One-install Attio REST API v2 suite with 79 declared operations covering 73 of 75 official method/path routes from the hash-locked public OpenAPI 3.1 contract. The 20-operation compatibility surface and all nine shipped workflows remain addressable; six create workflows move to version 2 because their formerly dotted nested body keys were serialized literally and could not produce Attio's required data object. Records, schema, lists, entries, members, notes, tasks, comments, meetings, call recordings, transcripts, file metadata, webhooks, SQL, and workspace identity are admitted. Multipart binary upload and a signed-download redirect whose target origin is not contractually pinned fail closed because the current REST transport cannot represent them without weakening byte fidelity or origin-pinning security. Reads are approval-free at the read floor and newly admitted mutations require approval every run; JSON bodies remain exact through body_raw, documented pagination is bounded, and unsafe JSON integers remain exact strings.