Documentation 40

API drift · week of 28 October 2026

The API audit of 28 October 2026

25 providers checked against each vendor's published spec. Done items have shipped; open items have not.

Subscribe to the feed (Atom). Each new report reaches your reader the week it is published.

01 / Summary

What moved upstream this week.

19 providers changed, 1 retirements still served, 94 new endpoints, 17 shape changes, 69 docs-only; 22 sources unknown.

1 Retirement16 Re-pin1 New endpoints5 Not checked1 Docs only1 No change

02 / By provider

Provider by provider.

GitHubRetirement

Coverage badge Deep: 652 of 667 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 16 added, 15 changed, 4 retired.

Retired upstream 0 done, 1 open

Endpoints the vendor retired while our live host still served them. Done means the live host now answers the way the vendor does. Hosts pinned before that keep serving what they always served.

  • Open GET /repos/{owner}/{repo}/dependency-graph/sbom. A scheduled retirement, not yet a removal.

Re-pinned 0 done, 5 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin github/rest from 755ee33b to the vendor's current spec.
  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin github/copilot_reports from e7976154 to the vendor's current spec.
  • Open Client pins moved (versions:client-check): gh 2.102.0 to 2.103.3 (packages/conformance/src/github/gh-cli.test.ts) and renovate 44.171.1 to 44.190.2 (packages/conformance/src/github/renovate.test.ts).

New upstream, not served yet 0 done, 8 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /agents/repos/{owner}/{repo}/automations/available-tools
  • Open GET /agents/repos/{owner}/{repo}/automations/available-triggers
  • Open GET /agents/repos/{owner}/{repo}/automations/{automation_id}/tasks
  • Open GET /agents/repos/{owner}/{repo}/pulls/{pull_number}/agent-merge
  • Open GET /repos/{owner}/{repo}/issues/{issue_number}/artifacts
  • Open GET /repos/{owner}/{repo}/issues/{issue_number}/artifacts/{artifact_number}
  • Open GET /repos/{owner}/{repo}/security-advisories/{ghsa_id}/comments
  • Open GET /repos/{owner}/{repo}/security-advisories/{ghsa_id}/comments/{comment_id}

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • GET /agents/automations/available-tools, GET /agents/automations/available-triggers, GET /agents/automations/{automation_id}, GET /agents/automations/{automation_id}/tasks (Removed): Still routes, probed 2026-10-28: 401 "Requires authentication" on all four, the same as /agents/automations.
  • Writes, no action: 8 added (DELETE/PUT …/pulls/{pull_number}/agent-merge, POST/PATCH/DELETE …/issues/{issue_number}/artifacts…, POST/PATCH …/security-advisories/{ghsa_id}/comments…, POST …/automations/{automation_id}/tasks) and 8 changed with no manifest row (automation POST/PATCH/DELETE, four code-security configuration create/update at org and enterprise scope, POST /organizations/{org}/settings/billing/budgets).
  • github/graphql: No change (upstream bytes match the pinned sha256).
  • github/docs:dependency-caching-source: versions:check did not check it.

Could not be checked

Sources the audit could not compare this week, and why.

  • github/docs:dependency-caching: Not checked.

Google AntigravityRe-pin

Coverage badge Deep: 13 of 15 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 3 added, 18 changed, 3 retired.

Re-pinned 0 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin antigravity/rest from e99222a8 to the vendor's current spec.

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • GET /{api_version}/interactions/{interactionsId}, DELETE /{api_version}/interactions/{interactionsId} and POST /{api_version}/interactions/{interactionsId}/cancel were flagged as Removed and as "Retirements still served". This is a false alarm: Each one is the same operationId under the renamed template {id}, listed in Added.
  • The write rows in Changed are already answered by the read-only refusal: DELETE /{api_version}/agents/{agentsId}, DELETE /{api_version}/voices/{voicesId}, PATCH /{api_version}/triggers/{id}, PATCH /{api_version}/webhooks/{id}, POST /{api_version}/agents, POST /{api_version}/interactions, POST /{api_version}/triggers, POST /{api_version}/triggers/{triggerId}/executions, POST /{api_version}/webhooks, POST /{api_version}/webhooks/{id}:ping, POST /{api_version}/webhooks/{id}:rotateSigningSecret, PUT /upload/{api_version}/environments/{environment}/files/{path}.
  • The Added rows DELETE /{api_version}/interactions/{id} and POST /{api_version}/interactions/{id}/cancel are writes and are not candidates.

Could not be checked

Sources the audit could not compare this week, and why.

  • antigravity/capture-pending: Diff.md says Not diffable, because provider-pins.yaml records no url+sha256 and no source_repo+commit for it.
  • antigravity/captures: Not diffable for the same reason.
  • antigravity/docs: Not diffable for the same reason.

BuildkiteRe-pin

Coverage badge Deep: 77 of 78 read surfaces with a final answer when the audit ran.

Re-pinned 0 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin docs from bcad57cf to the vendor's current spec.

New upstream, not served yet 0 done, 1 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /v2/organizations/{org.slug}/usage

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • docs:rest_api__jobs: +104 lines, new heading "Cancel a job" (a write operation
  • docs:rest_api__pipeline_triggers: +38/-4, new heading "Create a GitHub Actions pipeline trigger" (write, no action)
  • docs:rest_api__organizations__rate_limits: +55/-7.
  • docs:rest_api: +4/-0, no heading change.
  • docs:rest_api__clusters: +56/-5, no heading change.
  • docs:rest_api__pipelines: +83/-10, no heading change.
  • docs:rest_api__artifacts: +15/-0, no heading change.
  • docs:rest_api__organizations: +3/-0, prose (the inactive-organization 404 note).
  • docs:rest_api__repository_connections: +5/-3, prose and field descriptions (Entire connections: entire:// clone_url, empty default_branch).
  • docs:rest_api__agents, __builds, __rate_limits, __teams__suites: +1/-1 each.
  • docs:rest_api__clusters, __pipelines, __artifacts, __organizations, __rate_limits, __builds, rest_api: Re-pin the docs pages with the next buildkite bump
  • rest and spec-available: Hand-authored from the docs pages above, which are the checked upstream

CircleCIRe-pin

Coverage badge Full: 61 of 61 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 6 changed.

Re-pinned 0 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin rest from 3f28cf84 to the vendor's current spec.

CursorRe-pin

Coverage badge Full: 21 of 21 read surfaces with a final answer when the audit ran.

Re-pinned 0 done, 6 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin the four cursor/docs files to the vendor's current spec.
  • Open Re-pin addendum (2026-10-28): two of the four HEAD hashes in the line above have moved again.
  • Open Pin https://cursor.com/docs-static/cloud-agents-openapi.yaml as the spec of record for the Cloud Agents half of rest, by url+sha256 (2026-10-28: 200 text/yaml, OpenAPI 3.0.3, info.version 1.0.0, 27 paths, 146,464 bytes, sha256 dd3b836c4e95ad68892274280e53c348619cdd2051988793d2a85e8213d9a489).
  • Open GET /v1/agents, GET /v1/agents/{id}, GET /v1/models, GET /v1/repositories. Changed upstream.
  • Open GET /teams/members. Changed upstream.

New upstream, not served yet 0 done, 7 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /teams/directory-groups, GET /teams/directory-groups/:groupId, GET /teams/directory-groups/:groupId/members
  • Open GET /grok-bot/team-rules, GET /grok-bot/setup-manifests
  • Open GET /grok-bot/capabilities, GET /grok-bot/auto-review, GET /grok-bot/access, GET /grok-bot/network
  • Open GET /v1/environments, /v1/environments/{id}, /v1/environments/{id}/history, /v1/environments/{id}/builds, /v1/environments/{id}/builds/{buildId}, /v1/environments/{id}/builds/active
  • Open GET /v1/secrets, GET /v1/environments/{id}/secrets, GET /v1/team/secrets
  • Open GET /v0/private-workers/summary
  • Open 28 added write operations: POST /teams/user-spend-limits, 5 /teams/directory-groups…, 11 /grok-bot…, 3 /v1/environments create/update/delete, 4 secret set/delete, plus POST /v0/private-workers/pools, /tokens, /claims/{id}/release and /claims/{id}/fail, n/a, refuse (renderer-cursor's read-only boundary already answers them

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • docs:cloud-agent-api: The removed headings "Fleet Management" and "Get Fleet Summary" are a rename, not a retirement.
  • docs:cloud-agent-api (new since 2026-10-17): The removed heading "Create A Run" is also a rename, not a retirement.
  • docs:admin-api: Apart from the three families under Candidates, the changes are prose.
  • docs:analytics-api: A format change (each endpoint now has a GET line above a back-ticked path) and one sentence on /analytics/team/bugbot range semantics.
  • docs:ai-code-tracking-api: The same format change only.

Could not be checked

Sources the audit could not compare this week, and why.

  • cursor/rest: NOT CHECKED.

DatadogRe-pin

Coverage badge Deep: 757 of 879 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 12 added, 20 changed, 3 retired.

Re-pinned 0 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin rest:v1 + rest:v2 from be62256e to the vendor's current spec.

New upstream, not served yet 0 done, 3 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /api/v2/team/{team_id}/members
  • Open GET /api/v2/logs/archive_searches
  • Open GET /api/v2/metrics/list-tag-indexing-rule-exemptions

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • rest:v2 Removed GET /api/v2/spa/recommendations/{service}, GET /api/v2/spa/recommendations/{service}/{shard} and POST /api/v2/spa/recommendations-v2/{service} (tier 3, deferred, refuse; all x-unstable at the pin). Upstream dropped them from the document in DataDog/datadog-api-client-typescript c23b78eb (PR #5411, 2026-10-27). All three still route, probed 2026-10-28: 401 {"errors":["Unauthorized"]}, while a nonexistent path answers 404 {"errors":["Not found"]}.
  • rest:v2 Added writes are answered by the read-only refusal and are not rows:
  • rest:v2 Changed writes, no action:
  • rest:v2 Changed responses on refuse rows still answer the documented 404, no action: GET /api/v2/experiments/protocols/{protocol_id}, GET /api/v2/logs/config/metrics/{metric_id}, GET /api/v2/rum/applications/{id}.
  • rest:v2 Changed components reach only empty, refuse or generate rows. No green derive row reads them, and empty bodies do not change. Components: ObservabilityPipeline* (4), OrgConnectionTypeEnum, RUMApplication*Attributes (3), RUMBucketResponse, HistoricalJobResponseAttributes, CustomRuleAttributes, CustomRulesetRuleEmbedded, SecurityMonitoringStandardRuleQuery, SensitiveDataScannerStandardPatternAttributes, SensitiveDataScannerSuppressions, ExperimentsPublicProtocolResponseDataAttributes and Enforcement, plus AnalysisRequestDataAttributes and RoleUpdateAttributes, which are on write request bodies.
  • datadog-api-client-js: @datadog/datadog-api-client still resolves to the latest published 1.64.0 (check.md client-check).

Could not be checked

Sources the audit could not compare this week, and why.

  • capture-pending, captures and the 12 docs:* sources: Diff.md and check.md mark all 14 "Not diffable / NOT CHECKED".

DevinRe-pin

Coverage badge Deep: 120 of 122 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 59 added, 198 changed, 15 deprecated, 33 retired.

Re-pinned 0 done, 7 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin devin/rest from 00160cad to the vendor's current spec.
  • Open NOT a retirement, the five "Retirements still served" rows: live probes on 2026-10-17 show that api.devin.ai routes BEFORE it authenticates.
  • Open v3beta1 to v3 is a promotion, not a removal: the Devin release notes (https://docs.devin.ai/release-notes/overview, "Repositories and Blueprint APIs Promoted to V3") say "the repositories and snapshot-setup (blueprint/build) endpoints are now part of the stable v3 API at /v3/...
  • Open Deprecated with no removal date, still routing: GET /v3/enterprise/playbooks, GET /v3/organizations/{org_id}/playbooks (both green/empty), GET /v3/enterprise/playbooks/{playbook_id}, GET /v3/organizations/{org_id}/playbooks/{playbook_id} (deferred/refuse 404) and GET /v3/organizations/{org_id}/schedules, GET /v3/organizations/{org_id}/schedules/{schedule_id} (deferred/refuse 404) are now deprecated: true and all answer 403 live.
  • Open Covered rows whose shape moved: GET /v3/organizations/{org_id}/playbooks [parameters] adds the optional include_enterprise boolean, and the empty answer is still true because GET /v3/enterprise/playbooks is empty too.
  • Open Moved since 2026-10-17 (new this week, measured pinned 00160cad vs HEAD c535fbee): every one of the 198 Changed operations [responses] gains a documented 410 "Gone" response with a ProblemDetail body.

New upstream, not served yet 0 done, 11 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /v3/organizations/{org_id}/repositories, GET /v3/organizations/{org_id}/repositories/indexing, GET /v3/organizations/{org_id}/repositories/{repository_path}/indexing
  • Open GET /v3/enterprise/snapshot-setup/blueprints…
  • Open GET /v3/enterprise/organizations/{org_id}/code-scans/{scan_id}, GET /v3/organizations/{org_id}/code-scans/{scan_id}
  • Open GET /v3beta1/organizations/{org_id}/default-platform
  • Open GET /v3beta1/ai-gateway/metrics
  • Open 26 added write operations (8 DELETE, 1 PATCH, 11 POST, 6 PUT, all under the promoted /v3/.../repositories/indexing and /v3/.../snapshot-setup families plus .../code-scans/{scan_id}/{findings/remediate,scan-new-commits,effort} and PUT /v3beta1/organizations/{org_id}/default-platform), n/a, refuse (the gateway's read-only refusal already answers them
  • Open GET /v3beta1/enterprise/security-profiles, GET /v3beta1/organizations/{org_id}/security-profiles
  • Open GET /v3beta1/enterprise/security-profiles/{profile_id}, GET /v3beta1/organizations/{org_id}/security-profiles/{profile_id}
  • Open GET /v3beta1/enterprise/security-profile-settings, GET /v3beta1/organizations/{org_id}/security-profile-settings
  • Open GET /v3beta1/ai-gateway/models
  • Open 13 added security-profile write operations (POST/PATCH/DELETE on /v3beta1/{enterprise,organizations/{org_id}}/security-profiles… and PATCH .../security-profile-settings), n/a, refuse (the read-only refusal already answers them

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • devin/rest: 19 removed write operations under /v3beta1/.../repositories/indexing and /v3beta1/.../snapshot-setup (promoted to /v3, still routing) and 9 deprecated playbook/schedule write operations, none with a manifest row.
  • devin/rest, the five "Retirements still served" rows: Still routes, probed 2026-10-28T14:17Z: 403 "Unauthorized" problem+json on GET /v3/enterprise/playbooks, GET /v3/organizations/org-x/playbooks, GET /v3beta1/organizations/org-x/repositories, GET /v3beta1/organizations/org-x/repositories/indexing, GET /v3beta1/organizations/org-x/repositories/acme%2Frepo/indexing.
  • devin/rest, the 11 removed /v3beta1/.../snapshot-setup GETs (deferred/refuse): Still routes, probed 2026-10-28: 403 on all 11.

GitLabRe-pin

Coverage badge Deep: 751 of 755 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 132 added, 1673 changed, 1 deprecated, 6 retired.

Re-pinned 0 done, 10 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin gitlab/rest from ea02ef9f to the vendor's current spec.
  • Open COMMON CAUSE of the 1,674 Changed rows: GitLab changed the generator, not the API.
  • Open Consequence of the array re-typing, to check at conformance: 150 covered list rows (for example GET /api/v4/projects/{id}/merge_requests, GET /api/v4/groups, GET /api/v4/events) are now declared as arrays, which is what we already serve.
  • Open NuGet v2 path keys renamed, NOT a retirement: GET /api/v4/projects/{project_id}/packages/nuget/v2/FindPackagesById\(\) and GET /api/v4/projects/{project_id}/packages/nuget/v2/Packages\(\) (tier 3, deferred, derive) appear under Removed only because upstream stopped regex-escaping the parentheses.
  • Open Covered rows the common cause does NOT explain (36, all [parameters] unless noted):
  • Open Response components with real (non-generator) changes reaching covered rows:
  • Open NEW since 2026-10-17: four covered Duo workflow reads now declare a 200 body where the pin declares none (bare 200: OK).
  • Open NEW since 2026-10-17: GET /api/v4/projects/{id}/repository/files/{file_path}/blame (green t1) gains a 429 Too many requests response.
  • Open NEW since 2026-10-17: three more Changed components each gain one optional property and no required.

New upstream, not served yet 0 done, 18 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /api/v4/projects/{id}/repository/diff_stats, GET /api/v4/projects/{id}/repository/changed_paths
  • Open GET /api/v4/projects/{id}/releases/permalink/latest
  • Open GET /api/v4/pipelines
  • Open GET /api/v4/projects/{id}/jobs/{job_id}/artifacts/{artifact_path}, GET /api/v4/projects/{id}/jobs/artifacts/{ref_name}/raw/{artifact_path}
  • Open GET /api/v4/ai/duo_workflows/workflows/{id}/checkpoints/by_thread_ts
  • Open Npm family, 6 GETs: …/packages/npm/{package_name} and …/packages/npm/-/package/{package_name}/dist-tags, each at the project, group (/groups/{id}/-/) and instance (/api/v4/packages/npm/) scope, tier 3, derive (canon Package kind npm + PackageVersion, packages/canon/src/package-registry.ts:70).
  • Open Go proxy, 4 GETs (/api/v4/projects/{id}/packages/go/{module_name}/@v/list, ….info, ….mod, ….zip), tier 3, derive list/.info from kind golang versions.
  • Open PyPI, 4 GETs (amended from the 2026-10-17 "5 GETs" line, because GET /api/v4/projects/{id}/packages/pypi/forward/{package_name}/{upstream_path} is no longer in upstream's Added table): …/packages/pypi/simple/{package_name} (project + group), tier 3, derive (kind pypi, the same packagesForRepo() the green …/pypi/simple uses).
  • Open GET /api/v4/projects/{id}/packages/generic/{package_name}/{package_version}/{file_name}
  • Open NuGet, the 9 GETs besides the two renamed v2 feeds (…/nuget/v2/Packages(Id='{package_name}',Version='{package_version}'), …/nuget/metadata/{package_name}/index and /{package_version} (project + group), …/nuget/download/{package_name}/index and /{package_version}/{package_filename}, …/nuget/symbolfiles/… (project + group)), tier 3, refuse (GitLab's 404 for a package that does not exist
  • Open Registries canon has no kind for, 35 GETs: debian dists/… (18, project + group), maven {path}/{file_name} (3), composer (3, /api/v4/group/{id}/-/packages/composer/… + project archives), rpm (2), terraform modules (4), ml_models/{model_version_id}/files/… (2), dependency_proxy/packages/{maven,npm}/… (2), ml/mlflow/api/2.0/mlflow-artifacts/artifacts/… (1), tier 3, refuse (GitLab's own 404, the same ruling as the existing deferred/refuse conan, cargo and debian rows), S
  • Open GET /api/v4/groups/{id}/service_accounts/{user_id}, GET /api/v4/projects/{id}/service_accounts/{user_id}
  • Open GET /api/v4/projects/{id}/releases/{tag_name}/downloads/{direct_asset_path}
  • Open GET /api/v4/iam/userinfo, GET /api/v4/jobs/{id}/runtime_environment_key
  • Open Orbit, 4 GETs under /api/v4/orbit/ (tools, skills, skills/{name}, skills/{name}/{path}), tier 3, uncovered: GitLab Orbit (the knowledge-graph product) has no canon, M.
  • Open GET /api/v4/glql/schema
  • Open GET /api/v4/projects/{id}/feature_flags_settings, GET /api/v4/projects/{id}/ai_agent/sessions
  • Open 46 added write operations (6 DELETE, 1 PATCH, 22 POST, 17 PUT

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • gitlab/rest: GET /api/v4/internal/gitaly/object_pool_members (tier 3, deferred, refuse) is a false alarm.
  • gitlab/rest: The two "Retirements still served" rows are false alarms.
  • gitlab/rest: 3 removed writes with no manifest row, POST /api/v4/projects/{project_id}/product_analytics/request/{load,dry-run,meta}.
  • gitlab/rest: 1 deprecated write with no row, POST /api/v4/projects/{id}/merge_requests/{merge_request_iid}/cancel_merge_when_pipeline_succeeds.
  • gitlab/rest: 3 added /api/v4/internal/… GETs (gitlab_subscriptions/namespaces/{id}/projects, org_mover/maintenance_readiness, org_mover/maintenance_state).

Could not be checked

Sources the audit could not compare this week, and why.

  • gitlab/graphql: Not diffable.
  • gitlab/docs:project-webhooks: Not diffable.
  • gitlab/docs:group-webhooks: Not diffable, for the same reason.
  • gitlab/docs:linked-epics: Not diffable, for the same reason.

HubSpotRe-pin

Coverage badge Full: 32 of 32 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 2 changed.

Re-pinned 0 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin rest-companies from a7e78b8c to the vendor's current spec.

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • rest-schemas: Two write operations changed [responses] (POST /crm-object-schemas/v3/schemas, .../associations)

Could not be checked

Sources the audit could not compare this week, and why.

  • docs: No upstream url recorded for the docs-derived pages
  • captures: No url+sha256 and no source_repo+commit recorded in provider-pins.yaml (live api.hubapi.com captures of 2026-09-04, recorded as comments only)

JiraRe-pin

Coverage badge Deep: 326 of 328 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 14 added, 26 changed.

Re-pinned 0 done, 9 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin jira/rest:platform-v3 from 90d1546f to the vendor's current spec.
  • Open Upstream moved again after 2026-10-17: fetched 2026-10-28 14:30Z, 2,510,000 bytes, sha256 15ceb328…, info.version 1001.0.0-SNAPSHOT-12ca6ec5….
  • Open Common cause of the 24 Changed operations: Atlassian documented its request and entity-count limits.
  • Open Covered row whose change the common cause does not explain: GET /rest/api/3/label (tier 3, green/derive) [parameters] adds query ("Case-insensitive prefix used to filter labels before pagination") and scope (RECENT_PROJECTS/ALL_BROWSEABLE_PROJECTS
  • Open Covered row, not the common cause: GET /rest/api/3/search/jql (tier 1, green/derive) [parameters] adds includeArchivedProjects (default false)
  • Open Covered row, not the common cause: GET /rest/api/3/project/{projectIdOrKey} (tier 1, green/derive) [parameters] properties now says the response's properties object "is empty when this parameter is omitted"
  • Open Covered row, not the common cause: GET /rest/api/3/field/{fieldId}/context/defaultValue (tier 3, green/empty) [responses] adds a 400 for contexts whose defaults differ per issue type, and CustomFieldContextDefaultValue adds a longtext discriminator member.
  • Open Covered row, not the common cause: GET /rest/api/3/uiModifications (tier 3, deferred/refuse) [responses]: the 200 example's total changed from 3 to 5.

New upstream, not served yet 0 done, 5 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open All 6 added read operations route on a live Jira Cloud site: probed anonymously on 2026-10-28 14:30Z at https://ecosystem.atlassian.net, each returned 401 "Client must be authenticated to access this resource.", and a control path returned the routing-miss 404 "No endpoint GET …".
  • Open GET /rest/api/3/invalid-jqls-access-log
  • Open GET /rest/api/3/issue/limit/adf/report
  • Open GET /rest/api/3/policies, GET /rest/api/3/policies/project/{projectIdOrKey}, GET /rest/api/3/policies/project/{projectIdOrKey}/rules
  • Open POST /rest/api/3/forge/panel/action/bulk/status

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • 8 added write operations (POST /rest/api/3/agents/bulk/invoke/{batch,uniform}, POST /rest/api/3/policies/project/{projectIdOrKey}/validate, POST /rest/api/3/policies/{policyId}/{apply,remove}, PUT /rest/api/3/policies/project/{projectIdOrKey}/policies, POST /rest/api/3/workflows/copy, PUT /rest/api/3/field/{fieldId}/context/defaultValues), n/a, refuse (the gateway's read-only refusal already answers them
  • Changed write operations with no row: Their effects are covered by the Bump lines above.
  • jira/rest:software: Upstream bytes match the pinned sha256 (check.md), and diff.md says "No change"

LinearRe-pin

Coverage badge Full: 17 of 17 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 471 added, 20 changed, 7 deprecated, 6 retired.

Re-pinned 0 done, 6 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin linear/graphql from 7ef4c502 to the vendor's current spec.
  • Open Bump the client in the SAME PR: @linear/sdk 91.0.0 to 99.0.0 (versions:client-check
  • Open User.supportsAgentSessions. Changed upstream.
  • Open ProjectFilter.id, ProjectCollectionFilter.id, NullableProjectFilter.id, InitiativeFilter.id, InitiativeCollectionFilter.id, NullableInitiativeFilter.id. Changed upstream.
  • Open IntegrationService.datadog, IntegrationService.origin. Changed upstream.

New upstream, not served yet 0 done, 5 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open New fields on served types that are outside every SDK fragment (12, all [Internal]/[ALPHA] or new-loop surface): Issue.aiAnalysis, Organization.loops, Organization.teamSecuritySettings, Project.leadTeamId, ProjectStatus.inheritedFrom/team/teamId, Team.agentAutomationEnabled/codingAgentEnabled/inheritProjectStatuses/loops, DocumentContent.meeting, tier 3, none.
  • Open 9 more new fields on subset types, all outside every SDK 99 fragment, appeared since 2026-10-17, tier 3, none:
  • Open ProjectFilter.customIdentifier, ProjectFilter.leadTeam
  • Open 14 new Query.* roots (inboxNotifications, quotas, templateSearch, usageAlert, usageAlerts, userViewPreferences, dependencyPackageMetadata, and 7 [Internal] ones: agentSessionSshAddress, auditLogWebhookFailureEvents, integrationJiraProjectStatuses, originInstallUrl, originInstallation, originPendingInstallations, partnerProgramPartners), tier 3, uncovered.
  • Open 2 more new Query.* roots since 2026-10-17: integrationSyncResourceIds ([INTERNAL], Jira project IDs) and oauthApplicationCodingSessionTrustedSource (the calling OAuth app's status), tier 3, uncovered.

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • linear/graphql: None of the 6 removed entries is served.
  • linear/graphql: None of the 7 deprecated entries is served, and the set is unchanged since 2026-10-17.
  • linear/graphql: 7 Changed Mutation.* rows [parameters]: the 6 from 2026-10-17 plus userExternalUserDisconnect, which gained an optional Jira integration argument.
  • linear/graphql: 16 new Mutation.* fields are writes.
  • linear/graphql: 122 new types/enums and 282 new fields/enum values on 135 types outside our subset.

OpenAIRe-pin

Coverage badge Full: 122 of 122 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 89 added, 270 changed, 2 deprecated, 1 retired.

Re-pinned 0 done, 12 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin openai/rest from 2186421d to the vendor's current spec.
  • Open client: bump npm openai with this re-pin (versions:client-check).
  • Open The common cause of most of the 270 Changed rows: every operation now documents 400/403/404/429 error responses.
  • Open GET /organization/costs. Changed upstream.
  • Open GET /organization/usage/completions. Changed upstream.
  • Open GET /organization/usage/completions. Changed upstream.
  • Open GET /organization/usage/web_search_calls. Changed upstream.
  • Open The other 8 green usage rows (audio_speeches, audio_transcriptions, code_interpreter_sessions, embeddings, file_search_calls, images, moderations, vector_stores) [responses]: these change only because the shared UsageTimeBucket.results oneOf includes the two widened result schemas.
  • Open GET /organization/audit_logs. Changed upstream.
  • Open GET /organization/projects, GET /organization/projects/{project_id}. Changed upstream.
  • Open GET /organization/admin_api_keys. Changed upstream.

New upstream, not served yet 0 done, 9 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /organization/usage/decisions
  • Open GET /organization/external_storage, GET /organization/external_storage/{external_storage_id}
  • Open GET /organization/external_keys, GET /organization/external_keys/{external_key_id}
  • Open GET /agents…
  • Open GET /vaults, GET /vaults/{vault_id}, GET /vaults/{vault_id}/credentials, GET /vaults/{vault_id}/credentials/{credential_id}
  • Open GET /webhook_endpoints, GET /webhook_endpoints/{webhook_endpoint_id}, GET /webhook_event_types
  • Open GET /safety/alerts/{id}, GET /safety/cases/{id}
  • Open GET /live/sessions/{session_id}/content
  • Open 36 added write operations (13 under /agents, 6 /live/sessions…, 6 /vaults…, 5 /webhook_endpoints…, 3 /organization/external_storage…, plus POST /decisions, POST /evals/{eval_id}/runs/{run_id}/cancel and POST /organization/projects/{project_id}/api_keys/{api_key_id}), n/a, refuse (the gateway's read-only refusal already answers them

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • openai/rest: The removed POST /evals/{eval_id}/runs/{run_id} is a spec reorganisation, not a retirement.
  • openai/rest: The deprecated POST /images/variations IS retired upstream.
  • openai/rest: The deprecated POST /audio/translations (new since 2026-10-17, upstream ff80a233) is a scheduled sunset, not a retirement.
  • openai/rest: The Added operations new since 2026-10-17 that are not admin or usage reads are outside the served surface: the 4 /agents/automations reads (/agents/automations, /{automation_id}, /{automation_id}/invocations, /invocations/{invocation_id}
  • openai/rest: 153 Changed operations are writes with no manifest row (mostly the same documented-error-response addition).

PagerDutyRe-pin

Coverage badge Full: 211 of 211 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 8 added, 27 changed.

Re-pinned 0 done, 3 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin rest from b2e80f8b to the vendor's current spec.
  • Open Re-pin also moves eight green status-page rows (new since 2026-10-17, upstream builds 2026-10-20 to 2026-10-21): GET /status_pages, /status_pages/{id}/impacts, /posts, /posts/{post_id}/post_updates, /services, /severities, /statuses, /subscriptions.

New upstream, not served yet 0 done, 5 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /incidents/{id}/scribe_transcripts
  • Open GET /incidents/reviews
  • Open GET /incidents/{id}/review
  • Open GET /incidents/reviews/action_items
  • Open GET /incidents/{id}/review/action_items

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • rest: Write operations changed in [requestBody]/[parameters] (custom_shifts, overrides, events updates
  • rest: Four new write operations (POST /incidents/{id}/review, PUT /incidents/{id}/review, POST /incidents/{id}/review/markers), and the status-page write requestBodies changed (POST .../post_updates, PUT .../post_updates/{post_update_id}, POST .../subscriptions).
  • rest: FeatureEnablement, OrchestrationGlobal, OrchestrationRouter, OrchestrationWarningIneligible and CreateEventRequest changed only in descriptions and examples (for example, the "Signal Intelligence" branding note on FeatureEnablement.feature).
  • rest: No operation removed or newly deprecated between pinned and HEAD (removed [], newly deprecated []), so there is no retirement.

Could not be checked

Sources the audit could not compare this week, and why.

  • docs: No upstream url recorded for the docs-derived pages
  • captures: No url+sha256 and no source_repo+commit recorded in provider-pins.yaml (unauthenticated live captures from 2026-09-01
  • captures-file: No url+sha256 and no source_repo+commit recorded in provider-pins.yaml (abilities.json, captured 2026-09-02 with the public docs token

PrometheusRe-pin

Coverage badge Deep: 38 of 40 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 4 added, 5 changed.

Re-pinned 0 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin rest from 406b517e to the vendor's current spec.

New upstream, not served yet 0 done, 1 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /query_cost, GET /query_range_cost

SentryRe-pin

Coverage badge Full: 95 of 95 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 125 added, 114 changed, 2 deprecated, 27 retired.

Re-pinned 0 done, 4 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin rest from 9c036700 to the vendor's current spec.
  • Open Spec reorganisations that still route live (all 401 JSON on 2026-10-17), served unchanged
  • Open GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/issues/. Changed upstream.

New upstream, not served yet 0 done, 16 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /api/0/organizations/{organization_id_or_slug}/issues/
  • Open GET /api/0/organizations/{organization_id_or_slug}/issues/{issue_id}/events/{event_id}/
  • Open GET /api/0/organizations/{organization_id_or_slug}/shortids/{issue_id}/, GET /api/0/organizations/{organization_id_or_slug}/scim/v2/Groups/{team_id_or_slug}
  • Open GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/releases/, environments/{environment}/
  • Open GET /api/0/organizations/{organization_id_or_slug}/tags/
  • Open GET /api/0/organizations/{organization_id_or_slug}/scim/v2/
  • Open GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/
  • Open GET /api/0/organizations/{organization_id_or_slug}/workflows/, workflows/{workflow_id}/, detectors/, detectors/{detector_id}/
  • Open Integrations family under organizations/{o}/integrations/{integration_id}/ (4: detail, channels/, channel-validate/, repos/), organizations/{o}/config/integrations/, organizations/{o}/issues/{issue_id}/ integrations/, integrations/{integration_id}/, external-issues/, sentry-apps/{sentry_app_id_or_slug}/, organizations/{o}/sentry-apps/, organizations/{o}/sentry-app-components/, sentry-app-installations/{uuid}/external-requests/, organizations/{o}/forwarding/ (13), tier 3, empty for lists / refuse (DRF 404 {"detail": …}) for ids, matching the served-empty organizations/{o}/integrations/ and sentry-app-installations/, S
  • Open GET /api/0/organizations/{organization_id_or_slug}/trace/{trace_id}/, trace-meta/{trace_id}/
  • Open Telemetry families: organizations/{o}/trace-items/ attributes, metrics, stats, events-timeseries/, events-dropped/, profiling/ chunks, flamegraph, projects/{o}/{p}/profiling/profiles/{profile_id}/, projects/{o}/{p}/events/{event_id}/attachments/ and attachments/{attachment_id}/ (10), tier 2/3, uncovered: profiles, attachments and outcome stats
  • Open GET /api/0/organizations/{organization_id_or_slug}/project-keys/
  • Open Product families: organizations/{o}/agents/conversations/ (2), flags/logs/ (2), group-search-views/, issues/{issue_id}/autofix/, seer/models/, preprodartifacts/ (5) and projects/{o}/{p}/preprod… (3), projects/{o}/{p}/replays/jobs/delete/ (2), custom-inbound-filters/ (2), filters/ (20), tier 3, empty for lists where no such act happened (replay deletion jobs, saved issue views, flag logs
  • Open GET /api/0/organizations/{organization_id_or_slug}/code-mappings/, codeowners-associations/, GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/stacktrace-link/
  • Open GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/code-mapping-prefixes/stack/
  • Open GET /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/releases/completion/

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • docs:auth: Heading now "API Authentication | Sentry Docs" and one added paragraph linking a Token and Credential Formats page
  • docs:pagination: Title gains " | Sentry Docs"
  • docs:ratelimits: Title gains " | Sentry Docs"
  • rest: HEAD drops six organization-less GETs in favour of organizations/{o}/issues/{issue_id}/…: GET /api/0/issues/{issue_id}/, events/, events/{event_id}/, hashes/, tags/{key}/ and tags/{key}/values/.
  • rest: Five organization-scoped issue GETs that HEAD lists as Added are already served green (detail, events/, hashes/, tags/{key}/, tags/{key}/values/).
  • rest: scim/v2/Groups/{team_id}, shortids/{short_id}/, GET /api/0/projects/, teams/{o}/{t}/stats/ and the deprecated projects/{o}/{p}/issues/ still route, probed 2026-10-28: 401 application/json.
  • rest: The five removed alert GETs (projects/{o}/{p}/rules/, rules/{rule_id}/, organizations/{o}/alert-rules/, alert-rules/{alert_rule_id}/, …/activations/) are already retired with RETIREMENTS entries (#650).
  • rest: 12 removed write operations, 51 added and 46 changed write operations, and the deprecated POST …/user-feedback/ have no manifest row

Could not be checked

Sources the audit could not compare this week, and why.

  • captures: No url+sha256 and no source_repo+commit in provider-pins.yaml (live curl transcripts in a comment block), so neither versions:check nor specs:diff can compare it.

Microsoft TeamsRe-pin

Coverage badge Full: 13 of 13 read surfaces with a final answer when the audit ran.

Re-pinned 0 done, 2 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin rest from b4b9da45 to the vendor's current spec.

ZendeskRe-pin

Coverage badge Deep: 347 of 350 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 9 added, 29 changed.

Re-pinned 0 done, 6 open

The vendor's published spec moved, so we re-pin to the new one and re-run conformance against it.

  • Open Kept the outgoing spec, so hosts pinned before the re-pin keep serving it.
  • Open Re-pin zendesk/rest from 2988cdce to the vendor's current spec.
  • Open GET /api/v2/requests, GET /api/v2/users/{user_id}/requests. Changed upstream.
  • Open GET /api/v2/tickets/{ticket_id}/comments. Changed upstream.
  • Open GET /api/v2/ticket_fields. Changed upstream.
  • Open GET /api/v2/incremental/ticket_metric_events. Changed upstream.

New upstream, not served yet 0 done, 4 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open GET /api/v2/approval_clarification_flow_messages/{approval_request_id}
  • Open GET /api/v2/approval_workflow_instances/{workflow_instance_id}/approval_requests/{id}
  • Open GET /api/v2/custom_objects/{custom_object_key}/records/show_by_unique_identifier
  • Open 6 added write operations (POST /api/v2/oauth/tokens/delete_many, POST /api/v2/tickets/{ticket_id}/task_items/{task_item_id}/subticket, POST …/task_links, DELETE …/task_links/{task_object_link_id}, PUT /api/v2/channels/whatsapp_templates/toggle_many, PUT /api/v2/channels/whatsapp_templates/{template_id}/toggle), n/a, refuse (the gateway's read-only refusal already answers them, and no zendesk row is mode: scratch).

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • zendesk/rest writes, 6 added and 28 changed, all answered by the gateway's read-only refusal (no zendesk row is mode: scratch). The added writes are PATCH …/approval_requests/{id}/decision, PATCH /api/v2/approval_workflow_instances/{workflow_instance_id}/withdraw, PATCH/PUT …/records/update_by_unique_identifier, POST /api/v2/approval_clarification_flow_messages and POST /api/v2/brand_agents. The changed writes are the custom_objects, dynamic_content, organization_fields, user_fields, slas/policies, accounts, account/settings, satisfaction_rating, ITAM asset and triggers/reorder bodies. Two are worth noting: PUT /api/v2/triggers/reorder now documents an empty 200 body, and POST …/custom_objects/{custom_object_key}/jobs adds a 400 InvalidUniqueFieldKey.

BitbucketNew endpoints

Coverage badge Deep: 182 of 184 read surfaces with a final answer when the audit ran.

Operations in the vendor's spec this week: 1 added.

New upstream, not served yet 0 done, 1 open

Read endpoints the vendor added. Until one is built, calling it returns a coverage error, never invented data.

  • Open POST /workspaces/{workspace}/codesearch

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • rest: Upstream bytes moved (x-revision 2f04cc642ea9 to HEAD) with one added operation and no covered row changed in parameters, responses or components

Azure DevOpsNot checked

Coverage badge Deep: 227 of 232 read surfaces with a final answer when the audit ran.

Could not be checked

Sources the audit could not compare this week, and why.

  • rest:build, rest:core, rest:git, rest:graph, rest:ims, rest:pipelines, rest:wit, rest:work: The pinned upstream MicrosoftDocs/vsts-rest-api-specs still answers HTTP 404 on api.github.com as of 2026-10-28 (pinned commit 37856418, retrieved 2026-08-03

AnthropicNot checked

Coverage badge Full: 13 of 13 read surfaces with a final answer when the audit ran.

Could not be checked

Sources the audit could not compare this week, and why.

  • rest: The hand-authored OpenAPI is docs-derived with no upstream url or sha256 pinned, so drift is invisible to both versions:check and specs:diff

Codex AnalyticsNot checked

Coverage badge Full: 3 of 3 read surfaces with a final answer when the audit ran.

Could not be checked

Sources the audit could not compare this week, and why.

  • rest: Docs-derived, no upstream url or sha256 pinned

SalesforceNot checked

Coverage badge Partial: 24 of 50 read surfaces with a final answer when the audit ran.

Could not be checked

Sources the audit could not compare this week, and why.

  • rest: Docs-derived, no upstream url or sha256 pinned (and the capture that would make this Deep is still founder-gated)
  • docs: No upstream url recorded

StatuspageNot checked

Coverage badge Deep: 37 of 38 read surfaces with a final answer when the audit ran.

Could not be checked

Sources the audit could not compare this week, and why.

  • rest: The page served digest 3bcda923 on 2026-10-28, not the pinned c83fab9e (re-pinned 2026-10-26, #684).

SlackDocs only

Coverage badge Full: 17 of 17 read surfaces with a final answer when the audit ran.

Docs changes only

The vendor edited its docs. No endpoint we serve changed.

  • docs:conversations.history (+3/-7), docs:conversations.replies (+0/-8), docs:bookmarks.list (+0/-4), docs:chat.postMessage (+5/-1), docs:rate-limits (+1/-7), docs:users.list (+1/-1): Prose edits by line count, specs:diff records no heading change
  • client @slack/web-api: Npm has 8.2.0, pinned 7.19.0 (carried from 2026-10-17)
  • rest: Hand-authored from the docs pages above, which are the checked upstream

No change: Grafana.

03 / More

Other weeks, and what is served today.

Every report is on the API drift index. What each replica serves right now is on the coverage page, and every endpoint row is on its provider's page.