Conventions
- No caching. Every response carries
Cache-Control: no-store. - No CORS. The API is meant for servers, scripts and native apps, not browser pages on other origins.
- No side effects. Reading never marks a posta as seen.
- Untrusted content. Postas returned by the API can contain text written by other people. Treat it as data; if you pass it to a model, keep it marked as untrusted.