chore(api): sync OpenAPI contract by kong[bot] · Pull Request #51 · Kong/volcano-cli

kong · 2026-07-13T20:39:20Z

Summary

Sync the vendored OpenAPI contract from Kong/volcano-hosting@08d3b7a3c17d.
Regenerate checked-in client or contract types with this repository's pinned tooling.

API change report

Public API

New Endpoints: 42

POST /durable-functions/{functionId}/executions
POST /mcp
GET /openapi.json
HEAD /openapi.json
GET /openapi.yaml
HEAD /openapi.yaml
GET /projects/{id}/auth/pages/appearance
DELETE /projects/{id}/auth/pages/theme
PUT /projects/{id}/auth/pages/theme
DELETE /projects/{id}/auth/pages/{pageType}/layout
PUT /projects/{id}/auth/pages/{pageType}/layout
GET /projects/{id}/auth/pages/{pageType}/preview
POST /projects/{id}/auth/pages/{pageType}/preview
PUT /projects/{id}/frontend-shared-variables
GET /projects/{id}/frontends/{frontendId}/function-routes
POST /projects/{id}/frontends/{frontendId}/function-routes
DELETE /projects/{id}/frontends/{frontendId}/function-routes/{routeId}
PUT /projects/{id}/frontends/{frontendId}/function-routes/{routeId}
POST /projects/{id}/sandbox-executions
GET /projects/{id}/sandbox-sessions
POST /projects/{id}/sandbox-sessions
GET /projects/{id}/sandboxes
POST /projects/{id}/sandboxes
DELETE /projects/{id}/sandboxes/{sandboxId}
GET /projects/{id}/sandboxes/{sandboxId}
PATCH /projects/{id}/sandboxes/{sandboxId}
GET /projects/{id}/sandboxes/{sandboxId}/deployments
PUT /projects/{id}/shared-variables
DELETE /projects/{id}/source-export
GET /projects/{id}/source-export
POST /projects/{id}/source-export
DELETE /sandbox-sessions/{sessionId}
GET /sandbox-sessions/{sessionId}
POST /sandbox-sessions/{sessionId}/access
POST /sandbox-sessions/{sessionId}/exec
POST /sandbox-sessions/{sessionId}/files/read
POST /sandbox-sessions/{sessionId}/files/write
DELETE /sandbox-sessions/{sessionId}/grants/{subjectId}
PUT /sandbox-sessions/{sessionId}/grants/{subjectId}
POST /sandbox-sessions/{sessionId}/resume
POST /sandbox-sessions/{sessionId}/suspend
GET /sandboxes/presets

Deleted Endpoints: 1

POST /projects/{id}/git-connection/repository

Modified Endpoints: 169

POST /auth/oauth/{provider}/call-api

Description changed from 'Make an authenticated request to an OAuth provider's API on behalf of the user.
The user's stored access token is automatically used and refreshed if needed.

The request is always sent to the provider's fixed API base URL joined with
the caller-supplied endpoint. endpoint must be a relative path beginning
with / (optionally with a query string); it cannot change the target host.
Absolute URLs, protocol-relative //host values, or userinfo (@host) are
rejected with 400 so the request can never be redirected to another host.

Examples of endpoint:

Google userinfo: /oauth2/v1/userinfo
GitHub repositories: /user/repos
Microsoft Graph profile: /me

The response is the raw JSON response from the provider's API.
' to 'Make an authenticated request to an OAuth provider's API on behalf of the user.
The user's stored access token is automatically used and refreshed if needed.

The request is always sent to the provider's fixed API base URL joined with
the caller-supplied endpoint. endpoint must be a relative path beginning
with / (optionally with a query string); it cannot change the target host.
Absolute URLs, protocol-relative //host values, or userinfo (@host) are
rejected with 400 so the request can never be redirected to another host.

Examples of endpoint:

Google userinfo: /oauth2/v1/userinfo
GitHub repositories: /user/repos
Microsoft Graph profile: /me

The response wraps the provider's raw JSON value with request metadata.
An empty provider body is represented as data: null; the envelope
preserves the provider's HTTP status in status_code, including errors.
Provider response bodies are limited to 8 MiB after decompression.
Transport failures, invalid JSON (including invalid UTF-8), and oversized
bodies return 502. Provider redirects to another origin are blocked and
return 400.
'

Responses changed
- New response: 404
- New response: 500
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Description changed from 'Raw response from the OAuth provider's API' to 'OAuth provider API response envelope'
        
        AdditionalProperties changed from true to null
        
        Required changed
        
        New required property: data
        
        New required property: endpoint
        
        New required property: provider
        
        New required property: status_code
        
        Properties changed
        
        New property: data
        
        New property: endpoint
        
        New property: provider
        
        New property: status_code
- Modified response: 400
  - Description changed from 'Invalid request (for example: missing endpoint, an endpoint that is
    not a relative path, or an unsupported HTTP method).
    ' to 'Invalid request (for example: missing endpoint, an endpoint that is
    not a relative path, or an unsupported HTTP method), or a provider
    redirect to another origin.
    '
- Modified response: 401
  - Description changed from 'Not authenticated or provider not linked' to 'Not authenticated'
- Modified response: 502
  - Description changed from 'Provider API error' to 'Provider transport failure, invalid JSON, or response body larger than 8 MiB'

POST /auth/signin

Description changed from 'Authenticate with email and password. Requires an anon key.

Set session_mode to cookie to request HttpOnly refresh-token
storage. Cookie mode is honored only for an exact, credentialed CORS
origin on the same schemeful site as this API. Otherwise the response
retains the refresh token in its body.
' to 'Authenticate with email and password. Requires an anon key.

Set session_mode to cookie to request HttpOnly refresh-token
storage. Cookie mode is honored only for an exact, credentialed CORS
origin on the same schemeful site as this API. Otherwise the response
retains the refresh token in its body. A frontend on its default
Volcano URL is cross-site with this API and so always gets the body
token.
'

GET /databases/regions

Description changed from 'Returns the regions enabled for database provisioning in this platform environment.
This is a public endpoint that doesn't require authentication.
' to 'Returns the regions enabled for database provisioning in this platform environment.
These are the same regions offered for function deployment, and the only values
the region field of a database accepts.
This is a public endpoint that doesn't require authentication.
'
Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Items changed
        
        Properties changed
        
        Modified property: name
        
        Description changed from 'Human-readable region name' to 'Human-readable region location'
        
        Example changed from 'AWS US East 1 (N. Virginia)' to 'US East (N. Virginia)'

POST /databases/{databaseName}/branches/{branchName}/query/delete

Responses changed
- New response: 503
- Modified response: 200
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/branches/{branchName}/query/insert

Responses changed
- New response: 503
- Modified response: 200
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/branches/{branchName}/query/ping

Responses changed
- New response: 503
- Modified response: 200
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/branches/{branchName}/query/select

Responses changed
- New response: 503
- Modified response: 200
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/branches/{branchName}/query/update

Responses changed
- New response: 503
- Modified response: 200
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/query/delete

Responses changed
- Modified response: 200
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/query/insert

Responses changed
- Modified response: 200
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/query/ping

Responses changed
- Modified response: 200
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/query/select

Responses changed
- Modified response: 200
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/query/update

Responses changed
- Modified response: 200
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

GET /deployments

Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        Modified property: data
        
        Items changed
        
        Properties changed
        
        Modified property: resource
        Properties changed
        New property: kind

GET /functions/resolve

Description changed from 'Resolves a DNS-safe function name to its function ID within the caller's project.

SDKs use this endpoint internally to invoke by function name while routing by function ID.

With Service Key:

Allowed

With Auth User Token:

Allowed

With Anon Key:

Requires anon key permission: functions.invoke
Function must have is_public: true
' to 'Resolves a DNS-safe function name to its function ID and invocation URL within the caller's project.

SDKs use this endpoint internally to invoke by function name while routing by function ID.
Invoke the returned invoke_url as-is. It does not share a domain with the API, so a host
built from the API URL will not reach the function. When the deployment serves no public
invocation domain, as in local development, invoke_url is omitted and callers invoke
through POST /functions/{functionId}/invoke.

With Service Key:

Allowed

With Auth User Token:

Allowed

With Anon Key:

Requires anon key permission: functions.invoke
Function must have is_public: true
'
Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        New property: invoke_url
- Modified response: 404
  - Description changed from 'Function not found (or private function with anon key)' to 'Function not found (or private function with anon key). A durable
    function is never resolvable here: it is started through
    POST /durable-functions/{functionId}/executions, not invoked.
    '

POST /functions/{functionId}/invoke

Description changed from 'Invoke a serverless function.

With Service Key (admin/background operations):

Use for background jobs, webhooks, cron, admin operations
Function receives payload only (no user context)
Database queries bypass RLS (admin access)

With Auth User Token (user-facing):

Use for user-initiated actions

Function receives payload + __volcano_auth context:

{
  user_id: "uuid",
  email: "user@example.com",
  project_id: "uuid",
  role: "authenticated" or "anonymous"
}

Database queries enforce RLS (user-scoped data)

With Anon Key (public function only):

Requires anon key permission: functions.invoke
Function must have is_public: true
Function receives payload only (no __volcano_auth)

Transport and CORS:

Direct invocation endpoint is intended for http://api.<domain>/functions/{functionId}/invoke
DNS invocation endpoint is https://{functionId}.functions.<domain>/
CORS preflight for invocation allows only POST, OPTIONS
' to 'Invoke a serverless function.

With Service Key (admin/background operations):

Use for background jobs, webhooks, cron, admin operations
Function receives payload only (no user context)
Database queries bypass RLS (admin access)

With Auth User Token (user-facing):

Use for user-initiated actions

Function receives payload + __volcano_auth context:

{
  user_id: "uuid",
  email: "user@example.com",
  project_id: "uuid",
  role: "authenticated" or "anonymous"
}

Database queries enforce RLS (user-scoped data)

With Anon Key (public function only):

Requires anon key permission: functions.invoke
Function must have is_public: true
Function receives payload only (no __volcano_auth)

Transport and CORS:

This operation is the authenticated direct RPC endpoint and always uses the
POST {payload: ...} contract, including for functions whose DNS ingress is
configured in HTTP mode.
The geo-routed DNS ingress is the function's invoke_url. It is on a
different domain from this API, so it cannot be derived from the API host.
RPC-mode DNS ingress accepts POST at /. HTTP-mode DNS ingress accepts GET,
HEAD, POST, PUT, PATCH, and DELETE at / and nested paths.
Direct and RPC-mode CORS preflight advertises POST, OPTIONS. HTTP-mode DNS
preflight advertises GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS.
http_auth_mode: none applies only to public HTTP-mode DNS ingress; this
direct operation always requires a Volcano credential.

Durable functions are not invocable here. A durable function's id
answers 404, whatever its visibility, because a synchronous call would
run it with no execution record, no idempotency and no concurrency
accounting. Start one with
POST /durable-functions/{functionId}/executions.
'

Responses changed
- Modified response: 200
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms
- Modified response: 429
  - Description changed from 'Rate limit exceeded (per-function or project-wide limit), or the
    owning platform user's monthly bandwidth cap (aggregate ingress +
    egress) was exceeded.
    ' to 'Rate limit exceeded (per-function or project-wide limit), or the
    owning platform user's billing-cycle bandwidth allowance (aggregate ingress +
    egress) was exceeded.
    '
- Modified response: default
  - Headers changed
    - New header: x-volcano-compute-ms
    - New header: x-volcano-proxy-handler-ms
    - New header: x-volcano-proxy-ms

GET /projects

Description changed from 'Returns projects that are not deleting or deleted, newest first.
Supports two mutually exclusive pagination modes. Offset mode uses
page and limit. Cursor mode uses cursor or ending_before with
limit, returns next_cursor/prev_cursor, and supports a bounded
offset past the cursor anchor. Supplying limit without page
selects cursor mode. search applies a case-insensitive project-name
filter in either mode. Sending page with cursor or ending_before,
or sending both cursor directions, returns 400.
' to 'Returns projects that are not deleting or deleted, newest first.
Supports two mutually exclusive pagination modes. Offset mode uses
page and limit. Cursor mode uses cursor or ending_before with
limit, returns next_cursor/prev_cursor, and supports a bounded
offset past the cursor anchor. Supplying limit without page
selects cursor mode. search applies a case-insensitive project-name
filter in either mode. include optionally expands each returned
project with its Git connection and/or aggregate health summary using
git_connection and health. Sending page with cursor or ending_before,
or sending both cursor directions, returns 400.
'
New query param: include
Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        Modified property: data
        
        Items changed
        
        Properties changed
        
        New property: git_connection
        
        New property: health

POST /projects

Responses changed
- Modified response: 201
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        New property: git_connection
        
        New property: health

DELETE /projects/{id}

Security changed
- New security requirements: ProjectAccessToken

GET /projects/{id}

Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        New property: git_connection
        
        New property: health
Security changed
- New security requirements: ProjectAccessToken

PATCH /projects/{id}

Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        New property: git_connection
        
        New property: health
- Modified response: 400
  - Description changed from 'Bad request' to 'Bad request (no region selected, an unknown region, or — for a
    project holding durable functions — a region that does not offer
    durable execution)
    '
Security changed
- New security requirements: ProjectAccessToken

GET /projects/{id}/access-tokens

Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        Modified property: data
        
        Items changed
        
        Properties changed
        
        Modified property: scope
        Description changed from 'What a project access token may do within its project.

full is everything you can do to that one project, up to and including
deleting it. It cannot manage access tokens, so a leaked token cannot
mint a replacement or erase the record of its own use, but for a CI or
agent credential that only deploys, prefer read_only where the job
allows it.

read_only refuses mutations. It is enforced by route classification
rather than HTTP method, so the log and metrics query endpoints remain
available even though they are POST requests that carry body filters.

read_only also refuses the reads that return a credential — service
keys, variable values, and database connection strings. A service key
grants read and write over the project's data and keeps working after
the token that fetched it is revoked, so returning one to a read-only
credential would make the scope a formality.
' to 'What a project access token may do within its project.

full is everything you can do to that one project, up to and including
deleting it. It cannot manage access tokens, so a leaked token cannot
mint a replacement or erase the record of its own use, but for a CI or
agent credential that only deploys, prefer read_only where the job
allows it.

read_only refuses mutations. It is enforced by route classification
rather than HTTP method, so the log and metrics query endpoints remain
available even though they are POST requests that carry body filters.

read_only also refuses the reads that return a credential — service
keys, anon keys, variable values, and database connection strings. Those
grant write access over the project's data and keep working after the
token that fetched them is revoked, so returning one to a read-only
credential would make the scope a formality. An anon key is included
because its permissions are chosen per key and may include uploading,
deleting, and publishing.
'

POST /projects/{id}/access-tokens

Description changed from 'Creates a project access token and returns its secret.

The secret is in this response and nowhere else. Only its hash is
stored, so it cannot be retrieved, displayed, or recovered later — save
it when you create it.

The name must be unique within the project, which also makes this call
safe to retry: a duplicate is rejected rather than quietly minting a
second credential whose secret you never saw.

Requires a platform token.
' to 'Creates a project access token and returns its secret.

The secret is in this response and nowhere else. Only its hash is
stored, so it cannot be retrieved, displayed, or recovered later — save
it when you create it.

The name must be unique within the project, so a retry cannot mint a
second credential. It cannot recover the first one either. A retry that
returns 409 with code access_token_name_exists means the original
create committed and its secret is unrecoverable: list the project's
tokens, revoke the one holding that name, and create it again.

Requires a platform token.
'

Request body changed
- Content changed
  - Modified media type: application/json
    - Schema changed
      - Properties changed
        
        Modified property: name
        
        Description changed from 'Unique within the project. Creating a duplicate returns 409.' to 'Held by any of the project's tokens you have not revoked, including
        one that has expired. Creating a duplicate returns 409 with code
        access_token_name_exists; revoking the holder frees the name, so a
        rotation can keep the name its caller already references.
        '
        
        Modified property: scope
        
        Description changed from 'What a project access token may do within its project.

full is everything you can do to that one project, up to and including
deleting it. It cannot manage access tokens, so a leaked token cannot
mint a replacement or erase the record of its own use, but for a CI or
agent credential that only deploys, prefer read_only where the job
allows it.

read_only refuses mutations. It is enforced by route classification
rather than HTTP method, so the log and metrics query endpoints remain
available even though they are POST requests that carry body filters.

read_only also refuses the reads that return a credential — service
keys, variable values, and database connection strings. A service key
grants read and write over the project's data and keeps working after
the token that fetched it is revoked, so returning one to a read-only
credential would make the scope a formality.
' to 'What a project access token may do within its project.

full is everything you can do to that one project, up to and including
deleting it. It cannot manage access tokens, so a leaked token cannot
mint a replacement or erase the record of its own use, but for a CI or
agent credential that only deploys, prefer read_only where the job
allows it.

read_only refuses mutations. It is enforced by route classification
rather than HTTP method, so the log and metrics query endpoints remain
available even though they are POST requests that carry body filters.

read_only also refuses the reads that return a credential — service
keys, anon keys, variable values, and database connection strings. Those
grant write access over the project's data and keep working after the
token that fetched them is revoked, so returning one to a read-only
credential would make the scope a formality. An anon key is included
because its permissions are chosen per key and may include uploading,
deleting, and publishing.
'

Responses changed
- Modified response: 201
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Property 'AllOf' changed
        
        Modified schema: #/components/schemas/ProjectAccessToken
        
        Properties changed
        
        Modified property: scope
        
        Description changed from 'What a project access token may do within its project.

full is everything you can do to that one project, up to and including
deleting it. It cannot manage access tokens, so a leaked token cannot
mint a replacement or erase the record of its own use, but for a CI or
agent credential that only deploys, prefer read_only where the job
allows it.

read_only refuses mutations. It is enforced by route classification
rather than HTTP method, so the log and metrics query endpoints remain
available even though they are POST requests that carry body filters.

read_only also refuses the reads that return a credential — service
keys, variable values, and database connection strings. A service key
grants read and write over the project's data and keeps working after
the token that fetched it is revoked, so returning one to a read-only
credential would make the scope a formality.
' to 'What a project access token may do within its project.

full is everything you can do to that one project, up to and including
deleting it. It cannot manage access tokens, so a leaked token cannot
mint a replacement or erase the record of its own use, but for a CI or
agent credential that only deploys, prefer read_only where the job
allows it.

read_only refuses mutations. It is enforced by route classification
rather than HTTP method, so the log and metrics query endpoints remain
available even though they are POST requests that carry body filters.

read_only also refuses the reads that return a credential — service
keys, anon keys, variable values, and database connection strings. Those
grant write access over the project's data and keep working after the
token that fetched them is revoked, so returning one to a read-only
credential would make the scope a formality. An anon key is included
because its permissions are chosen per key and may include uploading,
deleting, and publishing.
'

GET /projects/{id}/access-tokens/usage

Description changed from 'Returns a zero-filled daily series of request counts for each of the
project's access tokens, oldest first. Every day in the window is
present, so a gap reads as zero rather than missing.

Revoked tokens are included, because the traffic they made before
revocation is usually the reason you are looking.

days defaults to 30 and is capped at 60, which is also how long per-day
counts are retained — a longer window cannot be answered.
' to 'Returns a zero-filled daily series of request counts for each of the
project's access tokens, oldest first. Every day in the window is
present, so a gap reads as zero rather than missing.

Revoked tokens are included, because the traffic they made before
revocation is usually the reason you are looking.

days defaults to 30 and is capped at 60, which is also how long per-day
counts are retained — a longer window cannot be answered.

A platform token sees every token in the project. A project access token
sees only its own row, so it can watch its own traffic without being
able to enumerate the project's other credentials by name.
'

Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Items changed
        
        Required changed
        
        New required property: token_prefix
        
        Properties changed
        
        New property: token_prefix

GET /projects/{id}/access-tokens/{tokenId}

Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        Modified property: scope
        
        Description changed from 'What a project access token may do within its project.

full is everything you can do to that one project, up to and including
deleting it. It cannot manage access tokens, so a leaked token cannot
mint a replacement or erase the record of its own use, but for a CI or
agent credential that only deploys, prefer read_only where the job
allows it.

read_only refuses mutations. It is enforced by route classification
rather than HTTP method, so the log and metrics query endpoints remain
available even though they are POST requests that carry body filters.

read_only also refuses the reads that return a credential — service
keys, variable values, and database connection strings. A service key
grants read and write over the project's data and keeps working after
the token that fetched it is revoked, so returning one to a read-only
credential would make the scope a formality.
' to 'What a project access token may do within its project.

full is everything you can do to that one project, up to and including
deleting it. It cannot manage access tokens, so a leaked token cannot
mint a replacement or erase the record of its own use, but for a CI or
agent credential that only deploys, prefer read_only where the job
allows it.

read_only refuses mutations. It is enforced by route classification
rather than HTTP method, so the log and metrics query endpoints remain
available even though they are POST requests that carry body filters.

read_only also refuses the reads that return a credential — service
keys, anon keys, variable values, and database connection strings. Those
grant write access over the project's data and keep working after the
token that fetched them is revoked, so returning one to a read-only
credential would make the scope a formality. An anon key is included
because its permissions are chosen per key and may include uploading,
deleting, and publishing.
'

GET /projects/{id}/access-tokens/{tokenId}/usage

Description changed from 'Returns a zero-filled daily series of request counts for a single token,
oldest first, so the response always has exactly days entries.

days defaults to 30 and is capped at 60, matching how long per-day
counts are retained.
' to 'Returns a zero-filled daily series of request counts for a single token,
oldest first, so the response always has exactly days entries.

days defaults to 30 and is capped at 60, matching how long per-day
counts are retained.

A project access token may read only its own usage; asking for another
token's returns 403. A platform token may read any token in the
project.
'

Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Required changed
        
        New required property: token_prefix
        
        Properties changed
        
        New property: token_prefix

GET /projects/{id}/anon-keys

Security changed
- New security requirements: ProjectAccessToken

POST /projects/{id}/anon-keys

Security changed
- New security requirements: ProjectAccessToken

DELETE /projects/{id}/anon-keys/{keyId}

Security changed
- New security requirements: ProjectAccessToken

GET /projects/{id}/anon-keys/{keyId}

Security changed
- New security requirements: ProjectAccessToken

POST /projects/{id}/anon-keys/{keyId}/regenerate

Security changed
- New security requirements: ProjectAccessToken

POST /projects/{id}/anon-keys/{keyId}/set-default

Security changed
- New security requirements: ProjectAccessToken

GET /projects/{id}/auth/config

Security changed
- New security requirements: ProjectAccessToken

PUT /projects/{id}/auth/config

Security changed
- New security requirements: ProjectAccessToken

POST /projects/{id}/auth/config/test-email

Security changed
- New security requirements: ProjectAccessToken

GET /projects/{id}/auth/hosted-pages/{pageType}

Modified path param: pageType
- Schema changed
  - New enum values

Report truncated; see the source commit for the complete contract diff.

Validation

Contract generation completed in the source workflow run.
Target repository CI validates the generated result.

CLAassistant · 2026-07-13T20:39:30Z

All committers have signed the CLA.

kong Bot force-pushed the chore/sync-openapi branch 10 times, most recently from 04d66d1 to b8d922a Compare July 20, 2026 13:54

kong Bot force-pushed the chore/sync-openapi branch 10 times, most recently from ee0bdba to eb217d3 Compare July 27, 2026 22:41

kong Bot force-pushed the chore/sync-openapi branch 9 times, most recently from bc4afe5 to 7b3fd89 Compare July 31, 2026 00:52

kong Bot force-pushed the chore/sync-openapi branch 9 times, most recently from 3d85dcf to 9f5fc74 Compare August 22, 2026 01:21

kong Bot force-pushed the chore/sync-openapi branch 10 times, most recently from 61e1bcc to 882ac57 Compare August 29, 2026 05:35

kong Bot force-pushed the chore/sync-openapi branch 8 times, most recently from 5187d45 to 1d7604f Compare September 5, 2026 02:49

kong Bot force-pushed the chore/sync-openapi branch 2 times, most recently from d4953ec to 1e2ab55 Compare September 10, 2026 22:00

chore(api): sync OpenAPI contract

b41cf58

Navigation Menu

chore(api): sync OpenAPI contract - #51

chore(api): sync OpenAPI contract#51
kong[bot] wants to merge 1 commit into
mainfrom
chore/sync-openapi

kong Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Jul 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

kong Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

API change report

Public API

New Endpoints: 42

Deleted Endpoints: 1

Modified Endpoints: 169

Validation

Uh oh!

CLAassistant commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kong Bot commented Jul 13, 2026 •

edited

Loading

CLAassistant commented Jul 13, 2026 •

edited

Loading