# Luria's API surface
Source: https://docs.luriart.com/install/api
Plain text: https://docs.luriart.com/install/api.txt
The two JavaScript calls Luria exposes, why there are no API keys or public REST endpoints today, and how to get your data out instead.
Luria has no merchant API keys and no public REST API today. Nothing to generate, nothing to rotate, nothing to authenticate against.
What exists is a JavaScript API on the page: two methods on `window.luria`, created by the snippet. That is the whole supported surface. To get data out, use the JSON export.
## What you'll need
* The Luria snippet on the pages you want to instrument ([Install on a custom site](/install/script)), or the app embed on Shopify ([Install on Shopify](/install/shopify))
* Comfort with a `
```
Put it in ``. Luria gives you the tag with your site ID already filled in, during onboarding or by email from [hello@luriart.com](mailto:hello@luriart.com); the dashboard does not show the site ID yet.
Serve it from `luriart.com`. The snippet works out where to send everything from its own script URL, so a self-hosted or bundled copy points at your domain and silently does nothing. On Shopify you add no tag at all: the app embed loads it with your shop's identity.
### Step 2: Record a conversion
```js
window.luria.convert("purchase", 129.00);
window.luria.convert("lead");
```
`goal` is a free-form label and defaults to `"conversion"`. `value` is a number in your store's currency, or omitted. The call sends immediately and clears the visitor's test attribution, so a later unrelated purchase is never credited to a test that has since ended.
On non-Shopify sites Luria also counts a conversion by itself on paths ending in `/thank-you`, `/thank_you`, or `/orders/`, once per order. On Shopify the snippet never counts purchases: the pixel and order webhooks do.
`window.luria` is absent when the visitor has Global Privacy Control or Do Not Track on, when consent is required and not yet given, or when the script is blocked. Guard your call or retry briefly rather than assuming it exists.
### Step 3: Leave `exposure` alone
```js
window.luria.exposure(test, arm);
```
The snippet calls this itself the moment it applies a variant. It exists for advanced setups where you render the variant yourself. Calling it with invented values inflates the arm counts the engine promotes and kills tests on, so your results stop meaning anything.
Those two methods are the entire JavaScript API. There is no callback, no event listener, and no way to read which variant a visitor was shown.
### Step 4: Get your data out
On Shopify, open the Luria app in your admin, find the "Your data" card and choose **Export everything (JSON)**: connection, site, consent record, usage counters, sync status, install history, raw events, and the synced copies of your Shopify objects. Access tokens are never included.
Anywhere else, email [hello@luriart.com](mailto:hello@luriart.com) and we will send your data by hand.
## Verify it worked
1. Open a page with the snippet in a private window with blockers off, and accept the consent banner if one appears.
2. In the browser console, type `window.luria`. You should see an object with `convert` and `exposure`.
3. Trigger a real conversion, then check that "Conversions this period" on the [dashboard](https://www.luriart.com/app) Overview goes up by one.
Full checklist: [Verify your install](/install/verify).
## Common failures
* **`window.luria` is undefined.** The snippet is async, so an inline script can run first. It is also absent by design under Global Privacy Control, Do Not Track, or a declined consent banner.
* **The conversion counted twice.** Two calls fired, or the page reloaded, or you called `convert` on a path Luria already auto-detects. See [Duplicates](/troubleshooting/duplicates).
* **Calls from the wrong domain.** Exposures and conversions are accepted only when the browser reports your registered site domain, or a subdomain of it. Everything else is refused.
* **Looking for the endpoints in the network tab.** `/api/consent`, `/api/patches` and `/api/events` are internal, rate limited per IP, and change shape without notice. They are not a merchant API. Do not call them.
* **Waiting on API keys or a REST endpoint.** Neither exists yet. Use the export, or email [hello@luriart.com](mailto:hello@luriart.com).
## Next steps
- [JavaScript events](/reference/javascript-events)
- [Webhooks](/install/webhooks)
- [Verify your install](/install/verify)
- [What is stored](/privacy/what-is-stored)