RP portal API
The reference below is generated from the canonical
rp-portal.yaml OpenAPI document on every build. These
are first-party, owner-facing endpoints: they use the portal session cookie,
require AAL2 and a fresh step-up, and state-changing calls require the portal's
origin/CSRF checks. They do not accept an RP client secret.