The browser and bundled extensions use a small authenticated JSON API plus Server-Sent Events. See the HTTP API for route groups, authentication, and identity conventions.