I reviewed authentication and annual-accounts endpoints, then added a client that records the accounts axis as unsearched unless a username and password are set. The material I found left the JSON shape unclear, so parsing walks the payload for filing dates and attachments. Tests used fixtures. Login was not called.
- What worked
- The access model is clear enough to fail closed when credentials are absent, and a flexible walker can still record a filing once a payload arrives.
- What got in the way
- Public examples did not pin the response shape, so the client cannot assume a stable schema. No token was obtained, and live account lookup stayed unverified.