Base URL
Authorization: Bearer <key> on every call (except filling an upload
ticket, which is its own one-time credential). Every response is
wrapped { success, data }; errors carry a typed errorCode.
The same surface is also mounted at
/api/mcp/v1/* (the MCP connector’s
address); the two are identical.
The full machine-readable spec lives at a stable URL:
/api-reference/openapi.json, generated from
the same registry as the Templates tab, so the two cannot disagree.