---
title: "Describe public API capabilities for external clients"
method: GET
path: "/api/capabilities"
tags: ["Capabilities"]
---

# Describe public API capabilities for external clients

`GET /api/capabilities`

## Request

- Base URL: `https://api.setluca.com`
- URL: `https://api.setluca.com/api/capabilities`
- Auth: one of:
  - API key in cookie `luca.session_token`
  - API key in header `x-api-key`
  - HTTP bearer

What the calling credential can actually reach: the endpoints open to it, the scopes it holds, and its plan tier's limits. Read this once at startup instead of probing endpoints and waiting for a 403.

**API key scopes:** `leads:read`, `conversations:read`, `bookings:read`, `campaigns:read`, `broadcasts:read`, `webhooks:read`, `integrations:read`.

## Headers

- `Luca-API-Version` '1'

## Response `200`

ok

- ApiCapabilitiesResponse
  - `apiBasePath` '/api', required
  - `auth` object, required
    - `apiKeyHeaders` string[], required
    - `workspaceHeaders` string[], required
    - `idempotencyHeader` 'idempotency-key', required
  - `boundary` object, required
    - `mcpImplementationRepo` 'separate', required
    - `internalEndpointsAllowed` false, required
    - `databaseAccessAllowed` false, required
    - `privateWebhookIngressAllowed` false, required
  - `scopes` string[], required
  - `operations` object[], required
    - `id` string, required
    - `method` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', required
    - `path` string, required
    - `scopes` string[], required
    - `idempotencyRequired` boolean, required
    - `description` string, required
  - `webhookEvents` string[], required
  - `resourceKinds` string[], required

## Other responses

- `401`: unauthorized
- `429`: rate limited

---

[API](https://skmtc.dev/setluca/apis/luca-api.md) · [All operations](https://skmtc.dev/setluca/apis/luca-api/llms.txt) · [OpenAPI document](https://skmtc.dev/setluca/apis/luca-api/revisions/90a200e4100b?raw)