All responses are JSON. Successful responses follow the envelope format: { success: true, data: { … } }. Error responses include a message field explaining what went wrong. All timestamps are ISO 8601. IP addresses are returned as strings.