Release 2.16.1

docs/user/guide-data-sources.md

@@ -25,7 +25,9 @@ When an RSS feed fails, open the latest-items preview and check the reported pul
 
 ## API Sources
 
-An API source connects to a JSON endpoint and can use either GET or POST:
+An API source groups one or more named requests under shared authentication. Use **Add request** to create separate cards for endpoints such as event information and donors. Each request has its own URL, method, items path, enabled state, refresh interval, latest response, and **Test Connection** / **Refresh now** actions. Save the source to persist added, edited, or removed requests. A request used by a slide cannot be removed.
+
+Each request can use either GET or POST:
 
 - **GET:** retrieve data directly from the API URL.
 - **POST:** send a JSON request body with the request.
@@ -40,10 +42,18 @@ API authentication supports:
 - An API key sent in a named header.
 - A login-then-token flow for services that issue a token from a login request.
 
+Authentication applies to every request in the source. Choose **None** for public endpoints. Token-login requests share one cached token and refresh it as needed. **Test Authentication** checks the shared settings without calling a data endpoint; Basic, Bearer, and API-key settings also need a request test to verify provider acceptance. Slides select a request by its **source / request** name. Existing request IDs and slide bindings are preserved when upgrading.
+
 For a login-then-token source, configure the login URL, JSON login body, token response path, and token header. If the service supports token refresh, configure the refresh URL, refresh-token response path, refresh body, and token prefix as required by that service. Keep credentials and tokens out of slide content and request examples that will be shared with other users.
 
 After a pull, review the latest response details, including the last-pulled time, HTTP status, content type, and stored JSON response. Use the response structure to choose the item number, items path, and fields used by an API region.
 
+Use **Test Connection** on the add or edit form to test the current field values without saving them or replacing the stored response. Token-login tests obtain a fresh token without replacing the token used by scheduled refreshes. Results separate authentication, the data request, and JSON/items extraction, with HTTP status, duration, content type, sanitised JSON previews, and a sample of available field paths. Each request has a 15-second timeout.
+
+An **Authentication: HTTP 404** means the token request received a not-found response before the data endpoint was called. Check the **Login / token URL**, API version, and provider documentation first. For a 401, check credentials; for a 403, check token scopes and application permissions. Token requests currently use POST with a JSON body, so confirm that format is supported by the provider.
+
+Use **Copy diagnostic report** to share the results. Known credentials and token values are redacted, URL query strings are omitted, and non-JSON response bodies are withheld. Previews are limited to 12,000 characters. Review reports for other private application data before sharing them.
+
 ## Timetables
 
 A timetable group contains the events that a timetable region displays. Configure: