Authentication
Every endpoint under /v1 is authenticated with an API key passed as a Bearer token:
API keys are prefixed with hmlt_ and are tied to your organization’s
entitlements — the set of locations your key may read. Endpoints only ever return
data within those entitlements; anything outside them responds as if it does not exist
(a 404), so resource existence is never leaked across organizations.
A missing, malformed, revoked, or unentitled key returns 401 with the standard error
envelope:
/health, /openapi.json, and the docs are the only public, unauthenticated routes.
Everything under /v1 requires a key.
