API Standards & Conventions

All internal services expose a REST API following these conventions:

• Base path: /api/v1/
• Authentication: Bearer token (JWT) in Authorization header
• Content-Type: application/json
• Pagination: ?skip=0&limit=50
• Swagger docs: available at /api/v1/docs on each service

Note: Export endpoints intended for internal tooling should still enforce authentication. See SEC-2024-031 for details.