Versioned API access
The API is versioned under /api/v1. Shared request, response, and error schemas live in
packages/protocol; generated clients and references must identify the schema version they target.
| Policy | Example surface | Authentication |
|---|---|---|
| Public | health, supported configuration, indicative prices | rate limited |
| Partner | quotes and quote status | partner credential |
| Internal | oracle refresh and reconciliation | service credential |
| Operator | pause and incident views | Cloudflare Access |
Errors use a stable code, human-readable message, request identifier, and schema version. Oracle signing is permitted only inside its approved Worker service boundary; the web application never receives a signing secret.
Current surface
The Worker reserves /api/v1 for versioned endpoints. The web quote panel currently reads
GET /api/v1/prices/{market} for AUD or NZD. Treat that response as indicative product data; firm
partner quotes and authenticated integration credentials are not public yet.
Every response contract belongs in packages/protocol, with stable error codes, a request ID, and
an explicit schema version. Missing configuration fails closed.
Request early access
Open a scoped issue in the repository describing the integration surface, expected volume, authentication needs, and required pilot market. Never send credentials in an issue.