API endpoint

# [METHOD] /[path] [does what] ## Intent[Which client] needs to [read or write what] so that [why]. ## Context- Service: [`api/the-service`, framework, where routes live]- Auth: [who may call it: signed-in user, token, role]- Similar endpoint to follow: [`path/to/similar.js`] ## What to do1. Add `[METHOD] /[path]` taking [body or query fields with types].2. Return [status and shape], e.g. `{ "id": "…", "status": "…" }`.3. Refuse [what] with [status] and the message "[text]".4. Document it in [where the API docs live]. ## Constraints- Existing clients of [neighbouring endpoint] keep working.- Never return [fields that must stay private]. ## Out of scope- [Pagination, webhooks, other methods] ## Open questions- [Who else calls this, and may the response shape still change? Remove it when settled.] ## Acceptance checks- A valid request returns [status] with [shape]- A caller without [permission] gets [403] and nothing is changed- Invalid input returns [400] with a message naming the field- The endpoint is documented in [place]