This is a synchronous API.

Yes. Access to data is entitled at package level, so you can request the views in the packages you are licensed for. See Before You Start. To check whether self-serve trial access is available, see Trial Accounts.

Request a token from POST /token/oauth, then send it on every other request in the Authorization header as Bearer {token}. See Authentication.

A token is valid for 60 minutes and can be reused across requests during that time. Long-running jobs must request a new token before it expires, and retry any request that returns 401 Unauthorized.