Conventions

• Request and response bodies are JSON with camelCase fields.
• Errors are { "error": { "code", "message", "details?" } }. details carries the validation issues when a body is rejected.
• Durations are written the way people say them: "10s", "3d", "1h30m", "250ms". A bare number is milliseconds.
• Timestamps are RFC 3339 in UTC.
• Routes whose body is entirely optional accept no body, an empty body, or {}.
• A POST that only reads (signing-secret/reveal) returns 200, not 201. It is a POST because a reason belongs in a body rather than a query string that lands in access logs, and because it writes an audit row.