What shipped

This release moves the headless platform and Public API v1 work from DEV to UAT. Four pieces of engineering work sit behind that one line summary.

Machine authentication as a first class login path

SuperAdmins mint workspace scoped keys (prefixed lna_) from Admin Space, API Keys. Each key provisions a SERVICE_ACCOUNT user with a normal RBAC role; the secret is shown once and stored server side as a sha256 hash rather than in plain text. A request carrying Authorization: Bearer lna_... resolves into the same request user shape as a JWT login, so downstream RBAC, ownership, and licensing checks do not need to know whether the caller was a human or a machine.

A curated, versioned public contract

Only operations tagged with @PublicApi() are exposed as part of the stable surface, flagged x-public: true in the OpenAPI schema. Filtered export and coverage checks enforce documentation quality on that tagged surface, so the contract a client integrates against is deliberately narrower and better documented than the full internal API.

Per key throttling

API traffic authenticated with a key is now rate limited per key instead of per source IP, so one integration cannot exhaust the quota available to another system sharing the same network path.

Supporting work