API overview

Two APIs, how they authenticate, and where the schemas are.

	Worksong API	Work API
Base path	/api on app.worksong.ai	/v1 on the Work API host
Contract	zod schemas in the product; prose in the API reference	OpenAPI 3.1 at /v1/openapi.json
Auth	Authorization: Bearer <token> per request; tokens are short-lived	A session or an API token that belongs to a Member
Streaming	Server-sent events on the Conversation stream	SignalR hub for realtime

Rules that apply everywhere:

• Never put a credential in a URL, log or page.
• Work mutations take an idempotency key and return the new version. A 409 with a conflict token means “read again and decide”.
• Work limits requests: over a limit you get 429 with Retry-After.
• A Worksong response may gain fields; ignore ones you do not know. Requests are strict: unknown fields are refused.

The Worksong API has no OpenAPI file yet. See Worksong API.

_{Source: worksong-ai/worksong:docs/API.md@e5e65e9, worksong-ai/Boardy:src/Boardy.Api/Program.cs@6775786. Docs version: Worksong 2.0 with Work 1.2.}