Authentication and keys
Studio API keys use a visible prefix and one-way hash; plaintext is shown once. Keys are workspace-scoped, rate-plan bound, expirable, rotatable, and revocable. Browser examples never embed a key.
Versioning and errors
The API is versioned under /api/v1. Responses include schemaVersion, requestId, and observedAt; pagination uses opaque signed cursors. Errors use Problem Details with a stable code, safe detail, field issues, retryability, and reset time where applicable.
Webhooks and embeds
Webhook signing secrets are encrypted references, rotation overlaps safely, deliveries are idempotent, and replay is explicit. Embeds expose only rights-cleared, correction-aware configuration and cannot reveal private source or account data.