Authorization: Bearer credentials scoped to a tenant and role. JSON mutations use Content-Type: application/json. Creation and other idempotent mutations require a stable Idempotency-Key: retry the same logical operation with identical input and the same key. Changed input under that key conflicts.
Bodies are uncompressed UTF-8 JSON. Duplicate keys, invalid Unicode, non-finite values and unsafe precision are refused. The reference implementation enforces separate limits for payloads, documents, responses, bundles and retained data; see captured limits.
Persist received events before saving the returned cursor. Events and webhooks can be duplicated or reordered; their revision is a prompt to fetch current status, not authority to confirm or execute. Notification retries stop after the delivery window and never renew review or admission deadlines.
Requests outside a principal’s scope are not existence probes. Errors use stable codes and ordinary HTTP statuses; see errors and retries. The OpenAPI contract defines the complete request and response shapes.