API keys & the REST API
Everything the product does is also a REST call — the reference below is generated live from the platform, so it is always in sync with what the API actually serves.
Authentication
Interactive sessions use your login (bearer JWT). For scripts and integrations, mint a stateless developer key on Developer Keys and send it with any of the three deliveries on endpoints marked API key supported: an Authorization: Bearer header, an X-API-TOKEN header, or an api_token query parameter.
Entitlements
Each endpoint lists the entitlement scopes it requires. Your key carries the entitlements of your account at mint time — if a call returns 404 on a path you can see documented here, your key predates a permission change: mint a fresh one.