# API changelog

One line for every change to the public REST API document (`openapi.json`): what was added,
changed or removed, written for the person calling the API. A test
(`sdks/api-client/test/drift.test.ts`) fails when the committed document has no line here, so
an API change cannot ship without somebody saying what it was.

Add a line with:

```
pnpm --filter @bucker/api-client changelog:stamp "<what changed>"
```

The `spec:` value is a fingerprint of the document (its canonical JSON, so formatting and key
order do not count). Only the line for the current document has to exist; older lines are
history.

- 2026-10-17 `spec:baseline` Starting point for this log. The document already described the issue, project, alerting, integration, remediation, ingest and administration routes; entries below record each change after it.
- 2026-10-17 `spec:861abedea510` Added org webhook subscriptions (/orgs/{orgSlug}/webhooks), the Teams bot endpoint and manifest, and the webhook-events catalogue.
- 2026-10-17 `spec:a11110397633` Added bulk merge of grouping suggestions (POST .../grouping-suggestions/merge) and a degradedBecause field on the suggestion scan result.
- 2026-10-17 `spec:328e515e3e55` Merged the sentry-gaps line: issue workflow (grouping rules, archive conditions, review, delete/discard, inbound filters, comments, ownership), the org-wide stream and exports, alerts and personal notifications, releases and release health, Explore, logs and metrics, replay, dashboards and performance, crons and status, the CLI and config-as-code, admin and identity, the AI lane, commercial and Sentry upload routes.
- 2026-10-17 `spec:18f5047c2686` Alert rules accept a metric-threshold condition over customer metrics (explicit aggregate, delta/rate for counters); the log search accepts the shared grammar (OR, groups, ! negation, [a,b] lists).
- 2026-10-17 `spec:95f9b2831dab` Outbound webhooks can be edited and deleted; sessions carry their sign-in method, with a step-up route for actions that need a fresh factor; a guest session for the read-only sandbox organization.
- 2026-10-17 `spec:d21cf8f31d4f` Plans and subscriptions carry add-on placement and entitlement (`addOns.mitigate`: included, paid add-on or absent; provisional pending a pricing decision); an operator route records a purchased add-on (POST /admin/tenants/{orgSlug}/add-ons); requesting or applying a mitigation or hotfix without the Mitigate add-on is a 403 naming it.
- 2026-10-21 `spec:28e231507467` Status pages: GET .../setup (the setup state: steps, facts and what the caller may do), POST .../setup/components (monitors, components and bindings in one request), PUT/DELETE .../brand/{asset} (logo and favicon upload), POST .../domain/check (look at a hostname's DNS now; GET .../domain/verify is deprecated); the domain state carries claim expiry, last and next check, per-record status, automation and the awaiting_publish state; the new status:write scope joins every scopes enum (personal, organization and agent tokens, and delegations).