Set the allowed origins
Requires api_keys:write. This list is the actual security boundary of a key that is public by design.
Matching is exact on the normalized origin — no wildcards, no prefixes. An empty list allows any origin: that is the getting-started state, and it is what you leave behind before going live.
Authorizations
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange.
Headers
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing. Absent, the session's default organization answers.
Path Parameters
Body
Scheme and host, optionally a port. No path, no query, no fragment.
Response
Updated.