HTTP API boundary

Applications should prefer the runtime SDK for browser conversation behavior. The HTTP API is available for supported server and channel integrations.

Authentication and workspace selection

Requests require the authentication mechanism issued for that integration. For authenticated workspace APIs, the active workspace is selected with x-org-slug and validated against verified identity context.

Never treat tenant-id, user-id, role, schema, or principal headers as authentication. Integration-specific correlation metadata does not replace authorization.

API discovery

Use the OpenAPI/Swagger document exposed by the deployed Core environment for the exact routes and schemas of that version. Do not rely on copied endpoint tables from another deployment.

The public runtime contract is documented separately in Runtime contract.