Create a one-time audience secret
Protect the owned Live with a server-generated audience secret. Send {} as JSON. Returns the newly issued secret only in this response, together with protection state, sequence and ETag; do not log it. Already-protected Lives return 409 already_protected. Requires the current Live ETag in If-Match (428 if missing, 412 if stale). Audience secrets authenticate viewers, not REST operators. Idempotency-Key is unsupported; a lost secret cannot be retrieved by GET.
Required scopes: live.update. Scopes intersect current authority; browser cookies never authenticate REST.
Authentication
Personal bearer credential issued through existing account settings or browser-approved CLI flow. Must be active, finite, unexpired, unrevoked, within any rotation overlap, and bound to an active personal membership/user/account. Explicit scopes intersect current user permissions; empty existing personal scopes inherit current user authority. Not an OAuth grant or service token. Browser cookies are ignored.
Organization-owned service token. Issue the initial token in organization credential settings. Scopes are documented per operation via x-required-scopes; they are not OAuth scopes.
Registered public-client OAuth for personal-account resources only. Exact registered HTTPS or fixed-port literal loopback redirect; S256 required; explicit consent. No organization/presentation authority. identity.read is required for /me and account metadata. Scope intersection with current user authority; no empty-scope inheritance.
Path parameters
Headers
Current strong Live ETag. Missing:428; stale:412. No automatic retry.