Base URL
Authentication
Product requests require a Bearer API key. The exception isPOST /agent-signups,
which bootstraps the first key when agent signup is enabled:
Conventions
- JSON everywhere — send
Content-Type: application/json; responses are JSON. - IDs are opaque strings; don’t parse them.
- Timestamps are ISO-8601 UTC.
- Errors use standard status codes with an
{ "error": "…" }body — see Error handling. - Idempotency — pass a
client_idon sends. Agent signup instead requires a securely savedIdempotency-Keyheader; see agent setup.

