Authentication

Most admin and operator routes expect interim tenant headers:

• x-organization-id — tenant scope
• x-user-role — RBAC role scaffold (for example ORG_ADMIN, OPS_MANAGER, VIEWER)
• x-user-id — optional trusted actor id for sensitive writes

JWT session auth (POST /api/auth/login) is also documented under Platform → Authentication when present in OpenAPI.

Webhook routes typically do not use admin tenant headers. Twilio webhooks may require x-twilio-signature when signature validation is enabled. Buyer ping webhooks may require x-arvexa-signature and x-arvexa-timestamp.

Never put real secrets, auth tokens, or vault references into examples or OpenAPI annotations.