All endpoints are prefixed with /v1 and require a Bearer token in the Authorization header unless marked Public. For local development the API runs on http://localhost:3001.