The entire backend is available via REST interface. I am looking to support finer API permissions via auth tokens.

But the APIs are accessible today with basic auth.