Read-only access to the statistics of your projects: accounts, daily metrics, videos, daily snapshots and UGC campaigns with counted views and payable amounts. Built for platforms that pay creators for views and want their clients to see the same numbers.

Access

  • We issue an API key for your projects; it is shown once. Send it as Authorization: Bearer lmr_… on every request.
  • A key sees only its projects. Anything else answers 404, exactly like an object that does not exist.
  • Keys are read-only. The only writes are widget links and creator invite links for your own projects.
  • 120 requests per minute per key; over the limit you get 429 with Retry-After. Pages hold up to 200 records.

Endpoints

GET/api/v1/projects
GET/api/v1/projects/{project}/accounts
GET/api/v1/accounts/{handle}
GET/api/v1/accounts/{handle}/daily?from&to
GET/api/v1/accounts/{handle}/videos?updated_since&cursor&limit
GET/api/v1/videos/{account}/{video_id}
GET/api/v1/videos/{account}/{video_id}/snapshots?from&to
GET/api/v1/projects/{project}/campaigns
GET/api/v1/campaigns/{id}
GET/api/v1/campaigns/{id}/videos?status&updated_since&cursor&limit
POST/api/v1/embeds
POST/api/v1/projects/{project}/invites

Data rules

  • Envelope: {"data": …, "next_cursor": …, "error": null}; errors: {"data": null, "error": {"code", "message"}}.
  • Timestamps are ISO 8601 in UTC. Days (YYYY-MM-DD) are calendar days in the account's timezone; today is marked incomplete.
  • Money is a decimal string with a currency: {"amount": "12.50", "currency": "USD"}.
  • Every record carries source (api, studio, demo, mixed or lumorastat) and fetched_at; payouts use api video snapshots only.
  • Campaign numbers are provisional until a video is locked; locked views and the payable amount never change.

Webhooks

We POST JSON to your https endpoint and sign it: Lumorastat-Signature: t=<unix time>,v1=<HMAC-SHA256 of "t.body">. Failed deliveries are retried after 1 min, 5 min, 30 min, 2 h and 12 h. Event ids are stable: process each id once.

sync.completedcampaign_video.status_changedcampaign_video.lockedcampaign_video.flaggedaccount.needs_reconnect
Verifying the signature (Python):
import hashlib, hmac, time

def verify(secret: str, header: str, body: bytes) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    signed = parts["t"].encode() + b"." + body
    expected = hmac.new(secret.encode(), signed, hashlib.sha256).hexdigest()
    fresh = abs(time.time() - int(parts["t"])) < 300
    return fresh and hmac.compare_digest(expected, parts["v1"])

Widgets and invites

  • Widgets: signed links to a video card, an account summary or a campaign summary for an iframe on one origin you name, valid up to 90 days, revocable.
  • Invites: links https://lumorastat.com/connect/… that let a creator connect a TikTok account to your project, valid up to 30 days, up to 10 accounts each.

Get a key

Write to us to get a key and the full reference (docs/api.md). Tell us your webhook URL and the origin where widgets will be shown.

hello@lumorastat.com