- Authentication
- Send the key as Authorization: Bearer <API_KEY>. Every key failure returns the same 401 response.
- Scopes
- Each operation requires its own scope. A missing scope returns 403; resource ownership is enforced independently.
- Rate limits
- Unauthenticated traffic is limited to 20 requests per minute per address. Proxy operations use independent 30-per-minute buckets per key; follow the limit headers and Retry-After.
- Idempotency
- Mutations require Idempotency-Key. Keys are namespaced per account; a retry safely returns the original result or a reconciliation state.
- Pagination
- Lists use cursor and limit. nextCursor=null means the end of the result set. Never treat a cursor as a record id.
- Errors
- Errors use {ok:false, version, requestId, error:{code,message}}. Stable code is for automation; message is display copy.