HTTP API v1 uses /api/v1. Unversioned /api paths remain compatibility aliases pinned to v1. Breaking contract changes require a new major URL version. Owner orchestration and restricted service APIs. Owner requests require an authenticated owner session, never a restricted service bearer token. Browser owner requests must originate from the authorized owner origin. Executor agents use scoped service credentials supplied by trusted orchestration. Examples do not grant authority or execute requests. MCP uses its separate JSON-RPC transport at /mcp and is described in the protocol guide.