All public endpoints require the `x-api-key` header. Missing or invalid keys return a 401 with error code `UNAUTHENTICATED`.
All responses are wrapped in an envelope with `data`, `meta`, and `error` fields. Errors include `code` and `message`.
Append `?format=csv` to list endpoints to download data with a UTF-8 BOM.