> ## Documentation Index > Fetch the complete documentation index at: https://docs.lithoblocks.com/llms.txt > Use this file to discover all available pages before exploring further. # Describe a template's input > The typed, nested description of the `data` a compile or send of this template takes: every path the template reads, with a label, a type inferred from the version's sample data, whether it is a list a loop needs, and nesting for dotted paths. `request_format` lists the same paths as a flat, null-filled skeleton; use this when you need types or want to build a form. `json_schema` is the same tree as JSON Schema 2020-12. ## OpenAPI ````yaml /api-reference/openapi.json get /v1/templates/{id}/input-schema openapi: 3.0.0 info: version: 0.0.1 title: LithoBlocks API description: >- # LithoBlocks API Welcome to the LithoBlocks API documentation. This API enables you to manage templates, entities, and organizations with a powerful, scope-based authorization system. ## API versioning Documented operations are under the `/v1` path prefix (for example, `GET /v1/templates`). **Older integrations** may still call the same routes without the `/v1` prefix (for example, `GET /templates`); those URLs remain supported for backward compatibility but are not listed in this OpenAPI document. **New integrations** should use `/v1` URLs. ## JSON and query naming Canonical names in JSON bodies, query strings, and path parameter names documented here are **snake_case** (for example `organization_id`, `template_id`, `include_author`). During a deprecation window, many inputs still accept legacy **camelCase** keys for the same values (for example `templateId` in place of `template_id`). **Responses** use snake_case for multi-word keys. Prefer snake_case for new clients; camelCase on input may be removed in a future version. ## Authentication & Authorization This API uses **LithoBlocks API Keys** for authentication with **scope-based authorization** for granular access control. ### Getting Your API Key 1. **Log into your LithoBlocks organization dashboard** 2. **Navigate to API Keys** in your account settings 3. **Create a new API key** and select the required scopes 4. **Copy your API key** (it will only be shown once for security) ### Using Your API Key Include your API key in the Authorization header: ``` Authorization: Bearer lb_live_sk_example_key_here ``` ### API Key Scopes & Role Requirements Your available scopes depend on your **organization role**. When creating an API key, you can only select scopes your role permits: Every operation below declares the scope it requires, and the API enforces exactly that scope. A key without it receives `403` with `required_scopes` in the body. #### 👥 **All Roles** (Viewer, Member, Admin, Owner) | Scope | Description | |-------|-------------| | `templates:read` | Read templates, search them, and read their versions | | `entities:read` | Read entities and their fields, and search them | | `organizations:read` | Read the organization and its member list | | `usage:read` | Read credit balance and usage | | `sample-data:read` | Read sample data | #### ✏️ **Member+** (Member, Admin, Owner) | Scope | Description | |-------|-------------| | `templates:create` | Create templates | | `templates:update` | Update templates and add versions | | `templates:activate` | Make a template version the active one | | `messages:create` | Compile templates and send messages | | `messages:preview` | Preview messages | | `entities:write` | Update and delete entities and their fields | #### 🔑 **Admin+** (Admin, Owner) | Scope | Description | |-------|-------------| | `templates:delete` | Delete templates | | `organizations:write` | Update the organization and invite members | | `users:read` | Read organization users by id | | `users:write` | Delete organization users | | `queues:write` | Push events to queue policies | `queues:read`, `scheduled:read` and `scheduled:write` exist so keys can be prepared for the scheduled messages and batch digests release; no operation requires them yet. ### API Key Management - **Multiple Keys**: Create multiple API keys with different scopes for different use cases - **Key Rotation**: Regularly rotate your API keys for security - **Scope Limitation**: Only request the minimum scopes needed for your application - **Organization Scoped**: All API keys are scoped to your organization ### Security Best Practices - **Never share API keys** or commit them to version control - **Use environment variables** to store API keys in your applications - **Create separate keys** for development, staging, and production - **Revoke unused keys** from your dashboard regularly ### Multi-Tenant Isolation All API endpoints enforce **organization-level isolation**: - You can only access resources within your organization - API keys are tied to the organization where they were created - Cross-organization access is never permitted ## Role-Based Access Control ### 👀 **Viewer Role** - Can read templates and entities - Can compile templates into messages - **Cannot** create or modify resources - **Cannot** access admin functions ### ✏️ **Member Role** - All Viewer permissions - Can create and update templates - Can create and update entities - **Cannot** access admin functions ### 🔧 **Admin Role** - All Member permissions - Can manage organization settings - Can view and manage users - **Cannot** delete the organization ### 👑 **Owner Role** - All Admin permissions - Full organization control - Can delete the organization - Can transfer ownership contact: name: LithoBlocks url: https://lithoblocks.com email: support@lithoblocks.com servers: - url: https://api.lithoblocks.com description: Production (paths in this spec are rooted at /v1/...) - url: http://localhost:8787 description: Local dev (paths in this spec are rooted at /v1/...) security: [] paths: /v1/templates/{id}/input-schema: get: tags: - Templates summary: Describe a template's input description: >- The typed, nested description of the `data` a compile or send of this template takes: every path the template reads, with a label, a type inferred from the version's sample data, whether it is a list a loop needs, and nesting for dotted paths. `request_format` lists the same paths as a flat, null-filled skeleton; use this when you need types or want to build a form. `json_schema` is the same tree as JSON Schema 2020-12. parameters: - schema: type: string format: uuid required: true name: id in: path - schema: type: string format: uuid description: >- A version of this template; default the current version, which compile and send use required: false description: >- A version of this template; default the current version, which compile and send use name: version_id in: query responses: '200': description: The template's input, described content: application/json: schema: type: object properties: template_id: type: string version_id: type: string fields: type: array items: $ref: '#/components/schemas/InputField' json_schema: type: object additionalProperties: nullable: true description: >- The same tree as a JSON Schema 2020-12 object schema for `data` warnings: type: array items: type: string description: >- Where the version's sample data disagrees with how the template reads a path; types fall back to string there required: - template_id - version_id - fields - json_schema - warnings '401': description: Authentication required content: application/json: schema: $ref: '#/components/schemas/ApiError' '403': description: Insufficient permissions content: application/json: schema: $ref: '#/components/schemas/ApiError' '404': description: Template not found, or the version does not belong to it content: application/json: schema: $ref: '#/components/schemas/ApiError' '422': description: The request body, query string or path parameters failed validation content: application/json: schema: $ref: '#/components/schemas/ValidationError' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ApiError' security: - bearerAuth: - templates:read components: schemas: InputField: type: object properties: name: type: string description: The last path segment path: type: string description: >- Dotted path, relative to its parent scope (the loop item, for a list's fields) label: type: string description: A label a person can read type: type: string enum: - string - number - boolean - object - array required: type: boolean description: >- True only for a list a loop or dynamic block reads: a missing list is a compile error, a missing value renders as {{x}} description: type: string example: nullable: true description: From the version's sample data, when the path resolves to a scalar fields: type: array items: type: object additionalProperties: nullable: true description: 'Children of an object: InputField objects of this same shape' items: type: object additionalProperties: nullable: true description: >- A list's item, an InputField of this same shape: an object with `fields`, or a scalar required: - name - path - label - type - required ApiError: type: object properties: error: type: string description: Human-readable summary. Not stable; match on `code`. code: $ref: '#/components/schemas/ErrorCode' request_id: type: string description: >- Echoed from the request's X-Request-Id header, or generated. Quote it in support requests. message: type: string details: type: string error_details: type: string success: type: boolean enum: - false valid: type: boolean enum: - false required_scopes: type: array items: type: string user_scopes: type: array items: type: string required: - error - code - request_id ValidationError: type: object properties: success: type: boolean enum: - false error: type: object properties: issues: type: array items: type: object properties: code: type: string path: type: array items: anyOf: - type: string - type: number message: type: string required: - code - path - message name: type: string required: - issues - name message: type: string description: >- The issues as one line, `path: message; path: message`, for callers that show a string (form builders such as Make) code: type: string enum: - validation_failed request_id: type: string required: - success - error - message - code - request_id ErrorCode: type: string enum: - unauthenticated - invalid_token - insufficient_scope - access_denied - validation_failed - invalid_request - invalid_data - invalid_destination - invalid_search_query - not_found - template_not_found - version_not_found - organization_not_found - entity_not_found - field_not_found - user_not_found - profile_not_found - credits_not_found - insufficient_credits - overage_limit_exceeded - credit_deduction_failed - compilation_failed - no_blocks_to_send - slack_not_connected - slack_user_not_found - slack_dm_failed - slack_token_decrypt_failed - slack_api_error - already_exists - invitation_pending - idempotency_conflict - idempotency_in_progress - rate_limited - tier_limit - invalid_state - maintenance - misconfigured - internal_error description: >- Machine-readable reason for the failure. Match on this, not on `error`. New codes may be added; existing ones are stable. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: API Key description: >- LithoBlocks API key obtained from your organization dashboard. The LithoBlocks MCP server also presents a Supabase-issued user session token here on the user's behalf; such a token acts as that user with the scopes their organization role allows. ````