Base: http://127.0.0.1:8080/api/v1 (lab) or https://<your-host>/api/v1. JSON. Errors:
{ "error": { "code": "conflict", "message": "pool overlaps existing pool" } }
Auth: Authorization: Bearer lattice_live_…. Pagination: ?limit=50&cursor=. List shape: { "items": [], "next_cursor": null }.
Idempotency: Idempotency-Key on creates that can double-submit.
What you call from a script
Same resources the console uses: tenants, prefixes, subnets, pools, reservations, excludes, options, leases (GET + POST …/release), GET /search?q=, DNS servers, client classes, DNS zones, static records, dashboard, nodes, audit, tokens, webhooks, NetBox export/import.
Full spec: docs/openapi.yaml in the Lattice DDI repo. Fragment: docs/openapi-ipam.yaml.
Until the first token exists, POST /tokens works from the host; other IPAM writes are loopback-only. After that, missing Bearer is 401; wrong role is 403. Rate limit: 300 requests/min/IP; token create is tighter.
The console talks only to this API. dhcpd does not use these routes on Discover — it talks SQL.