API changelog

What changed in the API under /v1, newest first. Every change so far has been an addition, or a refusal for something that was never allowed; nothing a client relied on has been taken away. The current document is always at https://api.updawg.net/openapi.json, and the API reference is built from it.

Every version is published too, named by the heading below it belongs to: https://docs.updawg.net/openapi/2026-10-11.json is the document as it stood after the changes under 2026-10-11, latest.json is the newest, and index.json lists them all. Pin a client to one and diff it against the next to see what changed.

What may change without notice, and the six months’ notice before anything is taken away, is in API stability. Deprecations are listed here as they are announced.

2026-10-18

The Slack app: POST /v1/orgs/{org}/slack/install returns the address that adds it to a workspace; GET /v1/orgs/{org}/slack/installations lists the workspaces and DELETE …/installations/{installation_id} removes one; GET …/installations/{installation_id}/channels lists a workspace’s public channels for the channel picker.
GET /v1/orgs/{org}/slack/links lists linked Slack accounts (your own, or everybody’s for an admin) and DELETE …/slack/links/{link_id} unlinks one; GET and POST /v1/orgs/{org}/slack/link-requests/{link_token} show and confirm an offer to link.
GET and PATCH /v1/orgs/{org}/slack/settings read and set approvals_from_slack, off by default.
A notification channel of kind slack_app posts through the installed app: {team_id, channel}.
/v1/integrations/slack/callback, /commands, /events and /interactions are Slack’s to call, signed by Slack, and refuse anything else.
Creating a slack_app channel, or pointing one at another Slack channel, answers with slack_membership: joined, invite_needed (a private channel: /invite @Updawg), reinstall_needed or unknown.

2026-10-16

POST /v1/orgs/{org}/compliance/exports makes a compliance export in the background: hosts_csv, resolutions_csv or report_pdf (a PDF made by Updawg). GET /v1/orgs/{org}/compliance/exports lists the recent ones, GET …/exports/{export_id} says how one is doing, and GET …/exports/{export_id}/download returns the file for seven days.

2026-10-11

GET /v1/orgs/{org}/proposals/grouped?by=policy|group returns the inbox’s sections, by the policy that made each proposal or by the host groups its hosts are in, with how many proposals each holds. The proposals list takes ?policy= and ?group= (an id, or none) to open one section.
PATCH /v1/orgs/{org}/members/{user_id} answers 200 with the member at their new role, where it answered 204 with no body.
GET /v1/orgs/{org}/policies/preview/context returns what a policy preview reads besides the document: the live policies, the enabled ones compiled, the fleet a preview evaluates, and engine, the policy engine’s version. The portal uses it to preview as you type.
Policies carry managed_by: terraform for a policy the Terraform provider created or last saved, otherwise null. A later edit from anywhere else doesn’t clear it.
POST /v1/orgs/{org}/signing-keys/retire takes any key still retiring while another is active, including Updawg’s previous key after an ordinary rotation.
POST /v1/orgs/{org}/signing-keys/endorse rotates a key your organization holds: your active key’s endorsement of the next one, with the next key’s proof. See Customer-held signing keys.
POST /v1/orgs/{org}/signing-keys/retire also takes an earlier key of your own, once you have rotated away from it.
Signing keys carry hosts_pinned, and hosts carry pinned_keys: the keys a host’s agent says it verifies jobs against (agents from protocol 0.11).
jobs.awaiting_signature is also raised four hours before the first of a proposal’s unsigned jobs expires, saying when.

2026-10-10

Notification rules can name a new event, jobs.awaiting_signature: a proposal’s jobs wait for your organization to sign them with its own key.
/v1/orgs/{org}/billing…, /v1/orgs/{org}/sso… and /v1/orgs/{org}/scim/token are answered at the EU API for organizations in every region; a region’s API answers them with 421 wrong-region.

2026-10-09

POST /v1/regions/{region}/token returns a short-lived token for another region’s API, used as Authorization: Bearer. See Data residency.
POST /v1/orgs takes region (eu or us).
Membership and invitations under /v1/orgs/{org}, and deleting an organization, are answered at the EU API for every region.

2026-10-08

Organizations and each membership in GET /v1/me carry region; memberships also carry api_url, the API to send that organization’s requests to.
Every operation under /v1/orgs/{org} may answer 421 wrong-region, naming the API that serves the organization.
Organizations carry over_allowance_since and changes_paused_from for a Free organization over the Free allowance; approving then answers 409 over-free-allowance.
POST /v1/orgs refuses with 409 organization-limit only when you already own an organization on Free.
Customer-held signing keys: POST /v1/orgs/{org}/signing-keys/hand-over, POST /v1/orgs/{org}/signing-keys/retire, GET /v1/orgs/{org}/jobs/unsigned and POST /v1/orgs/{org}/jobs/{job_id}/signature. Jobs gain the status awaiting_signature.

2026-10-07

DELETE /v1/orgs/{org} deletes an organization (purged a week later).
DELETE /v1/me erases your account; GET /v1/me/export returns your data.

2026-10-03 to 2026-10-05

Sign in with Google, Microsoft and Apple.
Single sign-on per organization (/v1/orgs/{org}/sso, verified domains) and SCIM 2.0 provisioning.
Compliance reports: GET /v1/orgs/{org}/compliance/report, …/compliance/export and patch targets.

2026-10-01 to 2026-10-02

Billing: GET /v1/orgs/{org}/billing, checkout, plan changes, usage and the Stripe customer portal. Plan limits are enforced, with 403 plan-required naming the plan that includes a feature.
Self-serve sign-up by emailed link.
Every advisory affecting the fleet: GET /v1/orgs/{org}/advisories.
Agent updates as proposals, and keeping agents on stable automatically.
Hosts in bulk: one action on many hosts, including decommission, delete and a reboot proposal.
Audit log retention an owner can shorten.

2026-09-29 to 2026-09-30

API tokens with scopes (/v1/orgs/{org}/api-tokens).
Release upgrades: plan one, preflight it, approve and sign it.
Rate limits per organization, with 429 and Retry-After.
A proposal’s changelog entries, and a host’s pinned package sources.

2026-09-25 to 2026-09-28

The API’s first public shape: hosts and their timeline, exposures and unfixable vulnerabilities; groups; enrollment tokens; proposals, their jobs, comments, decisions, halting, resuming and rollback; rollouts and their stages; notification channels, rules and signed webhooks; digests; the audit log and its export; a live event stream; and problem documents (RFC 9457) for every error.