One-install Shortcut REST v3 front door over three bounded domain packs and nine operating workflows. It admits 142 of 143 operations in the current official contract, including every JSON REST feature and all six deprecated milestone aliases. The sole exclusion is multipart file upload, which the current static JSON REST composition cannot serialize; file reads/updates/deletes and URL-backed linked-file creation remain available. A documentary read-only Story Source mirrors non-archived stories through stable next-token search pagination and fresh detail reads. Enroll a Shortcut-Token header connection at https://api.app.shortcut.com; the token grants complete access to its workspace and must never be rendered or logged. Reads are uncached; content-, people-, repository-, file-, and integration-sensitive reads are marked sensitive-read except Source sync/read and bounded workspace metadata. Every mutation is grant-off and approval-gated. Bundled chat workflows use approval-free read metadata only, while content reviews and all writes are non-chat.