POST a hostname only—schemes, ports, paths, credentials, and queries are rejected. Poll the returned request ID; ownership is enforced.
Terminal states distinguish ready, unavailable, deferred_review, policy_restricted, and failed.
POST /v1/discover
{"domain":"example.com"}
GET /v1/discovery-jobs/req_…