Call the API
Make an authenticated request against the server declared by the live OpenAPI contract.
Explore endpoints
Browse the generated REST reference and permission requirements.
Understand MCP
Learn how the standalone MCP wrapper is derived from the public API.
Contract boundaries
- Every authenticated request is bound to one verified organization. A request body or query string cannot select another organization.
- The endpoint’s OpenAPI
securitydeclaration lists every permission required for that operation. - List responses use opaque forward cursors. See Pagination.
- Private object bytes move through short-lived, object-scoped capabilities rather than through the API Worker. See Uploads and downloads.