The API contract says which calls need a key
Every operation now states whether it is open, needs an API key or JWT, or works only from a signed-in dashboard, and the translation API is documented.
Operations that take no API credential now say which of two cases they are: open to anyone, or available only from a signed-in dashboard session. Before, both looked the same in the contract, so an agent could take a dashboard-only call for an open one and get a 401.
The translation API that turns your own records into canonical products, offers and observations is now in the contract, including the one-call ingest operation and the review queue.
The site now names the real permission scopes on API keys, such as price:compute, and the function catalog is described as a marketplace listing that needs a credential to read. The docs count six reference apps, plus the hub that links them.