GET /health and GET /robots.txt is under /api/v1/ and needs Authorization: Bearer <key>. The only routes without a key are GET /health, GET /robots.txt and the inbound event route, which is authenticated per source (a signature, or a shared code for an ams360_ons source).
Each endpoint page lists the request fields, the response fields and the errors, with the capability a scoped key needs. The
/engines/{slug}/runs/latest routes are bound to platform engines and are not documented here.
Error bodies have one shape:
code. message is for people and can change.