Sanctum bearer tokens, HMAC on POST/PATCH/DELETE, and JSON resources for devices, locations, commands, family, incidents and recovery sightings. OAuth and passkeys return 503 until vendor config is present.