The versioned API uses Better Auth session cookies and live workspace membership checks. Mutations require JSON and the trusted service Origin. Desktop requests send X-MA-Device-Id. Owner and editor roles can modify shared profiles; viewers can use runtime sessions and update only their own device snapshots.
CAS mutations return REVISION_CONFLICT (409). Refresh before retrying. Secrets are returned only by create/runtime responses; never expose those responses to an untrusted renderer. No bearer API keys or offline authorization fallback are supported.