Versioning & base URL

The API is versioned in the URL path. The current version is v1, so every endpoint lives under:

/api/v1

The public OpenAPI 3.1 document at /api/v1/openapi.json is the contract — it describes every operation, schema, and example, and is what your code generators and tools should consume.

What counts as a change

• Additive changes are non-breaking and ship without a version bump: new endpoints, new optional request fields, and new fields on existing responses. Write your clients to tolerate unknown response fields.
• Breaking changes (removing or renaming a field, changing a type, tightening validation) would ship under a new major version — a future /api/v2 — never silently inside v1.

See the Changelog for the release history.

Calling from a browser

Server-to-server calls have no origin restriction. Calling the API from browser JavaScript is subject to CORS: the request's origin must be on the API's configured allowedOrigins list (the docs site and app origins are included; in development the docs, app, and API are same-origin, so no extra config is needed).