Authentication and base URLs
LEM uses an admin API token rather than OAuth2. Generate one in the LEM Admin Console under Settings, then Tokens, and send it as the X-AuthToken header. The token does not expire automatically; revoke it from the Admin Console when no longer needed.
One important quirk: LEM exposes three distinct URL prefixes, and each category of endpoint belongs to exactly one of them. Check which prefix an endpoint uses before constructing the URL.
{{LEM_URL}}/api/v1/...
Main fleet API, about 158 endpoints.
X-AuthToken{{LEM_URL}}/mpcs/...
Marketplace catalog management, 16 endpoints. The one prefix that authenticates with Authorization instead of X-AuthToken.
Authorization Marketplace Catalog in API collection{{LEM_adminURL}}/admin/v1/...
Admin console, served on port 8446, about 144 endpoints.
X-AuthTokenAPI sections
Companies
The top of the fleet hierarchy: list and manage companies and their projects.
View in API collectionEdge Lifecycle Management
Everything done to an edge through LEM: device inventory, zero-touch activation, application deployment, backups and restores, alerts, per-edge users and RBAC, licenses, certificates, software updates, remote access (WireGuard), and AI/ML model distribution.
View in API collectionDigital Twins / Asset Management
Fleet-wide DT2 asset models: define an asset hierarchy once and use it across every edge in the fleet.
View in API collectionAdmin Console
Administration of the LEM instance itself: settings, users and teams, tokens, Docker registry, license server management, data lifecycle (partitions, archive, purge), instance alerts, integrations (Kafka, ClickHouse, Syslog, git tracking, AI assistant), and system logs.
View in API collectionThe whole product in one place: Litmus Edge Manager in the API collection.
Two RBAC scopes, two APIs
LEM has two separate user-management surfaces, and confusing them is the most common mistake when working with this API:
- Per-edge RBAC (
/api/v1/loopedge-user/...) manages users on a Litmus Edge device itself, administered remotely through LEM. Documented under Edge Lifecycle RBAC. - LEM admin RBAC (
/admin/v1/...users, teams, and tokens) manages who can log into Edge Manager. Documented under Admin Console settings.
Common multi-step tasks
- Provision a new edge device (zero-touch)
- Deploy an application to an edge device (async task)
- Back up and restore an edge device from LEM
- Create a project alert (trigger plus action)
- Upload an AI/ML model to LEM
The complete list of guides is on the workflows page.
Reference material
- Environment variables -
LEM_URL,LEM_adminURL,LEM_AdminApiToken, and every captured ID - Changelog - what changed from Edge Manager 2.26.x, including deprecated license and firmware endpoints