API reference
Common headers
Two headers cover almost every call. The token call is the exception: it sends a JSON body and no bearer token.
POST /v2/auth/token is open and needs only Content-Type: application/json. Every other call needs Authorization: Bearer <accessToken>. JSON POST and PUT bodies also need Content-Type. The allow-list is an IP check, not a header you send.
Body fields
AuthorizationBearerrequired
Required on every call except POST /v2/auth/token.
Content-Typeapplication/jsonoptional
Required on every POST and PUT, including the token call.
AuthorizationBearer required | Required on every call except POST /v2/auth/token. |
Content-Typeapplication/json optional | Required on every POST and PUT, including the token call. |