Since the primary purpose of this code is to serve as a document to communicate how to call the API, I think overt code is preferable, even if duplicative.

The API versioning is per-module, so it will make more sense, I think, to include it as part of the opaque string that makes up the base url. It is very likely that the version numbers will increment differently for each API. The Auth API will likely never increment, but if we introduce a breaking change in the Vendor API, we would not need to increment all API versions nor deprecate URLs for other modules.

The TOKEN_ENDPOINT itself is a special case, as that is the name given in the OAuth2 specs, in that it is an opaque value to callers of the API that hopefully they would just paste into their OAuth2 client libraries that manage token expiration and renewal for them.