1.4The two API surfaces

The product's server answers on two separate route groups, called surfaces. Almost every operation is offered on both, and both enforce the same permissions, policies and audit; they differ in who is expected to call them and how the caller proves its identity. A few routes exist on only one surface: the directory batch operations (up to 100 objects per request) are offered only on the machine surface, and session handling such as signing out and switching role only on the browser surface.

With a standard installation the API runs under the IIS application path /backend, so the machine surface of an installation at https://gateway.example.com is reached at https://gateway.example.com/backend/api/.... The MCP server for AI agents is a third entry point at https://gateway.example.com/backend/mcp; it accepts API keys and agent access tokens only.

Note: The separation is a security property. Because the machine surface never accepts a browser's session cookie, a malicious web page cannot trick a signed-in administrator's browser into calling it.

Integrators should always use the /api surface. See Chapter 15, REST API for integrators.