chore(api): sync OpenAPI contract - #51
Draft
kong[bot] wants to merge 1 commit into
Draft
Conversation
|
|
kong
Bot
force-pushed
the
chore/sync-openapi
branch
10 times, most recently
from
July 20, 2026 13:54
04d66d1 to
b8d922a
Compare
kong
Bot
force-pushed
the
chore/sync-openapi
branch
10 times, most recently
from
July 27, 2026 22:41
ee0bdba to
eb217d3
Compare
kong
Bot
force-pushed
the
chore/sync-openapi
branch
8 times, most recently
from
July 30, 2026 15:23
259824a to
bc4afe5
Compare
kong
Bot
force-pushed
the
chore/sync-openapi
branch
from
July 31, 2026 00:52
bc4afe5 to
7b3fd89
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
API change report
Public API
New Endpoints: 15
POST /auth/oauth/exchange
GET /auth/password-policy
GET /github/callback
GET /projects/{id}/auth/insights
GET /projects/{id}/deployments/summary
DELETE /projects/{id}/git-connection
GET /projects/{id}/git-connection
PUT /projects/{id}/git-connection
GET /projects/{id}/git-deploy-settings
PUT /projects/{id}/git-deploy-settings
POST /user/git/connect
GET /user/git/connections
DELETE /user/git/connections/{connectionId}
GET /user/git/connections/{connectionId}/installations
GET /user/git/connections/{connectionId}/installations/{installationId}/repositories
Deleted Endpoints: None
Modified Endpoints: 116
POST /auth/device/token
request uses eligible HttpOnly cookie session storage.
'
POST /auth/device/verify
POST /auth/forgot-password
POST /auth/logout
Send
refresh_tokenfor the default flow. An eligible cookie-modebrowser request may instead send
session_mode: cookiewith an emptytoken; logout remains idempotent when the cookie is missing or expired.
'
GET /auth/oauth/providers
GET /auth/oauth/{provider}/authorize
tokens are appended to this URL's fragment on success. If the URL
carries a
vh_statequery parameter (the client SDK's one-timenonce), it is moved into the fragment as
stateso the SDK can bindthe returned session to the flow it initiated (login-CSRF defense).
' to 'URL to redirect to after the OAuth flow (optional). Must exactly
match an entry in the project's
allowed_redirect_urls, includingits query string, or be the project's own managed hosted-auth page
URL.
'
redirect_urlisnot registered in
allowed_redirect_urls'
POST /auth/oauth/{provider}/call-api
GET /auth/oauth/{provider}/callback
request uses eligible HttpOnly cookie session storage.
'
request uses eligible HttpOnly cookie session storage.
'
POST /auth/oauth/{provider}/link
POST /auth/oauth/{provider}/refresh-token
GET /auth/oauth/{provider}/token
DELETE /auth/oauth/{provider}/unlink
POST /auth/platform/exchange
POST /auth/refresh
Send
refresh_tokenin the body for the default flow. An eligiblecookie-mode browser request may instead send
session_mode: cookiewith an empty token or omit the request body; the API reads and resets
the project's HttpOnly cookie and omits
refresh_tokenfrom theresponse.
'
request uses eligible HttpOnly cookie session storage.
'
POST /auth/resend-confirmation
POST /auth/reset-password
policy returned by GET /auth/password-policy.
'
POST /auth/signin
Set
session_modetocookieto request HttpOnly refresh-tokenstorage. Cookie mode is honored only for an exact, credentialed CORS
origin on the same schemeful site as this API. Otherwise the response
retains the refresh token in its body.
'
request uses eligible HttpOnly cookie session storage.
'
POST /auth/signup
policy returned by GET /auth/password-policy.
'
POST /auth/signup-anonymous
request uses eligible HttpOnly cookie session storage.
'
GET /auth/user
PUT /auth/user
policy returned by GET /auth/password-policy.
'
Omitted keys remain unchanged; set a key to null to remove it.
Merging is shallow; nested objects replace the stored value for that top-level key.
'
DELETE /auth/user/cancel-email-change
POST /auth/user/change-email
POST /auth/user/confirm-email-change
POST /auth/user/convert-anonymous
policy returned by GET /auth/password-policy.
'
GET /auth/user/identities
DELETE /auth/user/identities/{identityId}
GET /auth/user/methods
POST /auth/user/methods/{methodId}/promote
DELETE /auth/user/sessions
GET /auth/user/sessions
DELETE /auth/user/sessions/{sessionId}
POST /databases/{databaseName}/query/delete
POST /databases/{databaseName}/query/insert
POST /databases/{databaseName}/query/ping
POST /databases/{databaseName}/query/select
POST /databases/{databaseName}/query/update
GET /functions/resolve
POST /functions/{functionId}/invoke
GET /projects
default so the request validator does not inject one: handlers that omit
pagesee it unset (nil) and default to 1 in code, while cursor-firstendpoints (e.g. the project deployments feed) can detect its absence to
stay in keyset/search mode. Supplying
pageselects offset pagination.'
POST /projects
DELETE /projects/{id}
GET /projects/{id}
PATCH /projects/{id}
GET /projects/{id}/anon-keys
pageand
limitand is the default when neithercursornorsearchissupplied (first page, default
limit). Cursor mode usescursorandlimit, supportssearch(case-insensitive name match), and returnsnext_cursor. Sending bothpageandcursor(orpageandsearch)returns 400.
'
DELETE /projects/{id}/anon-keys/{keyId}
POST /projects/{id}/anon-keys/{keyId}/set-default
GET /projects/{id}/auth/config
PUT /projects/{id}/auth/config
GET /projects/{id}/auth/users
default so the request validator does not inject one: handlers that omit
pagesee it unset (nil) and default to 1 in code, while cursor-firstendpoints (e.g. the project deployments feed) can detect its absence to
stay in keyset/search mode. Supplying
pageselects offset pagination.'
POST /projects/{id}/auth/users/{userId}/ban
POST /projects/{id}/auth/users/{userId}/unban
GET /projects/{id}/config
PUT /projects/{id}/config
GET /projects/{id}/databases
pageand
limit. Cursor mode usescursorandlimit, supportssearch(case-insensitive name match), and returns
next_cursor/prev_cursor.The optional
statusfilter applies in both modes and is bound to thecursor. Sending both
pageandcursor(orpageandsearch) returns 400.'
default so the request validator does not inject one: handlers that omit
pagesee it unset (nil) and default to 1 in code, while cursor-firstendpoints (e.g. the project deployments feed) can detect its absence to
stay in keyset/search mode. Supplying
pageselects offset pagination.'
POST /projects/{id}/databases
GET /projects/{id}/databases/{databaseName}
GET /projects/{id}/databases/{databaseName}/queries
Report truncated; see the source commit for the complete contract diff.
Validation