All API requests (except /health) require the X-API-Key header: 
X-API-Key: your-api-key-here
Requests without a valid API key receive 401 Unauthorized.