REST API for programmatic access to runs, findings, evidence packs, and coverage. All endpoints return JSON; errors follow RFC 7807.