Tenant-scoped REST endpoints under /api/v1 — OAuth 2.0 (PKCE) and personal access tokens for custom integrations and official clients.