The API you shipped by granting a token

"Do you have an API?" is the question that kills deals for small SaaS products. Building one means auth, rate limits, docs, versioning: a second product behind the first.

When every customer is a container, their data already answers HTTP. Their records are rows in their container's SQLite service; their uploads are paths in their files service. Give the customer a token scoped to their container and nothing else, and they can query their own data, export their own files, wire their own Zapier-shaped automations: against endpoints you never wrote, that cannot see the tenant next door.

You publish which paths are theirs and call it the developer docs.