Public access
The following endpoints are open:GET /api/v1/public/assetsGET /api/v1/public/assets/{id}GET /content/{storageKey}GET /api/v1/system/pingGET /api/v1/system/bootstrap
Authenticated management
Management APIs accept:- JWT via
Authorization: Bearer <JWT> - API key via
Authorization: Bearer <API_KEY>
/mcp only accepts API keys.
Roles
Current role values are:superAdminadminuser
superAdmin is bootstrap-only. admin can manage user, but not other admin or superAdmin accounts.