Luarmor API

Authentication, rate limits and errors for the Luarmor HTTP API

Luarmor provides an HTTP API for managing scripts, users and keys.

You can use it to control your Luarmor projects programmatically, manage user access, and update scripts and their settings.

IP whitelisting required: the Luarmor HTTP API is not public. Only script owners with a Luarmor account can use it, and only from a whitelisted IP address.

See IP whitelisting under Authentication for more information.

Things to remember

Headers

The Content-Type header must be set to application/json in all requests.

Rate limits

• Each endpoint has its own rate limits, but generally you can make 60 requests per minute.
• If you exceed the limit, you get a 429 status code.

If you exceed the rate limit, it may take a while before you can make requests again.

Parameter types

You can pass parameters in four different ways:

Type	Example
Path	/data/PARAMETER_HERE/stuff
Query	/data/things/stuff?paramName=PARAMETER_HERE
Body	{ "fieldName": "PARAMETER_HERE" }
Header	{ "headerName": "HEADER VALUE" }

Authentication

All API requests require authentication via an API key. You can find your API key on your Luarmor profile, and it is also sent to you by email when you register. If you have lost it, see Account management.

To find your project and script IDs, see Where is the script ID and project ID?.

Most endpoints take the key in the Authorization header, with no prefix:

GET https://api.luarmor.net/v3/projects/{project_id}/users
Authorization: YOUR_API_KEY

The API key endpoints (Get API Key Details and Get API Key Stats) take the API key as a path parameter instead.

Your API key gives full control over your projects. Never put it in a script you distribute, and never share it with anyone you do not fully trust.

IP whitelisting

You must whitelist your server’s IP address on the Luarmor dashboard to make API calls. Otherwise, your requests will be blocked by Cloudflare.

To find the IP address to whitelist, open the Luarmor IP trace page from your server and use the ip value.

If you are using a service that does not give you a static IP address, you must either use a proxy with a static IP or switch to a different service.

Responses and errors

Responses are JSON. Every response includes a success boolean and, usually, a human-readable message explaining what happened.

{
  "success": false,
  "message": "Invalid API key"
}

Status	Meaning
200	The request succeeded
400	Bad request. Usually an invalid API key or a missing parameter
403	Forbidden. Usually your IP is not whitelisted, or the API key is incorrect
404	The project, script or user does not exist
429	You exceeded the rate limit
504	Gateway timeout. This can happen when uploading large scripts; see Update Script

Always check message when a request fails, as it usually tells you exactly what went wrong.