{
  "api_keys_accepted": true,
  "documentation": "https://api.engineeringruntime.com/authentication",
  "environment": "production",
  "require_auth": false,
  "runtime_client_header": "X-Runtime-Client: engineering-runtime",
  "schemes": [
    {
      "applies": [
        "/api/public/*"
      ],
      "enforced": true,
      "id": "none",
      "name": "Open",
      "notes": "The public surface is always open by design — Community runtimes and the demo UI depend on it."
    },
    {
      "applies": [
        "/api/v1/*"
      ],
      "enforced": false,
      "header": "Authorization: Bearer \u003ctoken\u003e",
      "id": "bearer_jwt",
      "issued_by": "POST /api/v1/auth/login",
      "name": "JWT bearer token"
    },
    {
      "accepted": true,
      "applies": [
        "/api/v1/policies",
        "/api/v1/audit",
        "/api/v1/fleet/heartbeat"
      ],
      "enforced": false,
      "header": "X-API-Key: erk_…",
      "id": "api_key",
      "issued_by": "POST /api/v1/api-keys",
      "name": "Runtime API key"
    }
  ],
  "surfaces": [
    {
      "audience": "Demo Live UI and Community runtimes",
      "auth": "open — no credentials",
      "prefix": "/api/public",
      "stable": true
    },
    {
      "audience": "Enterprise app UI and authenticated runtimes",
      "auth": "open — REQUIRE_AUTH=false; X-API-Key is accepted and honoured when supplied",
      "prefix": "/api/v1",
      "stable": true
    }
  ]
}