One-install OneSignal REST API front door over app-key messaging/audience operations and a separate organization-key administration leaf. The suite publishes 51 executable operations covering 49 of 59 declared official contracts (46 of 56 distinct routes); the prior root exposed 15 operations. Version 2 preserves all 15 operation IDs and six workflow IDs while adding current message-channel, template, segment, custom-event, user, subscription, legacy-player, Live Activity, in-app-message, audit, app, and API-key metadata capabilities. 10 fail-closed exclusions cover secret-returning key issuance/rotation, credential-bearing app responses, export and history capabilities, URL-carried capability tokens, and one superseded token-registration route. The current official https://api.onesignal.com origin replaces the legacy /api/v1 enrollment base. App and organization keys are distinct connection slots because OneSignal assigns them different authority. The multi-document authority cannot be represented by one honest openapi_source; a hash-pinned generated fixture accounts for every current reference page plus the immutable legacy OpenAPI. Reads are uncached and not approval-gated, every mutation requires approval, unsafe JSON integers remain exact strings, provider credentials stay connection-owned, and no synced Source is claimed without live field-presence proof.