All API calls except health require the app bearer token. Destructive actions require confirmation.
Ready.