API & webhooks

Send your key as a bearer token. Keys start lsl_sk_ and are shown once, when you create them — we store only a hash, so we can't recover one for you. If you lose it, revoke it and make another.

curl https://levelsixlabs.com/api/v1/chemicals \
  -H "Authorization: Bearer lsl_sk_your_key_here"

GET /api/v1 returns what your key can reach, which is the quickest way to debug a 403 — it lists exactly the resources and scopes that key holds.

A key holds module:action scopes, using the same vocabulary as in-app permissions. Write includes read — the reverse never applies.

• No delete, anywhere. Deletion is unrecoverable and no integration has needed it. Archive through a PATCH instead.
• No access to your member list. People aren't inventory; a leaked key should never become a personal-data breach.
• No approving or verifying. Those are human judgements — a script asserting one is a script forging a signature.

Every collection supports GET /api/v1/<resource> and GET /api/v1/<resource>/<id>. Some also accept POST and PATCH — the rest are read-only because creating them has to run business rules that live in the app. A booking, for instance, needs the overlap check, the training gate and the fault block; a generic insert would bypass all three and double-book an instrument.

Resources marked with a plan requirement return 402 if the lab's plan doesn't include them — the API can't hand out what the app wouldn't show.

Fields, per resource

Exactly what each collection returns. This is an allow-list, not a dump of the table — columns are added to it on purpose, so a field we add internally never starts leaving the building without somebody deciding it should. Fields marked writable may also be sent on POST and PATCH.

Every list accepts limit (default 50, max 200), offset, and since / until against the resource's own sort column — so “what changed?” works without you having to guess which column that is.

curl "https://levelsixlabs.com/api/v1/faults?status=open&limit=100" \
  -H "Authorization: Bearer lsl_sk_..."

{
  "data": [ { "id": "…", "title": "Fume hood alarm", "severity": "high", … } ],
  "pagination": { "limit": 100, "offset": 0, "has_more": false }
}

There is no total count: it costs an extra aggregate on every request and almost nobody uses it. has_more is what a pager needs.

1000 requests per key per hour. Every response carries X-RateLimit-Limit and X-RateLimit-Remaining so you can back off before we tell you to.

Errors are always { "error": { "code", "message" } }. Branch on code, never on the prose — we reserve the right to improve the wording.

A record in another lab and a record that doesn't exist both return 404. Telling them apart would confirm that an id exists somewhere.

Add an endpoint in Settings, pick the events you care about, and we POST JSON to it. We retry 5 times over about a day (1, 5, 30, 120, 600 minutes after each failure), then mark it failed and show it in the endpoint's history. A 4xx other than 408 or 429 isn't retried — you've told us no, and retrying for a day only fills your error log.

{
  "event": "equipment.fault_reported",
  "occurred_at": "2026-08-12T09:41:02.511Z",
  "organisation_id": "…",
  "delivery_id": "…",
  "data": { "fault_id": "…", "title": "Fume hood alarm", "severity": "high" }
}

delivery_id is stable across retries — dedupe on it and a retried delivery won't look like a second event.

Verifying the signature

Every request carries LevelSixLabs-Signature: t=<unix>,v1=<hex>. The HMAC covers "<t>.<raw body>" — the timestamp is inside the signed string, so a genuine payload can't be replayed at you later. Reject anything older than 300 seconds.

import crypto from "node:crypto";

function verify(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(
    header.split(",").map((p) => p.split("=", 2))
  );
  const t = Number(parts.t);
  if (!Number.isFinite(t)) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > toleranceSeconds) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${rawBody}`)
    .digest("hex");

  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(parts.v1)
  );
}

Use the raw body, before any JSON parsing — re-serialising changes the bytes and the signature won't match. During a secret rotation we send two v1= values; accept either.

Events

Endpoints must be public https. We don't follow redirects and won't call private network addresses — both would turn a webhook into a way to make our servers fetch things on your behalf.

There is no Outlook write-sync, and we'd rather say so than leave a dead toggle in the settings. Two-way calendar sync needs an organisation-level Microsoft app registration that we don't operate.

What works instead, today, in Outlook, Google Calendar and Apple Calendar: a read-only subscription feed. Copy the ICS URL from your bookings page and your calendar keeps itself up to date. It's the honest answer to “does it work with Outlook?” — yes, for seeing bookings; no, for creating them from Outlook.