What was sent, when, and what came back: request.bodyDigest is the SHA-256 of the exact body that was signed, request.headers the headers it was sent with (the signature, never the secret), and response the endpoint’s last status and the first 1 KB of what it answered.
A signed-in person: the console's session cookie. Every state-changing request also carries the header x-immiscible-csrf: 1, and the member's role decides what it may do. Bearer tokens are ignored on these routes, so no machine credential can reach them.