Use it correctly
Use JSON requests with `content-type: application/json`.
Protected routes require org auth or broker auth. `401` and `403` are expected when access is missing.
Brokered engine endpoints never go direct from the client. They go through the runtime bridge.
Nulls, estimated values, fallback states, and disagreement flags are part of the contract and should be rendered.
