HTTP API

The front controller sends /_api/... to api_route_request(). Public status and health return JSON; other authentication rules belong to each handler. api_rate_limit_check() runs before dispatch: it uses api_rate_limits, defaulting to 100 requests per 3600 seconds per route/subject. Exceeding it returns 429; an infrastructure failure in rate evaluation returns 503.

api_response_success() returns JSON with status: success, data and message. api_response_error() returns status: error, message and optional details. api_get_request_body() parses JSON and returns 400 for invalid JSON. CORS reads api.cors-origins from configuration; OPTIONS preflight is handled before dispatch.

/_api/oauth/ without refresh redirects to oauth-authenticate/; it does not return an authorization JSON response. See the OAuth2 library for token storage.