API Overview

Caution

Stub — once the API stabilises, OpenAPI-spec it and switch this page to render the reference automatically via starlight-openapi.

Authentication

• Web auth — JWT in access_token cookie + CSRF double-submit. Used by the in-browser app.
• API key — Authorization: Bearer zpk_…. Used by RMM-driven scripts (scan/reconcile/capture/configure/install/uninstall).

Rate limits

TODO: document per-endpoint rate limits once finalised.