This endpoint requires a bearer access token. Use short-lived tokens and send them only in the Authorization header.
- Keep tokens short-lived and rotate them frequently.
- Never include tokens in query parameters or logs.
- Use least-privilege scope grants for the caller.
- Preserve user data ownership boundaries: authenticate and authorize access without transmitting plaintext master key material.
Security Schemes
BearerAuthscopes: token must still be policy-allowlisted.