Workspace management API

User-delegated REST and MCP for the same workspace data as the dashboard. Separate from publisher serving.

The management API lets a signed-in user delegate read and draft-write access to an agent. It never uses KNOBASE_API_KEY. Serving keys cannot call these routes, and management tokens cannot call POST /v1/offers/decide.

Credential A: serving key kb_… — POST /v1/offers/decide and serving events only.
Credential B: dashboard cookie session — humans in the product UI.
Credential C: OAuth management token — REST audience or MCP audience, bound to live grants and membership.
Live campaign delivery is not implemented. mark-ready sets test_ready and returns live_delivery: false.
Agents cannot approve confirmations. Humans approve once on a hosted approval page or in the dashboard.