---
title: API Documentation | Super Lambda
description: Super Lambda JSON API reference: signup, login, session, contact and health endpoints, plus agent-discovery resources.
dateModified: 2026-08-02
canonical_url: https://superlambda.com/docs/api
---

# API Documentation — Super Lambda

The Super Lambda API is a small JSON API for account signup/login, the
current-user endpoint, contact submissions and a health check. Base URL:
`https://superlambda.com`.

## Discovery resources
- OpenAPI 3.1 spec: https://superlambda.com/openapi.json
- API catalog (RFC 9727): https://superlambda.com/.well-known/api-catalog
- Agent auth guide: https://superlambda.com/auth.md
- Agent skills: https://superlambda.com/.well-known/agent-skills/index.json
- MCP server card: https://superlambda.com/.well-known/mcp/server-card.json (endpoint `/mcp`)
- HTML docs: https://superlambda.com/docs/api

## Authentication
Cookie sessions. `/api/signup` and `/api/login` set an `HttpOnly; Secure; SameSite=Lax`
cookie named `sl_session` (7-day expiry). Send it with authenticated requests.
This API does **not** use OAuth.

## Endpoints

### GET /api/health
Liveness/health probe. Returns `{ "ok": true, "status": "ok", "service": "super-lambda", "time": "…" }`.

### POST /api/signup
Create an account and start a session.
```json
{ "name": "Ada Lovelace", "email": "ada@example.com", "password": "at-least-8-chars" }
```
`201` → `{ "ok": true, "user": { "id", "name", "email" } }`. `409` if the email exists.

### POST /api/login
Authenticate and start a session.
```json
{ "email": "ada@example.com", "password": "at-least-8-chars" }
```
`200` on success, `401` on invalid credentials.

### GET /api/me
Return the authenticated user (requires the `sl_session` cookie). `401` if not signed in.

### POST /api/logout
Destroy the current session and clear the cookie.

### POST /api/contact
Submit a contact message.
```json
{ "name": "Ada", "email": "ada@example.com", "message": "10+ characters…" }
```

## Rate limits
Per client IP: `login` 20/15min, `signup` 10/hour, `contact` 5/hour. Over-limit
requests return `429` with a `Retry-After` header.