{"message":"API Security Lab","status":"online","note":"PHP is stateless \u2014 writes do not persist. Prefer the Node server for CRUD demos.","auth":"Writes require X-API-Key: demo-key (also accepted as Bearer or ?api_key=)","endpoints":{"GET \/api\/health":"Health check","GET \/openapi.json":"OpenAPI 3 spec","GET \/api\/users":"List users (PII in response)","GET \/api\/users\/:id":"Get user by id","POST \/api\/users":"Create user (mass-assign role\/balance)","GET \/api\/items":"List items; ?owner_id= has no access check","GET \/api\/search?q=":"Search users; query is echoed","POST \/api\/login":"Login with email + password","POST \/api\/reset":"No-op on PHP (already seed-only)"}}