Authentication

This API uses JWT Bearer Token authentication.

Authentication Flow

1. Obtain a JWT token from the identity provider
2. Include the token in every request

Authorization: Bearer <JWT_TOKEN>

Token Requirements

• Signed JWT
• Expiration enforced
• Must include required scopes
• Unauthorized Responses
• 401 Unauthorized
• 403 Forbidden

---

📄 docs/api/README.md

```markdown

API Reference

This section describes all public endpoints exposed by the API.

• Stable contracts
• Backward-compatible changes only
• Versioned endpoints