Filter to a single module via ?module=Core (case-sensitive, matches the namespace-derived module name). Add ?includeDrift=true to receive the drift section alongside the entries — comparing the manifest with the effective Feature + Authorization state in the database. Drift is computed only when requested because it triggers a DB read; the entry list alone is served from the cached scan.

The payload uses System.Text.Json with camelCase property names and enums as strings ("Page", not 1). Field names are part of the contract — see AuthorizationManifestApiResponse for the canonical schema.