Authentication

POST /auth/login sets a JWT in an HttpOnly cookie; every other endpoint reads it from there. POST /auth/logout clears it.

curl -c jar.txt -X POST https://…/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"me","password":"…"}'

curl -b jar.txt https://…/library/albums

Roles

viewer, staff, admin. Everything under the administration surface requires admin.

401 versus 403

401	No valid session. Sign in again.
403	Signed in, insufficient role.

Personal versus shared data

Endpoints that return your state — favourites, wishlist, notes, personal charts — resolve the user from the session. There is no way to ask for another user's annotations.

Anything scoped to your own listening additionally needs a scrobble link; without one those endpoints return empty rather than failing.