The LegalCloud REST API lets you manage documents, sites, resources, statistics and API tokens from your own systems. This page covers the basics shared by every endpoint.
Base URL
| Environment | URL |
|---|---|
| Production | https://api.legalcloud.info |
All endpoints live under /api/…, with the exception of the public pages (/d/{hash}). The API only works over HTTPS.
Interactive reference
The full list of endpoints, parameters and schemas is published as an OpenAPI 3.1 document:
- OpenAPI (JSON): https://api.legalcloud.info/api/openapi.json
- Interactive console: https://legalcloud.info/en/docs/api — paste your API token and try every endpoint from the browser.
This section of the guide explains the concepts; the console is the exhaustive reference.
Authentication
Create an API token in the dashboard (Organization → API) and send it in every request:
GET /api/documents HTTP/1.1
Host: api.legalcloud.info
Authorization: Bearer lc_...See Authentication for token types and scopes.
Response format
Successful responses are JSON with this envelope:
{
"success": true,
"data": { }
}Errors use:
{
"success": false,
"error": "Human readable message",
"code": "MACHINE_READABLE_CODE"
}See Errors reference.
Pagination
List endpoints accept page (starting at 1) and per_page. The response includes total, page and per_page:
curl -H "Authorization: Bearer YOUR_TOKEN" \
"https://api.legalcloud.info/api/documents?page=2&per_page=20"Quota and rate limits
Only calls made with an API token count against the quota of your plan; using the dashboard does not. Every response to a token call carries these headers:
| Header | Meaning |
|---|---|
X-Quota-Limit | Calls included per month in your plan |
X-Quota-Remaining | Calls left this month |
X-Quota-Reset | When the monthly counter resets |
X-RateLimit-Limit | Calls allowed per minute |
X-RateLimit-Remaining | Calls left in the current minute |
X-RateLimit-Reset | When the minute window resets |
When you exceed either limit the API answers 429. You can read your usage with GET /api/account/api-usage.
Endpoint groups
| Group | Endpoints | Scope |
|---|---|---|
| Documents | /api/documents, /api/documents/{id} and their versions | documents:read / documents:write |
| Sites | /api/sites | sites:read / sites:write |
| Resources | /api/resources | resources:read / resources:write |
| Statistics | /api/statistics/* | documents:read |
| API tokens and usage | /api/account/tokens, /api/account/api-usage | organization:read / organization:write |
| Public documents | /d/{hash}, /d/{hash}/restrictions | none (or a document token) |
Public documents
GET /d/{hash} returns the rendered HTML of a published document. It is the address you embed in an iframe. If the document requires a token, send it as Authorization: Bearer <token> (preferred) or as ?token= (iframes only: the token ends up in logs and browser history). See Embedding documents in your app.