diff --git a/docs/api-reference.md b/docs/api-reference.md
new file mode 100644
index 0000000..5d1bd30
--- /dev/null
+++ b/docs/api-reference.md
@@ -0,0 +1,23 @@
+# API Reference
+
+## Authentication
+
+All endpoints except `/health` and `/api/v1/auth/login` require a Bearer token.
+
+```
+Authorization: Bearer <jwt>
+```
+
+## Errors
+
+| Code | Meaning |
+|------|---------|
+| 400 | Bad request / validation error |
+| 401 | Missing or invalid token |
+| 403 | Insufficient permissions |
+| 404 | Resource not found |
+| 500 | Internal server error |
+
+## Rate limiting
+
+100 requests / minute per IP. Headers: `X-RateLimit-Remaining`, `X-RateLimit-Reset`.
diff --git a/tests/health_test.rs b/tests/health_test.rs
new file mode 100644
index 0000000..5360a2e
--- /dev/null
+++ b/tests/health_test.rs
@@ -0,0 +1,9 @@
+#[cfg(test)]
+mod tests {
+    #[tokio::test]
+    async fn health_returns_ok() {
+        // TODO: spin up test server
+        // For now just assert the handler compiles
+        assert!(true);
+    }
+}