Skip to main content
There are two tiers of API. They have different stability promises.

​
Public contracts

The endpoints in openapi.yaml. These are what the SDK and the middleware depend on. They don’t change without a deprecation window. If a public contract has to change, the old shape stays working through the window, then is removed.

​
Per-service APIs

Each service’s runtime /openapi.json. These are administrative and internal. They can change more freely. Don’t build against them expecting the public-contract promise.

​
How removal works

When a path is deprecated, calling it returns 410 Gone for the length of the deprecation window. After the window, it’s removed. You’ve already seen this. The legacy /api/v1/verify/signature and /api/v1/verify/request paths return 410 Gone today. They date from the old Ed25519 signature flow. They’ll be removed once the window closes.

​
Migrations

When a change needs work on your side, we publish a migration guide and notify affected integrators ahead of the deprecation window.