"""External API — scoped, machine-to-machine access for partner systems.

A standalone feature (distinct from the identity-consumer *directory
pull* surface, which exists to distribute employee/org data). An
**API client** is a non-human service principal that holds
``helix_api_`` bearer tokens and is granted a set of scopes to read /
write Helix business resources (cloud subscriptions first). Own
credential store, own auth dependency, own admin console + menu, own
scope registry — see ``docs/api/external-api.md``.
"""