Direct browser access is restricted. All requests must include valid bearer credentials and target versioned endpoints.