A narrow authorization surface.
Core routes cover authentication and session refresh, tenants and memberships, permission catalogs and roles, audit events, and authorization checks. They do not expose the billing, commerce, AI, content, or messaging APIs from the complete product.
AUTH / SESSION
Rotating credentials
Refresh credentials remain HttpOnly, SameSite=Strict cookies and are never returned in JSON.
TENANT / MEMBER
Explicit scope
Tenant membership and account discovery use separately controlled authorization paths.
ROLE / PERMISSION
Versioned policy
Roles reference a developer-owned permission catalog and preserve immutable history.
CHECK / AUDIT
Decision evidence
Authorization decisions and policy operations are represented in the public contract.
Inspect the source of truth.
The OpenAPI document in the repository is the authoritative HTTP contract. Use it for client generation, review, and compatibility checks.