Base: https://<your-host>/api/v1. From the box itself, http://127.0.0.1:8080/api/v1 also works. JSON. Errors:

{ "error": { "code": "conflict", "message": "pool overlaps existing pool" } }

Auth: Authorization: Bearer lattice_live_…. Pagination: ?limit=50&cursor=. List shape: { "items": [], "next_cursor": null }.

Idempotency: Idempotency-Key on create POSTs for prefixes, subnets, pools, reservations, excludes, and tokens. Same key + same body returns the original 201; same key + different body is 409.

What you call from a script

Same resources the console uses: tenants, prefixes, subnets, pools, reservations, excludes, options, leases (GET + POST …/release), GET /search?q=, GET /history?ip= / ?mac= / ?hostname= / ?client_id= / ?duid= / ?circuit= / ?remote= (occupancy; exactly one identity; optional giaddr with circuit/remote; at= / from/to / tz=; format=csv), subnet history for the address-map As of, DNS servers, client classes, DNS zones, static records, dashboard, nodes, audit, tokens, webhooks, NetBox export/import. See History.

Until the first token exists, the API is loopback-only (POST /tokens from a laptop will not mint). After the first token, Bearer is required. Missing Bearer is 401; wrong role is 403. Rate limit: 300 requests/min/IP; token create is 10/min/IP — both off loopback.

The console talks only to this API. dhcpd does not use these routes on Discover — it talks SQL.