Any key can list. A project-bound key sees only its own project, so a tool holding an organization-wide key can find the project to act on. Name that project in X-Project-Id: its id or its slug.
Authorization
bearer *Bearer <token>
API key of the form kaibo_<id>.<secret>. Scopes: read, write, read_write, forget, admin.