What it has: the assets, scans, issues, documents, vendor products, evidence ledger and reports of the organisations a key reaches, the evidence check, and a lookup for a CMS. API keys, bo_live_ and bo_test_, sent as Authorization: Bearer, each with the read, write or admin scope and a budget a minute set by its edition. Cursor pagination. Nine webhook events, signed with HMAC-SHA256, with a delivery log and replay. And test mode, a bo_test_ key reading fictional organisations and changing nothing.

The OpenAPI 3.1 document is published at /docs/openapi.json and /docs/openapi.yaml, generated from the same schemas the API validates against.

The statements on these pages that the API was not available yet are removed, as the entry before this one said the next entry would record.

What is published now are the commitments an integration is designed around, and they are settled: cursor pagination and its page sizes, the rate-limit headers on every response, the whole error model — which is in service today and is the same module the public API will answer with — and the versioning policy.

What is held back is anything that would be copied and run: the OpenAPI document, the quickstart, the worked example, the endpoint reference and webhooks. Each of those is a route with a statement on it saying what it will carry.

The next entry here is the one that removes those statements.