Integrations

Two services accept an organization API key and can therefore be called from your own code: core and sites. Every other publicly-routed service refuses one.

That is not a recommendation, it is the shape of the system: the list is derived by scanning the services for the code that installs a key validator, and a check fails if the list and the code disagree in either direction.

The route-by-route reference for those two services is not published today: there is no public API yet, and until there is, that surface is internal. The pages here describe how keys and scopes work, which is what you need before a reference is of any use.