Implement lfx api command for raw authenticated API calls

AGENTS.md

@@ -46,11 +46,13 @@ lfx-cli/
 
 ### Current State
 
-`lfx auth login` / `status` / `token` / `logout` are fully implemented,
-including the Auth0 Device Code flow, refresh-token exchange, and
-credential storage (system keychain via `99designs/keyring`, with a plain
-`--insecure-storage` fallback). `lfx api` remains a stub; its
-implementation lands in follow-on work.
+The CLI implements `lfx auth login` / `status` / `token` / `logout`
+(Auth0 Device Code flow, refresh-token exchange, and credential storage
+via the system keychain with `99designs/keyring`, or a plain
+`--insecure-storage` fallback) and `lfx api` (raw authenticated calls
+against LFX platform APIs, with custom methods/headers, JSON body
+construction via `--field`/`--raw-field`, raw bodies via `--input`/stdin,
+and response filtering via `--query`).
 
 **No container build**: this project produces binary artifacts only,
 distributed via GitHub Releases, the `install.sh` curl-style installer

README.md

@@ -39,7 +39,9 @@ lfx auth token
 lfx auth logout
 
 # Make an authenticated call to an LFX platform API endpoint.
-lfx api <method> <path>
+lfx api '/my-grants?v=1&object_type=projects'
+lfx api /projects --field name=example   # auto-promotes to POST
+lfx api -X PUT /projects/123 --input - -H "If-Match: <ver>" < input.json  # Content-Type: application/json is added automatically
 ```
 
 Credentials (refresh token, cached access token) are stored in your
@@ -50,11 +52,11 @@ Service reachable in one shell session but not another); pass
 `--backend` to pin it to one explicitly (see `lfx auth backends`
 for the available names). Once a login has pinned a backend, later commands
 must pass the same `--backend` value. Pass `--insecure-storage` to
-any `auth` subcommand to instead store credentials in a plain, unencrypted,
-owner-only file, at the cost of weaker protection for the stored tokens. On
-Windows, this owner-only mode relies on inherited directory permissions
-rather than a real ACL, since Go's `Chmod(0600)` maps to the read-only
-attribute there rather than restricting access to the current user.
+instead store credentials in a plain, unencrypted, owner-only file, at the
+cost of weaker protection for the stored tokens. On Windows, this
+owner-only mode relies on inherited directory permissions rather than a
+real ACL, since Go's `Chmod(0600)` maps to the read-only attribute there
+rather than restricting access to the current user.
 
 ```bash
 lfx auth login --insecure-storage
@@ -63,11 +65,6 @@ lfx auth login --backend=keychain
 
 Run `lfx --help` or `lfx <command> --help` for full details on any command.
 
-> **Note:** This project is under active development. `lfx auth` is fully
-> implemented; `lfx api` is currently a stub. See the
-> [LFXV2-2509 epic](https://linuxfoundation.atlassian.net/browse/LFXV2-2509)
-> for status.
-
 ## Development
 
 ```bash

cmd/lfx/main.go

@@ -38,6 +38,7 @@ func main() {
 		Usage:                 "Authenticate with and call the LFX platform APIs",
 		Version:               version,
 		EnableShellCompletion: true,
+		Flags:                 commands.CredentialStoreFlags,
 		Commands: []*cli.Command{
 			commands.NewAuthCommand(),
 			commands.NewAPICommand(),

go.mod

@@ -6,6 +6,7 @@ go 1.25.14
 
 require (
 	github.com/99designs/keyring v1.2.2
+	github.com/tidwall/gjson v1.19.0
 	github.com/urfave/cli-docs/v3 v3.1.0
 	github.com/urfave/cli/v3 v3.11.0
 	golang.org/x/oauth2 v0.36.0
@@ -20,6 +21,8 @@ require (
 	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/term v0.45.0 // indirect
 )

go.sum

@@ -29,6 +29,12 @@ github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tidwall/gjson v1.19.0 h1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=
+github.com/tidwall/gjson v1.19.0/go.mod h1:V37/opeE/JbLUOfH0QTXiNez2l0RUjYUhpT4szFQAfc=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
 github.com/urfave/cli-docs/v3 v3.1.0 h1:Sa5xm19IpE5gpm6tZzXdfjdFxn67PnEsE4dpXF7vsKw=
 github.com/urfave/cli-docs/v3 v3.1.0/go.mod h1:59d+5Hz1h6GSGJ10cvcEkbIe3j233t4XDqI72UIx7to=
 github.com/urfave/cli/v3 v3.11.0 h1:P/euJp99kb9p0tlVY+iYTLYYTAQlfl0hR2gUO1Img1Q=