# HTTP API The platform API separates credentials by route ownership. | Credential | Primary routes | | --- | --- | | Operator API key (`nab_sk_`) | Agent, vault, policy, card, discovery, and skill-runtime operations | | Operator session JWT | Resource-server management, metrics, disputes, and other `AuthUser` operations | | Resource-server API key | x402 verification, settlement, status, and receipts for one server | | Public | Health, supported x402 capabilities, and public discovery reads | Resource-server management uses the operator session JWT. Settlement status and receipt reads require the resource-server API key and are scoped to that server; `GET /x402/supported` remains public. The route-by-route contract, request shapes, and ownership rules are maintained in the repository's [HTTP API reference](https://github.com/newt-foundation/newton-agent-neobank/blob/main/docs/reference/http-api.md).