Documentation 40

API drift · week of 17 October 2026

The API audit of 17 October 2026

21 providers checked against each vendor's published spec. Done items have shipped; open items have not.

Subscribe to the feed (Atom). Each new report reaches your reader the week it is published.

01 / Summary

What moved upstream this week.

17 providers changed, 13 retirements still served, 79 new endpoints, 21 shape changes, 31 docs-only; 10 sources unknown.

3 Retirement11 Re-pin4 Not checked3 Docs only

02 / By provider

Provider by provider.

BitbucketRetirement

Coverage badge Deep: 159 of 161 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 6 added, 14 changed, 12 deprecated, 38 retired.

Retired upstream 7 done, 0 open

Endpoints the vendor retired while our live host still served them. Done means the live host now answers the way the vendor does. Hosts pinned before that keep serving what they always served.

  • Done GET /repositories. A real removal.
  • Done GET /workspaces. Same evidence.
  • Done GET /user/permissions/workspaces. Pinned deprecated: true, upstream drops the path.
  • Done GET /user/permissions/repositories. Pinned deprecated: true, upstream drops the path.
  • Done GET /snippets. Only the GET was removed.
  • Done Group: Bitbucket issue tracker, 18 GET reads under /repositories/{workspace}/{repo_slug}/ (issues*, components*, milestones*, versions*, issue export/import status), all tier 3, excluded, unclassified.
  • Done Group: Connect application properties, 4 GET …/properties/{app_key}/{property_name} reads (commit, repository, pull request, user), all tier 3, deferred, refuse.

Re-pinned 2 done, 0 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Done Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Done Re-pin bitbucket/rest from 1ba0a3ef to the vendor's current spec.

New upstream, not served yet 2 done, 0 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Done GET /repositories/{workspace}/{repo_slug}/pullrequests/{pull_request_id}/mergeability/checks
  • Done GET /repositories/{workspace}/{repo_slug}/merge-queues

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • Write and unserved operations, no action: 15 removed issue-tracker writes, 8 deprecated Connect-property writes, and 9 changed write operations (the 6 hook POST/PUT/DELETE, POST …/pipelines, POST …/comments/{comment_id}/resolve and POST …/merge).

GitHubRetirement

Coverage badge Deep: 631 of 650 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 43 added, 52 changed, 1 deprecated, 17 retired.

Retired upstream 0 done, 1 open

Endpoints the vendor retired while our live host still served them. Done means the live host now answers the way the vendor does. Hosts pinned before that keep serving what they always served.

  • Open GET /repos/{owner}/{repo}/dependency-graph/sbom. A scheduled retirement, not yet a removal.

Re-pinned 5 done, 0 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Done Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Done Re-pin github/rest from 768a056f to the vendor's current spec.
  • Done Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Done Re-pin github/copilot_reports from 7d4b9533 to the vendor's current spec.
  • Done Client pins moved (versions:client-check): gh 2.98.0 to 2.102.0 (packages/conformance/src/github/gh-cli.test.ts) and renovate 44.39.2 to 44.166.0 (packages/conformance/src/github/renovate.test.ts).

New upstream, not served yet 9 done, 1 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Done /agents/automations
  • Done /orgs/{org}/actions/policies
  • Done /orgs/{org}/properties/installations
  • Done GET /orgs/{org}/actions/runners/deprecations/{version}, GET /repos/{owner}/{repo}/actions/runners/deprecations/{version}
  • Done GET /orgs/{org}/code-scanning/ai-scan, GET /repos/{owner}/{repo}/code-scanning/ai-scan
  • Done GET /orgs/{org}/interaction-limits/pulls/creation-cap
  • Open GET /repos/{owner}/{repo}/actions/jobs/{job_id}/steps/{step_number}/logs
  • Done GET /repos/{owner}/{repo}/issues/{issue_number}/relates_to
  • Done GET /repos/{owner}/{repo}/stargazers/count, GET /repos/{owner}/{repo}/stargazers/history
  • Done GET /repos/{owner}/{repo}/pulls/{pull_number}/merge-async/{uuid}

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • Write and unserved operations, no action: 11 removed enterprise-team writes, 20 added writes (in the families above, plus POST …/pulls/{pull_number}/requested_reviewers/rerequest and PUT …/merge-async) and 27 changed writes with no manifest row.
  • github/graphql: No change (upstream bytes match the pinned sha256).

SentryRetirement

Coverage badge Deep: 78 of 86 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 114 added, 128 changed, 2 deprecated, 21 retired.

Retired upstream 5 done, 0 open

Endpoints the vendor retired while our live host still served them. Done means the live host now answers the way the vendor does. Hosts pinned before that keep serving what they always served.

  • Done GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/rules/. Gone upstream: dropped from openapi-derefed.json HEAD (present in the 2024-10-16 build 9c036700), and live GET https://sentry.io/api/0/projects/sentry/javascript/rules/ answers 404 text/html, empty body, allow: OPTIONS, which is the unrouted signature of /api/0/definitely-not-a-real-endpoint/ in the pin's 2026-09-01 captures
  • Done GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/rules/{rule_id}/. Same evidence: live /projects/sentry/javascript/rules/1/ to 404 text/html empty, allow: OPTIONS.
  • Done GET /api/0/organizations/{organization_id_or_slug}/alert-rules/. gone: live /organizations/sentry/alert-rules/ to 404 text/html empty, allow: OPTIONS, while /organizations/sentry/ answers 401.
  • Done GET /api/0/organizations/{organization_id_or_slug}/alert-rules/{alert_rule_id}/. gone: live /organizations/sentry/alert-rules/1/ to 404 text/html empty, allow: OPTIONS
  • Done GET /api/0/organizations/{organization_id_or_slug}/alert-rules/{alert_rule_id}/activations/. gone: live /organizations/sentry/alert-rules/1/activations/ to 404 text/html empty, allow: OPTIONS

Re-pinned 3 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Done Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Done Re-pin rest from 18806362 to the vendor's current spec.
  • Done At 9c036700, 34 covered GET rows move.
  • Open Spec reorganisations that still route live (all 401 JSON on 2026-10-17), served unchanged
  • Open GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/issues/. Changed upstream.

New upstream, not served yet 3 done, 11 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Done GET /api/0/organizations/{organization_id_or_slug}/user-teams/
  • Done GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/environments/
  • Done GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/members/
  • Open GET /api/0/organizations/{organization_id_or_slug}/issues/
  • Open GET /api/0/organizations/{organization_id_or_slug}/issues/{issue_id}/events/{event_id}/
  • Open GET /api/0/organizations/{organization_id_or_slug}/shortids/{issue_id}/, GET /api/0/organizations/{organization_id_or_slug}/scim/v2/Groups/{team_id_or_slug}
  • Open GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/releases/, environments/{environment}/
  • Open GET /api/0/organizations/{organization_id_or_slug}/tags/
  • Open GET /api/0/organizations/{organization_id_or_slug}/scim/v2/
  • Open GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/
  • Open GET /api/0/organizations/{organization_id_or_slug}/workflows/, workflows/{workflow_id}/, detectors/, detectors/{detector_id}/
  • Open Integrations family under organizations/{o}/integrations/{integration_id}/ (4: detail, channels/, channel-validate/, repos/), organizations/{o}/config/integrations/, organizations/{o}/issues/{issue_id}/ integrations/, integrations/{integration_id}/, external-issues/, sentry-apps/{sentry_app_id_or_slug}/, organizations/{o}/sentry-apps/, organizations/{o}/sentry-app-components/, sentry-app-installations/{uuid}/external-requests/, organizations/{o}/forwarding/ (13), tier 3, empty for lists / refuse (DRF 404 {"detail": …}) for ids, matching the served-empty organizations/{o}/integrations/ and sentry-app-installations/, S
  • Open Telemetry families: organizations/{o}/trace/{trace_id}/, trace-meta/{trace_id}/, trace-items/ attributes, metrics, stats, events-timeseries/, events-dropped/, profiling/ chunks, flamegraph, projects/{o}/{p}/profiling/profiles/{profile_id}/, projects/{o}/{p}/events/{event_id}/attachments/ and attachments/{attachment_id}/ (12), tier 2/3, uncovered: spans, traces, profiles and outcome stats (canon holds error events only)
  • Open Product families: organizations/{o}/agents/conversations/ (2), flags/logs/ (2), group-search-views/, issues/{issue_id}/autofix/, seer/models/, preprodartifacts/ (5) and projects/{o}/{p}/preprod… (3), projects/{o}/{p}/replays/jobs/delete/ (2), custom-inbound-filters/ (2), filters/, organizations/{o}/project-keys/ (21), tier 3, empty for lists where no such act happened (replay deletion jobs, saved issue views, flag logs

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • docs:auth: Heading now "API Authentication | Sentry Docs" and one added paragraph linking a Token and Credential Formats page
  • docs:pagination: Title gains " | Sentry Docs"
  • docs:ratelimits: Title gains " | Sentry Docs"
  • rest: 10 removed write operations, 47 added and 54 changed write operations, and the deprecated POST …/user-feedback/ have no manifest row

Could not be checked

Sources the audit could not compare this week, and why.

  • captures: No url+sha256 and no source_repo+commit in provider-pins.yaml (live curl transcripts in a comment block), so neither versions:check nor specs:diff can compare it.

CircleCIRe-pin

Coverage badge Full: 61 of 61 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 6 changed.

Re-pinned 0 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin rest from 3f28cf84 to the vendor's current spec.

CursorRe-pin

Coverage badge Full: 21 of 21 read surfaces with a final answer when the audit ran.

Re-pinned 0 done, 4 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin the four cursor/docs files to the vendor's current spec.
  • Open GET /v1/agents, GET /v1/agents/{id}, GET /v1/models, GET /v1/repositories. Changed upstream.
  • Open GET /teams/members. Changed upstream.

New upstream, not served yet 0 done, 7 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /teams/directory-groups, GET /teams/directory-groups/:groupId, GET /teams/directory-groups/:groupId/members
  • Open GET /grok-bot/team-rules, GET /grok-bot/setup-manifests
  • Open GET /grok-bot/capabilities, GET /grok-bot/auto-review, GET /grok-bot/access, GET /grok-bot/network
  • Open GET /v1/environments, /v1/environments/{id}, /v1/environments/{id}/history, /v1/environments/{id}/builds, /v1/environments/{id}/builds/{buildId}, /v1/environments/{id}/builds/active
  • Open GET /v1/secrets, GET /v1/environments/{id}/secrets, GET /v1/team/secrets
  • Open GET /v0/private-workers/summary
  • Open 28 added write operations: POST /teams/user-spend-limits, 5 /teams/directory-groups…, 11 /grok-bot…, 3 /v1/environments create/update/delete, 4 secret set/delete, plus POST /v0/private-workers/pools, /tokens, /claims/{id}/release and /claims/{id}/fail, n/a, refuse (renderer-cursor's read-only boundary already answers them

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • docs:cloud-agent-api: The removed headings "Fleet Management" and "Get Fleet Summary" are a rename, not a retirement.
  • docs:admin-api: Apart from the three families under Candidates, the changes are prose.
  • docs:analytics-api: A format change (each endpoint now has a GET line above a back-ticked path) and one sentence on /analytics/team/bugbot range semantics.
  • docs:ai-code-tracking-api: The same format change only.

Could not be checked

Sources the audit could not compare this week, and why.

  • cursor/rest: NOT CHECKED, because there is no url+sha256 or source_repo+commit for the hand-authored cursor-admin.json.

DevinRe-pin

Coverage badge Deep: 120 of 122 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 44 added, 7 changed, 15 deprecated, 33 retired.

Re-pinned 0 done, 6 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin devin/rest from 00160cad to the vendor's current spec.
  • Open NOT a retirement, the five "Retirements still served" rows: live probes on 2026-10-17 show that api.devin.ai routes BEFORE it authenticates.
  • Open v3beta1 to v3 is a promotion, not a removal: the Devin release notes (https://docs.devin.ai/release-notes/overview, "Repositories and Blueprint APIs Promoted to V3") say "the repositories and snapshot-setup (blueprint/build) endpoints are now part of the stable v3 API at /v3/...
  • Open Deprecated with no removal date, still routing: GET /v3/enterprise/playbooks, GET /v3/organizations/{org_id}/playbooks (both green/empty), GET /v3/enterprise/playbooks/{playbook_id}, GET /v3/organizations/{org_id}/playbooks/{playbook_id} (deferred/refuse 404) and GET /v3/organizations/{org_id}/schedules, GET /v3/organizations/{org_id}/schedules/{schedule_id} (deferred/refuse 404) are now deprecated: true and all answer 403 live.
  • Open Covered rows whose shape moved: GET /v3/organizations/{org_id}/playbooks [parameters] adds the optional include_enterprise boolean, and the empty answer is still true because GET /v3/enterprise/playbooks is empty too.

New upstream, not served yet 0 done, 6 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /v3/organizations/{org_id}/repositories, GET /v3/organizations/{org_id}/repositories/indexing, GET /v3/organizations/{org_id}/repositories/{repository_path}/indexing
  • Open GET /v3/enterprise/snapshot-setup/blueprints…
  • Open GET /v3/enterprise/organizations/{org_id}/code-scans/{scan_id}, GET /v3/organizations/{org_id}/code-scans/{scan_id}
  • Open GET /v3beta1/organizations/{org_id}/default-platform
  • Open GET /v3beta1/ai-gateway/metrics
  • Open 26 added write operations (8 DELETE, 1 PATCH, 11 POST, 6 PUT, all under the promoted /v3/.../repositories/indexing and /v3/.../snapshot-setup families plus .../code-scans/{scan_id}/{findings/remediate,scan-new-commits,effort} and PUT /v3beta1/organizations/{org_id}/default-platform), n/a, refuse (the gateway's read-only refusal already answers them

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • devin/rest: 19 removed write operations under /v3beta1/.../repositories/indexing and /v3beta1/.../snapshot-setup (promoted to /v3, still routing) and 9 deprecated playbook/schedule write operations, none with a manifest row.

GitLabRe-pin

Coverage badge Deep: 735 of 755 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 135 added, 1674 changed, 1 deprecated, 5 retired.

Re-pinned 0 done, 7 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin gitlab/rest from ea02ef9f to the vendor's current spec.
  • Open COMMON CAUSE of the 1,674 Changed rows: GitLab changed the generator, not the API.
  • Open Consequence of the array re-typing, to check at conformance: 150 covered list rows (for example GET /api/v4/projects/{id}/merge_requests, GET /api/v4/groups, GET /api/v4/events) are now declared as arrays, which is what we already serve.
  • Open NuGet v2 path keys renamed, NOT a retirement: GET /api/v4/projects/{project_id}/packages/nuget/v2/FindPackagesById\(\) and GET /api/v4/projects/{project_id}/packages/nuget/v2/Packages\(\) (tier 3, deferred, derive) appear under Removed only because upstream stopped regex-escaping the parentheses.
  • Open Covered rows the common cause does NOT explain (36, all [parameters] unless noted):
  • Open Response components with real (non-generator) changes reaching covered rows:

New upstream, not served yet 0 done, 18 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /api/v4/projects/{id}/repository/diff_stats, GET /api/v4/projects/{id}/repository/changed_paths
  • Open GET /api/v4/projects/{id}/releases/permalink/latest
  • Open GET /api/v4/pipelines
  • Open GET /api/v4/projects/{id}/jobs/{job_id}/artifacts/{artifact_path}, GET /api/v4/projects/{id}/jobs/artifacts/{ref_name}/raw/{artifact_path}
  • Open GET /api/v4/ai/duo_workflows/workflows/{id}/checkpoints/by_thread_ts
  • Open Npm family, 6 GETs: …/packages/npm/{package_name} and …/packages/npm/-/package/{package_name}/dist-tags, each at the project, group (/groups/{id}/-/) and instance (/api/v4/packages/npm/) scope, tier 3, derive (canon Package kind npm + PackageVersion, packages/canon/src/package-registry.ts:70).
  • Open Go proxy, 4 GETs (/api/v4/projects/{id}/packages/go/{module_name}/@v/list, ….info, ….mod, ….zip), tier 3, derive list/.info from kind golang versions.
  • Open PyPI, 5 GETs: …/packages/pypi/simple/{package_name} (project + group), tier 3, derive (kind pypi, the same packagesForRepo() the green …/pypi/simple uses).
  • Open GET /api/v4/projects/{id}/packages/generic/{package_name}/{package_version}/{file_name}
  • Open NuGet, the 9 GETs besides the two renamed v2 feeds (…/nuget/v2/Packages(Id='{package_name}',Version='{package_version}'), …/nuget/metadata/{package_name}/index and /{package_version} (project + group), …/nuget/download/{package_name}/index and /{package_version}/{package_filename}, …/nuget/symbolfiles/… (project + group)), tier 3, refuse (GitLab's 404 for a package that does not exist
  • Open Registries canon has no kind for, 35 GETs: debian dists/… (18, project + group), maven {path}/{file_name} (3), composer (3, /api/v4/group/{id}/-/packages/composer/… + project archives), rpm (2), terraform modules (4), ml_models/{model_version_id}/files/… (2), dependency_proxy/packages/{maven,npm}/… (2), ml/mlflow/api/2.0/mlflow-artifacts/artifacts/… (1), tier 3, refuse (GitLab's own 404, the same ruling as the existing deferred/refuse conan, cargo and debian rows), S
  • Open GET /api/v4/groups/{id}/service_accounts/{user_id}, GET /api/v4/projects/{id}/service_accounts/{user_id}
  • Open GET /api/v4/projects/{id}/releases/{tag_name}/downloads/{direct_asset_path}
  • Open GET /api/v4/iam/userinfo, GET /api/v4/jobs/{id}/runtime_environment_key
  • Open Orbit, 7 GETs under /api/v4/orbit/ (status, schema, tools, skills, skills/{name}, skills/{name}/{path}, query/templates), tier 3, uncovered: GitLab Orbit (the knowledge-graph product, published 2026-09-16 c9a84317) has no canon.
  • Open GET /api/v4/glql/schema
  • Open GET /api/v4/projects/{id}/feature_flags_settings, GET /api/v4/projects/{id}/ai_agent/sessions
  • Open 45 added write operations (6 DELETE, 1 PATCH, 21 POST, 17 PUT

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • gitlab/rest: 3 removed writes with no manifest row, POST /api/v4/projects/{project_id}/product_analytics/request/{load,dry-run,meta}.
  • gitlab/rest: 1 deprecated write with no row, POST /api/v4/projects/{id}/merge_requests/{merge_request_iid}/cancel_merge_when_pipeline_succeeds.
  • gitlab/rest: 3 added /api/v4/internal/… GETs (gitlab_subscriptions/namespaces/{id}/projects, org_mover/maintenance_readiness, org_mover/maintenance_state).

Could not be checked

Sources the audit could not compare this week, and why.

  • gitlab/graphql: Not diffable.

HubSpotRe-pin

Coverage badge Full: 32 of 32 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 2 changed.

Re-pinned 0 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin rest-companies from a7e78b8c to the vendor's current spec.

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • rest-schemas: Two write operations changed [responses] (POST /crm-object-schemas/v3/schemas, .../associations)

Could not be checked

Sources the audit could not compare this week, and why.

  • docs: No upstream url recorded for the docs-derived pages

JiraRe-pin

Coverage badge Deep: 326 of 328 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 13 added, 24 changed.

Re-pinned 0 done, 8 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin jira/rest:platform-v3 from 90d1546f to the vendor's current spec.
  • Open Common cause of the 24 Changed operations: Atlassian documented its request and entity-count limits.
  • Open Covered row whose change the common cause does not explain: GET /rest/api/3/label (tier 3, green/derive) [parameters] adds query ("Case-insensitive prefix used to filter labels before pagination") and scope (RECENT_PROJECTS/ALL_BROWSEABLE_PROJECTS
  • Open Covered row, not the common cause: GET /rest/api/3/search/jql (tier 1, green/derive) [parameters] adds includeArchivedProjects (default false)
  • Open Covered row, not the common cause: GET /rest/api/3/project/{projectIdOrKey} (tier 1, green/derive) [parameters] properties now says the response's properties object "is empty when this parameter is omitted"
  • Open Covered row, not the common cause: GET /rest/api/3/field/{fieldId}/context/defaultValue (tier 3, green/empty) [responses] adds a 400 for contexts whose defaults differ per issue type, and CustomFieldContextDefaultValue adds a longtext discriminator member.
  • Open Covered row, not the common cause: GET /rest/api/3/uiModifications (tier 3, deferred/refuse) [responses]: the 200 example's total changed from 3 to 5.

New upstream, not served yet 0 done, 5 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open All 13 added operations are unprobed: every path is https://<site>.atlassian.net/rest/api/3/…, which needs a real site, so the rulings below rest on the spec's x-experimental, x-atlassian-connect-scope and stated permissions
  • Open GET /rest/api/3/issue/limit/adf/report
  • Open GET /rest/api/3/policies, GET /rest/api/3/policies/project/{projectIdOrKey}, GET /rest/api/3/policies/project/{projectIdOrKey}/rules
  • Open POST /rest/api/3/forge/panel/action/bulk/status
  • Open 8 added write operations (POST /rest/api/3/agents/bulk/invoke/{batch,uniform}, POST /rest/api/3/policies/project/{projectIdOrKey}/validate, POST /rest/api/3/policies/{policyId}/{apply,remove}, PUT /rest/api/3/policies/project/{projectIdOrKey}/policies, POST /rest/api/3/workflows/copy, PUT /rest/api/3/field/{fieldId}/context/defaultValues), n/a, refuse (the gateway's read-only refusal already answers them

LinearRe-pin

Coverage badge Full: 17 of 17 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 442 added, 19 changed, 7 deprecated, 6 retired.

Re-pinned 0 done, 6 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin linear/graphql from 7ef4c502 to the vendor's current spec.
  • Open Bump the client in the SAME PR: @linear/sdk 91.0.0 to 98.0.0 (versions:client-check).
  • Open ProjectFilter.id, ProjectCollectionFilter.id, NullableProjectFilter.id, InitiativeFilter.id, InitiativeCollectionFilter.id, NullableInitiativeFilter.id. Changed upstream.
  • Open IntegrationService.datadog, IntegrationService.origin. Changed upstream.
  • Open 6 Changed Mutation.* rows (documentDelete, integrationJiraPersonal, integrationMcpServerConnect, integrationZendesk, issueImportCreateAsana, projectCreate) [parameters], plus 5 [responses] changes on AiConversation* / DocumentContentHistory* types.

New upstream, not served yet 0 done, 5 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open New fields on served types that are outside every SDK fragment (12, all [Internal]/[ALPHA] or new-loop surface): Issue.aiAnalysis, Organization.loops, Organization.teamSecuritySettings, Project.leadTeamId, ProjectStatus.inheritedFrom/team/teamId, Team.agentAutomationEnabled/codingAgentEnabled/inheritProjectStatuses/loops, DocumentContent.meeting, tier 3, none.
  • Open ProjectFilter.customIdentifier, ProjectFilter.leadTeam
  • Open 14 new Query.* roots (inboxNotifications, quotas, templateSearch, usageAlert, usageAlerts, userViewPreferences, dependencyPackageMetadata, and 7 [Internal] ones: agentSessionSshAddress, auditLogWebhookFailureEvents, integrationJiraProjectStatuses, originInstallUrl, originInstallation, originPendingInstallations, partnerProgramPartners), tier 3, uncovered.
  • Open 108 new types and 272 new fields on 132 types outside our subset, n/a, uncovered.
  • Open 14 new Mutation.* fields, n/a, refuse.

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • linear/graphql: None of the 6 removed entries is served.
  • linear/graphql: None of the 7 deprecated entries is served.

OpenAIRe-pin

Coverage badge Full: 122 of 122 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 73 added, 270 changed, 1 deprecated, 1 retired.

Re-pinned 0 done, 10 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin openai/rest from 2186421d to the vendor's current spec.
  • Open The common cause of most of the 270 Changed rows: every operation now documents 400/403/404/429 error responses.
  • Open GET /organization/costs. Changed upstream.
  • Open GET /organization/usage/completions. Changed upstream.
  • Open GET /organization/usage/web_search_calls. Changed upstream.
  • Open The other 8 green usage rows (audio_speeches, audio_transcriptions, code_interpreter_sessions, embeddings, file_search_calls, images, moderations, vector_stores) [responses]: these change only because the shared UsageTimeBucket.results oneOf includes the two widened result schemas.
  • Open GET /organization/audit_logs. Changed upstream.
  • Open GET /organization/projects, GET /organization/projects/{project_id}. Changed upstream.
  • Open GET /organization/admin_api_keys. Changed upstream.

New upstream, not served yet 0 done, 8 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /organization/usage/decisions
  • Open GET /organization/external_storage, GET /organization/external_storage/{external_storage_id}
  • Open GET /agents…
  • Open GET /vaults, GET /vaults/{vault_id}, GET /vaults/{vault_id}/credentials, GET /vaults/{vault_id}/credentials/{credential_id}
  • Open GET /webhook_endpoints, GET /webhook_endpoints/{webhook_endpoint_id}, GET /webhook_event_types
  • Open GET /safety/alerts/{id}, GET /safety/cases/{id}
  • Open GET /live/sessions/{session_id}/content
  • Open 36 added write operations (13 under /agents, 6 /live/sessions…, 6 /vaults…, 5 /webhook_endpoints…, 3 /organization/external_storage…, plus POST /decisions, POST /evals/{eval_id}/runs/{run_id}/cancel and POST /organization/projects/{project_id}/api_keys/{api_key_id}), n/a, refuse (the gateway's read-only refusal already answers them

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • openai/rest: The removed POST /evals/{eval_id}/runs/{run_id} is a spec reorganisation, not a retirement.
  • openai/rest: The deprecated POST /images/variations IS retired upstream.
  • openai/rest: 153 Changed operations are writes with no manifest row (mostly the same documented-error-response addition).

PagerDutyRe-pin

Coverage badge Full: 211 of 211 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 1 added, 16 changed.

Re-pinned 0 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin rest from b2e80f8b to the vendor's current spec.

New upstream, not served yet 0 done, 1 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /incidents/{id}/scribe_transcripts

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • rest: Write operations changed in [requestBody]/[parameters] (custom_shifts, overrides, events updates

Could not be checked

Sources the audit could not compare this week, and why.

  • docs: No upstream url recorded for the docs-derived pages

Microsoft TeamsRe-pin

Coverage badge Full: 13 of 13 read surfaces with a final answer when the audit ran.

Re-pinned 0 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin rest from b4b9da45 to the vendor's current spec.

ZendeskRe-pin

Coverage badge Deep: 336 of 345 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 10 added, 19 changed.

Re-pinned 3 done, 4 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Done Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Done Re-pin zendesk/rest from 3a477ea8 to the vendor's current spec.
  • Done The common cause of the 19 Changed rows: Zendesk loosened its schemas to match what the API really returns, and documented query parameters it already accepted.
  • Open GET /api/v2/requests, GET /api/v2/users/{user_id}/requests. Changed upstream.
  • Open GET /api/v2/tickets/{ticket_id}/comments. Changed upstream.
  • Open GET /api/v2/ticket_fields. Changed upstream.
  • Open GET /api/v2/incremental/ticket_metric_events. Changed upstream.

New upstream, not served yet 2 done, 1 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Done GET /api/v2/channels/whatsapp_templates, GET /api/v2/channels/whatsapp_templates/languages
  • Done GET /api/v2/tickets/{ticket_id}/parent_ticket_tasks, GET /api/v2/tickets/{ticket_id}/task_items/{task_item_id}/task_links
  • Open 6 added write operations (POST /api/v2/oauth/tokens/delete_many, POST /api/v2/tickets/{ticket_id}/task_items/{task_item_id}/subticket, POST …/task_links, DELETE …/task_links/{task_object_link_id}, PUT /api/v2/channels/whatsapp_templates/toggle_many, PUT /api/v2/channels/whatsapp_templates/{template_id}/toggle), n/a, refuse (the gateway's read-only refusal already answers them, and no zendesk row is mode: scratch).

Azure DevOpsNot checked

Coverage badge Deep: 227 of 232 read surfaces with a final answer when the audit ran.

Could not be checked

Sources the audit could not compare this week, and why.

  • rest:build, rest:core, rest:git, rest:graph, rest:ims, rest:pipelines, rest:wit, rest:work: The pinned upstream MicrosoftDocs/vsts-rest-api-specs answers HTTP 404 on api.github.com and github.com as of 2026-10-17 (pinned commit 37856418, retrieved 2026-08-03), the repository has been removed or made private, so the ten vendored files under packages/conformance/specs/ado (committed to git, so not at risk of loss) are now the only copy we can reach and can never be re-verified against their source

AnthropicNot checked

Coverage badge Full: 13 of 13 read surfaces with a final answer when the audit ran.

Could not be checked

Sources the audit could not compare this week, and why.

  • rest: The hand-authored OpenAPI is docs-derived with no upstream url or sha256 pinned, so drift is invisible to both versions:check and specs:diff

Codex AnalyticsNot checked

Coverage badge Full: 3 of 3 read surfaces with a final answer when the audit ran.

Could not be checked

Sources the audit could not compare this week, and why.

  • rest: Docs-derived, no upstream url or sha256 pinned

SalesforceNot checked

Coverage badge Partial: 23 of 50 read surfaces with a final answer when the audit ran.

Could not be checked

Sources the audit could not compare this week, and why.

  • rest: Docs-derived, no upstream url or sha256 pinned (and the capture that would make this Deep is still founder-gated)
  • docs: No upstream url recorded

BuildkiteDocs only

Coverage badge Deep: 75 of 78 read surfaces with a final answer when the audit ran.

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • docs:rest_api__jobs: +104 lines, new heading "Cancel a job" (a write operation
  • docs:rest_api__pipeline_triggers: +36/-4, new heading "Create a GitHub Actions pipeline trigger" (write, no action)
  • docs:rest_api__clusters, __pipelines, __artifacts, __organizations, __rate_limits, __builds, rest_api: Prose edits (+4 to +33 lines, no heading change)
  • rest and spec-available: Hand-authored from the docs pages above, which are the checked upstream

SlackDocs only

Coverage badge Full: 17 of 17 read surfaces with a final answer when the audit ran.

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • docs:conversations.history: +5/-1 prose edit, no heading change
  • docs:users.list: +1/-1 prose edit
  • docs:rate-limits: +1/-1 prose edit
  • rest: Hand-authored from the docs pages above, which are the checked upstream

StatuspageDocs only

Coverage badge Deep: 37 of 38 read surfaces with a final answer when the audit ran.

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • rest: The extracted OpenAPI page's bytes moved (3bcda923 to HEAD) with no operation-level change

03 / More

Other weeks, and what is served today.

Every report is on the API drift index. What each replica serves right now is on the coverage page, and every endpoint row is on its provider's page.