Read this contract with the installed version
Use API authentication and request conventions first. Paths below are normalized; mount under the correct local Admin or Customer namespace. Every handler independently enforces current authorization, resource/account scope, feature/licence state and actual installed capability. A listed route is not a token-scope grant or native production acceptance. Read the operational procedure and fields before changing data. The newer source reference includes preparation/activation routes which earlier kits may not expose.
Every route in this family
| Method | Normalized path | Request and effect |
|---|---|---|
| GET | /v1/notifications |
Read authorized state/content; inspect observation time and pagination. |
| POST | /v1/notifications/{id}/read |
Explicit typed mutation; use the current revision/preview/CSRF or separately authorized token contract as applicable. |
| POST | /v1/operations |
Explicit typed mutation; use the current revision/preview/CSRF or separately authorized token contract as applicable. |
| GET | /v1/operations |
Read authorized state/content; inspect observation time and pagination. |
| GET | /v1/operations/{id} |
Read authorized state/content; inspect observation time and pagination. |
| POST | /v1/operations/{id}/cancel |
Empty body; request cancellation of the existing job, without erasing effects. |
| GET | /v1/operations/{id}/events |
Read scoped append-only event history using a bounded cursor. |
| GET | /v1/audit-events |
Read authorized state/content; inspect observation time and pagination. |
| GET | /v1/resources |
Read authorized state/content; inspect observation time and pagination. |
Delivery, verification and errors
A returned operation or 202 means accepted work, not completed service change. Retain the operation ID and inspect events and actual resource state. Preserve one idempotency key for a reviewed ambiguous-delivery attempt. Current revision/ETag, exact impact preview and confirmation are separate protection mechanisms; do not guess or reuse stale values.
For 401, restore a valid local session/token. For 403, inspect the actual typed authorization/freshness/licence denial; generic denial is not automatically a password prompt. For 409, reload changed state or inspect the original operation. A capability/storage/agent 503 stays unavailable. Never place passwords, bearer tokens, private keys or recovery material in a URL. The complete request/response field reference distinguishes internal lifecycle models from public client input.