REST policy
Prefer A2A (POST /rpc + skill names) for all new integrations.
REST exists only as a thin compatibility layer for a small allowlisted set of routes. New product capabilities are added as:
- A2A skills
- A2UI surfaces (humans)
- REST only if a non-agent external consumer explicitly requires it
/a2a/campaigns.list — those are documentation-only.
There is no public POST /api/messages/send (or similar) for SMS. Unknown /api/*, /v1/*, and /rest/* routes return 404 with a pointer to POST /rpc.
Thin HTTP that does exist (auth required unless noted): session/keys helpers under /api/auth/*, /api/keys, /api/billing/cost — not a product CRUD surface for campaigns/contacts.