Skip to main content
There are two tiers of API. They have different stability promises.

​
Public contracts

The endpoints in openapi.yaml. These are what the SDK, the middleware and the enforcement adapters depend on. They don’t change without a deprecation window. If a public contract has to change, the old shape stays working through the window, then is removed.

​
Per-service APIs

Each service’s runtime /openapi.json. These are administrative and internal. They can change more freely. Don’t build against them expecting the public-contract promise.

​
How removal works

When a path is retired, calling it returns 410 Gone with a machine-readable code. After the window, it’s removed.

​
Retired today

Native agent credentials. Agents no longer hold an api_key_id + secret pair. These paths return 410 Gone with code: agent_native_credentials_retired, before any credential is read: Credential verification. Every /api/v1/verify/* path returns 410 Gone with the same code. Validate the access token at your protected resource instead. The older /api/v1/verify/signature and /api/v1/verify/request paths date from the original Ed25519 request-signing flow, which no longer exists.

​
Migrations

When a change needs work on your side, we publish a migration guide and notify affected integrators ahead of the deprecation window. For the credential change, follow the agent quickstart.