Design constraints
A future API would accept only client-encrypted ciphertext and metadata necessary for expiry and retrieval. It should never accept a plaintext decryption key. Read operations must consume a record atomically so two concurrent requests cannot both retrieve it.
Before documentation becomes a contract
The API will not be advertised as available until authentication, abuse controls, rate limits, error semantics, idempotency, observability, versioning, and deletion behavior have been implemented and tested. Example requests published before then could be mistaken for a supported integration.
If you are evaluating an integration, use the contact page to describe the workflow—without including credentials or confidential system details.