Review the API surfaces in a workspace: OpenAPI, GraphQL and AsyncAPI contracts, catalogues, authentication and authorisation configuration, security disclosure contacts, contract tests and ECZ-ID public proof references. Inspection only, filename and path only. It does not test an endpoint or read a secret.