Every request answers "403 API is disabled"
The REST API is off. A Super User can turn it on in Settings > API. The browser shows a notice at the top while it is off.
A request answers "403 Permission denied."
It ran as you, and your role may not do it to this record, as in the admin: a Contributor changing someone else's item, or reading a user account your role may not see. Ask someone with the right role. The same request with your API key would get the same answer.
A plugin's resource is missing
The browser lists the resources registered with Omeka's api_resources filter. Check that the plugin is installed and active, and that it has an API: not every plugin does. Reload the browser after activating it.
An operation is missing
Operations are listed when the resource offers them and your role may use them on at least your own records. A Researcher sees only List and Show; Create files is listed only for roles that may add files.
Create or Update answers 400 "Error when saving record."
The record did not validate. The response's errors names the fields, such as "item_type_id": "Invalid item type.". Linked records are given by ID ({"collection": {"id": 3}}), and metadata as element_texts: [{"html": false, "text": "…", "element": {"id": 50}}], where 50 is the element's ID (see elements).
An Update deleted my metadata
element_texts replaces all of a record's texts with those you send. Start from the record's Show, change what you need, and send the whole list. Leave element_texts out to keep the metadata as it is.
A query parameter answers 400 "Invalid GET request parameter"
The resource does not understand it. The parameters each resource accepts are those listed under Query parameters.
The public browser answers 404
There is none until at least one resource is ticked under Public browser, and the REST API is on.
The public browser shows no example for a resource
Examples there come from records anyone can read. A resource with no public record, or that visitors may not read (users), has none.
Is the public browser safe?
It shows documentation, examples from public records, and sends visitors' requests to /api as visitors. It does not change what the API lets visitors read, and it cannot change anything.