All API requests (except /health) require the X-API-Key header:
X-API-Key: your-api-key-here
Requests without a valid API key receive 401 Unauthorized.