POST /widgets to create a saved configuration. The response includes the
widget ID; use GET /widgets/{widget_id}/public-config for the safe
configuration needed by an embed client.
Every write accepts the optional X-Idempotency-Key header. To start a call,
use the canonical Web Call API from a
trusted server; widget configuration endpoints do not start provider calls.
