Per-user scoped (WHERE user_id = <effective subject>). Optional filters:
domain (membership in a domain id from /v1/graph/domains),
nodeType (exact) and q (case-insensitive title substring). Ordered by
createdAt descending with id as a stable tiebreaker; page with
nextCursor until hasMore is false. No totals (keyset pagination).
This route requires the read scope.A missing or invalid credential returns 401 authentication_error. A valid credential without the scope returns 403 permission_denied, and the problem body names the exact scope required.