REST + JSON. Bearer auth. Idempotent. Per-key scopes + IP allowlist. Webhook signatures via HMAC. Test-mode keys that never touch SMTP. Every response carries X-Request-Id and rate-limit headers.
brands:read.curl https://app.boomsauce.com/api/v1/brands \ -H "Authorization: Bearer YOUR_KEY"
Every 4xx/5xx response carries error, message, request_id, and docs_url. Send the request_id to support and we can find it in one query.