Explicit exclusions

The public REST API and MCP intentionally do not expose any operation to:

• connect or disconnect an advertising, commerce, attribution, or social provider;
• start or complete OAuth or callback flows;
• discover provider accounts, pixels, apps, shops, identities, or configuration options;
• select or alter provider integration configuration;
• read provider access tokens, refresh tokens, or credentials;
• manage team members, invites, billing methods, payout accounts, or organization deletion;
• upload media, launch ads, trigger provider syncs, or directly create payout activity.

Those workflows remain inside Lucra's authenticated platform UI and internal service routes. Internal /api/* routes are not public contracts and are not reachable through the versioned /v1/* gateway unless they appear in the endpoint table above.