Base paths and local authority
The route reference shows normalized /v1/... paths. The installed browser workspaces mount them under /admin/v1/... or /customer/v1/...; Customer View has its own read-only policy. Authentication routes use /auth/{namespace}/.... Use your actual verified HTTPS Panel origin, not the marketing site or licence authority.
The source route table records handler availability, not a promise that every token or role may call it. Current local identity, grants, ownership, freshness, native licence and capability checks apply independently. Unknown control modules require unsupported:deny. Commercial purchases cannot populate local permissions.
Browser request contract
The supplied client sends X-Panel-Request: 1, same-origin credentials and no-store requests. For a write, it obtains current CSRF from /auth/{namespace}/csrf, adds X-CSRF-Token and JSON content type, and retains an Idempotency-Key when that operation requires one. File-text/upload endpoints have their specialized content/ETag contracts. Do not use cross-origin cookies or a stale CSRF token as integration credentials.
Resource writes normally carry current revision. Protected server/security/migration/restore mutations first require their server-generated preview and exact confirmation. Completing fresh password/MFA verification never automatically replays a pending write.
Durable and ambiguous delivery
An accepted mutation usually returns an operation ID and 202; a recognized replay may return 200. Follow its detail/events before declaring success. The generic marker route requires an 8–128 character idempotency key, JSON up to 4096 bytes, rejects unknown fields and only supports its exact marker kind. Hosting lifecycle endpoints are dedicated typed handlers, not arbitrary generic operation names.
Pagination and response shape
Most lists return api_version: 1, items and next_after. Operations/events/audits use a nonnegative sequence cursor and limit 1–100, default 50; entity inventories use the supported bounded cursor. Some feature endpoints deliberately use typed objects such as settings, backups, preview or operation, so do not assume all lists share one shape. Read every page before treating an inventory as complete.
Errors
Error JSON includes code, message, correlation reference and retryable flag. Typical meanings are 400 invalid request/pagination, 401 authentication, 403 permission/licence/freshness denial, 404 unavailable/unknown resource, 409 revision/resource/idempotency conflict, 413 oversized body, 415 unsupported content type and 503 unavailable storage/agent. Preserve the actual typed code. A generic 403 is not an automatic password challenge. After a timeout or unreadable response, inspect the retained operation/resource before another mutation.
Integration limits
Owner hosting:inventory:read tokens only authorize the three explicit integration GET routes. Other scoped tokens do not become automated account-management grants. This documentation lists reviewed versioned routes, request models and supported client fields. Internal models are not automatically public endpoints, and source contracts do not claim installed native acceptance. Use a release-matched supported client and disposable acceptance environment.