Reference

Every endpoint below is authenticated the same way, refuses in the same shape, and pages the same way. Those three things are documented once, in the guides, rather than repeated on every operation:

• Authentication and scopes — how a key is sent and what it may do
• Pagination — limit, starting_after, next_cursor
• Errors — the problem+json shape and every code it can carry

The machine-readable contract is at /api/v1/openapi.json. It is generated from the same definitions that build the responses, so it cannot describe a field the API does not return.

Requests are made server-side

API keys are never usable from a browser — /api/v1 does not allow cross-origin credentialed requests, deliberately. Every example here is a server-side call, and there is no in-page "try it" button because it could not work.