Pending friend requests — ?direction=received (default, the caller's inbox) | sent

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.