Skip to content
Lumbus Live

Your studio, from your own tools.

One header, plain JSON. Go live, switch scenes, put up Be right back and mark moments from a stream deck, a bot or a script. Signed webhooks tell your systems when a stream starts, ends, records or finds a moment worth posting. Included with Studio Max; keys and endpoints live under API & webhooks in your studio.

Authentication

A key in one header.

Create a key under API & webhooks in your studio; it begins with lmbl_ and is shown once. Send it as a bearer token. A key opens every studio your login belongs to, with the role you hold there. Sixty calls a minute per key.

curl https://live.getlumbus.com/api/live/v1/studios \
  -H "Authorization: Bearer lmbl_YOUR_KEY"

curl -X POST \
  https://live.getlumbus.com/api/live/v1/studios/STUDIO_ID/live \
  -H "Authorization: Bearer lmbl_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "action": "start" }'

Endpoints

Eight calls, under live.getlumbus.com/api/live/v1.

  • GET/studiosread

    Every studio your login belongs to: id, name, state, live or not, your role.

  • GET/studios/:idread

    One studio in detail: the stream, the current scene, the scenes, the platforms (never a key), the open session.

  • POST/studios/:id/livecontrol

    { "action": "start" } goes live; { "action": "stop" } ends the stream. The same doors as the dashboard button.

  • POST/studios/:id/scenecontrol

    { "name": "Interview" } or { "sceneId": "…" } switches scene. Answers pending: true when the studio has not confirmed yet.

  • POST/studios/:id/brbcontrol

    { "on": true } puts up Be right back; { "on": false } returns to the live scene.

  • POST/studios/:id/markerscontrol

    { "note": "…" } marks this moment for the clips pipeline, while live or not.

  • GET/studios/:id/sessionsread

    The last fifty streams: when, how long, which platforms, whether a recording is ready.

  • GET/studios/:id/momentsread

    The moments the studio found, with their status, times, titles and reasons.

Every answer is JSON. Times are ISO 8601. A control call the studio has not confirmed within a few seconds answers pending: true; read the studio again to confirm. Errors come as { "error": { "code", "message" } }.

401 UNAUTHENTICATED

No key, a malformed key, or a revoked one.

403 FORBIDDEN

Your plan has no API, or the key lacks the scope (GET needs read, POST needs control).

403 FORBIDDEN_ROLE

You are a viewer on that studio: you can read it, not control it.

404 NOT_FOUND

A studio your login is not a member of. The id is never confirmed.

409 CONFLICT

The studio cannot do that now: not ready, no platform on, a payment hold, or it did not answer in time.

429 RATE_LIMITED

More than 60 calls in a minute on one key. Retry-After says how long to wait.

503 SERVICE_PREPARING

That part is not switched on yet.

Webhooks

We call you when something happens.

Register an https address under API & webhooks and pick the events. Each delivery is a JSON POST, signed with the secret you were shown once. A delivery that fails is tried again after one minute, five minutes, thirty minutes, two hours and twelve hours, then given up; the log in your studio shows every try.

  • stream.startedA stream went live
  • stream.endedA stream ended
  • session.recordedA recording is ready to download (or partly ready, with what is missing said)
  • moment.readyA moment worth posting is ready
  • clip.exportedA clip finished exporting
  • alert.raisedAn alert was raised on a studio
  • studio.asleepA studio went to sleep
  • studio.awakeA studio woke up

What a delivery looks like

POST https://example.com/lumbus
Content-Type: application/json
X-Lumbus-Event: stream.started
X-Lumbus-Delivery: 1842
X-Lumbus-Timestamp: 1791326400
X-Lumbus-Signature: v1=5f1a…

{
  "id": "1842",
  "event": "stream.started",
  "createdAt": "2026-10-06T22:40:00.000Z",
  "data": {
    "studioId": "…",
    "sessionId": "…",
    "startedAt": "2026-10-06T22:40:00.000Z",
    "platforms": ["twitch", "kick"]
  }
}

Checking the signature

Recompute an HMAC-SHA256 over the timestamp, a dot and the raw body, with your secret; compare it to the header in constant time; refuse a timestamp more than five minutes off. In Node:

import { createHmac, timingSafeEqual } from "node:crypto";
export function verify(secret, headers, rawBody) {
  const ts = headers["x-lumbus-timestamp"];
  const given = headers["x-lumbus-signature"]; // "v1=<hex>"
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const expected = "v1=" + createHmac("sha256", secret)
    .update(ts + "." + rawBody).digest("hex");
  return expected.length === given.length &&
    timingSafeEqual(Buffer.from(expected), Buffer.from(given));
}

Included with Studio Max.

Studio Max is the plan for teams running the operation through Lumbus: two studios at once, role permissions, the API and webhooks, clip approvals. Every other plan sees one sentence under API & webhooks and the way to change plan.

Start your free trial Every plan, side by side