API changelog

The API operations each release changed, from the affects lists in the release notes. Each operation links to its section in the reference. Regenerate with make api.reference.generate.

v0.12.0

This release is not published yet. The operations below changed on main.

MeService

Operation	Kind	Change
GetMe	new features	Signed-in users can read their own built-in role without user-directory access.

v0.11.0

AdminService

Operation	Kind	Change
GetUserToken	behaviour changes	A disabled user token now shows the new DISABLED status, and the active filter no longer returns it. It was shown as active even though the data plane does not route it. A token that is both disabled and revoked or expired still shows REVOKED or EXPIRED. ListUserTokens takes a new disabled status filter that returns disabled tokens that are neither revoked nor expired; filter by revoked or expired to find the others.
ListUserTokens	behaviour changes	A disabled user token now shows the new DISABLED status, and the active filter no longer returns it. It was shown as active even though the data plane does not route it. A token that is both disabled and revoked or expired still shows REVOKED or EXPIRED. ListUserTokens takes a new disabled status filter that returns disabled tokens that are neither revoked nor expired; filter by revoked or expired to find the others.
DeleteProject	behaviour changes	Deleting or archiving a project now also hides the API keys that were revoked before it, so a new project with the same name does not list them as its own. ListApiKeys reports these keys as API_KEY_STATUS_DELETED, not API_KEY_STATUS_REVOKED; each keeps its revocation stamp and stays on the data plane's revocation list.
UpsertProjectOIDCConfig	security updates	A disabled project OIDC contract no longer reserves its issuer and audience, so another organization can enable a contract for that pair. Enabling a contract is still refused while another organization's enabled contract names the same issuer and audience, and the refusal now tells you to ask a platform administrator to release the pair. The refusal's audit entry names the holding organization and project, and the delete audit entry records the issuer and audience it released.
GetProjectDeletionImpact	new features	GetProjectDeletionImpact previews what deleting a live project removes: the project's id, and the number of users, model assignments, API keys, revoked API keys, settings, fallback policies, provider grants, MCP server grants, MCP profiles, OIDC contracts and role bindings granted directly at the project's scope. All counts except users and model assignments use the delete's own rules, and all twelve fields are empty after the delete.
EnsureDefaultProjectMembership	new features	EnsureDefaultProjectMembership adds a user to the Users of their organization's default project when they are not in it yet, and reports whether they joined. It never changes an existing role, skips a banned user or one SCIM blocks from signing in, and writes an AUTO_JOIN_DEFAULT_PROJECT audit record when the user joins. It needs the admin management key or the project.members.add permission.
UpsertSystemSetting	new features	An admin can now change two management plane address checks without restarting valet. The system settings oidc.discovery_allow_private_addresses and gateway_auth.jwks_allow_private_addresses override OIDC_DISCOVERY_ALLOW_PRIVATE_ADDRESSES and GATEWAY_AUTH_JWKS_ALLOW_PRIVATE_ADDRESSES. Each takes true, false or inherit, and UpsertSystemSetting refuses any other value for them.
SetDataplaneConfigOverride	bug fixes	Changes that check a data plane's version, such as provider overrides, shared and catch-all hostnames, OIDC contracts and the newer rate-limit dimensions, no longer refuse a data plane on 0.11.0 or newer that was just upgraded or has had no configuration change for a day, because it now reports its version on every poll. A data plane silent for 24 hours is refused as down, disconnected or older than 0.11.0, with a prompt to check its connection and build.
AttachProjectGatewayProject	bug fixes	Changes that check a data plane's version, such as provider overrides, shared and catch-all hostnames, OIDC contracts and the newer rate-limit dimensions, no longer refuse a data plane on 0.11.0 or newer that was just upgraded or has had no configuration change for a day, because it now reports its version on every poll. A data plane silent for 24 hours is refused as down, disconnected or older than 0.11.0, with a prompt to check its connection and build.
AddDataplaneProject	bug fixes	Changes that check a data plane's version, such as provider overrides, shared and catch-all hostnames, OIDC contracts and the newer rate-limit dimensions, no longer refuse a data plane on 0.11.0 or newer that was just upgraded or has had no configuration change for a day, because it now reports its version on every poll. A data plane silent for 24 hours is refused as down, disconnected or older than 0.11.0, with a prompt to check its connection and build.
CreateProjectGateway	bug fixes	Changes that check a data plane's version, such as provider overrides, shared and catch-all hostnames, OIDC contracts and the newer rate-limit dimensions, no longer refuse a data plane on 0.11.0 or newer that was just upgraded or has had no configuration change for a day, because it now reports its version on every poll. A data plane silent for 24 hours is refused as down, disconnected or older than 0.11.0, with a prompt to check its connection and build.
SetProjectGatewayWorkspace	bug fixes	Changes that check a data plane's version, such as provider overrides, shared and catch-all hostnames, OIDC contracts and the newer rate-limit dimensions, no longer refuse a data plane on 0.11.0 or newer that was just upgraded or has had no configuration change for a day, because it now reports its version on every poll. A data plane silent for 24 hours is refused as down, disconnected or older than 0.11.0, with a prompt to check its connection and build.
DeleteProjectGateway	bug fixes	Changes that check a data plane's version, such as provider overrides, shared and catch-all hostnames, OIDC contracts and the newer rate-limit dimensions, no longer refuse a data plane on 0.11.0 or newer that was just upgraded or has had no configuration change for a day, because it now reports its version on every poll. A data plane silent for 24 hours is refused as down, disconnected or older than 0.11.0, with a prompt to check its connection and build.
UpsertProjectOIDCConfig	bug fixes	Changes that check a data plane's version, such as provider overrides, shared and catch-all hostnames, OIDC contracts and the newer rate-limit dimensions, no longer refuse a data plane on 0.11.0 or newer that was just upgraded or has had no configuration change for a day, because it now reports its version on every poll. A data plane silent for 24 hours is refused as down, disconnected or older than 0.11.0, with a prompt to check its connection and build.
ListDataplanes	bug fixes	Listing data planes now returns next_page_token when more remain, and passing it as page_token returns the next page. A token that is malformed or from a listing for another customer is refused with INVALID_ARGUMENT. Configuration changes now reach every data plane of a customer with more than 1,000 of them.
ListWorkspaces	bug fixes	Listing data planes now returns next_page_token when more remain, and passing it as page_token returns the next page. A token that is malformed or from a listing for another customer is refused with INVALID_ARGUMENT. Configuration changes now reach every data plane of a customer with more than 1,000 of them.
QueryPlatformAuditLogs	bug fixes	A request with a NUL character in a name, description or filter field now returns 400 invalid_argument. It returned 500 internal before, which clients retry and which counted as a server failure. This applies when the management plane uses the extended query protocol, which is the default. A deployment that sets global.useSimpleProtocol (USE_QUERY_EXEC_MODE_SIMPLE_PROTOCOL=true, used with pgbouncer) still returns 500 for these requests.
ListProjectMcpServers	bug fixes	A request with a NUL character in a name, description or filter field now returns 400 invalid_argument. It returned 500 internal before, which clients retry and which counted as a server failure. This applies when the management plane uses the extended query protocol, which is the default. A deployment that sets global.useSimpleProtocol (USE_QUERY_EXEC_MODE_SIMPLE_PROTOCOL=true, used with pgbouncer) still returns 500 for these requests.
AddProjectProvider	bug fixes	A request with a NUL character in a name, description or filter field now returns 400 invalid_argument. It returned 500 internal before, which clients retry and which counted as a server failure. This applies when the management plane uses the extended query protocol, which is the default. A deployment that sets global.useSimpleProtocol (USE_QUERY_EXEC_MODE_SIMPLE_PROTOCOL=true, used with pgbouncer) still returns 500 for these requests.
UpdateProject	bug fixes	A request with a NUL character in a name, description or filter field now returns 400 invalid_argument. It returned 500 internal before, which clients retry and which counted as a server failure. This applies when the management plane uses the extended query protocol, which is the default. A deployment that sets global.useSimpleProtocol (USE_QUERY_EXEC_MODE_SIMPLE_PROTOCOL=true, used with pgbouncer) still returns 500 for these requests.

AiKeysService

Operation	Kind	Change
Register	security updates	On a management plane that serves more than one organization, provider key changes no longer reach another organization's data planes. A change in an organization's default project now reaches only its own data planes that serve the default project.
Revoke	security updates	On a management plane that serves more than one organization, provider key changes no longer reach another organization's data planes. A change in an organization's default project now reaches only its own data planes that serve the default project.
UpdateTrafficSettings	security updates	On a management plane that serves more than one organization, provider key changes no longer reach another organization's data planes. A change in an organization's default project now reaches only its own data planes that serve the default project.
Revoke	new features	Revoke with legacy revokes one of your own provider keys from before keys belonged to a project. It writes an audit entry, deletes the stored key and stops it routing in the projects you use.
Register	new features	Register takes an optional preference ("always", "primary" or "fallback") for a provider's first key in a project, and tetrate agentrouter api byok add takes it as --preference. A key added after it keeps the existing keys' preference, which Register returns in key.traffic_preference. Two keys added at once for the same provider in a project no longer split traffic: the second goes behind the first, with the same preference.

AlertDestinationService

Operation	Kind	Change
CreateAlertDestination	behaviour changes	Creating, changing or deleting an alert destination from the Admin Console, the Developer Console or the API now writes one alert_destinations audit record naming the signed-in user, with success set to false when the change is refused after the sign-in and permission checks; no record holds a credential. Until the Admin Console stops writing its own record, a change made there writes two.
UpdateAlertDestination	behaviour changes	Creating, changing or deleting an alert destination from the Admin Console, the Developer Console or the API now writes one alert_destinations audit record naming the signed-in user, with success set to false when the change is refused after the sign-in and permission checks; no record holds a credential. Until the Admin Console stops writing its own record, a change made there writes two.
DeleteAlertDestination	behaviour changes	Creating, changing or deleting an alert destination from the Admin Console, the Developer Console or the API now writes one alert_destinations audit record naming the signed-in user, with success set to false when the change is refused after the sign-in and permission checks; no record holds a credential. Until the Admin Console stops writing its own record, a change made there writes two.

ApiKeysService

Operation	Kind	Change
ListApiKeys	behaviour changes	Project Owners can list, disable and delete the API keys of their project. Super Admins can list the keys of their organization. Listing uses the new permission api_key_directory.read, which Project Owner, Super Admin, Viewer, User Admin and the admin management key hold. A User Admin bound to a project lists the keys of that project. The read and write management keys do not get it, so they cannot list other users' keys.
UpdateApiKey	behaviour changes	Project Owners can list, disable and delete the API keys of their project. Super Admins can list the keys of their organization. Listing uses the new permission api_key_directory.read, which Project Owner, Super Admin, Viewer, User Admin and the admin management key hold. A User Admin bound to a project lists the keys of that project. The read and write management keys do not get it, so they cannot list other users' keys.
DeleteApiKey	behaviour changes	Project Owners can list, disable and delete the API keys of their project. Super Admins can list the keys of their organization. Listing uses the new permission api_key_directory.read, which Project Owner, Super Admin, Viewer, User Admin and the admin management key hold. A User Admin bound to a project lists the keys of that project. The read and write management keys do not get it, so they cannot list other users' keys.
UpdateApiKey	behaviour changes	Enabling, disabling, renaming or deleting an API key, from either console or the API, now writes one UPDATE_API_KEY or DELETE_API_KEY audit record per call, in the same transaction, naming the signed-in user. The Developer Console saves a status and name edit as two calls. A refused change writes one record with success set to false. The Admin Console's ENABLE, DISABLE, UPDATE, DELETE and BULK_ records for API keys stop, except for a change it refuses before the management plane sees it.
DeleteApiKey	behaviour changes	Enabling, disabling, renaming or deleting an API key, from either console or the API, now writes one UPDATE_API_KEY or DELETE_API_KEY audit record per call, in the same transaction, naming the signed-in user. The Developer Console saves a status and name edit as two calls. A refused change writes one record with success set to false. The Admin Console's ENABLE, DISABLE, UPDATE, DELETE and BULK_ records for API keys stop, except for a change it refuses before the management plane sees it.
ListApiKeys	behaviour changes	An API key with no stored key type, from before key types were stored, now reports API_KEY_TYPE_MANAGEMENT, the type it works as. It reported API_KEY_TYPE_PROMPT before.
ListApiKeys	behaviour changes	Deleting or archiving a project now also hides the API keys that were revoked before it, so a new project with the same name does not list them as its own. ListApiKeys reports these keys as API_KEY_STATUS_DELETED, not API_KEY_STATUS_REVOKED; each keeps its revocation stamp and stays on the data plane's revocation list.
ListApiKeys	security updates	An Admin Console user with only an organization role can no longer list the API keys of every organization. Listing every organization needs the platform admin scope or api_key_directory.read at platform level.
UpdateApiKey	security updates	An Admin Console user who holds admin only through an organization role can change or delete only the API keys where that role grants API key edit or delete, and a management key only the keys of its own organization. Other keys return NOT_FOUND. Enabling a revoked key returns FAILED_PRECONDITION except for a platform admin that names no customer_id, so the Developer Console can no longer re-enable a key an admin revoked. Enabling a destroyed key always returns FAILED_PRECONDITION.
DeleteApiKey	security updates	An Admin Console user who holds admin only through an organization role can change or delete only the API keys where that role grants API key edit or delete, and a management key only the keys of its own organization. Other keys return NOT_FOUND. Enabling a revoked key returns FAILED_PRECONDITION except for a platform admin that names no customer_id, so the Developer Console can no longer re-enable a key an admin revoked. Enabling a destroyed key always returns FAILED_PRECONDITION.
ListApiKeys	new features	ListApiKeys lists the keys of one organization or project, with status, owner, text and ID filters, a filter for the keys that can hold their own fallback policy (override_targetable_only), sorting, counts and the key owners. Keys show their client, disabled state and deletion time. A fallback policy that targets a key shows the project of that key. A management key bound to an organization gets PERMISSION_DENIED for another organization's keys.
UpdateApiKey	new features	UpdateApiKey and DeleteApiKey take an optional customer_id and project_id, so an organization admin or project owner can change the keys of their scope. UpdateApiKey can refuse a revoked key and record who disabled a key.
DeleteApiKey	new features	UpdateApiKey and DeleteApiKey take an optional customer_id and project_id, so an organization admin or project owner can change the keys of their scope. UpdateApiKey can refuse a revoked key and record who disabled a key.

BillingAdminService

Operation	Kind	Change
SearchBillingUsers	new features	Administrators read their organization's balances and top-ups; operators adjust credits.
GetUserBalance	new features	Administrators read their organization's balances and top-ups; operators adjust credits.
ListUserTransactions	new features	Administrators read their organization's balances and top-ups; operators adjust credits.
ListUserTopups	new features	Administrators read their organization's balances and top-ups; operators adjust credits.
ListTopupActivities	new features	Administrators read their organization's balances and top-ups; operators adjust credits.
CreateCreditAdjustment	new features	Administrators read their organization's balances and top-ups; operators adjust credits.

BillingService

Operation	Kind	Change
GetMyBalance	new features	Self-service balance, top-ups, auto top-up and cards through the API.
ListMyTransactions	new features	Self-service balance, top-ups, auto top-up and cards through the API.
ListMyTopups	new features	Self-service balance, top-ups, auto top-up and cards through the API.
GetMyReceiptUrl	new features	Self-service balance, top-ups, auto top-up and cards through the API.
GetMyAutoTopupSettings	new features	Self-service balance, top-ups, auto top-up and cards through the API.
ListMyPaymentMethods	new features	Self-service balance, top-ups, auto top-up and cards through the API.
StartTopup	new features	Self-service balance, top-ups, auto top-up and cards through the API.
CancelPendingTopup	new features	Self-service balance, top-ups, auto top-up and cards through the API.
UpdateMyAutoTopupSettings	new features	Self-service balance, top-ups, auto top-up and cards through the API.
CreateMySetupIntent	new features	Self-service balance, top-ups, auto top-up and cards through the API.
SetMyDefaultPaymentMethod	new features	Self-service balance, top-ups, auto top-up and cards through the API.
DeleteMyPaymentMethod	new features	Self-service balance, top-ups, auto top-up and cards through the API.

BonusClaimAdminService

Operation	Kind	Change
ListBonusClaims	new features	Administrators can review, approve, reject and cancel bonus claims, and reveal contact details, through the API.
GetBonusClaimStats	new features	Administrators can review, approve, reject and cancel bonus claims, and reveal contact details, through the API.
GetBonusClaim	new features	Administrators can review, approve, reject and cancel bonus claims, and reveal contact details, through the API.
ListReviewQueue	new features	Administrators can review, approve, reject and cancel bonus claims, and reveal contact details, through the API.
GetReviewQueueCounts	new features	Administrators can review, approve, reject and cancel bonus claims, and reveal contact details, through the API.
GetBonusClaimAbuseSummary	new features	Administrators can review, approve, reject and cancel bonus claims, and reveal contact details, through the API.
ApproveBonusClaim	new features	Administrators can review, approve, reject and cancel bonus claims, and reveal contact details, through the API.
RejectBonusClaim	new features	Administrators can review, approve, reject and cancel bonus claims, and reveal contact details, through the API.
CancelBonusClaim	new features	Administrators can review, approve, reject and cancel bonus claims, and reveal contact details, through the API.
RevealBonusClaimPii	new features	Administrators can review, approve, reject and cancel bonus claims, and reveal contact details, through the API.

CatalogService

Operation	Kind	Change
AssignModelToProject	new features	AssignModelToProject and UnassignModelFromProject now accept a caller who holds the project.model.edit permission for the project, also when the caller is not one of the project's users. The permission can come from an organization role, a role on the project, or a management key's own role. An organization admin no longer has to be added to a project to manage its models. A management key uses only its own roles, not the roles of the user who owns it.
UnassignModelFromProject	new features	AssignModelToProject and UnassignModelFromProject now accept a caller who holds the project.model.edit permission for the project, also when the caller is not one of the project's users. The permission can come from an organization role, a role on the project, or a management key's own role. An organization admin no longer has to be added to a project to manage its models. A management key uses only its own roles, not the roles of the user who owns it.
UpsertProvider	bug fixes	UpsertProvider refuses to create an enabled provider with no auth scheme, and refuses to enable a provider that has none. Such a provider made API key creation fail for every tenant until it was deleted. Send supported_auth_schemes, or keep the provider disabled.

ClientsService

Operation	Kind	Change
DeleteClient	new features	Developers can rename, enable, disable and delete their own keys, list their revoked and deleted keys, and delete a client that has no live key. Enabling a revoked or destroyed key returns FAILED_PRECONDITION.

CustomerRequestLogsService

Operation	Kind	Change
ListCustomerRequestLogs	behaviour changes	CustomerRequestLogsService.ListCustomerRequestLogs now matches only the full request ID, comparing the UUID part without regard to case.

GatewayAuthPolicyService

Operation	Kind	Change
CreateGatewayAuthPolicy	security updates	A jwt gateway auth policy must now name at least one audience, and a jit identity mapping rule must set claim_value_template or set match_every_claim_value to true. A policy stored with no audience can still be updated without one. A jit rule without jit_principal_cap now creates no principal once its project holds 100 external principals.
UpdateGatewayAuthPolicy	security updates	A jwt gateway auth policy must now name at least one audience, and a jit identity mapping rule must set claim_value_template or set match_every_claim_value to true. A policy stored with no audience can still be updated without one. A jit rule without jit_principal_cap now creates no principal once its project holds 100 external principals.
CreateIdentityMappingRule	security updates	A jwt gateway auth policy must now name at least one audience, and a jit identity mapping rule must set claim_value_template or set match_every_claim_value to true. A policy stored with no audience can still be updated without one. A jit rule without jit_principal_cap now creates no principal once its project holds 100 external principals.
GetPrivateAddressSettings	new features	An Organization's super_admin can now let the management plane accept an identity provider on a private network for that Organization alone, for gateway auth policy keys and for project OIDC contracts, without asking the deployment's operator. Each setting takes ALLOW, DENY or INHERIT, and the Organization's choice wins over the deployment's own setting. An admin API key cannot change either one.
SetPrivateAddressSettings	new features	An Organization's super_admin can now let the management plane accept an identity provider on a private network for that Organization alone, for gateway auth policy keys and for project OIDC contracts, without asking the deployment's operator. Each setting takes ALLOW, DENY or INHERIT, and the Organization's choice wins over the deployment's own setting. An admin API key cannot change either one.

GuardrailProvidersService

Operation	Kind	Change
SetGuardrailProviderSecret	new features	Guardrail providers can be Amazon Bedrock Guardrails (kind bedrockguardrails): set region, optional endpoint and timeout, store a static AWS key pair with aws_credentials, and bind each rule to a guardrail ID and version. A rule bound to DRAFT returns a warning. Rule writes are refused while a data plane serving the rule's project, or for an organization-scope rule any data plane in the organization, runs a build older than 0.11.0 or has not reported a readable build.

GuardrailsService

Operation	Kind	Change
CreateGuardrailRule	new features	Guardrail providers can be Amazon Bedrock Guardrails (kind bedrockguardrails): set region, optional endpoint and timeout, store a static AWS key pair with aws_credentials, and bind each rule to a guardrail ID and version. A rule bound to DRAFT returns a warning. Rule writes are refused while a data plane serving the rule's project, or for an organization-scope rule any data plane in the organization, runs a build older than 0.11.0 or has not reported a readable build.
UpdateGuardrailRule	new features	Guardrail providers can be Amazon Bedrock Guardrails (kind bedrockguardrails): set region, optional endpoint and timeout, store a static AWS key pair with aws_credentials, and bind each rule to a guardrail ID and version. A rule bound to DRAFT returns a warning. Rule writes are refused while a data plane serving the rule's project, or for an organization-scope rule any data plane in the organization, runs a build older than 0.11.0 or has not reported a readable build.

IdentityService

Operation	Kind	Change
SetUserPassword	new features	SetUserPassword (POST /v1/users/{user_id}/password) lets a Super Admin set another user's password. It signs that user out everywhere and is recorded in the audit log as SET_USER_PASSWORD.

MCPCatalogService

Operation	Kind	Change
SetCatalogServerTools	new features	MCP catalog servers now return their tools, last tool fetch time and error, install examples and metadata, and SetCatalogServerTools saves a server's tools. The list organization admins see leaves out metadata and the fetch error.
GetCatalogServer	new features	MCP catalog servers now return their tools, last tool fetch time and error, install examples and metadata, and SetCatalogServerTools saves a server's tools. The list organization admins see leaves out metadata and the fetch error.
ListCatalogServers	new features	MCP catalog servers now return their tools, last tool fetch time and error, install examples and metadata, and SetCatalogServerTools saves a server's tools. The list organization admins see leaves out metadata and the fetch error.
ListCustomerCatalogServers	new features	MCP catalog servers now return their tools, last tool fetch time and error, install examples and metadata, and SetCatalogServerTools saves a server's tools. The list organization admins see leaves out metadata and the fetch error.
CreateCatalogServer	new features	CreateCatalogServer adds an MCP catalog server and returns ALREADY_EXISTS for an id in use. UpdateCatalogServer edits one and returns NOT_FOUND for an id that does not exist, so an edit never brings back a deleted server. UpsertCatalogServer is unchanged.
UpdateCatalogServer	new features	CreateCatalogServer adds an MCP catalog server and returns ALREADY_EXISTS for an id in use. UpdateCatalogServer edits one and returns NOT_FOUND for an id that does not exist, so an edit never brings back a deleted server. UpsertCatalogServer is unchanged.

MCPProfilesService

Operation	Kind	Change
AddMCPProfileServer	behaviour changes	Attaching an MCP server to an oauth MCP profile returns invalid_argument unless the request lists 1 to 32 distinct tool names or regex: patterns, with regex:* for every tool. An empty list and blank, padded or repeated entries are refused. A request that repeats the MCP server's current tools on that profile is accepted, so the token of an MCP server attached before this rule can still be rotated. Profiles of type none and api_key keep the empty list meaning every tool.
SetMCPProfileServerTools	behaviour changes	Setting the tools of a server attached to an oauth MCP profile returns invalid_argument unless the request lists 1 to 32 distinct tool names or regex: patterns, with regex:* for every tool. An empty list and blank, padded or repeated entries are refused, and the stored list stays as it was. Profiles of type none and api_key keep the empty list meaning every tool.
UpdateMCPProfile	behaviour changes	Updating an MCP profile of type none or api_key to type oauth returns failed_precondition and names the MCP server when an attached MCP server has a tool list an oauth profile refuses, such as an empty list. The profile keeps its type. Tool names and regex: patterns, including regex:*, do not block the update. A profile that is already oauth is not checked by this rule.
CreateMCPProfile	behaviour changes	Creating an MCP profile with a security type other than oauth, api_key or none returns invalid_argument, and so does an update that changes the type to such a value. Spellings such as OAuth and oauth2 were accepted before and served with no token check. An update that leaves the type unset, or sends the type the profile already has, is accepted, so a profile stored with another type can still be renamed.
UpdateMCPProfile	behaviour changes	Creating an MCP profile with a security type other than oauth, api_key or none returns invalid_argument, and so does an update that changes the type to such a value. Spellings such as OAuth and oauth2 were accepted before and served with no token check. An update that leaves the type unset, or sends the type the profile already has, is accepted, so a profile stored with another type can still be renamed.
CreateMCPProfile	behaviour changes	Creating an MCP profile of type oauth returns invalid_argument unless security_policy_value sets issuer and remote_jwks, an absolute http or https URL. An update returns the same error when it changes the type to oauth, the issuer or the key set URL and leaves either missing or invalid. An update that changes none of them is accepted, so a profile saved without them can still be renamed.
UpdateMCPProfile	behaviour changes	Creating an MCP profile of type oauth returns invalid_argument unless security_policy_value sets issuer and remote_jwks, an absolute http or https URL. An update returns the same error when it changes the type to oauth, the issuer or the key set URL and leaves either missing or invalid. An update that changes none of them is accepted, so a profile saved without them can still be renamed.
UpdateMCPProfile	bug fixes	A request with a NUL character in a name, description or filter field now returns 400 invalid_argument. It returned 500 internal before, which clients retry and which counted as a server failure. This applies when the management plane uses the extended query protocol, which is the default. A deployment that sets global.useSimpleProtocol (USE_QUERY_EXEC_MODE_SIMPLE_PROTOCOL=true, used with pgbouncer) still returns 500 for these requests.

MeService

Operation	Kind	Change
ListMyKeys	behaviour changes	Your API keys with no stored key type, from before key types were stored, now report API_KEY_TYPE_MANAGEMENT, the type they work as. They reported API_KEY_TYPE_PROMPT before.
UpdateMyKey	behaviour changes	Your API keys with no stored key type, from before key types were stored, now report API_KEY_TYPE_MANAGEMENT, the type they work as. They reported API_KEY_TYPE_PROMPT before.
GetMe	new features	GetMe session claims carry platform_permissions, the permissions of the user's platform-level role bindings, held directly or through a group. A call that names no customer_id to a platform-wide method, such as GetModel or GetUsageStats, passes the permission check when the method's permission is in this set. The claim is left out when the set cannot be read.
UpdateMyKey	new features	Developers can rename, enable, disable and delete their own keys, list their revoked and deleted keys, and delete a client that has no live key. Enabling a revoked or destroyed key returns FAILED_PRECONDITION.
RevokeMyKey	new features	Developers can rename, enable, disable and delete their own keys, list their revoked and deleted keys, and delete a client that has no live key. Enabling a revoked or destroyed key returns FAILED_PRECONDITION.
ListMyKeys	new features	Developers can rename, enable, disable and delete their own keys, list their revoked and deleted keys, and delete a client that has no live key. Enabling a revoked or destroyed key returns FAILED_PRECONDITION.
ListMyKeys	new features	Listed API keys show the title of their client.
ListMyKeys	new features	Listed API keys carry standalone, true for a key with no client of its own.
ListAssignableKeyScopes	new features	ListAssignableKeyScopes takes an optional project_id and answers for a management key in that project, with the permission check IssueMyKey applies there. The Developer Console scope picker uses it for the project of the key. The Developer Console now renames, enables, disables and deletes a key as the signed-in user, through MeService.UpdateMyKey and MeService.RevokeMyKey.

PolicyService

Operation	Kind	Change
ListFallbackChainPolicies	new features	ListApiKeys lists the keys of one organization or project, with status, owner, text and ID filters, a filter for the keys that can hold their own fallback policy (override_targetable_only), sorting, counts and the key owners. Keys show their client, disabled state and deletion time. A fallback policy that targets a key shows the project of that key. A management key bound to an organization gets PERMISSION_DENIED for another organization's keys.
CreateBudgetPolicy	new features	An organization admin can now create a project budget, which applies to every API key in the project. With the BLOCK action the budget stops traffic at its limit, and with the default MONITOR action it records spend and alerts without stopping traffic. A project admin cannot create one or move another budget onto project scope, and can still edit, enable, disable and delete their own project's budget.
UpdateBudgetPolicy	new features	An organization admin can now create a project budget, which applies to every API key in the project. With the BLOCK action the budget stops traffic at its limit, and with the default MONITOR action it records spend and alerts without stopping traffic. A project admin cannot create one or move another budget onto project scope, and can still edit, enable, disable and delete their own project's budget.
CreateRateLimitPolicy	bug fixes	Changes that check a data plane's version, such as provider overrides, shared and catch-all hostnames, OIDC contracts and the newer rate-limit dimensions, no longer refuse a data plane on 0.11.0 or newer that was just upgraded or has had no configuration change for a day, because it now reports its version on every poll. A data plane silent for 24 hours is refused as down, disconnected or older than 0.11.0, with a prompt to check its connection and build.
UpdateRateLimitPolicy	bug fixes	Changes that check a data plane's version, such as provider overrides, shared and catch-all hostnames, OIDC contracts and the newer rate-limit dimensions, no longer refuse a data plane on 0.11.0 or newer that was just upgraded or has had no configuration change for a day, because it now reports its version on every poll. A data plane silent for 24 hours is refused as down, disconnected or older than 0.11.0, with a prompt to check its connection and build.
SetRateLimitPolicyStatus	bug fixes	Changes that check a data plane's version, such as provider overrides, shared and catch-all hostnames, OIDC contracts and the newer rate-limit dimensions, no longer refuse a data plane on 0.11.0 or newer that was just upgraded or has had no configuration change for a day, because it now reports its version on every poll. A data plane silent for 24 hours is refused as down, disconnected or older than 0.11.0, with a prompt to check its connection and build.

ProjectsService

Operation	Kind	Change
ArchiveProject	behaviour changes	Deleting or archiving a project now also hides the API keys that were revoked before it, so a new project with the same name does not list them as its own. ListApiKeys reports these keys as API_KEY_STATUS_DELETED, not API_KEY_STATUS_REVOKED; each keeps its revocation stamp and stays on the data plane's revocation list.
CreateProject	bug fixes	A request with a NUL character in a name, description or filter field now returns 400 invalid_argument. It returned 500 internal before, which clients retry and which counted as a server failure. This applies when the management plane uses the extended query protocol, which is the default. A deployment that sets global.useSimpleProtocol (USE_QUERY_EXEC_MODE_SIMPLE_PROTOCOL=true, used with pgbouncer) still returns 500 for these requests.

RequestLogsService

Operation	Kind	Change
QueryRequestLogs	behaviour changes	RequestLogsService.QueryRequestLogs now matches only the full request ID, comparing the UUID part without regard to case.
QueryRequestLogs	new features	Request logs show the project, provider, and the attribute routing rule that picked the model or the rate limit that refused it, and flag unexplained model changes. QueryRequestLogs filters by policy (policy_filter, policy_type), except for requests in long-term storage (GetRequestLog still shows their policies). Credential headers (authorization, cookie, x-tars-api-key) are masked on every request log read.
GetRequestLog	new features	Request logs show the project, provider, and the attribute routing rule that picked the model or the rate limit that refused it, and flag unexplained model changes. QueryRequestLogs filters by policy (policy_filter, policy_type), except for requests in long-term storage (GetRequestLog still shows their policies). Credential headers (authorization, cookie, x-tars-api-key) are masked on every request log read.
GetUsageStats	new features	GET /v1/usage/stats takes group_keys, which keeps only the named groups, and subgroup_by, which splits each group by model, user, api_key or usage_mode. Each split group carries its subgroup_keys and no series, and ordering, paging and total_groups count the split groups.

SecretService

Operation	Kind	Change
CreateSecret	bug fixes	A secret keeps the tags it was created with. CreateSecret, GetSecret, ListSecrets and RotateSecret return them, and creating the secret again replaces them. Tags sent before this release were not stored, so those secrets have none until they are created again.
GetSecret	bug fixes	A secret keeps the tags it was created with. CreateSecret, GetSecret, ListSecrets and RotateSecret return them, and creating the secret again replaces them. Tags sent before this release were not stored, so those secrets have none until they are created again.
ListSecrets	bug fixes	A secret keeps the tags it was created with. CreateSecret, GetSecret, ListSecrets and RotateSecret return them, and creating the secret again replaces them. Tags sent before this release were not stored, so those secrets have none until they are created again.
RotateSecret	bug fixes	A secret keeps the tags it was created with. CreateSecret, GetSecret, ListSecrets and RotateSecret return them, and creating the secret again replaces them. Tags sent before this release were not stored, so those secrets have none until they are created again.

v0.10.1

No API operations changed in this release.

v0.10.0

AdminService

Operation	Kind	Change
QueryAuditLogs	behaviour changes	Fleet audit reads require explicit platform permissions; organization admin and audit reader scopes no longer grant fleet access. An organization admin who called these methods before keeps working, but sees only their own organization's records, and only records written from 0.10 on, because earlier records have no organization owner.
GetAuditLog	behaviour changes	Fleet audit reads require explicit platform permissions; organization admin and audit reader scopes no longer grant fleet access. An organization admin who called these methods before keeps working, but sees only their own organization's records, and only records written from 0.10 on, because earlier records have no organization owner.
QueryPlatformAuditLogs	behaviour changes	Fleet audit reads require explicit platform permissions; organization admin and audit reader scopes no longer grant fleet access. An organization admin who called these methods before keeps working, but sees only their own organization's records, and only records written from 0.10 on, because earlier records have no organization owner.
AddProjectMember	behaviour changes	Removing users from a project or demoting them protects assignments of the built-in Project Owner role held by users who have not been deleted. Admin memberships, custom roles and directly granted permissions do not count as Project Owner assignments.
UpdateProjectMember	behaviour changes	Removing users from a project or demoting them protects assignments of the built-in Project Owner role held by users who have not been deleted. Admin memberships, custom roles and directly granted permissions do not count as Project Owner assignments.
RemoveProjectMember	behaviour changes	Removing users from a project or demoting them protects assignments of the built-in Project Owner role held by users who have not been deleted. Admin memberships, custom roles and directly granted permissions do not count as Project Owner assignments.
UpsertProjectOIDCConfig	behaviour changes	Writing a project's OIDC contract is refused on Agent Router Service (SaaS). Enabling a contract is refused while a data plane serving the project runs a build older than 0.10.0 or has not reported its build, and so is attaching a project whose contract is enabled to such a data plane. Each refusal names the data plane.
AttachProjectGatewayProject	behaviour changes	Writing a project's OIDC contract is refused on Agent Router Service (SaaS). Enabling a contract is refused while a data plane serving the project runs a build older than 0.10.0 or has not reported its build, and so is attaching a project whose contract is enabled to such a data plane. Each refusal names the data plane.
AddDataplaneProject	behaviour changes	Writing a project's OIDC contract is refused on Agent Router Service (SaaS). Enabling a contract is refused while a data plane serving the project runs a build older than 0.10.0 or has not reported its build, and so is attaching a project whose contract is enabled to such a data plane. Each refusal names the data plane.
QueryAuditLogs	security updates	Organization-scoped audit reads show records with trusted ownership stamps; fleet-wide reads require an explicit platform audit grant.
GetAuditLog	security updates	Organization-scoped audit reads show records with trusted ownership stamps; fleet-wide reads require an explicit platform audit grant.
QueryPlatformAuditLogs	security updates	Organization-scoped audit reads show records with trusted ownership stamps; fleet-wide reads require an explicit platform audit grant.
QueryCustomerAuditLogs	security updates	Organization-scoped audit reads show records with trusted ownership stamps; fleet-wide reads require an explicit platform audit grant.
GetCustomerAuditLog	security updates	Organization-scoped audit reads show records with trusted ownership stamps; fleet-wide reads require an explicit platform audit grant.
QueryAuditLogs	security updates	Provisioned admin-scoped secrets also gain QueryAuditLogs and GetAuditLog, with the same fleet visibility already available through QueryPlatformAuditLogs.
GetAuditLog	security updates	Provisioned admin-scoped secrets also gain QueryAuditLogs and GetAuditLog, with the same fleet visibility already available through QueryPlatformAuditLogs.
RemoveProjectMcpServer	security updates	Removing a catalog MCP server from a project now also detaches it from the legacy MCP profiles of users in the project, and editing the tools of a server that the project no longer grants is refused with PERMISSION_DENIED. Before, a legacy profile kept serving a server after its grant was removed.
UpsertCatalogModel	new features	UpsertModel takes clear_fields, to clear stored values such as a price, the context window or the backend URLs, and remove_metadata_keys, to remove metadata keys. A request that sets neither works as before.
QueryCustomerAuditLogs	new features	Organization audit log reads now include customer update and archive, project, project member, AI key, model assignment, MCP profile, MCP profile act-as, MCP OAuth client, API key, budget alert, data plane and project gateway changes, and on a single-organization deployment user role and SSO provider changes. Refused requests and fleet-wide actions stay out, and so do records written before the upgrade. That is because no earlier release writes an organization owner on an audit record.
GetCustomerAuditLog	new features	Organization audit log reads now include customer update and archive, project, project member, AI key, model assignment, MCP profile, MCP profile act-as, MCP OAuth client, API key, budget alert, data plane and project gateway changes, and on a single-organization deployment user role and SSO provider changes. Refused requests and fleet-wide actions stay out, and so do records written before the upgrade. That is because no earlier release writes an organization owner on an audit record.
GetProjectOIDCConfig	new features	A project's OIDC contract now names the token claim that identifies one caller, identity_claim, which is sub unless you name another, and how many callers the project may hold, principal_cap, which is 100 unless you set one at least 1. On a 0.10.0 data plane each caller gets its own API key, so budgets and rate limits apply per caller. The cap is enforced when a data plane resolves a contract caller. Existing contracts get both defaults. Omitting either field on a write keeps the stored value.
UpsertProjectOIDCConfig	new features	A project's OIDC contract now names the token claim that identifies one caller, identity_claim, which is sub unless you name another, and how many callers the project may hold, principal_cap, which is 100 unless you set one at least 1. On a 0.10.0 data plane each caller gets its own API key, so budgets and rate limits apply per caller. The cap is enforced when a data plane resolves a contract caller. Existing contracts get both defaults. Omitting either field on a write keeps the stored value.
QueryAuditLogs	deprecations	Calling the fleet audit methods as an organization admin, without a platform audit grant, is deprecated and will be refused in a later release. In 0.10 these calls return only the caller's own organization's records, and only records written from 0.10 on, because records written before the upgrade have no organization owner. The management plane logs a deprecation warning on each such call. Use QueryCustomerAuditLogs and GetCustomerAuditLog for organization reads.
GetAuditLog	deprecations	Calling the fleet audit methods as an organization admin, without a platform audit grant, is deprecated and will be refused in a later release. In 0.10 these calls return only the caller's own organization's records, and only records written from 0.10 on, because records written before the upgrade have no organization owner. The management plane logs a deprecation warning on each such call. Use QueryCustomerAuditLogs and GetCustomerAuditLog for organization reads.
QueryPlatformAuditLogs	deprecations	Calling the fleet audit methods as an organization admin, without a platform audit grant, is deprecated and will be refused in a later release. In 0.10 these calls return only the caller's own organization's records, and only records written from 0.10 on, because records written before the upgrade have no organization owner. The management plane logs a deprecation warning on each such call. Use QueryCustomerAuditLogs and GetCustomerAuditLog for organization reads.

CatalogService

Operation	Kind	Change
DeleteModel	behaviour changes	Deleting a model now also removes its project assignments, in the same change. The audit record counts them in metadata.project_assignments_removed.
CreateModel	behaviour changes	In single-organization installs, a Model Admin can now create, edit and delete models through the API with their own session. A user who holds the Platform Model Admin role can do the same in any install. GetModel now also accepts a platform grant of models.read, as ListModels does.
UpsertModel	behaviour changes	In single-organization installs, a Model Admin can now create, edit and delete models through the API with their own session. A user who holds the Platform Model Admin role can do the same in any install. GetModel now also accepts a platform grant of models.read, as ListModels does.
DeleteModel	behaviour changes	In single-organization installs, a Model Admin can now create, edit and delete models through the API with their own session. A user who holds the Platform Model Admin role can do the same in any install. GetModel now also accepts a platform grant of models.read, as ListModels does.
ListModels	behaviour changes	In single-organization installs, a Model Admin can now create, edit and delete models through the API with their own session. A user who holds the Platform Model Admin role can do the same in any install. GetModel now also accepts a platform grant of models.read, as ListModels does.
GetModel	behaviour changes	In single-organization installs, a Model Admin can now create, edit and delete models through the API with their own session. A user who holds the Platform Model Admin role can do the same in any install. GetModel now also accepts a platform grant of models.read, as ListModels does.
ListModels	new features	ListModels and GetModel take an optional customer_id and project_id, so a user with an organization role that can read models, such as a Viewer, can read the model catalog. A read that names customer_id leaves out the aigw-headers metadata key. New REST paths: GET /v1/customers/{customer_id}/catalog/models and GET /v1/customers/{customer_id}/catalog/models/{id}.
GetModel	new features	ListModels and GetModel take an optional customer_id and project_id, so a user with an organization role that can read models, such as a Viewer, can read the model catalog. A read that names customer_id leaves out the aigw-headers metadata key. New REST paths: GET /v1/customers/{customer_id}/catalog/models and GET /v1/customers/{customer_id}/catalog/models/{id}.
CreateModel	new features	CreateModel adds a model and returns ALREADY_EXISTS when the provider already has a model of that name. The provider rules run first: a create under a disabled provider that leaves is_enabled unset returns FAILED_PRECONDITION, also when the model exists. REST: POST /v1/catalog/models:create. CLI: tetrate agentrouter api catalog models create.
UpsertModel	new features	UpsertModel takes clear_fields, to clear stored values such as a price, the context window or the backend URLs, and remove_metadata_keys, to remove metadata keys. A request that sets neither works as before.

GatewayAuthPolicyService

Operation	Kind	Change
CreateGatewayAuthPolicy	behaviour changes	Creating a GatewayAuthPolicy, or changing its extraction_header, is now refused when the header is x-tars-project or x-tars-project-id, because the data plane reads either one as the request's project. A policy already stored with one of them keeps it, and a data plane on 0.10.0 refuses the token calls it verifies with extraction_header_conflict, including calls that send the token in Authorization.
UpdateGatewayAuthPolicy	behaviour changes	Creating a GatewayAuthPolicy, or changing its extraction_header, is now refused when the header is x-tars-project or x-tars-project-id, because the data plane reads either one as the request's project. A policy already stored with one of them keeps it, and a data plane on 0.10.0 refuses the token calls it verifies with extraction_header_conflict, including calls that send the token in Authorization.
CreateClaimProjectBinding	new features	An application can leave out x-tars-project when its GatewayAuthPolicy binds a claim value to a project, and the data plane acts in that project. Calls matching no binding, bindings for two projects, or a bound project that is unserved or rejects tokens are refused with 403. When the data plane auth config passes its size cap and a policy's bindings are left out, such calls answer 503 bindings_unavailable until the bindings shrink or the caller sends x-tars-project.
ListClaimProjectBindings	new features	An application can leave out x-tars-project when its GatewayAuthPolicy binds a claim value to a project, and the data plane acts in that project. Calls matching no binding, bindings for two projects, or a bound project that is unserved or rejects tokens are refused with 403. When the data plane auth config passes its size cap and a policy's bindings are left out, such calls answer 503 bindings_unavailable until the bindings shrink or the caller sends x-tars-project.
DeleteClaimProjectBinding	new features	An application can leave out x-tars-project when its GatewayAuthPolicy binds a claim value to a project, and the data plane acts in that project. Calls matching no binding, bindings for two projects, or a bound project that is unserved or rejects tokens are refused with 403. When the data plane auth config passes its size cap and a policy's bindings are left out, such calls answer 503 bindings_unavailable until the bindings shrink or the caller sends x-tars-project.

IdentityService

Operation	Kind	Change
BanUser	security updates	Banning or deleting a user now revokes their MCP OAuth refresh tokens and unredeemed authorization codes, and /oauth/token refuses every grant for a banned or deleted user with invalid_grant. A token exchange no longer creates an account for a deleted email address, and an authorization code can no longer be redeemed twice. Unbanning a deleted user fails with FAILED_PRECONDITION; restore it instead. An MCP access token already issued stays valid until it expires, 24 hours by default.
DeleteUser	security updates	Banning or deleting a user now revokes their MCP OAuth refresh tokens and unredeemed authorization codes, and /oauth/token refuses every grant for a banned or deleted user with invalid_grant. A token exchange no longer creates an account for a deleted email address, and an authorization code can no longer be redeemed twice. Unbanning a deleted user fails with FAILED_PRECONDITION; restore it instead. An MCP access token already issued stays valid until it expires, 24 hours by default.
UnbanUser	security updates	Banning or deleting a user now revokes their MCP OAuth refresh tokens and unredeemed authorization codes, and /oauth/token refuses every grant for a banned or deleted user with invalid_grant. A token exchange no longer creates an account for a deleted email address, and an authorization code can no longer be redeemed twice. Unbanning a deleted user fails with FAILED_PRECONDITION; restore it instead. An MCP access token already issued stays valid until it expires, 24 hours by default.

MCPProfilesService

Operation	Kind	Change
CreateMCPProfile	behaviour changes	MCP profile audit entries name the person who acted. When an API key makes the call, the key is in metadata.via_key; when an admin acts for another user, that user is in metadata.subject_user_id.
UpdateMCPProfile	behaviour changes	MCP profile audit entries name the person who acted. When an API key makes the call, the key is in metadata.via_key; when an admin acts for another user, that user is in metadata.subject_user_id.
DeleteMCPProfile	behaviour changes	MCP profile audit entries name the person who acted. When an API key makes the call, the key is in metadata.via_key; when an admin acts for another user, that user is in metadata.subject_user_id.
AddMCPProfileServer	behaviour changes	MCP profile audit entries name the person who acted. When an API key makes the call, the key is in metadata.via_key; when an admin acts for another user, that user is in metadata.subject_user_id.
RemoveMCPProfileServer	behaviour changes	MCP profile audit entries name the person who acted. When an API key makes the call, the key is in metadata.via_key; when an admin acts for another user, that user is in metadata.subject_user_id.
SetMCPProfileServerTools	behaviour changes	MCP profile audit entries name the person who acted. When an API key makes the call, the key is in metadata.via_key; when an admin acts for another user, that user is in metadata.subject_user_id.
SetMCPProfileServerTools	security updates	Removing a catalog MCP server from a project now also detaches it from the legacy MCP profiles of users in the project, and editing the tools of a server that the project no longer grants is refused with PERMISSION_DENIED. Before, a legacy profile kept serving a server after its grant was removed.
ListMCPProfiles	new features	MCP profile reads can span every project you belong to (all_projects, CLI --all-projects) and can include each attached server's name, icon and tools (include_tools).
GetMCPProfile	new features	MCP profile reads can span every project you belong to (all_projects, CLI --all-projects) and can include each attached server's name, icon and tools (include_tools).
UpdateMCPProfile	bug fixes	UpdateMCPProfile clears a profile's description when the request sends a blank description, as the API reference says. Before, the blank was stored.
AddMCPProfileServer	bug fixes	A server attached to an MCP profile through the API reaches every data plane at once. A failed attach keeps the server's previous token.

MeService

Operation	Kind	Change
ListAssignableKeyScopes	new features	GET /v1/me/assignable-key-scopes lists the scopes an organization API key can carry and which of them you can grant, to anyone who can create the key, including the User Admin role.
GetMe	new features	GetMe session claims carry can_open_admin_console, which says whether the Developer Console should offer the Admin Console: true when the user holds any org-level permission, or a project admin row or project binding that can add, edit or remove users in the project. It is not an access check; false does not stop someone with a narrower project grant from entering, and the claim is left out when the answer is unknown.
ListMyProjects	bug fixes	Listing your projects no longer shows the admin role on every project for a custom organization role that can add, remove or edit users in the project. It was listed as admin everywhere, and the Developer Console let it try changes it was then refused. Organization admins, platform admins and organization-wide API keys with owner access still show admin on every project.
ListMyReachableProjects	bug fixes	Listing your reachable projects now includes every project you or one of your groups in the organization hold a project binding on with any project permission, whether it comes from a custom project role or a permission granted on the binding itself. Before, a project bound without a settings or members read permission was missing from the Admin Console project switcher even though you could act in it.

PolicyService

Operation	Kind	Change
UpdateFallbackChainPolicy	behaviour changes	Updating a fallback policy is refused with INVALID_ARGUMENT when a changed chain is sent alone for a policy with several entries, or when chain and entries are both changed so they disagree. Before, the first merged the entries into one and the second saved entries.
CreateFallbackChainPolicy	behaviour changes	Saving a project's fallback or traffic split policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the project, matching what the data plane serves. Before, traffic split checked neither and fallback did not check providers. A tag policy is also refused when it names a disabled model.
UpdateFallbackChainPolicy	behaviour changes	Saving a project's fallback or traffic split policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the project, matching what the data plane serves. Before, traffic split checked neither and fallback did not check providers. A tag policy is also refused when it names a disabled model.
UpsertFallbackPolicy	behaviour changes	Saving a project's fallback or traffic split policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the project, matching what the data plane serves. Before, traffic split checked neither and fallback did not check providers. A tag policy is also refused when it names a disabled model.
SetFallbackChainPolicyStatus	behaviour changes	Saving a project's fallback or traffic split policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the project, matching what the data plane serves. Before, traffic split checked neither and fallback did not check providers. A tag policy is also refused when it names a disabled model.
CreateTrafficSplitPolicy	behaviour changes	Saving a project's fallback or traffic split policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the project, matching what the data plane serves. Before, traffic split checked neither and fallback did not check providers. A tag policy is also refused when it names a disabled model.
UpdateTrafficSplitPolicy	behaviour changes	Saving a project's fallback or traffic split policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the project, matching what the data plane serves. Before, traffic split checked neither and fallback did not check providers. A tag policy is also refused when it names a disabled model.
SetTrafficSplitPolicyStatus	behaviour changes	Saving a project's fallback or traffic split policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the project, matching what the data plane serves. Before, traffic split checked neither and fallback did not check providers. A tag policy is also refused when it names a disabled model.
ListFallbackChainPolicies	behaviour changes	Listing fallback or traffic-split policies for one API key now returns them only to the key's owner, the owners of its project, organization admins and admin keys. Other users and non-admin keys get a permission error.
ListTrafficSplitPolicies	behaviour changes	Listing fallback or traffic-split policies for one API key now returns them only to the key's owner, the owners of its project, organization admins and admin keys. Other users and non-admin keys get a permission error.
GetEffectivePolicy	behaviour changes	Active admin-scoped admin secrets gain the admin_console machine role at management-plane startup, so the Admin Console can read the effective attribute-routing policy of a key or a tag preview, and a policy's coverage. The role is not assignable to users or groups.
GetPolicyCoverage	behaviour changes	Active admin-scoped admin secrets gain the admin_console machine role at management-plane startup, so the Admin Console can read the effective attribute-routing policy of a key or a tag preview, and a policy's coverage. The role is not assignable to users or groups.
CreateBudgetPolicy	security updates	Project admins can now create budgets only for their own project's API keys, and edit, enable, disable or delete only the budgets of their own project and its API keys. Team, user, tag and organization-wide budgets, and other projects' budgets, need an organization admin.
UpdateBudgetPolicy	security updates	Project admins can now create budgets only for their own project's API keys, and edit, enable, disable or delete only the budgets of their own project and its API keys. Team, user, tag and organization-wide budgets, and other projects' budgets, need an organization admin.
SetBudgetPolicyStatus	security updates	Project admins can now create budgets only for their own project's API keys, and edit, enable, disable or delete only the budgets of their own project and its API keys. Team, user, tag and organization-wide budgets, and other projects' budgets, need an organization admin.
DeleteBudgetPolicy	security updates	Project admins can now create budgets only for their own project's API keys, and edit, enable, disable or delete only the budgets of their own project and its API keys. Team, user, tag and organization-wide budgets, and other projects' budgets, need an organization admin.
CreateUserGroup	security updates	Creating, renaming or deleting a team, and adding or removing its users, through the API now needs an organization admin. Project admins can no longer change teams, which apply across every project. Users whose role lets them manage teams can still do so in the Admin Console.
UpdateUserGroup	security updates	Creating, renaming or deleting a team, and adding or removing its users, through the API now needs an organization admin. Project admins can no longer change teams, which apply across every project. Users whose role lets them manage teams can still do so in the Admin Console.
DeleteUserGroup	security updates	Creating, renaming or deleting a team, and adding or removing its users, through the API now needs an organization admin. Project admins can no longer change teams, which apply across every project. Users whose role lets them manage teams can still do so in the Admin Console.
AddUserGroupMembers	security updates	Creating, renaming or deleting a team, and adding or removing its users, through the API now needs an organization admin. Project admins can no longer change teams, which apply across every project. Users whose role lets them manage teams can still do so in the Admin Console.
RemoveUserGroupMembers	security updates	Creating, renaming or deleting a team, and adding or removing its users, through the API now needs an organization admin. Project admins can no longer change teams, which apply across every project. Users whose role lets them manage teams can still do so in the Admin Console.
UpdateFallbackChainPolicy	bug fixes	Editing chain in a fallback policy you read back now saves; before, the entries sent with it won and the edit was ignored.

ProjectsService

Operation	Kind	Change
AddProjectMember	behaviour changes	Removing users from a project or demoting them protects assignments of the built-in Project Owner role held by users who have not been deleted. Admin memberships, custom roles and directly granted permissions do not count as Project Owner assignments.
UpdateProjectMember	behaviour changes	Removing users from a project or demoting them protects assignments of the built-in Project Owner role held by users who have not been deleted. Admin memberships, custom roles and directly granted permissions do not count as Project Owner assignments.
RemoveProjectMember	behaviour changes	Removing users from a project or demoting them protects assignments of the built-in Project Owner role held by users who have not been deleted. Admin memberships, custom roles and directly granted permissions do not count as Project Owner assignments.

RequestLogsService

Operation	Kind	Change
ListMcpOperations	behaviour changes	Existing metrics_reader keys can read their organization's individual MCP calls. Client addresses and error messages stay hidden unless the key also has the admin or request_logs_reader scope.
GetMcpOperationStats	new features	GET /v1/mcp-operations and GET /v1/mcp-operations/stats list and summarize an organization's MCP calls by session, profile, backend, tool, client or method. Calls recorded before the upgrade belong to no organization, so these reads leave them out until they age out after 30 days; only platform readers see them.
ListMcpOperations	new features	GET /v1/mcp-operations and GET /v1/mcp-operations/stats list and summarize an organization's MCP calls by session, profile, backend, tool, client or method. Calls recorded before the upgrade belong to no organization, so these reads leave them out until they age out after 30 days; only platform readers see them.
GetUsageStats	new features	GET /v1/usage/stats takes a caller_type filter: idp keeps the usage of identity-provider applications and api_key keeps every other caller's. Totals, the series, distinct counts and groups all count the kept usage only.

v0.9.2

No API operations changed in this release.

v0.9.1

No API operations changed in this release.

v0.9.0

AdminService

Operation	Kind	Change
QueryAuditLogs	behaviour changes	Audit records for changes made through the Developer Console now name the signed-in user and their email instead of the console's service key. The key ID moves to metadata.via_key. Admin Console calls that already send X-Acting-Session-Token change the same way: user_id changes from the key to the person, and metadata.via_key is added. Audit records of a user or management-key caller now also carry the caller's email.
QueryPlatformAuditLogs	behaviour changes	Audit records for changes made through the Developer Console now name the signed-in user and their email instead of the console's service key. The key ID moves to metadata.via_key. Admin Console calls that already send X-Acting-Session-Token change the same way: user_id changes from the key to the person, and metadata.via_key is added. Audit records of a user or management-key caller now also carry the caller's email.
QueryAuditLogs	behaviour changes	An audit record is now written in the same transaction as the change it records. A change that fails or is refused leaves one record with success set to false. Changes made through the workspace API are now audited too.
QueryPlatformAuditLogs	behaviour changes	An audit record is now written in the same transaction as the change it records. A change that fails or is refused leaves one record with success set to false. Changes made through the workspace API are now audited too.
QueryAuditLogs	behaviour changes	The Developer Console no longer writes its own audit records for key rotation, management-key create and delete, and project telemetry changes; the server's ROTATE_CLIENT_KEY, ISSUE_MY_KEY, REVOKE_MY_KEY and CREATE_ or UPDATE_TELEMETRY_CONFIG records cover them. A legacy key rotation (no client) keeps the console record until a later release. A data plane upgrade outcome is now one FINISH_DATAPLANE_UPGRADE record with the final phase in metadata.phase; only Completed has success set to true.
QueryPlatformAuditLogs	behaviour changes	The Developer Console no longer writes its own audit records for key rotation, management-key create and delete, and project telemetry changes; the server's ROTATE_CLIENT_KEY, ISSUE_MY_KEY, REVOKE_MY_KEY and CREATE_ or UPDATE_TELEMETRY_CONFIG records cover them. A legacy key rotation (no client) keeps the console record until a later release. A data plane upgrade outcome is now one FINISH_DATAPLANE_UPGRADE record with the final phase in metadata.phase; only Completed has success set to true.
QueryAuditLogs	behaviour changes	Until a later release removes the Admin Console's own audit records, an Admin Console change that the server audits leaves two records, and both now name the signed-in user: the console's and the server's. For example, a data plane update writes UPDATE from the console, and UPDATE_DATAPLANE with metadata.via_key from the server.
QueryPlatformAuditLogs	behaviour changes	Until a later release removes the Admin Console's own audit records, an Admin Console change that the server audits leaves two records, and both now name the signed-in user: the console's and the server's. For example, a data plane update writes UPDATE from the console, and UPDATE_DATAPLANE with metadata.via_key from the server.
QueryAuditLogs	behaviour changes	Audit records of Developer Console calls now carry the browser's user_agent, and the X-Forwarded-For chain that the console received in metadata.forwarded_for. source_ip stays the address of the console.
QueryPlatformAuditLogs	behaviour changes	Audit records of Developer Console calls now carry the browser's user_agent, and the X-Forwarded-For chain that the console received in metadata.forwarded_for. source_ip stays the address of the console.
RemoveProjectProvider	behaviour changes	Removing a provider from a project's allow-list fails with FAILED_PRECONDITION while the project still has models from that provider.
AddProjectProvider	behaviour changes	Adding or removing a provider on a project's allow-list through the API now needs the project provider permission, which Project Owner and Super Admin hold, as the Admin Console already did. Provider Admin and Model Admin no longer give it, and neither does a custom role with only the providers permissions.
RemoveProjectProvider	behaviour changes	Adding or removing a provider on a project's allow-list through the API now needs the project provider permission, which Project Owner and Super Admin hold, as the Admin Console already did. Provider Admin and Model Admin no longer give it, and neither does a custom role with only the providers permissions.
AddProjectProvider	new features	Project admins can add and remove the providers on their own project's allow-list.
RemoveProjectProvider	new features	Project admins can add and remove the providers on their own project's allow-list.
GetSystemSetting	new features	GetSystemSetting takes an optional include_config_event flag for guardrails.enabled. It returns the status of the latest push of that setting to your data planes in the last 24 hours.
QueryAuditLogs	new features	Audit log queries accept search, a case-insensitive match over the actor's email, user ID and type, the action, the resource type and ID, the correlation ID, the endpoint, the source IP and the error message. They also accept order_by, which sorts by actor, action, resource, source or outcome. A search that sets no start_time covers the 30 days before the end time (or now), from the start of that UTC day.
QueryPlatformAuditLogs	new features	Audit log queries accept search, a case-insensitive match over the actor's email, user ID and type, the action, the resource type and ID, the correlation ID, the endpoint, the source IP and the error message. They also accept order_by, which sorts by actor, action, resource, source or outcome. A search that sets no start_time covers the 30 days before the end time (or now), from the start of that UTC day.
ClearSystemSetting	new features	Data planes now carry stored_url, the URL stored for the data plane. When another organization uses the same data plane ID, stored_url is the first hostname your data plane declares, or empty. The new ClearSystemSetting unsets the proxy URL setting or the stored URL of one data plane.
GetDataplane	new features	Data planes now carry stored_url, the URL stored for the data plane. When another organization uses the same data plane ID, stored_url is the first hostname your data plane declares, or empty. The new ClearSystemSetting unsets the proxy URL setting or the stored URL of one data plane.
ListDataplanes	new features	Data planes now carry stored_url, the URL stored for the data plane. When another organization uses the same data plane ID, stored_url is the first hostname your data plane declares, or empty. The new ClearSystemSetting unsets the proxy URL setting or the stored URL of one data plane.
EnsureDefaultProject	new features	EnsureDefaultProject creates an organization's default project when it does not exist yet, with the enabled providers, MCP servers and models, and returns it. An existing default project is returned as it is, so an allow-list that you emptied stays empty.
GetProject	new features	Projects now carry preferred_endpoint_url, the address a project owner starred, as tenancy.v1 projects do.
ListProjects	new features	Projects now carry preferred_endpoint_url, the address a project owner starred, as tenancy.v1 projects do.
EnsureDefaultProject	new features	Projects now carry preferred_endpoint_url, the address a project owner starred, as tenancy.v1 projects do.
CreateWorkspace	bug fixes	These changes are now audited: data plane changes made through the workspace API, guardrail pattern and fallback-policy changes, refused gateway attaches, data plane upgrade outcomes, and the data plane URL, token revocations and MCP catalog entries a data plane writes.
UpdateWorkspace	bug fixes	These changes are now audited: data plane changes made through the workspace API, guardrail pattern and fallback-policy changes, refused gateway attaches, data plane upgrade outcomes, and the data plane URL, token revocations and MCP catalog entries a data plane writes.
SetWorkspaceProject	bug fixes	These changes are now audited: data plane changes made through the workspace API, guardrail pattern and fallback-policy changes, refused gateway attaches, data plane upgrade outcomes, and the data plane URL, token revocations and MCP catalog entries a data plane writes.
SetWorkspaceURL	bug fixes	These changes are now audited: data plane changes made through the workspace API, guardrail pattern and fallback-policy changes, refused gateway attaches, data plane upgrade outcomes, and the data plane URL, token revocations and MCP catalog entries a data plane writes.
DeleteWorkspace	bug fixes	These changes are now audited: data plane changes made through the workspace API, guardrail pattern and fallback-policy changes, refused gateway attaches, data plane upgrade outcomes, and the data plane URL, token revocations and MCP catalog entries a data plane writes.
AttachProjectGatewayProject	bug fixes	These changes are now audited: data plane changes made through the workspace API, guardrail pattern and fallback-policy changes, refused gateway attaches, data plane upgrade outcomes, and the data plane URL, token revocations and MCP catalog entries a data plane writes.
AttachProjectGatewayProject	bug fixes	The warning for a gateway with no URL no longer says the gateway serves nothing. It now says the gateway serves through the catch-all while it is the only gateway on its data plane, and stops serving once another gateway joins.
SetProjectGatewayWorkspace	bug fixes	The warning for a gateway with no URL no longer says the gateway serves nothing. It now says the gateway serves through the catch-all while it is the only gateway on its data plane, and stops serving once another gateway joins.
QueryAuditLogs	bug fixes	The Audit Logs page now loads quickly on a management plane with millions of audit records. It used to read the whole audit table on every load and could time out with "Couldn't load this page".
QueryPlatformAuditLogs	bug fixes	The Audit Logs page now loads quickly on a management plane with millions of audit records. It used to read the whole audit table on every load and could time out with "Couldn't load this page".
ClearSystemSetting	deprecations	stored_url on data planes and ClearSystemSetting are deprecated. They go with the stored data plane URL in a later release.
GetDataplane	deprecations	stored_url on data planes and ClearSystemSetting are deprecated. They go with the stored data plane URL in a later release.
ListDataplanes	deprecations	stored_url on data planes and ClearSystemSetting are deprecated. They go with the stored data plane URL in a later release.

AiKeysService

Operation	Kind	Change
Revoke	security updates	Revoking a BYOK key now attempts to remove its stored provider secret; a cleanup failure does not prevent the key from being revoked.
List	new features	Listing AI keys can include your legacy per-user keys, which route in every project you use, with include_legacy. Each key now reports its traffic preference and whether it is a legacy key. Without include_legacy the list is unchanged.

ApiKeysService

Operation	Kind	Change
UpdateApiKey	behaviour changes	UpdateApiKey called without user_id for a key that does not exist now returns NotFound or a field error, where it returned InvalidArgument with the message user_id is required.
ListApiKeys	new features	GET /v1/api-keys takes project_id and application_keys_only filters, and each key now says whether it serves an application, so you can find an application's key and disable it to stop that application.
UpdateApiKey	new features	An administrator can disable or re-enable one application's API key by sending the key id alone to UpdateApiKey. An admin key bound to an organization reaches only that organization's application keys. A request that sets name on this path is refused with InvalidArgument.

ClientsService

Operation	Kind	Change
ListClients	behaviour changes	An API key's client that was created without a project now belongs to its key's project once a fallback or traffic split policy of the key is saved, so it is then listed only in that project, not in every project.
GetClient	behaviour changes	An API key's client that was created without a project now belongs to its key's project once a fallback or traffic split policy of the key is saved, so it is then listed only in that project, not in every project.
GetApiKeySettings	new features	You can read and change your own API key's global fallback and token rate limit through the API. The settings apply to every key of the key's client, and each change is recorded in the audit log.
UpdateApiKeySettings	new features	You can read and change your own API key's global fallback and token rate limit through the API. The settings apply to every key of the key's client, and each change is recorded in the audit log.

ContentService

Operation	Kind	Change
ListContentVersions	new features	Announcements and sign-in page content can be managed through the API, and the published content can be read without signing in. Reading the versions and changing them need the admin scope or a new Platform Content Creator, Editor or Deleter role. A newly published version can take up to 30 seconds to show. A sign-in page file (CSS, JS or an image) can take up to five and a half minutes, because browsers and shared caches keep it for five minutes.
GetContentVersion	new features	Announcements and sign-in page content can be managed through the API, and the published content can be read without signing in. Reading the versions and changing them need the admin scope or a new Platform Content Creator, Editor or Deleter role. A newly published version can take up to 30 seconds to show. A sign-in page file (CSS, JS or an image) can take up to five and a half minutes, because browsers and shared caches keep it for five minutes.
CreateContentVersion	new features	Announcements and sign-in page content can be managed through the API, and the published content can be read without signing in. Reading the versions and changing them need the admin scope or a new Platform Content Creator, Editor or Deleter role. A newly published version can take up to 30 seconds to show. A sign-in page file (CSS, JS or an image) can take up to five and a half minutes, because browsers and shared caches keep it for five minutes.
UpdateContentVersion	new features	Announcements and sign-in page content can be managed through the API, and the published content can be read without signing in. Reading the versions and changing them need the admin scope or a new Platform Content Creator, Editor or Deleter role. A newly published version can take up to 30 seconds to show. A sign-in page file (CSS, JS or an image) can take up to five and a half minutes, because browsers and shared caches keep it for five minutes.
PublishContentVersion	new features	Announcements and sign-in page content can be managed through the API, and the published content can be read without signing in. Reading the versions and changing them need the admin scope or a new Platform Content Creator, Editor or Deleter role. A newly published version can take up to 30 seconds to show. A sign-in page file (CSS, JS or an image) can take up to five and a half minutes, because browsers and shared caches keep it for five minutes.
UnpublishContentVersion	new features	Announcements and sign-in page content can be managed through the API, and the published content can be read without signing in. Reading the versions and changing them need the admin scope or a new Platform Content Creator, Editor or Deleter role. A newly published version can take up to 30 seconds to show. A sign-in page file (CSS, JS or an image) can take up to five and a half minutes, because browsers and shared caches keep it for five minutes.
DeleteContentVersion	new features	Announcements and sign-in page content can be managed through the API, and the published content can be read without signing in. Reading the versions and changing them need the admin scope or a new Platform Content Creator, Editor or Deleter role. A newly published version can take up to 30 seconds to show. A sign-in page file (CSS, JS or an image) can take up to five and a half minutes, because browsers and shared caches keep it for five minutes.
GetPublishedContent	new features	Announcements and sign-in page content can be managed through the API, and the published content can be read without signing in. Reading the versions and changing them need the admin scope or a new Platform Content Creator, Editor or Deleter role. A newly published version can take up to 30 seconds to show. A sign-in page file (CSS, JS or an image) can take up to five and a half minutes, because browsers and shared caches keep it for five minutes.

CustomerRequestLogsService

Operation	Kind	Change
GetMyUsageStats	new features	GET /v1/me/usage/stats reads your own usage over time, per API key, filtered by key or project.
GetCustomerRequestLogStats	new features	Request log statistics can be grouped by caller_type, which separates identity-provider callers from API key callers, and by application, which shows the usage of each application under its key's current name. GetCustomerRequestLogStats lists only the caller's own requests, so application usage appears in GetRequestLogStats.
ListCustomerRequestLogs	new features	Each request log carries caller_type, idp for an identity-provider application and api_key for any other caller, and QueryRequestLogs and GetRequestLogStats take a caller_type filter with the same values.
GetCustomerRequestLog	new features	Each request log carries caller_type, idp for an identity-provider application and api_key for any other caller, and QueryRequestLogs and GetRequestLogStats take a caller_type filter with the same values.

EmailDomainPolicyAdminService

Operation	Kind	Change
ListEmailDomainPolicies	new features	Administrators can list, export, create, edit, deactivate and import email domain policies through the API. One import takes at most 100000 rows. The API answers only where bonus claims are on: ENABLE_BONUS_CLAIM is "true" on the management plane API and corporate login is off. Otherwise every call returns FAILED_PRECONDITION.
GetEmailDomainPolicy	new features	Administrators can list, export, create, edit, deactivate and import email domain policies through the API. One import takes at most 100000 rows. The API answers only where bonus claims are on: ENABLE_BONUS_CLAIM is "true" on the management plane API and corporate login is off. Otherwise every call returns FAILED_PRECONDITION.
ExportEmailDomainPolicies	new features	Administrators can list, export, create, edit, deactivate and import email domain policies through the API. One import takes at most 100000 rows. The API answers only where bonus claims are on: ENABLE_BONUS_CLAIM is "true" on the management plane API and corporate login is off. Otherwise every call returns FAILED_PRECONDITION.
CreateEmailDomainPolicy	new features	Administrators can list, export, create, edit, deactivate and import email domain policies through the API. One import takes at most 100000 rows. The API answers only where bonus claims are on: ENABLE_BONUS_CLAIM is "true" on the management plane API and corporate login is off. Otherwise every call returns FAILED_PRECONDITION.
UpdateEmailDomainPolicy	new features	Administrators can list, export, create, edit, deactivate and import email domain policies through the API. One import takes at most 100000 rows. The API answers only where bonus claims are on: ENABLE_BONUS_CLAIM is "true" on the management plane API and corporate login is off. Otherwise every call returns FAILED_PRECONDITION.
DeactivateEmailDomainPolicy	new features	Administrators can list, export, create, edit, deactivate and import email domain policies through the API. One import takes at most 100000 rows. The API answers only where bonus claims are on: ENABLE_BONUS_CLAIM is "true" on the management plane API and corporate login is off. Otherwise every call returns FAILED_PRECONDITION.
ImportEmailDomainPolicies	new features	Administrators can list, export, create, edit, deactivate and import email domain policies through the API. One import takes at most 100000 rows. The API answers only where bonus claims are on: ENABLE_BONUS_CLAIM is "true" on the management plane API and corporate login is off. Otherwise every call returns FAILED_PRECONDITION.

IdentityService

Operation	Kind	Change
GetUser	new features	User directory responses include the team name alongside its ID, without a separate team lookup.
ListUsers	new features	User directory responses include the team name alongside its ID, without a separate team lookup.
SearchUsers	new features	User directory responses include the team name alongside its ID, without a separate team lookup.
GetSSOProvider	new features	SSO providers now carry scopes, attribute mapping, the discovery URL and the organization name and slug. Writes can rename the organization, reset the OIDC endpoints, clear the admin emails and lift role-sync bans, and RegisterSSOProvider creates a provider without overwriting one. With customer_id set, an organization administrator of a single-customer deployment can manage SSO. CreateOrUpdateSSOProvider with customer_id only updates a provider; create one with RegisterSSOProvider.
ListSSOProviders	new features	SSO providers now carry scopes, attribute mapping, the discovery URL and the organization name and slug. Writes can rename the organization, reset the OIDC endpoints, clear the admin emails and lift role-sync bans, and RegisterSSOProvider creates a provider without overwriting one. With customer_id set, an organization administrator of a single-customer deployment can manage SSO. CreateOrUpdateSSOProvider with customer_id only updates a provider; create one with RegisterSSOProvider.
CreateOrUpdateSSOProvider	new features	SSO providers now carry scopes, attribute mapping, the discovery URL and the organization name and slug. Writes can rename the organization, reset the OIDC endpoints, clear the admin emails and lift role-sync bans, and RegisterSSOProvider creates a provider without overwriting one. With customer_id set, an organization administrator of a single-customer deployment can manage SSO. CreateOrUpdateSSOProvider with customer_id only updates a provider; create one with RegisterSSOProvider.
RegisterSSOProvider	new features	SSO providers now carry scopes, attribute mapping, the discovery URL and the organization name and slug. Writes can rename the organization, reset the OIDC endpoints, clear the admin emails and lift role-sync bans, and RegisterSSOProvider creates a provider without overwriting one. With customer_id set, an organization administrator of a single-customer deployment can manage SSO. CreateOrUpdateSSOProvider with customer_id only updates a provider; create one with RegisterSSOProvider.
CreateOrUpdateSSOProvider	new features	CreateOrUpdateSSOProvider takes validate_config. It refuses, and does not save, a role mapping with an unknown role, a SAML role sync that cannot work, or IdP client credentials that the IdP refuses. Only a save that creates the provider or changes the IdP connection contacts the IdP, over https. A token endpoint that the API cannot reach, or that answers with a server error, a rate limit or no OAuth error, refuses the save.
SetUserRole	new features	Admins can set a user's role with POST /v1/users/{user_id}/role. The user's access changes at once. Any change that is not a promotion to a higher level signs the user out, also a move between roles at the same level. The change is not saved when its audit record cannot be written.

InferenceIngressService

Operation	Kind	Change
ListDataplaneURLs	new features	ListDataplaneURLs accepts project_id, customer_id and include_unaddressed. Each entry now lists every address it answers on and its source, whether the data plane has called home, the ID of the data plane or Project Gateway it is for, and the gateway's attachment state. A request for one project also returns the endpoint that its owner starred.

MCPCatalogService

Operation	Kind	Change
UpsertCatalogServer	new features	The MCP catalog operations accept a platform MCP role, so a platform admin can manage the catalog without full admin rights. A customer's admins can list the enabled catalog servers. Deleting or disabling a server can now be refused while profiles or projects still use it.
GetCatalogServer	new features	The MCP catalog operations accept a platform MCP role, so a platform admin can manage the catalog without full admin rights. A customer's admins can list the enabled catalog servers. Deleting or disabling a server can now be refused while profiles or projects still use it.
SetCatalogServerEnabled	new features	The MCP catalog operations accept a platform MCP role, so a platform admin can manage the catalog without full admin rights. A customer's admins can list the enabled catalog servers. Deleting or disabling a server can now be refused while profiles or projects still use it.
DeleteCatalogServer	new features	The MCP catalog operations accept a platform MCP role, so a platform admin can manage the catalog without full admin rights. A customer's admins can list the enabled catalog servers. Deleting or disabling a server can now be refused while profiles or projects still use it.
ListCustomerCatalogServers	new features	The MCP catalog operations accept a platform MCP role, so a platform admin can manage the catalog without full admin rights. A customer's admins can list the enabled catalog servers. Deleting or disabling a server can now be refused while profiles or projects still use it.
GetCatalogServerOAuthClient	new features	A new operation returns the OAuth client that signs a project in to an MCP catalog server: the project's own client, or else the shared one from the Admin Console. It never returns the client secret.

McpOAuthClientsService

Operation	Kind	Change
GetMcpOAuthClient	security updates	The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.
ListMcpOAuthClients	security updates	The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.
CreateMcpOAuthClient	security updates	The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.
UpdateMcpOAuthClient	security updates	The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.
DeleteMcpOAuthClient	security updates	The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.
UpdateDeploymentMcpOAuthClient	security updates	The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through. Those clients are managed through the new shared-client operations only. Changing the token or authorization URL of an OAuth client that has a client secret now requires the secret in the same request; public clients are not affected.
ListDeploymentMcpOAuthClients	new features	Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.
GetDeploymentMcpOAuthClient	new features	Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.
CreateDeploymentMcpOAuthClient	new features	Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.
UpdateDeploymentMcpOAuthClient	new features	Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.
DeleteDeploymentMcpOAuthClient	new features	Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.
ExchangeDeploymentMcpOAuthCode	new features	Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.
CreateMcpOAuthClient	new features	Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.
GetMcpOAuthClient	new features	Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.
ListMcpOAuthClients	new features	Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.
UpdateMcpOAuthClient	new features	Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token. Its token endpoint must use https on a public address unless MCP_OAUTH_TOKEN_ALLOW_PRIVATE_ADDRESSES is set. A project client can no longer share a provider with a shared client. OAuth clients return their full metadata in metadata_json.

MeService

Operation	Kind	Change
ListMyProjects	new features	GET /v1/me/projects now returns member_role on each project: your own role as a member of that project. It is empty when you see the project without being a member. The role field does not change.

PatternsService

Operation	Kind	Change
CreatePattern	bug fixes	These changes are now audited: data plane changes made through the workspace API, guardrail pattern and fallback-policy changes, refused gateway attaches, data plane upgrade outcomes, and the data plane URL, token revocations and MCP catalog entries a data plane writes.
UpdatePattern	bug fixes	These changes are now audited: data plane changes made through the workspace API, guardrail pattern and fallback-policy changes, refused gateway attaches, data plane upgrade outcomes, and the data plane URL, token revocations and MCP catalog entries a data plane writes.
DeletePattern	bug fixes	These changes are now audited: data plane changes made through the workspace API, guardrail pattern and fallback-policy changes, refused gateway attaches, data plane upgrade outcomes, and the data plane URL, token revocations and MCP catalog entries a data plane writes.

PolicyService

Operation	Kind	Change
CreateFallbackChainPolicy	behaviour changes	Saving fallback chain entries requires enabled models and providers. Project and API-key policies restrict models only when their effective project has assignments; projects without assignments allow all enabled models. API-key policies require a live project on their client group. Organization-wide policies need no assignments. BOUND model allow-lists are not validated.
UpdateFallbackChainPolicy	behaviour changes	Saving fallback chain entries requires enabled models and providers. Project and API-key policies restrict models only when their effective project has assignments; projects without assignments allow all enabled models. API-key policies require a live project on their client group. Organization-wide policies need no assignments. BOUND model allow-lists are not validated.
UpsertFallbackPolicy	behaviour changes	Saving fallback chain entries requires enabled models and providers. Project and API-key policies restrict models only when their effective project has assignments; projects without assignments allow all enabled models. API-key policies require a live project on their client group. Organization-wide policies need no assignments. BOUND model allow-lists are not validated.
GetFallbackChainPolicy	behaviour changes	A fallback policy saved before retry conditions were configurable reads back the five conditions the gateway applies to it, timeout,rate-limit,server-error,connect-failure,overloaded, instead of its stored retry_on. Saving that value back keeps the same retries, and changing retry_on now takes effect for such a policy.
ListFallbackChainPolicies	behaviour changes	A fallback policy saved before retry conditions were configurable reads back the five conditions the gateway applies to it, timeout,rate-limit,server-error,connect-failure,overloaded, instead of its stored retry_on. Saving that value back keeps the same retries, and changing retry_on now takes effect for such a policy.
UpdateFallbackChainPolicy	behaviour changes	A fallback policy saved before retry conditions were configurable reads back the five conditions the gateway applies to it, timeout,rate-limit,server-error,connect-failure,overloaded, instead of its stored retry_on. Saving that value back keeps the same retries, and changing retry_on now takes effect for such a policy.
GetTrafficSplitPolicy	behaviour changes	Traffic split policies now read back with entries as well as split. An update that sends both keeps whichever differs from the saved policy, so editing only split in a read-back still works; changing both so they disagree is refused.
ListTrafficSplitPolicies	behaviour changes	Traffic split policies now read back with entries as well as split. An update that sends both keeps whichever differs from the saved policy, so editing only split in a read-back still works; changing both so they disagree is refused.
UpdateTrafficSplitPolicy	behaviour changes	Traffic split policies now read back with entries as well as split. An update that sends both keeps whichever differs from the saved policy, so editing only split in a read-back still works; changing both so they disagree is refused.
ListFallbackChainPolicies	behaviour changes	Listing fallback or traffic split policies without a target now also returns the per-key policies saved in the Developer Console, so the Admin Console's Fallback Policies page shows them too. That page does not load when there are more than 5,000 fallback policies.
ListTrafficSplitPolicies	behaviour changes	Listing fallback or traffic split policies without a target now also returns the per-key policies saved in the Developer Console, so the Admin Console's Fallback Policies page shows them too. That page does not load when there are more than 5,000 fallback policies.
UpsertFallbackPolicy	behaviour changes	Saving a per-key fallback policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the key's project. Keys in the default project are not limited this way.
UpdateFallbackChainPolicy	behaviour changes	Saving a per-key fallback policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the key's project. Keys in the default project are not limited this way.
SetFallbackChainPolicyStatus	behaviour changes	Saving a per-key fallback policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the key's project. Keys in the default project are not limited this way.
UpdateTagSchemaEntry	new features	Administrators can edit or clear a tag's description from the Tags tab. Its key and value stay fixed, so API keys and policies using the tag are unaffected.
ListApiKeyIdsByTag	new features	GET /v1/policy/api-key-ids lists the IDs of API keys that carry a tag, or of keys with no tags (untagged=true). POST /v1/policy/api-key-tags/lookup returns the tags on up to 200 keys in one call.
BatchListApiKeyTags	new features	GET /v1/policy/api-key-ids lists the IDs of API keys that carry a tag, or of keys with no tags (untagged=true). POST /v1/policy/api-key-tags/lookup returns the tags on up to 200 keys in one call.
UpsertFallbackPolicy	new features	The owner of an API key can set and turn off the fallback and traffic split policies of that key, without a project role.
SetFallbackChainPolicyStatus	new features	The owner of an API key can set and turn off the fallback and traffic split policies of that key, without a project role.
CreateTrafficSplitPolicy	new features	The owner of an API key can set and turn off the fallback and traffic split policies of that key, without a project role.
UpdateTrafficSplitPolicy	new features	The owner of an API key can set and turn off the fallback and traffic split policies of that key, without a project role.
SetTrafficSplitPolicyStatus	new features	The owner of an API key can set and turn off the fallback and traffic split policies of that key, without a project role.
CreateTrafficSplitPolicy	new features	Traffic split policies can target one API key, and hold one weighted split for each primary model in the new entries field. Each entry needs a different primary model name. Create, update and status calls also work on a path without a project. A per-key split is refused when a model or its provider is not available to the key's project, except in the default project. A model can have weight 0 if another has more.
UpdateTrafficSplitPolicy	new features	Traffic split policies can target one API key, and hold one weighted split for each primary model in the new entries field. Each entry needs a different primary model name. Create, update and status calls also work on a path without a project. A per-key split is refused when a model or its provider is not available to the key's project, except in the default project. A model can have weight 0 if another has more.
GetTrafficSplitPolicy	new features	Traffic split policies can target one API key, and hold one weighted split for each primary model in the new entries field. Each entry needs a different primary model name. Create, update and status calls also work on a path without a project. A per-key split is refused when a model or its provider is not available to the key's project, except in the default project. A model can have weight 0 if another has more.
ListTrafficSplitPolicies	new features	Traffic split policies can target one API key, and hold one weighted split for each primary model in the new entries field. Each entry needs a different primary model name. Create, update and status calls also work on a path without a project. A per-key split is refused when a model or its provider is not available to the key's project, except in the default project. A model can have weight 0 if another has more.
SetTrafficSplitPolicyStatus	new features	Traffic split policies can target one API key, and hold one weighted split for each primary model in the new entries field. Each entry needs a different primary model name. Create, update and status calls also work on a path without a project. A per-key split is refused when a model or its provider is not available to the key's project, except in the default project. A model can have weight 0 if another has more.
ListFallbackChainPolicies	bug fixes	Listing policies by target_key_id finds the per-key fallback and traffic split policies saved in the Developer Console, and those of a disabled key. The first per-key fallback policy saved through the API no longer fails for a key that never had one.
ListTrafficSplitPolicies	bug fixes	Listing policies by target_key_id finds the per-key fallback and traffic split policies saved in the Developer Console, and those of a disabled key. The first per-key fallback policy saved through the API no longer fails for a key that never had one.
UpsertFallbackPolicy	bug fixes	Listing policies by target_key_id finds the per-key fallback and traffic split policies saved in the Developer Console, and those of a disabled key. The first per-key fallback policy saved through the API no longer fails for a key that never had one.
UpsertFallbackPolicy	bug fixes	These changes are now audited: data plane changes made through the workspace API, guardrail pattern and fallback-policy changes, refused gateway attaches, data plane upgrade outcomes, and the data plane URL, token revocations and MCP catalog entries a data plane writes.

ProjectsService

Operation	Kind	Change
GetProject	new features	Project owners can choose the endpoint the consoles show for a project with SetPreferredEndpoint. Projects now carry public_endpoint_url and preferred_endpoint_url.
SetPreferredEndpoint	new features	Project owners can choose the endpoint the consoles show for a project with SetPreferredEndpoint. Projects now carry public_endpoint_url and preferred_endpoint_url.

RbacService

Operation	Kind	Change
GrantSuperAdmin	behaviour changes	Granting or revoking super_admin now fails with Internal, and changes nothing, when its audit record cannot be written.
RevokeSuperAdmin	behaviour changes	Granting or revoking super_admin now fails with Internal, and changes nothing, when its audit record cannot be written.

RequestLogsService

Operation	Kind	Change
GetUsageStats	behaviour changes	Existing metrics_reader keys can read their organization's usage per user, team or API key.
GetUsageStats	new features	GET /v1/usage/stats reads an organization's usage over time, with distinct users, per user, team or API key. Groups sort by any token figure or by last use, and skip jumps straight to a page.
GetRequestLogStats	new features	Request log statistics can be grouped by caller_type, which separates identity-provider callers from API key callers, and by application, which shows the usage of each application under its key's current name. GetCustomerRequestLogStats lists only the caller's own requests, so application usage appears in GetRequestLogStats.
QueryRequestLogs	new features	Each request log carries caller_type, idp for an identity-provider application and api_key for any other caller, and QueryRequestLogs and GetRequestLogStats take a caller_type filter with the same values.
GetRequestLog	new features	Each request log carries caller_type, idp for an identity-provider application and api_key for any other caller, and QueryRequestLogs and GetRequestLogStats take a caller_type filter with the same values.
GetRequestLogStats	new features	Each request log carries caller_type, idp for an identity-provider application and api_key for any other caller, and QueryRequestLogs and GetRequestLogStats take a caller_type filter with the same values.

v0.8.1

No API operations changed in this release.

v0.8.0

AdminService

Operation	Kind	Change
ListProjectMcpServers	behaviour changes	Listing, adding and removing a project's MCP servers now needs the project MCP permission. The MCP Admin role doesn't include it, so its holders need Project Owner or Super Admin for all three.
AddProjectMcpServer	behaviour changes	Listing, adding and removing a project's MCP servers now needs the project MCP permission. The MCP Admin role doesn't include it, so its holders need Project Owner or Super Admin for all three.
RemoveProjectMcpServer	behaviour changes	Listing, adding and removing a project's MCP servers now needs the project MCP permission. The MCP Admin role doesn't include it, so its holders need Project Owner or Super Admin for all three.
CreateServiceAccount	security updates	SetWorkspaceURL and SetDataplaneURL refuse to set or clear a data plane URL with FailedPrecondition when another organization uses the same data plane ID. The URL was stored under the ID alone, so the write also changed the other organization's data plane. CreateServiceAccount with a serve URL for such an ID is refused too when no URL is stored for that ID yet. The Admin Console's System Settings save does not check this yet; it moves onto SetDataplaneURL in a later release.
SetDataplaneURL	security updates	SetWorkspaceURL and SetDataplaneURL refuse to set or clear a data plane URL with FailedPrecondition when another organization uses the same data plane ID. The URL was stored under the ID alone, so the write also changed the other organization's data plane. CreateServiceAccount with a serve URL for such an ID is refused too when no URL is stored for that ID yet. The Admin Console's System Settings save does not check this yet; it moves onto SetDataplaneURL in a later release.
SetWorkspaceURL	security updates	SetWorkspaceURL and SetDataplaneURL refuse to set or clear a data plane URL with FailedPrecondition when another organization uses the same data plane ID. The URL was stored under the ID alone, so the write also changed the other organization's data plane. CreateServiceAccount with a serve URL for such an ID is refused too when no URL is stored for that ID yet. The Admin Console's System Settings save does not check this yet; it moves onto SetDataplaneURL in a later release.
ListProjectMcpServerCandidates	new features	Project owners can list the enabled MCP servers their project doesn't have yet, searched by name and paged, to pick which ones to add.
AddProjectMcpServer	new features	Project owners can add and remove their project's MCP servers, and Viewers can list them. The list shows each server's name, description, icon, enabled state and last update, including servers disabled since, and can be paged, searched by name, filtered by enabled state and sorted.
ListProjectMcpServers	new features	Project owners can add and remove their project's MCP servers, and Viewers can list them. The list shows each server's name, description, icon, enabled state and last update, including servers disabled since, and can be paged, searched by name, filtered by enabled state and sorted.
RemoveProjectMcpServer	new features	Project owners can add and remove their project's MCP servers, and Viewers can list them. The list shows each server's name, description, icon, enabled state and last update, including servers disabled since, and can be paged, searched by name, filtered by enabled state and sorted.
GetModelLifecycles	new features	Admins can read whether a model in the catalog is retired, deprecated, new or in preview, with the reason and any retirement date. A model the catalog does not contain is left out of the result.
GetModelUsage	new features	Admins can see which models their organization uses retire soon, and which projects and API keys still call them. A model whose retirement date has passed is included, flagged as retired, while the organization still calls it. Results cover only your organization.
ListRetiringModels	new features	Admins can see which models their organization uses retire soon, and which projects and API keys still call them. A model whose retirement date has passed is included, flagged as retired, while the organization still calls it. Results cover only your organization.
PlanCatalogSync	new features	The model catalog can be synced through the admin API: preview what a sync would change, apply it in the background pinned to the exact documents previewed, and poll the run's progress. One sync runs at a time.
ApplyCatalogSync	new features	The model catalog can be synced through the admin API: preview what a sync would change, apply it in the background pinned to the exact documents previewed, and poll the run's progress. One sync runs at a time.
GetCatalogSyncRun	new features	The model catalog can be synced through the admin API: preview what a sync would change, apply it in the background pinned to the exact documents previewed, and poll the run's progress. One sync runs at a time.
GetProjectSettings	bug fixes	Getting, setting or deleting a project setting now returns NOT_FOUND when the project is missing or deleted. Deleting a project now deletes its settings, so a new project with the same name starts with none. The default project is still created on demand.
UpsertProjectSetting	bug fixes	Getting, setting or deleting a project setting now returns NOT_FOUND when the project is missing or deleted. Deleting a project now deletes its settings, so a new project with the same name starts with none. The default project is still created on demand.
DeleteProject	bug fixes	Getting, setting or deleting a project setting now returns NOT_FOUND when the project is missing or deleted. Deleting a project now deletes its settings, so a new project with the same name starts with none. The default project is still created on demand.
DeleteProjectSetting	bug fixes	Getting, setting or deleting a project setting now returns NOT_FOUND when the project is missing or deleted. Deleting a project now deletes its settings, so a new project with the same name starts with none. The default project is still created on demand.
AddProjectModel	bug fixes	Adding or removing a model from a project now updates keys that carry their own settings (BYOK, fallback, traffic split, or a rate limit), so they no longer keep routing against the old model list. A key created with CreateApiKey or IssueMyKey now gets its own routes instead of waiting on an unrelated change. Both updates are sent in the background, so the call returns without waiting for them.
RemoveProjectModel	bug fixes	Adding or removing a model from a project now updates keys that carry their own settings (BYOK, fallback, traffic split, or a rate limit), so they no longer keep routing against the old model list. A key created with CreateApiKey or IssueMyKey now gets its own routes instead of waiting on an unrelated change. Both updates are sent in the background, so the call returns without waiting for them.
CreateUserToken	bug fixes	Adding or removing a model from a project now updates keys that carry their own settings (BYOK, fallback, traffic split, or a rate limit), so they no longer keep routing against the old model list. A key created with CreateApiKey or IssueMyKey now gets its own routes instead of waiting on an unrelated change. Both updates are sent in the background, so the call returns without waiting for them.
UpsertProjectSetting	bug fixes	Project default settings, project membership changes, the request-log mode, and rate-limit policies moved to another target now reach your gateways within the usual update cycle. They were previously saved but not pushed, so keys kept an old rate limit or fallback, a removed member kept the project's shared provider keys, and a moved policy kept limiting its old keys. A project-wide rate limit is also now enforced on keys with no settings of their own.
DeleteProjectSetting	bug fixes	Project default settings, project membership changes, the request-log mode, and rate-limit policies moved to another target now reach your gateways within the usual update cycle. They were previously saved but not pushed, so keys kept an old rate limit or fallback, a removed member kept the project's shared provider keys, and a moved policy kept limiting its old keys. A project-wide rate limit is also now enforced on keys with no settings of their own.
AddProjectMember	bug fixes	Project default settings, project membership changes, the request-log mode, and rate-limit policies moved to another target now reach your gateways within the usual update cycle. They were previously saved but not pushed, so keys kept an old rate limit or fallback, a removed member kept the project's shared provider keys, and a moved policy kept limiting its old keys. A project-wide rate limit is also now enforced on keys with no settings of their own.
RemoveProjectMember	bug fixes	Project default settings, project membership changes, the request-log mode, and rate-limit policies moved to another target now reach your gateways within the usual update cycle. They were previously saved but not pushed, so keys kept an old rate limit or fallback, a removed member kept the project's shared provider keys, and a moved policy kept limiting its old keys. A project-wide rate limit is also now enforced on keys with no settings of their own.
UpsertSystemSetting	bug fixes	Project default settings, project membership changes, the request-log mode, and rate-limit policies moved to another target now reach your gateways within the usual update cycle. They were previously saved but not pushed, so keys kept an old rate limit or fallback, a removed member kept the project's shared provider keys, and a moved policy kept limiting its old keys. A project-wide rate limit is also now enforced on keys with no settings of their own.

ApiKeysService

Operation	Kind	Change
CreateApiKey	bug fixes	Adding or removing a model from a project now updates keys that carry their own settings (BYOK, fallback, traffic split, or a rate limit), so they no longer keep routing against the old model list. A key created with CreateApiKey or IssueMyKey now gets its own routes instead of waiting on an unrelated change. Both updates are sent in the background, so the call returns without waiting for them.

CatalogService

Operation	Kind	Change
AssignModelToProject	bug fixes	Adding or removing a model from a project now updates keys that carry their own settings (BYOK, fallback, traffic split, or a rate limit), so they no longer keep routing against the old model list. A key created with CreateApiKey or IssueMyKey now gets its own routes instead of waiting on an unrelated change. Both updates are sent in the background, so the call returns without waiting for them.
UnassignModelFromProject	bug fixes	Adding or removing a model from a project now updates keys that carry their own settings (BYOK, fallback, traffic split, or a rate limit), so they no longer keep routing against the old model list. A key created with CreateApiKey or IssueMyKey now gets its own routes instead of waiting on an unrelated change. Both updates are sent in the background, so the call returns without waiting for them.

IdentityService

Operation	Kind	Change
CreateOrUpdateSSOProvider	bug fixes	Moving the corporate OIDC SSO provider to a different identity provider no longer keeps the previous provider's endpoints. Before, sign-in could keep going to the old identity provider with the new client ID, which locked out everyone not already signed in. Same-provider edits keep any explicitly configured endpoints.

InferenceIngressService

Operation	Kind	Change
GetDataplaneURL	security updates	The inference API no longer returns another organization's data plane URL, and Prompt sends only to your own data planes. When another organization uses the same data plane ID, the URL returned is the first hostname your data plane declares; if it declares none, the URL lookups return nothing and Prompt is refused. Prompt with no project mapping now uses your organization's only data plane.
ListDataplaneURLs	security updates	The inference API no longer returns another organization's data plane URL, and Prompt sends only to your own data planes. When another organization uses the same data plane ID, the URL returned is the first hostname your data plane declares; if it declares none, the URL lookups return nothing and Prompt is refused. Prompt with no project mapping now uses your organization's only data plane.
Prompt	security updates	The inference API no longer returns another organization's data plane URL, and Prompt sends only to your own data planes. When another organization uses the same data plane ID, the URL returned is the first hostname your data plane declares; if it declares none, the URL lookups return nothing and Prompt is refused. Prompt with no project mapping now uses your organization's only data plane.

MCPCatalogService

Operation	Kind	Change
UpsertCatalogServer	bug fixes	Changes to an MCP catalog server now reach data planes that host no project gateway, so a re-pointed server stops serving its old URL and a disabled or deleted one stops being reachable at /mcp/s/<server>. Archiving a project through the tenancy API now also clears the project's gateway setup, as deleting it already did.
SetCatalogServerEnabled	bug fixes	Changes to an MCP catalog server now reach data planes that host no project gateway, so a re-pointed server stops serving its old URL and a disabled or deleted one stops being reachable at /mcp/s/<server>. Archiving a project through the tenancy API now also clears the project's gateway setup, as deleting it already did.
DeleteCatalogServer	bug fixes	Changes to an MCP catalog server now reach data planes that host no project gateway, so a re-pointed server stops serving its old URL and a disabled or deleted one stops being reachable at /mcp/s/<server>. Archiving a project through the tenancy API now also clears the project's gateway setup, as deleting it already did.

MCPProfilesService

Operation	Kind	Change
CreateMCPProfile	bug fixes	Deleting an MCP profile frees its name for a new or renamed profile.
UpdateMCPProfile	bug fixes	Deleting an MCP profile frees its name for a new or renamed profile.
DeleteMCPProfile	bug fixes	Deleting an MCP profile frees its name for a new or renamed profile.

McpOAuthClientsService

Operation	Kind	Change
CreateMcpOAuthClient	bug fixes	MCP servers whose OAuth client was created through the API now get their sign-in applied on gateways. Their servers were recorded in a form the gateway configuration did not read, so those servers were treated as needing no sign-in. Sign-in details are also now looked up within the project that owns them, so two projects using the same provider name no longer stop each other's MCP servers from signing in.
UpdateMcpOAuthClient	bug fixes	MCP servers whose OAuth client was created through the API now get their sign-in applied on gateways. Their servers were recorded in a form the gateway configuration did not read, so those servers were treated as needing no sign-in. Sign-in details are also now looked up within the project that owns them, so two projects using the same provider name no longer stop each other's MCP servers from signing in.

MeService

Operation	Kind	Change
IssueMyKey	bug fixes	Adding or removing a model from a project now updates keys that carry their own settings (BYOK, fallback, traffic split, or a rate limit), so they no longer keep routing against the old model list. A key created with CreateApiKey or IssueMyKey now gets its own routes instead of waiting on an unrelated change. Both updates are sent in the background, so the call returns without waiting for them.

PolicyService

Operation	Kind	Change
GetEffectivePolicy	behaviour changes	Attribute-based routing has two scopes, project and API key: a key's own routing policy replaces its project's. A tag preview returns the project's policy only when project_id is supplied, and no policy otherwise. Organization and tag policies are no longer resolved.
GetPolicyCoverage	behaviour changes	Attribute-based routing has two scopes, project and API key: a key's own routing policy replaces its project's. A tag preview returns the project's policy only when project_id is supplied, and no policy otherwise. Organization and tag policies are no longer resolved.
CreateRateLimitPolicy	new features	A project or API key rate-limit policy can now limit requests per minute, requests per hour and tokens per minute beside tokens per hour, in any mix. Existing per-hour values stay. A refused request gets a 429 naming the policy and its window when the data plane can tell which policy set the limit. UpdateRateLimitPolicy removes one limit through clear_dimensions, GetEffectivePolicy names the dimension of each entry, and period has no effect. count_tokens calls count against no rate limit.
UpdateRateLimitPolicy	new features	A project or API key rate-limit policy can now limit requests per minute, requests per hour and tokens per minute beside tokens per hour, in any mix. Existing per-hour values stay. A refused request gets a 429 naming the policy and its window when the data plane can tell which policy set the limit. UpdateRateLimitPolicy removes one limit through clear_dimensions, GetEffectivePolicy names the dimension of each entry, and period has no effect. count_tokens calls count against no rate limit.
GetRateLimitPolicy	new features	A project or API key rate-limit policy can now limit requests per minute, requests per hour and tokens per minute beside tokens per hour, in any mix. Existing per-hour values stay. A refused request gets a 429 naming the policy and its window when the data plane can tell which policy set the limit. UpdateRateLimitPolicy removes one limit through clear_dimensions, GetEffectivePolicy names the dimension of each entry, and period has no effect. count_tokens calls count against no rate limit.
ListRateLimitPolicies	new features	A project or API key rate-limit policy can now limit requests per minute, requests per hour and tokens per minute beside tokens per hour, in any mix. Existing per-hour values stay. A refused request gets a 429 naming the policy and its window when the data plane can tell which policy set the limit. UpdateRateLimitPolicy removes one limit through clear_dimensions, GetEffectivePolicy names the dimension of each entry, and period has no effect. count_tokens calls count against no rate limit.
GetEffectivePolicy	new features	A project or API key rate-limit policy can now limit requests per minute, requests per hour and tokens per minute beside tokens per hour, in any mix. Existing per-hour values stay. A refused request gets a 429 naming the policy and its window when the data plane can tell which policy set the limit. UpdateRateLimitPolicy removes one limit through clear_dimensions, GetEffectivePolicy names the dimension of each entry, and period has no effect. count_tokens calls count against no rate limit.
UpdateRateLimitPolicy	bug fixes	Project default settings, project membership changes, the request-log mode, and rate-limit policies moved to another target now reach your gateways within the usual update cycle. They were previously saved but not pushed, so keys kept an old rate limit or fallback, a removed member kept the project's shared provider keys, and a moved policy kept limiting its old keys. A project-wide rate limit is also now enforced on keys with no settings of their own.

ProjectsService

Operation	Kind	Change
ArchiveProject	bug fixes	Changes to an MCP catalog server now reach data planes that host no project gateway, so a re-pointed server stops serving its old URL and a disabled or deleted one stops being reachable at /mcp/s/<server>. Archiving a project through the tenancy API now also clears the project's gateway setup, as deleting it already did.
AddProjectMember	bug fixes	Project default settings, project membership changes, the request-log mode, and rate-limit policies moved to another target now reach your gateways within the usual update cycle. They were previously saved but not pushed, so keys kept an old rate limit or fallback, a removed member kept the project's shared provider keys, and a moved policy kept limiting its old keys. A project-wide rate limit is also now enforced on keys with no settings of their own.
RemoveProjectMember	bug fixes	Project default settings, project membership changes, the request-log mode, and rate-limit policies moved to another target now reach your gateways within the usual update cycle. They were previously saved but not pushed, so keys kept an old rate limit or fallback, a removed member kept the project's shared provider keys, and a moved policy kept limiting its old keys. A project-wide rate limit is also now enforced on keys with no settings of their own.

v0.7.2

No API operations changed in this release.

v0.7.1

No API operations changed in this release.

v0.7.0

AdminService

Operation	Kind	Change
ListDataplaneConfigOverrides	behaviour changes	A provider endpoint or key override now applies to one project on a data plane and names that project, so another project the same data plane serves keeps calling the provider with the bundle endpoint and credential. An override written before this release named no project and is removed, with its stored credential, the first time the management plane starts after the upgrade.
SetDataplaneConfigOverride	behaviour changes	A provider endpoint or key override now applies to one project on a data plane and names that project, so another project the same data plane serves keeps calling the provider with the bundle endpoint and credential. An override written before this release named no project and is removed, with its stored credential, the first time the management plane starts after the upgrade.
ClearDataplaneConfigOverride	behaviour changes	A provider endpoint or key override now applies to one project on a data plane and names that project, so another project the same data plane serves keeps calling the provider with the bundle endpoint and credential. An override written before this release named no project and is removed, with its stored credential, the first time the management plane starts after the upgrade.
CreateProjectGateway	behaviour changes	Once a data plane declares hostnames in its chart, these three calls accept only a hostname that data plane declared, and refuse anything else with FailedPrecondition naming the chart key. A data plane that has declared nothing keeps today's behaviour, so each one crosses over as its own chart lists a name. SetDataplaneURL no longer stamps a data plane's address onto its default gateway once that data plane declares its own hostnames; it still records the address itself, which is unchanged.
SetProjectGatewayURL	behaviour changes	Once a data plane declares hostnames in its chart, these three calls accept only a hostname that data plane declared, and refuse anything else with FailedPrecondition naming the chart key. A data plane that has declared nothing keeps today's behaviour, so each one crosses over as its own chart lists a name. SetDataplaneURL no longer stamps a data plane's address onto its default gateway once that data plane declares its own hostnames; it still records the address itself, which is unchanged.
UpdateProjectGateway	behaviour changes	Once a data plane declares hostnames in its chart, these three calls accept only a hostname that data plane declared, and refuse anything else with FailedPrecondition naming the chart key. A data plane that has declared nothing keeps today's behaviour, so each one crosses over as its own chart lists a name. SetDataplaneURL no longer stamps a data plane's address onto its default gateway once that data plane declares its own hostnames; it still records the address itself, which is unchanged.
DeleteProject	behaviour changes	Deleting a project now revokes the API keys scoped to it, rather than refusing while any of them is live. Previously an administrator revoked each key by hand and only then deleted the project. The revoked keys stop being accepted at once, and each data plane drops the routes they carried at its next configuration update.
AttachProjectGatewayProject	behaviour changes	A project gateway now holds several projects. Attaching a second, different project used to be rejected with FailedPrecondition and a "detach the current project first" message; it now succeeds wherever the data plane can enforce the per-project boundary, so one hostname serves every project attached to its gateway and each request resolves to its own project by its own credential. Two concurrent attaches of the same project leave one of them with ABORTED, which the caller retries.
DeleteDataplane	behaviour changes	Deleting a data plane now refuses while it is the only one serving a project, and the refusal names up to ten of those projects and reports how many there are in all. A data plane whose projects are all served by another one is deleted as before. Detaching a project from its last data plane is still allowed and now writes a PROJECT_SERVED_NOWHERE audit entry naming the project and that data plane, so the audit log carries a new action type from this release on.
DeleteWorkspace	behaviour changes	Deleting a data plane now refuses while it is the only one serving a project, and the refusal names up to ten of those projects and reports how many there are in all. A data plane whose projects are all served by another one is deleted as before. Detaching a project from its last data plane is still allowed and now writes a PROJECT_SERVED_NOWHERE audit entry naming the project and that data plane, so the audit log carries a new action type from this release on.
DetachProjectGatewayProject	behaviour changes	Deleting a data plane now refuses while it is the only one serving a project, and the refusal names up to ten of those projects and reports how many there are in all. A data plane whose projects are all served by another one is deleted as before. Detaching a project from its last data plane is still allowed and now writes a PROJECT_SERVED_NOWHERE audit entry naming the project and that data plane, so the audit log carries a new action type from this release on.
ListCatalogModels	new features	Catalog model lists can be paged with page, and support search, mode, modality, context-window and price filters, sorting and snapshot grouping. Paged lists leave out models whose provider is disabled unless include_disabled is set.
ListDataplaneConfigDifferences	new features	A data plane now reports each whitelisted field on which it serves something other than the bundle the management plane sent, with both values, and a project reports the fields its data planes disagree on. The management plane labels each difference as an intended override, as a data plane that has not pulled yet, or as one nothing explains. An administrator or the project's owner acknowledges a difference, and one that clears stays on record until then.
ListProjectConfigDifferences	new features	A data plane now reports each whitelisted field on which it serves something other than the bundle the management plane sent, with both values, and a project reports the fields its data planes disagree on. The management plane labels each difference as an intended override, as a data plane that has not pulled yet, or as one nothing explains. An administrator or the project's owner acknowledges a difference, and one that clears stays on record until then.
AcknowledgeConfigDifference	new features	A data plane now reports each whitelisted field on which it serves something other than the bundle the management plane sent, with both values, and a project reports the fields its data planes disagree on. The management plane labels each difference as an intended override, as a data plane that has not pulled yet, or as one nothing explains. An administrator or the project's owner acknowledges a difference, and one that clears stays on record until then.
ListProjectGatewayMembers	new features	A data plane now reports each whitelisted field on which it serves something other than the bundle the management plane sent, with both values, and a project reports the fields its data planes disagree on. The management plane labels each difference as an intended override, as a data plane that has not pulled yet, or as one nothing explains. An administrator or the project's owner acknowledges a difference, and one that clears stays on record until then.
ListDataplanes	new features	A data plane now reports each whitelisted field on which it serves something other than the bundle the management plane sent, with both values, and a project reports the fields its data planes disagree on. The management plane labels each difference as an intended override, as a data plane that has not pulled yet, or as one nothing explains. An administrator or the project's owner acknowledges a difference, and one that clears stays on record until then.
GetDataplane	new features	A data plane now reports each whitelisted field on which it serves something other than the bundle the management plane sent, with both values, and a project reports the fields its data planes disagree on. The management plane labels each difference as an intended override, as a data plane that has not pulled yet, or as one nothing explains. An administrator or the project's owner acknowledges a difference, and one that clears stays on record until then.
GetProjectDeletionImpact	new features	GetProjectDeletionImpact reads what deleting a project costs, and how far a delete under way has got. Before the delete it names every data plane serving the project. After it, each reads CLEARING until every gateway it hosted for the project acknowledged the zeroized configuration, then CLEARED with the time the last did. One still hosting a gateway joined to the project stays CLEARING; one carrying neither a membership nor a joined gateway is absent.
DeleteProject	new features	DeleteProject now answers with the data planes whose label for the project it removed, so a caller confirming a delete reads the affected fleet out of the delete's own response rather than a follow-up call. Each of them serves the configuration it last pulled until its next pull lands, so the list names what is now clearing rather than what has cleared, and GetProjectDeletionImpact reports how far each has got.
ListProjectDataplanes	new features	You can now ask which data planes serve a project. ListProjectDataplanes answers with the data planes carrying the project's label and where each one stands in serving it, and a project no data plane serves answers an empty list rather than an error. It answers on every deployment, unlike ListProjectGatewayMembers beside it, which stays Enterprise-only and keyed on gateways.
ListDataplaneProjects	new features	A data plane can now be labelled with the projects it serves, naming a data plane and a project rather than a gateway. The data plane picks that project's configuration up on its next config update, and drops it on the next one after the label is removed. Removing the last label serving a project is refused, because its keys would then admit nowhere, unless the call sets acknowledge_last_endpoint to remove it anyway; the response then reports served_nowhere so the caller can tell its owners.
AddDataplaneProject	new features	A data plane can now be labelled with the projects it serves, naming a data plane and a project rather than a gateway. The data plane picks that project's configuration up on its next config update, and drops it on the next one after the label is removed. Removing the last label serving a project is refused, because its keys would then admit nowhere, unless the call sets acknowledge_last_endpoint to remove it anyway; the response then reports served_nowhere so the caller can tell its owners.
RemoveDataplaneProject	new features	A data plane can now be labelled with the projects it serves, naming a data plane and a project rather than a gateway. The data plane picks that project's configuration up on its next config update, and drops it on the next one after the label is removed. Removing the last label serving a project is refused, because its keys would then admit nowhere, unless the call sets acknowledge_last_endpoint to remove it anyway; the response then reports served_nowhere so the caller can tell its owners.
ListDataplaneProjects	new features	Each project label now says when that data plane first answered a request for the project successfully, in a new verified_at field. It is per project and data plane, so another project's traffic on the same data plane never sets it, and applying a label again clears it until the next success. Each label also reports the config pull before it, as target_revision, held_revision and config_current.
ListProjectDataplanes	new features	Each project label now says when that data plane first answered a request for the project successfully, in a new verified_at field. It is per project and data plane, so another project's traffic on the same data plane never sets it, and applying a label again clears it until the next success. Each label also reports the config pull before it, as target_revision, held_revision and config_current.
ListDataplaneConfigOverrides	new features	An administrator can now give one project on one data plane its own endpoint or its own key for one provider, and every other project that data plane serves goes on calling the provider with the bundle endpoint and credential. A key is write-only and reaches only the project it was written for; clearing an override restores the bundle value and destroys the key.
SetDataplaneConfigOverride	new features	An administrator can now give one project on one data plane its own endpoint or its own key for one provider, and every other project that data plane serves goes on calling the provider with the bundle endpoint and credential. A key is write-only and reaches only the project it was written for; clearing an override restores the bundle value and destroys the key.
ClearDataplaneConfigOverride	new features	An administrator can now give one project on one data plane its own endpoint or its own key for one provider, and every other project that data plane serves goes on calling the provider with the bundle endpoint and credential. A key is write-only and reaches only the project it was written for; clearing an override restores the bundle value and destroys the key.
ListDataplaneRollout	new features	Rollout progress now reads per data plane as a fraction of its labelled projects, and rolls up to a fleet figure such as 7 of 9 that counts a data plane only when every project on it holds its current revision. Projects with no revision yet are left out of both, so a data plane serving only those reads 0 of 0. Each data plane also reports whether its guardrails union is current, beside those counts rather than folded into them.
ListProjectsServedFrom	new features	You can now resolve a set of data planes to the projects served from them, so a region-bound rule attaches to those projects rather than to the infrastructure. Each project also reports the data planes outside your selection that serve it, because a project labelled in several regions is served from all of them. Nothing verifies that a data plane named for a region runs in it.
ListProjectGatewayMembers	new features	A project's gateway members now come back with where the project stands across the data planes serving it: the revision last minted for its configuration, how many labelled data planes have confirmed that revision, and how many carry the label at all. A member is one ingress endpoint and one data plane hosts several of them, so the two readings answer different questions and the rollup is the one that says whether the project is covered.
DeleteDataplane	new features	Forgetting a data plane now leaves a zeroize directive waiting for it and soft-deletes its credential. The directive travels only on the data plane's own next configuration poll, which the record shows as a call home, and the data plane acknowledges it like any configuration revision. A data plane that never calls keeps serving what it holds, and the forget can be undone until the directive lands. A data plane that was issued a new credential before it was forgotten collects its directive too.
GetProjectOIDCConfig	new features	A project can now publish an OIDC contract, naming the issuer that mints its tokens, the audience and scope they must carry and an optional entitlement. The issuer's discovery document is read as you write it, so an unreachable issuer is refused then. A contract naming an issuer and audience another organization's project already names is refused. A data plane on 0.7.0 or later admits callers against the contract; one below it answers them with a 401.
UpsertProjectOIDCConfig	new features	A project can now publish an OIDC contract, naming the issuer that mints its tokens, the audience and scope they must carry and an optional entitlement. The issuer's discovery document is read as you write it, so an unreachable issuer is refused then. A contract naming an issuer and audience another organization's project already names is refused. A data plane on 0.7.0 or later admits callers against the contract; one below it answers them with a 401.
DeleteProjectOIDCConfig	new features	A project can now publish an OIDC contract, naming the issuer that mints its tokens, the audience and scope they must carry and an optional entitlement. The issuer's discovery document is read as you write it, so an unreachable issuer is refused then. A contract naming an issuer and audience another organization's project already names is refused. A data plane on 0.7.0 or later admits callers against the contract; one below it answers them with a 401.
UpsertProjectOIDCConfig	new features	The management plane refuses to fetch an OIDC issuer's discovery document from a non-public address: loopback, link-local, private, carrier-grade NAT, unique-local, unspecified, or another range reserved from public routing, such as benchmarking. It checks the address it connects to, redirects included, and the refusal names the setting that lifts it. A redirect is followed only to https on the issuer's own host and port.
UpdateWorkspace	new features	A data plane can now repair itself when its doctor reports RBAC objects or CRDs its chart declares as missing or changed, writing back what the chart says. Turn it on per data plane with auto_repair. A run makes at most two attempts, and the data plane's health then shows a SelfRepairHealthy issue carrying the error. A run that escalates also keeps a doctor bundle, which happens when both attempts fail on the same step or the data plane reports on neither.
UpdateDataplane	new features	A data plane can now repair itself when its doctor reports RBAC objects or CRDs its chart declares as missing or changed, writing back what the chart says. Turn it on per data plane with auto_repair. A run makes at most two attempts, and the data plane's health then shows a SelfRepairHealthy issue carrying the error. A run that escalates also keeps a doctor bundle, which happens when both attempts fail on the same step or the data plane reports on neither.
UpdateProjectGateway	new features	A project gateway can now declare the environment it serves in environment, and a gateway auth policy can name the token claim carrying a token's environment in environment_claim. Only a platform administrator can set or clear a gateway's environment, and an enabled policy with environment_claim is refused on a gateway that declares none. The gateway refuses an IdP token whose environment claim does not name the gateway's environment.
GetProjectGateway	new features	A project gateway can now declare the environment it serves in environment, and a gateway auth policy can name the token claim carrying a token's environment in environment_claim. Only a platform administrator can set or clear a gateway's environment, and an enabled policy with environment_claim is refused on a gateway that declares none. The gateway refuses an IdP token whose environment claim does not name the gateway's environment.
ListProjectGateways	new features	A project gateway can now declare the environment it serves in environment, and a gateway auth policy can name the token claim carrying a token's environment in environment_claim. Only a platform administrator can set or clear a gateway's environment, and an enabled policy with environment_claim is refused on a gateway that declares none. The gateway refuses an IdP token whose environment claim does not name the gateway's environment.
UpdateProjectGatewayProject	new features	A project's membership of a project gateway now accepts ACCEPTED_CREDENTIALS_TOKEN on Enterprise, so the gateway refuses API keys for that project and accepts only IdP tokens. ACCEPTED_CREDENTIALS_BOTH no longer returns a warning. A data plane older than 0.7.0 keeps accepting API keys whatever the membership declares.
RemoveDataplaneProject	bug fixes	Removing the last project from a data plane that has a single gateway now takes the project's label off, reports served_nowhere and records PROJECT_SERVED_NOWHERE in the audit log. Before, the call answered removed=true while the label stayed on the data plane, and neither was recorded.
DetachProjectGatewayProject	bug fixes	Removing the last project from a data plane that has a single gateway now takes the project's label off, reports served_nowhere and records PROJECT_SERVED_NOWHERE in the audit log. Before, the call answered removed=true while the label stayed on the data plane, and neither was recorded.
RemoveDataplaneProject	bug fixes	Removing a project from a data plane now takes the label off even when the data plane's configuration update fails, so a response with removed=true no longer lists the label it removed. Removing a label left behind by an earlier removal records PROJECT_SERVED_NOWHERE when it was the project's last one.
DeleteProject	bug fixes	Deleting a project that shares a gateway with another project no longer stops that gateway serving the other project, and the deletion receipt now reports the data plane as cleared as soon as the data plane acknowledges configuration that no longer carries the deleted project. Before, that data plane stayed clearing indefinitely.
GetProjectDeletionImpact	bug fixes	Deleting a project that shares a gateway with another project no longer stops that gateway serving the other project, and the deletion receipt now reports the data plane as cleared as soon as the data plane acknowledges configuration that no longer carries the deleted project. Before, that data plane stayed clearing indefinitely.
AttachProjectGatewayProject	deprecations	A project owner attaching a project to a gateway, detaching one or deleting a gateway is deprecated, and 0.9.0 requires a platform administrator for all three. Until then a project owner can make these changes while the gateway serves only projects they own. Once a gateway serves another owner's project, only a platform administrator can change it, and a project-owner credential answers 403.
DetachProjectGatewayProject	deprecations	A project owner attaching a project to a gateway, detaching one or deleting a gateway is deprecated, and 0.9.0 requires a platform administrator for all three. Until then a project owner can make these changes while the gateway serves only projects they own. Once a gateway serves another owner's project, only a platform administrator can change it, and a project-owner credential answers 403.
DeleteProjectGateway	deprecations	A project owner attaching a project to a gateway, detaching one or deleting a gateway is deprecated, and 0.9.0 requires a platform administrator for all three. Until then a project owner can make these changes while the gateway serves only projects they own. Once a gateway serves another owner's project, only a platform administrator can change it, and a project-owner credential answers 403.
SetDataplaneURL	deprecations	Setting a data plane's or a project gateway's address through the admin API is deprecated. A 0.7 data plane reports its own address from global.gateway.hostnames in its serve-helm values. SetDataplaneURL, its SetWorkspaceURL alias, SetProjectGatewayURL and the url field of CreateProjectGateway and UpdateProjectGateway keep working. A data plane before 0.7 cannot declare hostnames, so these calls stay until no supported data plane predates 0.7.
SetWorkspaceURL	deprecations	Setting a data plane's or a project gateway's address through the admin API is deprecated. A 0.7 data plane reports its own address from global.gateway.hostnames in its serve-helm values. SetDataplaneURL, its SetWorkspaceURL alias, SetProjectGatewayURL and the url field of CreateProjectGateway and UpdateProjectGateway keep working. A data plane before 0.7 cannot declare hostnames, so these calls stay until no supported data plane predates 0.7.
SetProjectGatewayURL	deprecations	Setting a data plane's or a project gateway's address through the admin API is deprecated. A 0.7 data plane reports its own address from global.gateway.hostnames in its serve-helm values. SetDataplaneURL, its SetWorkspaceURL alias, SetProjectGatewayURL and the url field of CreateProjectGateway and UpdateProjectGateway keep working. A data plane before 0.7 cannot declare hostnames, so these calls stay until no supported data plane predates 0.7.
CreateProjectGateway	deprecations	Setting a data plane's or a project gateway's address through the admin API is deprecated. A 0.7 data plane reports its own address from global.gateway.hostnames in its serve-helm values. SetDataplaneURL, its SetWorkspaceURL alias, SetProjectGatewayURL and the url field of CreateProjectGateway and UpdateProjectGateway keep working. A data plane before 0.7 cannot declare hostnames, so these calls stay until no supported data plane predates 0.7.
UpdateProjectGateway	deprecations	Setting a data plane's or a project gateway's address through the admin API is deprecated. A 0.7 data plane reports its own address from global.gateway.hostnames in its serve-helm values. SetDataplaneURL, its SetWorkspaceURL alias, SetProjectGatewayURL and the url field of CreateProjectGateway and UpdateProjectGateway keep working. A data plane before 0.7 cannot declare hostnames, so these calls stay until no supported data plane predates 0.7.
ListCatalogModels	deprecations	A catalog model list that sets only provider_id or include_disabled still returns the full catalog, but is deprecated and will return one page in a later release. Setting any other field returns one page.

GatewayAuthPolicyService

Operation	Kind	Change
CreateGatewayAuthPolicy	behaviour changes	Creating a gateway auth policy, or changing its jwks_uri, is now refused when the jwks_uri carries a user name or password, writes an IPv4 address as anything other than a dotted quad, or names or resolves to a carrier-grade NAT, multicast, reserved or other internal address. Existing policies keep working, and an update that leaves jwks_uri as it is still succeeds.
UpdateGatewayAuthPolicy	behaviour changes	Creating a gateway auth policy, or changing its jwks_uri, is now refused when the jwks_uri carries a user name or password, writes an IPv4 address as anything other than a dotted quad, or names or resolves to a carrier-grade NAT, multicast, reserved or other internal address. Existing policies keep working, and an update that leaves jwks_uri as it is still succeeds.
CreateGatewayAuthPolicy	behaviour changes	Creating a gateway auth policy, or changing its jwks_inline key set, is now refused when the key set holds more than 32 keys or more than 16 KiB. Existing policies keep their key sets, and an update that leaves jwks_inline as it is still succeeds.
UpdateGatewayAuthPolicy	behaviour changes	Creating a gateway auth policy, or changing its jwks_inline key set, is now refused when the key set holds more than 32 keys or more than 16 KiB. Existing policies keep their key sets, and an update that leaves jwks_inline as it is still succeeds.
CreateIdentityMappingRule	behaviour changes	Creating an identity mapping rule now refuses a jit_project_id that is not a project of the policy's customer or is not attached to the policy's gateway, a jit_principal_cap on a pre_registered rule, and a jit rule whose principal_type is not external.
CreateGatewayAuthPolicy	behaviour changes	Creating a gateway auth policy, or changing its extraction_header, is now refused unless the gateway can remove that header after verifying the token, which rules out the identity headers the gateway sets and credential headers such as x-api-key, cookie and proxy-authorization. Existing policies keep their header, and the data plane and management plane log a warning for each enabled policy that reads such a header.
UpdateGatewayAuthPolicy	behaviour changes	Creating a gateway auth policy, or changing its extraction_header, is now refused unless the gateway can remove that header after verifying the token, which rules out the identity headers the gateway sets and credential headers such as x-api-key, cookie and proxy-authorization. Existing policies keep their header, and the data plane and management plane log a warning for each enabled policy that reads such a header.
CreateGatewayAuthPolicy	new features	A project gateway can now declare the environment it serves in environment, and a gateway auth policy can name the token claim carrying a token's environment in environment_claim. Only a platform administrator can set or clear a gateway's environment, and an enabled policy with environment_claim is refused on a gateway that declares none. The gateway refuses an IdP token whose environment claim does not name the gateway's environment.
UpdateGatewayAuthPolicy	new features	A project gateway can now declare the environment it serves in environment, and a gateway auth policy can name the token claim carrying a token's environment in environment_claim. Only a platform administrator can set or clear a gateway's environment, and an enabled policy with environment_claim is refused on a gateway that declares none. The gateway refuses an IdP token whose environment claim does not name the gateway's environment.
GetGatewayAuthPolicy	new features	A project gateway can now declare the environment it serves in environment, and a gateway auth policy can name the token claim carrying a token's environment in environment_claim. Only a platform administrator can set or clear a gateway's environment, and an enabled policy with environment_claim is refused on a gateway that declares none. The gateway refuses an IdP token whose environment claim does not name the gateway's environment.
ListGatewayAuthPolicies	new features	A project gateway can now declare the environment it serves in environment, and a gateway auth policy can name the token claim carrying a token's environment in environment_claim. Only a platform administrator can set or clear a gateway's environment, and an enabled policy with environment_claim is refused on a gateway that declares none. The gateway refuses an IdP token whose environment claim does not name the gateway's environment.

GuardrailProvidersService

Operation	Kind	Change
CreateGuardrailProvider	new features	You can now author a guardrail, a guardrail rule, a guardrail provider and a pattern for a whole organization rather than one project at a time. Send scope GUARDRAIL_SCOPE_ORGANIZATION with no project_id, and every project of that customer is served the rule. A request that names a project behaves exactly as it did, and a request that names both is refused, so a caller that forgot the project cannot write into every project by accident.

GuardrailTriggersService

Operation	Kind	Change
ListGuardrailTriggers	new features	Every guardrail rule now carries a reference, a short read-only id such as GR-0142 that the database mints once and never rewrites. The guardrail rule APIs and each trigger evaluation return it beside the display_name, and the data plane receives it in its runtime configuration, so a platform operator reading a trigger has one id to quote. Existing rules were numbered in creation order, and a blocked caller's refusal body does not carry the reference yet.
GetGuardrailTrigger	new features	Every guardrail rule now carries a reference, a short read-only id such as GR-0142 that the database mints once and never rewrites. The guardrail rule APIs and each trigger evaluation return it beside the display_name, and the data plane receives it in its runtime configuration, so a platform operator reading a trigger has one id to quote. Existing rules were numbered in creation order, and a blocked caller's refusal body does not carry the reference yet.
ListGuardrailTriggers	new features	A guardrail trigger now reports one verdict for the whole event, which is blocked, redacted or would-have, resolved from its rule evaluations so an enforced block outranks an enforced redact and either outranks a monitor-mode hit that changed nothing. ListGuardrailTriggers filters on verdicts and returns a count for each one. The counts answer every filter on the request except verdicts itself, so a console showing the three as peers keeps all three counts on screen after a reader picks one.
GetGuardrailTrigger	new features	A guardrail trigger now reports one verdict for the whole event, which is blocked, redacted or would-have, resolved from its rule evaluations so an enforced block outranks an enforced redact and either outranks a monitor-mode hit that changed nothing. ListGuardrailTriggers filters on verdicts and returns a count for each one. The counts answer every filter on the request except verdicts itself, so a console showing the three as peers keeps all three counts on screen after a reader picks one.

GuardrailsService

Operation	Kind	Change
CreateGuardrail	behaviour changes	A project owner now creates, edits and deletes the guardrails and guardrail rules of a project they own, without an organization-wide guardrails credential. The shared pattern library and the external guardrail providers stay administrator-only, and a project owner still reaches no other project's guardrails.
UpdateGuardrail	behaviour changes	A project owner now creates, edits and deletes the guardrails and guardrail rules of a project they own, without an organization-wide guardrails credential. The shared pattern library and the external guardrail providers stay administrator-only, and a project owner still reaches no other project's guardrails.
DeleteGuardrail	behaviour changes	A project owner now creates, edits and deletes the guardrails and guardrail rules of a project they own, without an organization-wide guardrails credential. The shared pattern library and the external guardrail providers stay administrator-only, and a project owner still reaches no other project's guardrails.
SetGuardrailStatus	behaviour changes	A project owner now creates, edits and deletes the guardrails and guardrail rules of a project they own, without an organization-wide guardrails credential. The shared pattern library and the external guardrail providers stay administrator-only, and a project owner still reaches no other project's guardrails.
CreateGuardrailFromTemplate	behaviour changes	A project owner now creates, edits and deletes the guardrails and guardrail rules of a project they own, without an organization-wide guardrails credential. The shared pattern library and the external guardrail providers stay administrator-only, and a project owner still reaches no other project's guardrails.
CreateGuardrailRule	behaviour changes	A project owner now creates, edits and deletes the guardrails and guardrail rules of a project they own, without an organization-wide guardrails credential. The shared pattern library and the external guardrail providers stay administrator-only, and a project owner still reaches no other project's guardrails.
UpdateGuardrailRule	behaviour changes	A project owner now creates, edits and deletes the guardrails and guardrail rules of a project they own, without an organization-wide guardrails credential. The shared pattern library and the external guardrail providers stay administrator-only, and a project owner still reaches no other project's guardrails.
DeleteGuardrailRule	behaviour changes	A project owner now creates, edits and deletes the guardrails and guardrail rules of a project they own, without an organization-wide guardrails credential. The shared pattern library and the external guardrail providers stay administrator-only, and a project owner still reaches no other project's guardrails.
CreateGuardrail	new features	You can now author a guardrail, a guardrail rule, a guardrail provider and a pattern for a whole organization rather than one project at a time. Send scope GUARDRAIL_SCOPE_ORGANIZATION with no project_id, and every project of that customer is served the rule. A request that names a project behaves exactly as it did, and a request that names both is refused, so a caller that forgot the project cannot write into every project by accident.
UpdateGuardrail	new features	You can now author a guardrail, a guardrail rule, a guardrail provider and a pattern for a whole organization rather than one project at a time. Send scope GUARDRAIL_SCOPE_ORGANIZATION with no project_id, and every project of that customer is served the rule. A request that names a project behaves exactly as it did, and a request that names both is refused, so a caller that forgot the project cannot write into every project by accident.
CreateGuardrailRule	new features	You can now author a guardrail, a guardrail rule, a guardrail provider and a pattern for a whole organization rather than one project at a time. Send scope GUARDRAIL_SCOPE_ORGANIZATION with no project_id, and every project of that customer is served the rule. A request that names a project behaves exactly as it did, and a request that names both is refused, so a caller that forgot the project cannot write into every project by accident.
UpdateGuardrailRule	new features	You can now author a guardrail, a guardrail rule, a guardrail provider and a pattern for a whole organization rather than one project at a time. Send scope GUARDRAIL_SCOPE_ORGANIZATION with no project_id, and every project of that customer is served the rule. A request that names a project behaves exactly as it did, and a request that names both is refused, so a caller that forgot the project cannot write into every project by accident.
ListGuardrails	new features	A project now reads the organization's guardrails alongside its own, and every guardrail, pattern and provider reports the level it sits at. The organization's rules are enforced on the project, so they belong in what it reads; a project still cannot edit them, and a write aimed at one is refused.
GetGuardrail	new features	A project now reads the organization's guardrails alongside its own, and every guardrail, pattern and provider reports the level it sits at. The organization's rules are enforced on the project, so they belong in what it reads; a project still cannot edit them, and a write aimed at one is refused.
GetEffectiveStack	new features	A project's effective guardrail stack now reads as one list carrying both levels. A rule set at the organization and a rule set at the project that check the same thing at the same stage are marked as duplicating each other rather than one being merged away, because the data plane evaluates both. Rules that are present and switched off stay on the list, marked unenforced.
GetBlastRadius	new features	A guardrail apply can now state what it reconverges before you confirm it: how many projects it changes, how many distinct data planes re-pull, and how many of those projects are served nowhere.
TestRuleAgainstStack	new features	A candidate guardrail rule can now be tested against a project's stack before it takes traffic. The answer names the checks it duplicates, whether it blocks what another rule only redacts, whether its provider is one its scope may bind and is switched on, whether the patterns it names resolve, and whether a data plane would evaluate it at all. Nothing is stored and no traffic is sent.
ListGuardrailRules	new features	Every guardrail rule now carries a reference, a short read-only id such as GR-0142 that the database mints once and never rewrites. The guardrail rule APIs and each trigger evaluation return it beside the display_name, and the data plane receives it in its runtime configuration, so a platform operator reading a trigger has one id to quote. Existing rules were numbered in creation order, and a blocked caller's refusal body does not carry the reference yet.
GetGuardrailRule	new features	Every guardrail rule now carries a reference, a short read-only id such as GR-0142 that the database mints once and never rewrites. The guardrail rule APIs and each trigger evaluation return it beside the display_name, and the data plane receives it in its runtime configuration, so a platform operator reading a trigger has one id to quote. Existing rules were numbered in creation order, and a blocked caller's refusal body does not carry the reference yet.
CreateGuardrailRule	new features	Every guardrail rule now carries a reference, a short read-only id such as GR-0142 that the database mints once and never rewrites. The guardrail rule APIs and each trigger evaluation return it beside the display_name, and the data plane receives it in its runtime configuration, so a platform operator reading a trigger has one id to quote. Existing rules were numbered in creation order, and a blocked caller's refusal body does not carry the reference yet.
UpdateGuardrailRule	new features	Every guardrail rule now carries a reference, a short read-only id such as GR-0142 that the database mints once and never rewrites. The guardrail rule APIs and each trigger evaluation return it beside the display_name, and the data plane receives it in its runtime configuration, so a platform operator reading a trigger has one id to quote. Existing rules were numbered in creation order, and a blocked caller's refusal body does not carry the reference yet.

IdentityService

Operation	Kind	Change
CreateOrUpdateSSOProvider	behaviour changes	Saving an SSO provider with role sync set to strict is refused when the provider is SAML, has no usable role mapping (a role claim path and at least one entry), or names no recovery administrator. In shared auth database mode a mapping whose only entries target super_admin does not count, nor do the provider's own admin emails. Stored providers keep working; the check runs on their next save.

InferenceIngressService

Operation	Kind	Change
ListDataplaneURLs	behaviour changes	Listing data plane addresses with an inference key issued for a project other than default now returns only that project's addresses, where it used to return every address in the organization.
GetDataplaneURL	bug fixes	Looking up a data plane address with an inference key now returns the key's own project's address on a data plane serving several projects, where it used to answer 400. A key issued before July 2026 still gets the 400.

PatternsService

Operation	Kind	Change
CreatePattern	new features	You can now author a guardrail, a guardrail rule, a guardrail provider and a pattern for a whole organization rather than one project at a time. Send scope GUARDRAIL_SCOPE_ORGANIZATION with no project_id, and every project of that customer is served the rule. A request that names a project behaves exactly as it did, and a request that names both is refused, so a caller that forgot the project cannot write into every project by accident.

PolicyService

Operation	Kind	Change
GetAttributeRoutingPolicy	security updates	Project-scoped attribute-routing reads now stay within the authorized project, so callers can no longer view another project's routing rules, condition values, or policy target identifiers such as target_api_key_id.
ListAttributeRoutingPolicies	security updates	Project-scoped attribute-routing reads now stay within the authorized project, so callers can no longer view another project's routing rules, condition values, or policy target identifiers such as target_api_key_id.
GetRequestAttribute	security updates	Project-scoped attribute-routing reads now stay within the authorized project, so callers can no longer view another project's routing rules, condition values, or policy target identifiers such as target_api_key_id.
ListRequestAttributes	security updates	Project-scoped attribute-routing reads now stay within the authorized project, so callers can no longer view another project's routing rules, condition values, or policy target identifiers such as target_api_key_id.
CreateRateLimitPolicy	new features	A rate-limit policy now carries a display_name, the public label a caller will see when that limit refuses a request. Existing policies take their name as the label, and a policy created without one does the same, so a platform operator only sets it when the name is not meant for callers. The label is stored and returned for now; the refusal body that prints it is still to come.
GetRateLimitPolicy	new features	A rate-limit policy now carries a display_name, the public label a caller will see when that limit refuses a request. Existing policies take their name as the label, and a policy created without one does the same, so a platform operator only sets it when the name is not meant for callers. The label is stored and returned for now; the refusal body that prints it is still to come.
ListRateLimitPolicies	new features	A rate-limit policy now carries a display_name, the public label a caller will see when that limit refuses a request. Existing policies take their name as the label, and a policy created without one does the same, so a platform operator only sets it when the name is not meant for callers. The label is stored and returned for now; the refusal body that prints it is still to come.
UpdateRateLimitPolicy	new features	A rate-limit policy now carries a display_name, the public label a caller will see when that limit refuses a request. Existing policies take their name as the label, and a policy created without one does the same, so a platform operator only sets it when the name is not meant for callers. The label is stored and returned for now; the refusal body that prints it is still to come.
GetBudgetConsumption	new features	GetBudgetConsumption reports what an Organization, or each project inside it, has consumed in the current period, in spend and in tokens, with the budget set at that scope when there is one. A scope with no budget is reported as having none rather than as zero, and the read states no enforcement behaviour: what happens when a budget is reached stays with the budget policy that defines it.
ListAttributeRoutingPolicies	bug fixes	Listing attribute routing policies now rejects a scope_types or statuses filter it cannot apply, instead of ignoring it and returning a broader list than requested. Only KEY and PROJECT scopes are accepted.

ProjectsService

Operation	Kind	Change
ArchiveProject	behaviour changes	Deleting a project now revokes the API keys scoped to it, rather than refusing while any of them is live. Previously an administrator revoked each key by hand and only then deleted the project. The revoked keys stop being accepted at once, and each data plane drops the routes they carried at its next configuration update.
CreateProject	behaviour changes	Creating a project over the tenancy API now refuses, with InvalidArgument, a project_id longer than 253 characters or one using anything other than lowercase letters, digits, hyphens, underscores and dots, or not starting and ending with a letter or digit. The admin API has held the same field to that rule since it shipped, while the tenancy call accepted any non-empty value, including a slug with a slash or an uppercase letter. Projects that already exist are untouched.

RequestLogsService

Operation	Kind	Change
CountProjectRequests	new features	A new call counts one project's requests on each of several data planes in one request, naming the project rather than every API key it holds. Reading these counts through the request-log list cost a discarded row and a scan of the whole data plane's window.

v0.6.2

No API operations changed in this release.

v0.6.1

No API operations changed in this release.

v0.6.0

AdminService

Operation	Kind	Change
ListCatalogProviders	new features	Provider reads have a new field, has_credential: true when the provider's platform key is stored, false when it is not, and unset when the check could not run (the read still succeeds). ListProviders and GetProvider also accept a customer_id, and optionally a project_id within it, which returns the same providers without the key suffix or internal metadata.
UpsertCatalogProvider	new features	CreateProvider adds a provider and returns AlreadyExists if the id is taken, and DeleteProviderCredential removes a provider's platform key. UpsertProvider now needs display_name, base_url and a canonical id only when it creates the provider, so {id, is_enabled} toggles an existing one.
UpsertCatalogProvider	new features	UpsertProvider has a new field, remove_metadata_keys, that removes the named top-level keys from the provider's metadata. A null value in metadata is still stored as sent. credential and credential_suffix cannot be removed this way.
UpdateProjectGatewayProject	new features	Project gateway attachments now record accepted_credentials; existing attachments read API_KEY. Enterprise projects with an enabled jwt gateway auth policy can choose BOTH, which prevents disabling or deleting their last enabled policy. TOKEN is refused for now. The gateway does not yet enforce this setting: API keys still work, and an identity-provider token alone does not authenticate a caller.
ListProjectGatewayProjects	new features	Project gateway attachments now record accepted_credentials; existing attachments read API_KEY. Enterprise projects with an enabled jwt gateway auth policy can choose BOTH, which prevents disabling or deleting their last enabled policy. TOKEN is refused for now. The gateway does not yet enforce this setting: API keys still work, and an identity-provider token alone does not authenticate a caller.
ListProjectGatewayMembers	new features	Project gateway attachments now record accepted_credentials; existing attachments read API_KEY. Enterprise projects with an enabled jwt gateway auth policy can choose BOTH, which prevents disabling or deleting their last enabled policy. TOKEN is refused for now. The gateway does not yet enforce this setting: API keys still work, and an identity-provider token alone does not authenticate a caller.
DeleteProject	bug fixes	Deleting a project now also deletes its project fallback overrides, so a project created later with the same ID starts with none. The upgrade removes overrides left behind by projects deleted earlier, unless a new project already uses the same ID: that project keeps them, and an admin who doesn't want them removes them on the Fallback page.

CatalogService

Operation	Kind	Change
GetProvider	behaviour changes	GetProvider and the provider writes now also accept a platform role binding that grants the providers permission, such as platform_provider_admin. The admin scope still works as before.
UpsertProvider	behaviour changes	GetProvider and the provider writes now also accept a platform role binding that grants the providers permission, such as platform_provider_admin. The admin scope still works as before.
SetProviderCredential	behaviour changes	GetProvider and the provider writes now also accept a platform role binding that grants the providers permission, such as platform_provider_admin. The admin scope still works as before.
DeleteProvider	behaviour changes	GetProvider and the provider writes now also accept a platform role binding that grants the providers permission, such as platform_provider_admin. The admin scope still works as before.
ListProviders	new features	Provider reads have a new field, has_credential: true when the provider's platform key is stored, false when it is not, and unset when the check could not run (the read still succeeds). ListProviders and GetProvider also accept a customer_id, and optionally a project_id within it, which returns the same providers without the key suffix or internal metadata.
GetProvider	new features	Provider reads have a new field, has_credential: true when the provider's platform key is stored, false when it is not, and unset when the check could not run (the read still succeeds). ListProviders and GetProvider also accept a customer_id, and optionally a project_id within it, which returns the same providers without the key suffix or internal metadata.
CreateProvider	new features	CreateProvider adds a provider and returns AlreadyExists if the id is taken, and DeleteProviderCredential removes a provider's platform key. UpsertProvider now needs display_name, base_url and a canonical id only when it creates the provider, so {id, is_enabled} toggles an existing one.
DeleteProviderCredential	new features	CreateProvider adds a provider and returns AlreadyExists if the id is taken, and DeleteProviderCredential removes a provider's platform key. UpsertProvider now needs display_name, base_url and a canonical id only when it creates the provider, so {id, is_enabled} toggles an existing one.
UpsertProvider	new features	CreateProvider adds a provider and returns AlreadyExists if the id is taken, and DeleteProviderCredential removes a provider's platform key. UpsertProvider now needs display_name, base_url and a canonical id only when it creates the provider, so {id, is_enabled} toggles an existing one.
UpsertProvider	new features	UpsertProvider has a new field, remove_metadata_keys, that removes the named top-level keys from the provider's metadata. A null value in metadata is still stored as sent. credential and credential_suffix cannot be removed this way.

CustomerMetricsService

Operation	Kind	Change
GetUserMetric	behaviour changes	Latency metrics (response_latency, ttft, tpot and the guardrail latency metrics) now return an empty summary, and the metric catalog reports an empty function for them: the per-window average they carried was not a true average and is no longer computed. Additive metrics keep their summary and total.
GetApiKeyMetric	behaviour changes	Latency metrics (response_latency, ttft, tpot and the guardrail latency metrics) now return an empty summary, and the metric catalog reports an empty function for them: the per-window average they carried was not a true average and is no longer computed. Additive metrics keep their summary and total.
GetProjectMetric	behaviour changes	Latency metrics (response_latency, ttft, tpot and the guardrail latency metrics) now return an empty summary, and the metric catalog reports an empty function for them: the per-window average they carried was not a true average and is no longer computed. Additive metrics keep their summary and total.
GetMyMetric	behaviour changes	Latency metrics (response_latency, ttft, tpot and the guardrail latency metrics) now return an empty summary, and the metric catalog reports an empty function for them: the per-window average they carried was not a true average and is no longer computed. Additive metrics keep their summary and total.
ListMetrics	behaviour changes	Latency metrics (response_latency, ttft, tpot and the guardrail latency metrics) now return an empty summary, and the metric catalog reports an empty function for them: the per-window average they carried was not a true average and is no longer computed. Additive metrics keep their summary and total.

GatewayAuthPolicyService

Operation	Kind	Change
CreateGatewayAuthPolicy	new features	The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.
GetGatewayAuthPolicy	new features	The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.
ListGatewayAuthPolicies	new features	The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.
UpdateGatewayAuthPolicy	new features	The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.
DeleteGatewayAuthPolicy	new features	The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.
CreateIdentityMappingRule	new features	The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.
ListIdentityMappingRules	new features	The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.
DeleteIdentityMappingRule	new features	The management API can now store gateway authentication policies and the rules that map a verified identity onto a caller.

MetricsService

Operation	Kind	Change
GetCustomerMetric	behaviour changes	Latency metrics (response_latency, ttft, tpot and the guardrail latency metrics) now return an empty summary, and the metric catalog reports an empty function for them: the per-window average they carried was not a true average and is no longer computed. Additive metrics keep their summary and total.
GetMetric	behaviour changes	Latency metrics (response_latency, ttft, tpot and the guardrail latency metrics) now return an empty summary, and the metric catalog reports an empty function for them: the per-window average they carried was not a true average and is no longer computed. Additive metrics keep their summary and total.
ListMetrics	behaviour changes	Latency metrics (response_latency, ttft, tpot and the guardrail latency metrics) now return an empty summary, and the metric catalog reports an empty function for them: the per-window average they carried was not a true average and is no longer computed. Additive metrics keep their summary and total.

PolicyService

Operation	Kind	Change
CreateFallbackChainPolicy	behaviour changes	A fallback-policy write sent with a project is now refused unless its target stays inside that project: the organization-wide default (a CUSTOMER target), tag-targeted legacy policies, and any key or project outside it are rejected, even for an organization administrator. Writes sent without a project keep working as before.
UpdateFallbackChainPolicy	behaviour changes	A fallback-policy write sent with a project is now refused unless its target stays inside that project: the organization-wide default (a CUSTOMER target), tag-targeted legacy policies, and any key or project outside it are rejected, even for an organization administrator. Writes sent without a project keep working as before.
DeleteFallbackChainPolicy	behaviour changes	A fallback-policy write sent with a project is now refused unless its target stays inside that project: the organization-wide default (a CUSTOMER target), tag-targeted legacy policies, and any key or project outside it are rejected, even for an organization administrator. Writes sent without a project keep working as before.
SetFallbackChainPolicyStatus	behaviour changes	A fallback-policy write sent with a project is now refused unless its target stays inside that project: the organization-wide default (a CUSTOMER target), tag-targeted legacy policies, and any key or project outside it are rejected, even for an organization administrator. Writes sent without a project keep working as before.
UpsertFallbackPolicy	behaviour changes	A fallback-policy write sent with a project is now refused unless its target stays inside that project: the organization-wide default (a CUSTOMER target), tag-targeted legacy policies, and any key or project outside it are rejected, even for an organization administrator. Writes sent without a project keep working as before.
ListAttributeRoutingPolicies	behaviour changes	Listing attribute-routing policies for a project now requires the user's own attribute_routing_policies.read grant on that project.
UpsertFallbackPolicy	behaviour changes	A fallback policy now rejects an unsupported retry_on value with a clear message instead of silently storing it. An existing value with an unknown token reads back empty, meaning the default retry set applies.
GetAttributeRoutingPolicyAnalytics	new features	Attribute-routing policies now report their routing decisions over a selected lookback period. The readout breaks requests down by the rule or default that matched, the destination provider and model, and monitor or enforce mode, counts requests that carried an attribute value outside its allowed set, and states the time through which routing data is available. Use it to review a policy in monitor mode before enforcing it. Reading it requires attribute_routing_policies.read on the project.
ListAttributeRoutingPolicies	new features	Attribute-routing policies can now be listed across the whole organization by leaving out project_id, with each policy naming the project it applies to. This needs organization-level read access.
ListAttributeRoutingPolicies	new features	Attribute-routing policies now report rule_count and distinct_destination_model_count on every read, including the list, so a list can show how many rules a policy has and how many models they route to without loading the rules.
GetAttributeRoutingPolicy	new features	Attribute-routing policies now report rule_count and distinct_destination_model_count on every read, including the list, so a list can show how many rules a policy has and how many models they route to without loading the rules.
CreateAttributeRoutingPolicy	new features	Attribute-routing policies now report rule_count and distinct_destination_model_count on every read, including the list, so a list can show how many rules a policy has and how many models they route to without loading the rules.
UpdateAttributeRoutingPolicy	new features	Attribute-routing policies now report rule_count and distinct_destination_model_count on every read, including the list, so a list can show how many rules a policy has and how many models they route to without loading the rules.
CreateFallbackChainPolicy	new features	Project owners can now manage fallback policies for their own project: creating, updating, deleting, activating and deactivating project- and API-key-scoped policies inside a project they own needs only the project owner's own grants. A request routed through a project may only target that project -- a key or project outside it, or the organization-wide default, is refused, and the organization-wide default keeps its organization-level administration.
UpdateFallbackChainPolicy	new features	Project owners can now manage fallback policies for their own project: creating, updating, deleting, activating and deactivating project- and API-key-scoped policies inside a project they own needs only the project owner's own grants. A request routed through a project may only target that project -- a key or project outside it, or the organization-wide default, is refused, and the organization-wide default keeps its organization-level administration.
DeleteFallbackChainPolicy	new features	Project owners can now manage fallback policies for their own project: creating, updating, deleting, activating and deactivating project- and API-key-scoped policies inside a project they own needs only the project owner's own grants. A request routed through a project may only target that project -- a key or project outside it, or the organization-wide default, is refused, and the organization-wide default keeps its organization-level administration.
SetFallbackChainPolicyStatus	new features	Project owners can now manage fallback policies for their own project: creating, updating, deleting, activating and deactivating project- and API-key-scoped policies inside a project they own needs only the project owner's own grants. A request routed through a project may only target that project -- a key or project outside it, or the organization-wide default, is refused, and the organization-wide default keeps its organization-level administration.
UpsertFallbackPolicy	new features	Project owners can now manage fallback policies for their own project: creating, updating, deleting, activating and deactivating project- and API-key-scoped policies inside a project they own needs only the project owner's own grants. A request routed through a project may only target that project -- a key or project outside it, or the organization-wide default, is refused, and the organization-wide default keeps its organization-level administration.
GetBudgetSpendHistory	new features	Administrators can preview up to 12 UTC months of billable spend for a team, its highest-spending member, or an API key before creating a budget, with month/spend filters, sorting and pagination. History uses current team membership and rolled-up managed/BYOK usage, excludes passthrough, preserves decimal precision and fills missing months with zero; without filters or pagination it returns all requested months oldest first, and user sessions require tenant budget-read permission.
GetBudgetPolicy	new features	Budget policy reads now include the stored target client's name and, when spending is requested, the number of keys matching a tag budget. Integrations can display these details without separate database reads.
ListBudgetPolicies	new features	Budget policy reads now include the stored target client's name and, when spending is requested, the number of keys matching a tag budget. Integrations can display these details without separate database reads.
CreateTrafficSplitPolicy	bug fixes	Project-scoped traffic-split, fallback-chain and attribute routing policies now create and update successfully when no tag selector is supplied.
UpdateTrafficSplitPolicy	bug fixes	Project-scoped traffic-split, fallback-chain and attribute routing policies now create and update successfully when no tag selector is supplied.
CreateFallbackChainPolicy	bug fixes	Project-scoped traffic-split, fallback-chain and attribute routing policies now create and update successfully when no tag selector is supplied.
UpdateFallbackChainPolicy	bug fixes	Project-scoped traffic-split, fallback-chain and attribute routing policies now create and update successfully when no tag selector is supplied.
CreateAttributeRoutingPolicy	bug fixes	Project-scoped traffic-split, fallback-chain and attribute routing policies now create and update successfully when no tag selector is supplied.
UpsertFallbackPolicy	bug fixes	A fallback or traffic-split policy write with a missing or unrecognised target_scope_type now explains that unknown JSON names are ignored and names the target id fields to check. A project-routed PROJECT-scope write with no target_project_id now returns INVALID_ARGUMENT naming the field, instead of PERMISSION_DENIED.
CreateFallbackChainPolicy	bug fixes	A fallback or traffic-split policy write with a missing or unrecognised target_scope_type now explains that unknown JSON names are ignored and names the target id fields to check. A project-routed PROJECT-scope write with no target_project_id now returns INVALID_ARGUMENT naming the field, instead of PERMISSION_DENIED.
UpdateFallbackChainPolicy	bug fixes	A fallback or traffic-split policy write with a missing or unrecognised target_scope_type now explains that unknown JSON names are ignored and names the target id fields to check. A project-routed PROJECT-scope write with no target_project_id now returns INVALID_ARGUMENT naming the field, instead of PERMISSION_DENIED.
CreateTrafficSplitPolicy	bug fixes	A fallback or traffic-split policy write with a missing or unrecognised target_scope_type now explains that unknown JSON names are ignored and names the target id fields to check. A project-routed PROJECT-scope write with no target_project_id now returns INVALID_ARGUMENT naming the field, instead of PERMISSION_DENIED.
UpdateTrafficSplitPolicy	bug fixes	A fallback or traffic-split policy write with a missing or unrecognised target_scope_type now explains that unknown JSON names are ignored and names the target id fields to check. A project-routed PROJECT-scope write with no target_project_id now returns INVALID_ARGUMENT naming the field, instead of PERMISSION_DENIED.
GetEffectivePolicy	bug fixes	The effective fallback-policy view now merges fallback entries per protected model across scopes and folds bound allow-lists over the merged set, matching what the data plane enforces. A protected model inherited from a broader scope is no longer hidden when a bound policy exists, and each entry reports the policy that supplied it.
ListFallbackChainPolicies	bug fixes	Deleting a project now also deletes its project fallback overrides, so a project created later with the same ID starts with none. The upgrade removes overrides left behind by projects deleted earlier, unless a new project already uses the same ID: that project keeps them, and an admin who doesn't want them removes them on the Fallback page.

RbacService

Operation	Kind	Change
ListRoles	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
CreateRole	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
UpdateRole	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
DeleteRole	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
ListBindings	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
CreateBinding	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
UpdateBinding	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
DeleteBinding	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
ListGroups	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
CreateGroup	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
ListGroupMembers	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
AddGroupMember	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
RemoveGroupMember	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
GetTeamAccessGroup	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
EnsureTeamAccessGroup	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
DeleteTeamAccessGroup	behaviour changes	Organization API keys can now manage roles, role assignments, groups and Team access groups through the management API, and existing admin keys get this without being reissued. A key can grant only permissions it holds, only in its own organization; keys limited to one project, and granting or revoking super administrators, still need a signed-in user.
ListRoles	bug fixes	GET /api/rbac/roles?includeApiScope=true also lists the roles an API key can hold, such as api_audit_logs_reader, so an administrator can see which scopes exist. A key gets one of these roles through its scopes, not through a role binding.

v0.5.1

No API operations changed in this release.

v0.5.0

AdminService

Operation	Kind	Change
QueryAuditLogs	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
GetAuditLog	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
QueryAuditLogs	behaviour changes	Audit entries from the management plane's services now record the call that produced them -- source_ip, user_agent, http_method and endpoint -- and name the user an action was performed on under the subject_user_id metadata key. Key lifecycle entries use one vocabulary: ISSUE_MY_KEY, REVOKE_MY_KEY, ROTATE_CLIENT_KEY, UPDATE_API_KEY and DELETE_API_KEY, with resource_type api_key and actor_type USER or SERVICE.
QueryPlatformAuditLogs	behaviour changes	Audit entries from the management plane's services now record the call that produced them -- source_ip, user_agent, http_method and endpoint -- and name the user an action was performed on under the subject_user_id metadata key. Key lifecycle entries use one vocabulary: ISSUE_MY_KEY, REVOKE_MY_KEY, ROTATE_CLIENT_KEY, UPDATE_API_KEY and DELETE_API_KEY, with resource_type api_key and actor_type USER or SERVICE.
QueryAuditLogs	new features	QueryAuditLogs and QueryPlatformAuditLogs accept subject_user_id, which selects the entries where a user was acted upon rather than the entries they performed themselves. An admin minting a key for a service identity is now findable from either side: user_id names the admin, subject_user_id names the identity.
QueryPlatformAuditLogs	new features	QueryAuditLogs and QueryPlatformAuditLogs accept subject_user_id, which selects the entries where a user was acted upon rather than the entries they performed themselves. An admin minting a key for a service identity is now findable from either side: user_id names the admin, subject_user_id names the identity.
RecordCatalogSync	new features	The catalog API can now record and read a management plane's catalog sync state: which published catalog version it last read, which one it is actually on, when each happened and who ran it. The same pair is on the admin API, so a scheduled job authenticating with a plane's admin key writes the same record an operator's own run does.
GetCatalogSyncState	new features	The catalog API can now record and read a management plane's catalog sync state: which published catalog version it last read, which one it is actually on, when each happened and who ran it. The same pair is on the admin API, so a scheduled job authenticating with a plane's admin key writes the same record an operator's own run does.
UpsertCatalogProvider	new features	Catalog audit entries now say whether a write came from a batch. A sync run's several hundred UPSERT rows carry batched: true in their metadata and interactive edits carry batched: false, so the audit view can be filtered to just the changes a person made.
UpsertCatalogModel	new features	Catalog audit entries now say whether a write came from a batch. A sync run's several hundred UPSERT rows carry batched: true in their metadata and interactive edits carry batched: false, so the audit view can be filtered to just the changes a person made.
QueryAuditLogs	bug fixes	Scoped management API keys can now reach audit-log and metrics operations without organization or project fields. The handler applies the relevant workspace, organization or platform boundary for each operation.
GetAuditLog	bug fixes	Scoped management API keys can now reach audit-log and metrics operations without organization or project fields. The handler applies the relevant workspace, organization or platform boundary for each operation.

CatalogService

Operation	Kind	Change
RecordCatalogSync	new features	The catalog API can now record and read a management plane's catalog sync state: which published catalog version it last read, which one it is actually on, when each happened and who ran it. The same pair is on the admin API, so a scheduled job authenticating with a plane's admin key writes the same record an operator's own run does.
GetCatalogSyncState	new features	The catalog API can now record and read a management plane's catalog sync state: which published catalog version it last read, which one it is actually on, when each happened and who ran it. The same pair is on the admin API, so a scheduled job authenticating with a plane's admin key writes the same record an operator's own run does.
UpsertProvider	new features	Catalog audit entries now say whether a write came from a batch. A sync run's several hundred UPSERT rows carry batched: true in their metadata and interactive edits carry batched: false, so the audit view can be filtered to just the changes a person made.
UpsertModel	new features	Catalog audit entries now say whether a write came from a batch. A sync run's several hundred UPSERT rows carry batched: true in their metadata and interactive edits carry batched: false, so the audit view can be filtered to just the changes a person made.

CustomerRequestLogsService

Operation	Kind	Change
GetCustomerRequestLogStats	bug fixes	Request log stats now report the full billed amount. The group cost left out per-image generation cost, so a group of image generation traffic could read 0.00 while those requests were billed. The response-level total cost was never populated and was always empty. Both now count every cost component, so figures for image-heavy workloads rise to the amount that was always charged.
ListCustomerRequestLogs	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.
GetCustomerRequestLog	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.
GetCustomerRequestLogStats	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.

GuardrailProvidersService

Operation	Kind	Change
CreateGuardrailProvider	behaviour changes	Creating or updating an externalservice guardrail provider now rejects, with INVALID_ARGUMENT, a config the data plane could not use: an unknown key or non-string value, a service_url that is not an absolute http or https URL or names a link-local or metadata address, a blank endpoint or one without a leading slash, a blank timeout or one outside 0-30s, or a ca_cert_pem over 8 KiB, over four certificates or holding anything else. Its rules need a raw.threshold above 0 and at most 1.
UpdateGuardrailProvider	behaviour changes	Creating or updating an externalservice guardrail provider now rejects, with INVALID_ARGUMENT, a config the data plane could not use: an unknown key or non-string value, a service_url that is not an absolute http or https URL or names a link-local or metadata address, a blank endpoint or one without a leading slash, a blank timeout or one outside 0-30s, or a ca_cert_pem over 8 KiB, over four certificates or holding anything else. Its rules need a raw.threshold above 0 and at most 1.
CreateGuardrailProvider	security updates	Creating or updating a guardrail provider now rejects the config key api_key_file, and the credential keys api_key and auth_token, under any spelling, with INVALID_ARGUMENT. A stored api_key_file is no longer delivered to the data plane: the management plane sets that key itself, so a caller could otherwise choose which credential file a provider reads.
UpdateGuardrailProvider	security updates	Creating or updating a guardrail provider now rejects the config key api_key_file, and the credential keys api_key and auth_token, under any spelling, with INVALID_ARGUMENT. A stored api_key_file is no longer delivered to the data plane: the management plane sets that key itself, so a caller could otherwise choose which credential file a provider reads.
CreateGuardrailProvider	new features	tare api guardrails providers create and update take the provider as --provider, a JSON object in the API's shape, so a guardrail provider can be registered and enabled from the CLI. The flag is required.
UpdateGuardrailProvider	new features	tare api guardrails providers create and update take the provider as --provider, a JSON object in the API's shape, so a guardrail provider can be registered and enabled from the CLI. The flag is required.

GuardrailsService

Operation	Kind	Change
CreateGuardrailRule	behaviour changes	Creating or updating an externalservice guardrail provider now rejects, with INVALID_ARGUMENT, a config the data plane could not use: an unknown key or non-string value, a service_url that is not an absolute http or https URL or names a link-local or metadata address, a blank endpoint or one without a leading slash, a blank timeout or one outside 0-30s, or a ca_cert_pem over 8 KiB, over four certificates or holding anything else. Its rules need a raw.threshold above 0 and at most 1.
UpdateGuardrailRule	behaviour changes	Creating or updating an externalservice guardrail provider now rejects, with INVALID_ARGUMENT, a config the data plane could not use: an unknown key or non-string value, a service_url that is not an absolute http or https URL or names a link-local or metadata address, a blank endpoint or one without a leading slash, a blank timeout or one outside 0-30s, or a ca_cert_pem over 8 KiB, over four certificates or holding anything else. Its rules need a raw.threshold above 0 and at most 1.
CreateGuardrailRule	behaviour changes	Creating or updating a guardrail rule with the externalService configuration variant now fails with INVALID_ARGUMENT for every provider kind. A stored rule that still carries the variant stays readable and editable as long as the write does not send it back.
UpdateGuardrailRule	behaviour changes	Creating or updating a guardrail rule with the externalService configuration variant now fails with INVALID_ARGUMENT for every provider kind. A stored rule that still carries the variant stays readable and editable as long as the write does not send it back.
CreateGuardrailRule	deprecations	The externalService variant of a guardrail rule's configuration is deprecated: nothing reads it, and its headers were never sent as HTTP headers. Connection settings and the credential live on the provider; per-check parameters go in the rule's raw configuration, where threshold is the one reserved key.
UpdateGuardrailRule	deprecations	The externalService variant of a guardrail rule's configuration is deprecated: nothing reads it, and its headers were never sent as HTTP headers. Connection settings and the credential live on the provider; per-check parameters go in the rule's raw configuration, where threshold is the one reserved key.

IdentityService

Operation	Kind	Change
GetUser	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
ListUsers	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
SearchUsers	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
GetUserStats	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
CreateOrUpdateSSOProvider	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
ListSSOProviders	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
GetSSOProvider	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
DeleteSSOProvider	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
CreateOrUpdateSSOProvider	new features	Corporate SSO now supports SAML 2.0 as well as OIDC. Register the IdP entity id, sign-on URL and signing certificate, then import the service provider metadata the management API publishes for that provider. Encrypted assertions and IdP-initiated sign-in are not supported.
GetUser	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
ListUsers	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
SearchUsers	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
RevokeUserSessions	new features	Administrators can sign a user out of every session through the management plane API, for example after lowering their role. The user's API keys keep working and the account is not banned. It needs the same users.edit permission as banning a user, and only a signed-in administrator can call it, not an API key.

McpOAuthClientsService

Operation	Kind	Change
CreateMcpOAuthClient	new features	You can now register and connect an MCP server whose OAuth provider issues public clients, which have no client secret.
UpdateMcpOAuthClient	new features	You can now register and connect an MCP server whose OAuth provider issues public clients, which have no client secret.

MeService

Operation	Kind	Change
GetSSOProviderStatus	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
StartSSOLogin	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
StartSSOLogin	new features	Corporate SSO now supports SAML 2.0 as well as OIDC. Register the IdP entity id, sign-on URL and signing certificate, then import the service provider metadata the management API publishes for that provider. Encrypted assertions and IdP-initiated sign-in are not supported.
StartSocialLogin	new features	Google and GitHub sign-in can now be served by the management API. Set the provider's client id and secret to offer it; a provider missing either one is not offered. A Google or GitHub account whose email address the provider has not verified cannot sign in.
ListSocialProviders	new features	Google and GitHub sign-in can now be served by the management API. Set the provider's client id and secret to offer it; a provider missing either one is not offered. A Google or GitHub account whose email address the provider has not verified cannot sign in.
SignInWithPassword	new features	The management plane now serves password sign-in, reset, and change directly, using the same password format as the auth service. The surface stays off until ENABLE_PASSWORD_AUTH is true with corporate login off; reset mail also needs SMTP_HOST, and without it no reset links are issued.
RequestPasswordReset	new features	The management plane now serves password sign-in, reset, and change directly, using the same password format as the auth service. The surface stays off until ENABLE_PASSWORD_AUTH is true with corporate login off; reset mail also needs SMTP_HOST, and without it no reset links are issued.
ResetPassword	new features	The management plane now serves password sign-in, reset, and change directly, using the same password format as the auth service. The surface stays off until ENABLE_PASSWORD_AUTH is true with corporate login off; reset mail also needs SMTP_HOST, and without it no reset links are issued.
ChangePassword	new features	The management plane now serves password sign-in, reset, and change directly, using the same password format as the auth service. The surface stays off until ENABLE_PASSWORD_AUTH is true with corporate login off; reset mail also needs SMTP_HOST, and without it no reset links are issued.
SignUpWithPassword	new features	Self-serve sign-up now works against the management plane: confirm the emailed link once to verify and sign in (a second open does not mint another session). Where a challenge is configured, sign-up and sign-in ask for it; an unreachable challenge service blocks sign-up but lets sign-in continue. Needs ENABLE_PASSWORD_AUTH with corporate login off, and SMTP_HOST; sign-up itself stays off unless turned on.
SendVerificationEmail	new features	Self-serve sign-up now works against the management plane: confirm the emailed link once to verify and sign in (a second open does not mint another session). Where a challenge is configured, sign-up and sign-in ask for it; an unreachable challenge service blocks sign-up but lets sign-in continue. Needs ENABLE_PASSWORD_AUTH with corporate login off, and SMTP_HOST; sign-up itself stays off unless turned on.
VerifyEmail	new features	Self-serve sign-up now works against the management plane: confirm the emailed link once to verify and sign in (a second open does not mint another session). Where a challenge is configured, sign-up and sign-in ask for it; an unreachable challenge service blocks sign-up but lets sign-in continue. Needs ENABLE_PASSWORD_AUTH with corporate login off, and SMTP_HOST; sign-up itself stays off unless turned on.
CreateUser	new features	Self-serve sign-up now works against the management plane: confirm the emailed link once to verify and sign in (a second open does not mint another session). Where a challenge is configured, sign-up and sign-in ask for it; an unreachable challenge service blocks sign-up but lets sign-in continue. Needs ENABLE_PASSWORD_AUTH with corporate login off, and SMTP_HOST; sign-up itself stays off unless turned on.
UpdateMe	new features	Signed-in users can change their own display name through the management plane API. Only the name can be changed this way, and the call needs a browser or CLI sign-in rather than an API key.
ResolveMyPermissions	new features	The management plane now serves the RBAC read surface directly: a caller can resolve their own permissions at an organization or project, list the project ids they can reach, and read the deployment's permission catalog. These answer from the same bindings the platform already enforces against, so what the API reports and what a request is allowed to do cannot drift apart. Nothing changes for existing callers yet -- the console continues to use the auth service until it is moved over.
ListMyReachableProjects	new features	The management plane now serves the RBAC read surface directly: a caller can resolve their own permissions at an organization or project, list the project ids they can reach, and read the deployment's permission catalog. These answer from the same bindings the platform already enforces against, so what the API reports and what a request is allowed to do cannot drift apart. Nothing changes for existing callers yet -- the console continues to use the auth service until it is moved over.
GetPermissionCatalog	new features	The management plane now serves the RBAC read surface directly: a caller can resolve their own permissions at an organization or project, list the project ids they can reach, and read the deployment's permission catalog. These answer from the same bindings the platform already enforces against, so what the API reports and what a request is allowed to do cannot drift apart. Nothing changes for existing callers yet -- the console continues to use the auth service until it is moved over.
GetMe	new features	GetMe now returns session claims to a signed-in browser session: the caller's organization-level permission set and whether the deployment has an administrator. A console reading its session from the management plane gets the same permission view the auth service provides today, including the difference between "no access" and "could not tell". Callers using an API key see no change.

MetricsService

Operation	Kind	Change
GetMetric	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
GetRawMetric	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
ListMetrics	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
GetMetric	bug fixes	Scoped management API keys can now reach audit-log and metrics operations without organization or project fields. The handler applies the relevant workspace, organization or platform boundary for each operation.
GetRawMetric	bug fixes	Scoped management API keys can now reach audit-log and metrics operations without organization or project fields. The handler applies the relevant workspace, organization or platform boundary for each operation.
ListMetrics	bug fixes	Scoped management API keys can now reach audit-log and metrics operations without organization or project fields. The handler applies the relevant workspace, organization or platform boundary for each operation.

PatternsService

Operation	Kind	Change
ListPatterns	behaviour changes	Listing and reading guardrail patterns now requires the guardrail_patterns.read permission or a scope that grants guardrail reads. Keys with the read, write, admin, guardrails_reader or guardrails_admin scope keep access, as do the Super Admin and Viewer roles and anyone who can open the Admin Console's Patterns page today. A key scoped to an unrelated area, or a custom role with neither, now gets a permission error.
GetPattern	behaviour changes	Listing and reading guardrail patterns now requires the guardrail_patterns.read permission or a scope that grants guardrail reads. Keys with the read, write, admin, guardrails_reader or guardrails_admin scope keep access, as do the Super Admin and Viewer roles and anyone who can open the Admin Console's Patterns page today. A key scoped to an unrelated area, or a custom role with neither, now gets a permission error.

PolicyService

Operation	Kind	Change
DeleteUserGroup	behaviour changes	DeleteUserGroup now refuses with FailedPrecondition while the team still has members or is the target of an active budget policy. Previously, deleting a team with members failed with an internal error; deleting a team without members also deleted its budget policies.
ListUserGroups	behaviour changes	ListUserGroups now returns InvalidArgument for a non-empty page.filter or an unsupported page.order_by instead of silently ignoring them.
ListRequestAttributes	behaviour changes	ListRequestAttributes now accepts an optional search, returns unfiltered catalog stats, supports sorting by name, value_type or referencing_policy_count, and rejects unsupported page.filter or page.order_by values with InvalidArgument instead of ignoring them.
GetEffectivePolicy	new features	PolicyService can explain which attribute-routing policy governs a key or tag preview. It returns the enabled winner, ordered rules and precedence details, and reports how many eligible keys are covered. These views require the attribute_routing_policies.read permission.
GetPolicyCoverage	new features	PolicyService can explain which attribute-routing policy governs a key or tag preview. It returns the enabled winner, ordered rules and precedence details, and reports how many eligible keys are covered. These views require the attribute_routing_policies.read permission.
GetUserGroup	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
ListUserGroups	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
UpdateUserGroup	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
ListUserGroupMembers	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
AddUserGroupMembers	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
RemoveUserGroupMembers	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
CreateFallbackChainPolicy	new features	Fallback policies can now define independent ordered fallback entries for each model, so requests fail over through the configured providers in the order specified. UpsertFallbackPolicy replaces the full set of entries for an organization, project, or API-key target in one idempotent call: omitted models are removed and an empty set deactivates the target. Existing policy clients using the flat chain representation remain compatible.
GetFallbackChainPolicy	new features	Fallback policies can now define independent ordered fallback entries for each model, so requests fail over through the configured providers in the order specified. UpsertFallbackPolicy replaces the full set of entries for an organization, project, or API-key target in one idempotent call: omitted models are removed and an empty set deactivates the target. Existing policy clients using the flat chain representation remain compatible.
UpdateFallbackChainPolicy	new features	Fallback policies can now define independent ordered fallback entries for each model, so requests fail over through the configured providers in the order specified. UpsertFallbackPolicy replaces the full set of entries for an organization, project, or API-key target in one idempotent call: omitted models are removed and an empty set deactivates the target. Existing policy clients using the flat chain representation remain compatible.
UpsertFallbackPolicy	new features	Fallback policies can now define independent ordered fallback entries for each model, so requests fail over through the configured providers in the order specified. UpsertFallbackPolicy replaces the full set of entries for an organization, project, or API-key target in one idempotent call: omitted models are removed and an empty set deactivates the target. Existing policy clients using the flat chain representation remain compatible.
ListPolicies	new features	The unified policy list now includes attribute-routing policies alongside the budget, rate-limit, fallback-chain and traffic-split rows, naming each policy's target, effective project, and monitor or enforce mode, and appearing only where the caller could read it directly. For these rows match_count counts the eligible keys for which the policy is the enabled winner; a paused policy reports zero.
UpsertFallbackPolicy	bug fixes	Fallback policies now keep independent ordered entries for each protected model and resolve project and organization policies, plus API-key policies, in the documented precedence order. Full-set updates converge on replay, remove omitted entries, and treat an explicit empty set as a deactivated override while preserving legacy fallback-chain aliases.

RbacService

Operation	Kind	Change
ListRoles	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
CreateRole	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
UpdateRole	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
DeleteRole	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
ListBindings	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
CreateBinding	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
UpdateBinding	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
DeleteBinding	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
ListGroups	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
CreateGroup	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
ListGroupMembers	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
AddGroupMember	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
RemoveGroupMember	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
GetTeamAccessGroup	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
EnsureTeamAccessGroup	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
DeleteTeamAccessGroup	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
GrantSuperAdmin	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
RevokeSuperAdmin	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.

RequestLogsService

Operation	Kind	Change
GetRequestLogStats	bug fixes	Request log stats now report the full billed amount. The group cost left out per-image generation cost, so a group of image generation traffic could read 0.00 while those requests were billed. The response-level total cost was never populated and was always empty. Both now count every cost component, so figures for image-heavy workloads rise to the amount that was always charged.
QueryRequestLogs	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.
GetRequestLog	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.
GetRequestLogStats	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.

v0.4.1

No API operations changed in this release.

v0.4.0

AdminService

Operation	Kind	Change
SetWorkspaceURL	security updates	Claiming a hostname that is already in use no longer exposes details about the existing configuration. The conflict message now says only that the hostname is in use, preventing a rejected claim from revealing information about another organization's resources.
SetDataplaneURL	security updates	Claiming a hostname that is already in use no longer exposes details about the existing configuration. The conflict message now says only that the hostname is in use, preventing a rejected claim from revealing information about another organization's resources.
CreateProjectGateway	security updates	Claiming a hostname that is already in use no longer exposes details about the existing configuration. The conflict message now says only that the hostname is in use, preventing a rejected claim from revealing information about another organization's resources.
UpdateProjectGateway	security updates	Claiming a hostname that is already in use no longer exposes details about the existing configuration. The conflict message now says only that the hostname is in use, preventing a rejected claim from revealing information about another organization's resources.
SetProjectGatewayURL	security updates	Claiming a hostname that is already in use no longer exposes details about the existing configuration. The conflict message now says only that the hostname is in use, preventing a rejected claim from revealing information about another organization's resources.
CreateUserToken	bug fixes	Creating or rotating a routing key through the API saves the key and its client membership together. If membership setup fails, no partial key or client records remain. Newly created standalone routing keys also appear in the client list; those created directly through the token API have no client title.

ClientsService

Operation	Kind	Change
CreateClientWithKey	bug fixes	Creating or rotating a routing key through the API saves the key and its client membership together. If membership setup fails, no partial key or client records remain. Newly created standalone routing keys also appear in the client list; those created directly through the token API have no client title.
RotateKeyInClient	bug fixes	Creating or rotating a routing key through the API saves the key and its client membership together. If membership setup fails, no partial key or client records remain. Newly created standalone routing keys also appear in the client list; those created directly through the token API have no client title.

GuardrailProvidersService

Operation	Kind	Change
CreateGuardrailProvider	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
UpdateGuardrailProvider	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
ListGuardrailProviders	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
GetGuardrailProvider	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
DeleteGuardrailProvider	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
SetGuardrailProviderSecret	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
ListGuardrailProviders	behaviour changes	Listing and reading guardrail providers now requires either the "guardrail_providers.read" permission or a scope that grants guardrail reads, bringing provider reads into the same permission domain as the writes. Management API keys carrying the read, write, admin, guardrails_reader or guardrails_admin scope keep their access with no action needed, as do the Super Admin and Viewer roles and every console session. A key scoped only to an unrelated area -- audit logs, for example -- and any custom role that grants neither the new permission nor a guardrail read scope will now receive a permission error where a provider list or lookup previously succeeded. To restore access, add "guardrail_providers.read" to the custom role, or issue the key with a scope that includes guardrail reads.
GetGuardrailProvider	behaviour changes	Listing and reading guardrail providers now requires either the "guardrail_providers.read" permission or a scope that grants guardrail reads, bringing provider reads into the same permission domain as the writes. Management API keys carrying the read, write, admin, guardrails_reader or guardrails_admin scope keep their access with no action needed, as do the Super Admin and Viewer roles and every console session. A key scoped only to an unrelated area -- audit logs, for example -- and any custom role that grants neither the new permission nor a guardrail read scope will now receive a permission error where a provider list or lookup previously succeeded. To restore access, add "guardrail_providers.read" to the custom role, or issue the key with a scope that includes guardrail reads.
ListGuardrailProviders	security updates	A management API key scoped to an unrelated area can no longer enumerate a project's guardrail providers. Listing and reading providers required no permission and no scope at all, so any credential valid for the project could read every provider registered in it -- names, kinds and endpoints -- even though changing one had been restricted to administrators. Both operations are now gated. Callers holding a guardrail read scope are unaffected, which includes every console session, so this narrows the credentials that can reach provider configuration rather than closing the read to everyone without an explicit grant. No CVE; required a credential already valid for the project.
GetGuardrailProvider	security updates	A management API key scoped to an unrelated area can no longer enumerate a project's guardrail providers. Listing and reading providers required no permission and no scope at all, so any credential valid for the project could read every provider registered in it -- names, kinds and endpoints -- even though changing one had been restricted to administrators. Both operations are now gated. Callers holding a guardrail read scope are unaffected, which includes every console session, so this narrows the credentials that can reach provider configuration rather than closing the read to everyone without an explicit grant. No CVE; required a credential already valid for the project.
CreateGuardrailProvider	new features	Creating or updating a guardrail provider now fails with a clear message when the provider could never run: an Azure AI Content Safety provider must carry an endpoint that is an absolute http(s) URL, alongside the existing checks on provider kind and on an external service's declared checks. Such a provider used to be saved and shipped, and then quietly skipped by the gateway, so every rule bound to it stopped enforcing with nothing to see. Existing providers are untouched: only a write that actually changes the configuration is checked, so renaming or disabling one still works even if its stored configuration would not pass.
UpdateGuardrailProvider	new features	Creating or updating a guardrail provider now fails with a clear message when the provider could never run: an Azure AI Content Safety provider must carry an endpoint that is an absolute http(s) URL, alongside the existing checks on provider kind and on an external service's declared checks. Such a provider used to be saved and shipped, and then quietly skipped by the gateway, so every rule bound to it stopped enforcing with nothing to see. Existing providers are untouched: only a write that actually changes the configuration is checked, so renaming or disabling one still works even if its stored configuration would not pass.

GuardrailsService

Operation	Kind	Change
CreateGuardrailRule	behaviour changes	Editing a guardrail rule that is bound to a provider outside its own project is now refused. The rule keeps enforcing and reading it is unaffected, but any update that touches its provider, check type or configuration fails until the rule is repointed at a provider its own project owns -- which can be done in the same update call. Only rules the guardrail-provider ownership migration reports as still bound outside their project are affected; it names the count in a notice reading "N non-template rule(s) remain bound outside their own project".
UpdateGuardrailRule	behaviour changes	Editing a guardrail rule that is bound to a provider outside its own project is now refused. The rule keeps enforcing and reading it is unaffected, but any update that touches its provider, check type or configuration fails until the rule is repointed at a provider its own project owns -- which can be done in the same update call. Only rules the guardrail-provider ownership migration reports as still bound outside their project are affected; it names the count in a notice reading "N non-template rule(s) remain bound outside their own project".
CreateGuardrailRule	security updates	A guardrail rule can now be bound only to a provider its own project owns. A caller who knew another project's provider id could previously point a rule at it and send that project's traffic through another project's provider and credential, because the binding check asked only whether the provider existed and was usable, never who owned it. The refusal reads the same whether the id names another project's provider, a catalog template or nothing at all, so it cannot be used to discover which provider ids exist. Rules that already reference a provider in their own project are unaffected. No CVE; requires a caller authorized to write guardrails in some project.

Rules written before this release are NOT rewritten, and any that the upgrade left bound outside their own project keep enforcing -- and keep exporting the other project's provider configuration, its endpoint and credential reference included, into the referencing project's data-plane configuration. The upgrade reports how many such rules remain: the guardrail-provider ownership migration raises a notice reading "N non-template rule(s) remain bound outside their own project". Repoint each of them at a provider its own project owns; until you do, the next edit to the rule's provider, check type or configuration is refused. | | UpdateGuardrailRule | security updates | A guardrail rule can now be bound only to a provider its own project owns. A caller who knew another project's provider id could previously point a rule at it and send that project's traffic through another project's provider and credential, because the binding check asked only whether the provider existed and was usable, never who owned it. The refusal reads the same whether the id names another project's provider, a catalog template or nothing at all, so it cannot be used to discover which provider ids exist. Rules that already reference a provider in their own project are unaffected. No CVE; requires a caller authorized to write guardrails in some project. Rules written before this release are NOT rewritten, and any that the upgrade left bound outside their own project keep enforcing -- and keep exporting the other project's provider configuration, its endpoint and credential reference included, into the referencing project's data-plane configuration. The upgrade reports how many such rules remain: the guardrail-provider ownership migration raises a notice reading "N non-template rule(s) remain bound outside their own project". Repoint each of them at a provider its own project owns; until you do, the next edit to the rule's provider, check type or configuration is refused. |

IdentityService

Operation	Kind	Change
BanUser	new features	Administrators can ban and unban a user through the management API. Banning a user signs them out everywhere and disables their API keys. Unbanning lets them sign in again, and they issue new keys -- keys removed by the ban are not restored. Both calls require an interactive session holding the admin scope or the users.edit permission, which is the same authority the delete call requires. An API key is refused even when it carries that permission.
UnbanUser	new features	Administrators can ban and unban a user through the management API. Banning a user signs them out everywhere and disables their API keys. Unbanning lets them sign in again, and they issue new keys -- keys removed by the ban are not restored. Both calls require an interactive session holding the admin scope or the users.edit permission, which is the same authority the delete call requires. An API key is refused even when it carries that permission.
DeleteUser	new features	Platform operators can soft-delete and restore user accounts over the management API. DELETE /v1/users/{user_id} marks the account deleted, revokes its API keys, and ends its sessions in one atomic operation; POST /v1/users/{user_id}/restore reverses it. The delete refuses the last active administrator of the platform or of any organization the user administers, so a deployment cannot be left unadministrable.
RestoreUser	new features	Platform operators can soft-delete and restore user accounts over the management API. DELETE /v1/users/{user_id} marks the account deleted, revokes its API keys, and ends its sessions in one atomic operation; POST /v1/users/{user_id}/restore reverses it. The delete refuses the last active administrator of the platform or of any organization the user administers, so a deployment cannot be left unadministrable.
SearchUsers	new features	The management API now serves the user directory the Admin Console reads. POST /v1/users/search returns a page of users matched on name or email substring, filtered by account status, role, team or id set, sorted on a chosen field, and POST /v1/users/stats returns the per-status counts over those same filters. A request that names no status leaves deleted users out, so the active population is what a caller sees by default. A directory user also carries its account status, ban reason and deletion time, so a console can render a deleted user in history instead of resolving nothing.
GetUserStats	new features	The management API now serves the user directory the Admin Console reads. POST /v1/users/search returns a page of users matched on name or email substring, filtered by account status, role, team or id set, sorted on a chosen field, and POST /v1/users/stats returns the per-status counts over those same filters. A request that names no status leaves deleted users out, so the active population is what a caller sees by default. A directory user also carries its account status, ban reason and deletion time, so a console can render a deleted user in history instead of resolving nothing.

PolicyService

Operation	Kind	Change
ListBudgetPolicies	behaviour changes	Listing budget policies now returns INVALID_ARGUMENT for a non-empty page.filter or an unsupported page.order_by, including multiple sort fields. These inputs were previously ignored.
ListBudgetPolicies	new features	Budget policies can now report live billable spend and passthrough estimates, including per-member spend for teams and customer spend and near-limit, over-limit and unmeasured policy counts on list requests. Reads include target names, with user names and email addresses limited to the caller's directory permissions. Lists support target search and sorting, and inactive policies can be permanently removed. Statistics measure at most 500 active policies per request and indicate when more policies match. A failed measurement no longer discards the policy list; the response reports the number of failed measurements.
GetBudgetPolicy	new features	Budget policies can now report live billable spend and passthrough estimates, including per-member spend for teams and customer spend and near-limit, over-limit and unmeasured policy counts on list requests. Reads include target names, with user names and email addresses limited to the caller's directory permissions. Lists support target search and sorting, and inactive policies can be permanently removed. Statistics measure at most 500 active policies per request and indicate when more policies match. A failed measurement no longer discards the policy list; the response reports the number of failed measurements.
PurgeBudgetPolicy	new features	Budget policies can now report live billable spend and passthrough estimates, including per-member spend for teams and customer spend and near-limit, over-limit and unmeasured policy counts on list requests. Reads include target names, with user names and email addresses limited to the caller's directory permissions. Lists support target search and sorting, and inactive policies can be permanently removed. Statistics measure at most 500 active policies per request and indicate when more policies match. A failed measurement no longer discards the policy list; the response reports the number of failed measurements.
CreateRequestAttribute	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
GetRequestAttribute	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
ListRequestAttributes	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
UpdateRequestAttribute	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
DeleteRequestAttribute	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
CreateAttributeRoutingPolicy	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
GetAttributeRoutingPolicy	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
ListAttributeRoutingPolicies	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
UpdateAttributeRoutingPolicy	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
DeleteAttributeRoutingPolicy	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
SetAttributeRoutingPolicyStatus	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
SetAttributeRoutingPolicyMode	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
PurgeBudgetPolicy	new features	The API can now permanently remove an inactive budget policy without changing the existing deactivation behavior of DELETE. Without the admin scope, purge reaches only PROJECT and API_KEY policies in the request project. Callers with the admin scope can also purge inactive policies with other scopes in their customer.
CreateBudgetPolicy	bug fixes	CreateBudgetPolicy now accepts only the released TEAM, TEAM_PER_USER_DEFAULT, and API_KEY scopes. Existing policies in legacy scopes remain available for reads, updates, enforcement, and resolution.

v0.3.0

AdminService

Operation	Kind	Change
UpdateProjectMember	security updates	A project can no longer be left with no administrator. Demoting or removing a project's last admin through the admin or tenancy member APIs is now refused with FailedPrecondition; the mutation is allowed again as soon as a second admin exists. Previously either call could strip the final admin and orphan the project, leaving no one able to manage its members. A project whose ownership is held only through a manual role grant (not a member row) is unaffected, and revoking that grant is still done separately.
RemoveProjectMember	security updates	A project can no longer be left with no administrator. Demoting or removing a project's last admin through the admin or tenancy member APIs is now refused with FailedPrecondition; the mutation is allowed again as soon as a second admin exists. Previously either call could strip the final admin and orphan the project, leaving no one able to manage its members. A project whose ownership is held only through a manual role grant (not a member row) is unaffected, and revoking that grant is still done separately.
CreateUserToken	bug fixes	Creating an API key now schedules a budget snapshot refresh instead of waiting for the next periodic rebuild, up to five minutes by default. Exhausted budgets begin enforcing on the new key once the updated snapshot reaches the data plane. The refresh runs in the background; it does not delay key creation.

ClientsService

Operation	Kind	Change
CreateClientWithKey	bug fixes	Creating an API key now schedules a budget snapshot refresh instead of waiting for the next periodic rebuild, up to five minutes by default. Exhausted budgets begin enforcing on the new key once the updated snapshot reaches the data plane. The refresh runs in the background; it does not delay key creation.
AddKeyToClient	bug fixes	A budget policy on a single API key now caps the client behind the key, within the key's project, instead of the key row. Rotating the key used to strand the policy on the retired key, leaving the replacement with no budget while the policy still listed as active; the budget now follows the rotation, the period's spend is summed across every key of the client in that project, and both keys of a rotation pair are governed while both are live. The client is recorded on the policy when it is written, and at most one active per-key policy per project, client and intent is allowed (one default and one bound may coexist): creating, retargeting or activating a second one on another key of the same client, or attaching an already-budgeted key to such a client, is refused. A key cannot be moved out of a client that other keys stay in while that client's budget is active; deactivate the budget first. A per-key budget can only be created on, or retargeted to, a key that belongs to the project named in the request; a key in another project is reported as not found.
RotateKeyInClient	bug fixes	A budget policy on a single API key now caps the client behind the key, within the key's project, instead of the key row. Rotating the key used to strand the policy on the retired key, leaving the replacement with no budget while the policy still listed as active; the budget now follows the rotation, the period's spend is summed across every key of the client in that project, and both keys of a rotation pair are governed while both are live. The client is recorded on the policy when it is written, and at most one active per-key policy per project, client and intent is allowed (one default and one bound may coexist): creating, retargeting or activating a second one on another key of the same client, or attaching an already-budgeted key to such a client, is refused. A key cannot be moved out of a client that other keys stay in while that client's budget is active; deactivate the budget first. A per-key budget can only be created on, or retargeted to, a key that belongs to the project named in the request; a key in another project is reported as not found.

PolicyService

Operation	Kind	Change
CreateBudgetPolicy	behaviour changes	Per-key budget storage changes with migration 0131. If two per-key budgets were active on two keys of the same client at the same intent, the upgrade keeps the earliest and deactivates the rest, and the surviving limit now applies to the client's combined spend.
UpdateBudgetPolicy	behaviour changes	Per-key budget storage changes with migration 0131. If two per-key budgets were active on two keys of the same client at the same intent, the upgrade keeps the earliest and deactivates the rest, and the surviving limit now applies to the client's combined spend.
CreateBudgetPolicy	bug fixes	Creating, changing, deleting, or disabling a budget policy now schedules a gateway refresh for every project it governs. Previously only one project's gateways were refreshed, leaving other projects enforcing the old policy until the next periodic rebuild. Removing the last budget also clears older gateway snapshots that could otherwise keep blocking requests until another configuration refresh.
UpdateBudgetPolicy	bug fixes	Creating, changing, deleting, or disabling a budget policy now schedules a gateway refresh for every project it governs. Previously only one project's gateways were refreshed, leaving other projects enforcing the old policy until the next periodic rebuild. Removing the last budget also clears older gateway snapshots that could otherwise keep blocking requests until another configuration refresh.
DeleteBudgetPolicy	bug fixes	Creating, changing, deleting, or disabling a budget policy now schedules a gateway refresh for every project it governs. Previously only one project's gateways were refreshed, leaving other projects enforcing the old policy until the next periodic rebuild. Removing the last budget also clears older gateway snapshots that could otherwise keep blocking requests until another configuration refresh.
SetBudgetPolicyStatus	bug fixes	Creating, changing, deleting, or disabling a budget policy now schedules a gateway refresh for every project it governs. Previously only one project's gateways were refreshed, leaving other projects enforcing the old policy until the next periodic rebuild. Removing the last budget also clears older gateway snapshots that could otherwise keep blocking requests until another configuration refresh.
CreateBudgetPolicy	bug fixes	A budget policy on a single API key now caps the client behind the key, within the key's project, instead of the key row. Rotating the key used to strand the policy on the retired key, leaving the replacement with no budget while the policy still listed as active; the budget now follows the rotation, the period's spend is summed across every key of the client in that project, and both keys of a rotation pair are governed while both are live. The client is recorded on the policy when it is written, and at most one active per-key policy per project, client and intent is allowed (one default and one bound may coexist): creating, retargeting or activating a second one on another key of the same client, or attaching an already-budgeted key to such a client, is refused. A key cannot be moved out of a client that other keys stay in while that client's budget is active; deactivate the budget first. A per-key budget can only be created on, or retargeted to, a key that belongs to the project named in the request; a key in another project is reported as not found.
UpdateBudgetPolicy	bug fixes	A budget policy on a single API key now caps the client behind the key, within the key's project, instead of the key row. Rotating the key used to strand the policy on the retired key, leaving the replacement with no budget while the policy still listed as active; the budget now follows the rotation, the period's spend is summed across every key of the client in that project, and both keys of a rotation pair are governed while both are live. The client is recorded on the policy when it is written, and at most one active per-key policy per project, client and intent is allowed (one default and one bound may coexist): creating, retargeting or activating a second one on another key of the same client, or attaching an already-budgeted key to such a client, is refused. A key cannot be moved out of a client that other keys stay in while that client's budget is active; deactivate the budget first. A per-key budget can only be created on, or retargeted to, a key that belongs to the project named in the request; a key in another project is reported as not found.
SetBudgetPolicyStatus	bug fixes	A budget policy on a single API key now caps the client behind the key, within the key's project, instead of the key row. Rotating the key used to strand the policy on the retired key, leaving the replacement with no budget while the policy still listed as active; the budget now follows the rotation, the period's spend is summed across every key of the client in that project, and both keys of a rotation pair are governed while both are live. The client is recorded on the policy when it is written, and at most one active per-key policy per project, client and intent is allowed (one default and one bound may coexist): creating, retargeting or activating a second one on another key of the same client, or attaching an already-budgeted key to such a client, is refused. A key cannot be moved out of a client that other keys stay in while that client's budget is active; deactivate the budget first. A per-key budget can only be created on, or retargeted to, a key that belongs to the project named in the request; a key in another project is reported as not found.
CreateBudgetPolicy	bug fixes	Budget policies with a block or fallback action are no longer accepted at the user and per-key-default team scopes, where enforcement does not evaluate them. Such a policy was stored and reported spend but never gated a request; creating one now returns an error naming the limitation, and monitor policies at these scopes remain supported. The few existing rows (internal testing only; the Console never authored these scopes) cannot be edited or re-activated while they keep the enforcing action; switching one to monitor or moving it to a scope enforcement governs unfreezes it, and deactivating or deleting it remains available either way.
UpdateBudgetPolicy	bug fixes	Budget policies with a block or fallback action are no longer accepted at the user and per-key-default team scopes, where enforcement does not evaluate them. Such a policy was stored and reported spend but never gated a request; creating one now returns an error naming the limitation, and monitor policies at these scopes remain supported. The few existing rows (internal testing only; the Console never authored these scopes) cannot be edited or re-activated while they keep the enforcing action; switching one to monitor or moving it to a scope enforcement governs unfreezes it, and deactivating or deleting it remains available either way.
SetBudgetPolicyStatus	bug fixes	Budget policies with a block or fallback action are no longer accepted at the user and per-key-default team scopes, where enforcement does not evaluate them. Such a policy was stored and reported spend but never gated a request; creating one now returns an error naming the limitation, and monitor policies at these scopes remain supported. The few existing rows (internal testing only; the Console never authored these scopes) cannot be edited or re-activated while they keep the enforcing action; switching one to monitor or moving it to a scope enforcement governs unfreezes it, and deactivating or deleting it remains available either way.

ProjectsService

Operation	Kind	Change
UpdateProjectMember	security updates	A project can no longer be left with no administrator. Demoting or removing a project's last admin through the admin or tenancy member APIs is now refused with FailedPrecondition; the mutation is allowed again as soon as a second admin exists. Previously either call could strip the final admin and orphan the project, leaving no one able to manage its members. A project whose ownership is held only through a manual role grant (not a member row) is unaffected, and revoking that grant is still done separately.
RemoveProjectMember	security updates	A project can no longer be left with no administrator. Demoting or removing a project's last admin through the admin or tenancy member APIs is now refused with FailedPrecondition; the mutation is allowed again as soon as a second admin exists. Previously either call could strip the final admin and orphan the project, leaving no one able to manage its members. A project whose ownership is held only through a manual role grant (not a member row) is unaffected, and revoking that grant is still done separately.

v0.2.1

No API operations changed in this release.

v0.2.0

AdminService

Operation	Kind	Change
ListUserTokens	security updates	Listing, reading and revoking user tokens through the admin API is now confined to the calling credential's own organization. A credential carrying the broad admin scope could previously act on any organization's tokens, because these operations matched a token by its id alone and never checked who was asking. Naming a different organization on the request is refused. Credentials that are not tied to an organization, such as an operator's environment-configured key, are unaffected. An organization administrator signed in to the dashboard can now list, read and revoke their own organization's tokens through these operations, which an organization-scoped API key still cannot do. Before upgrading a management plane that serves more than one organization, re-scope by hand any user tokens still stamped with the placeholder organization "default": until you do, the organization that owns them can no longer read or revoke them.
GetUserToken	security updates	Listing, reading and revoking user tokens through the admin API is now confined to the calling credential's own organization. A credential carrying the broad admin scope could previously act on any organization's tokens, because these operations matched a token by its id alone and never checked who was asking. Naming a different organization on the request is refused. Credentials that are not tied to an organization, such as an operator's environment-configured key, are unaffected. An organization administrator signed in to the dashboard can now list, read and revoke their own organization's tokens through these operations, which an organization-scoped API key still cannot do. Before upgrading a management plane that serves more than one organization, re-scope by hand any user tokens still stamped with the placeholder organization "default": until you do, the organization that owns them can no longer read or revoke them.
RevokeUserToken	security updates	Listing, reading and revoking user tokens through the admin API is now confined to the calling credential's own organization. A credential carrying the broad admin scope could previously act on any organization's tokens, because these operations matched a token by its id alone and never checked who was asking. Naming a different organization on the request is refused. Credentials that are not tied to an organization, such as an operator's environment-configured key, are unaffected. An organization administrator signed in to the dashboard can now list, read and revoke their own organization's tokens through these operations, which an organization-scoped API key still cannot do. Before upgrading a management plane that serves more than one organization, re-scope by hand any user tokens still stamped with the placeholder organization "default": until you do, the organization that owns them can no longer read or revoke them.
QueryAuditLogs	new features	The audit log query RPCs (QueryAuditLogs and QueryPlatformAuditLogs) can now return success and failure counts alongside the page of entries. Set include_stats and read the new stats field instead of running an extra query per count. The counts obey every filter except success, so a view filtered to one outcome still shows both numbers. The response is unchanged when include_stats is not set.
QueryPlatformAuditLogs	new features	The audit log query RPCs (QueryAuditLogs and QueryPlatformAuditLogs) can now return success and failure counts alongside the page of entries. Set include_stats and read the new stats field instead of running an extra query per count. The counts obey every filter except success, so a view filtered to one outcome still shows both numbers. The response is unchanged when include_stats is not set.

CatalogService

Operation	Kind	Change
UpsertProvider	behaviour changes	Creating a provider through the catalog API no longer enables it. A provider created without is_enabled now arrives disabled, and registering a model under it is refused until it is enabled: enabling a provider is what makes the data plane start fetching its credentials, so one created before it has a credential cannot serve. Existing providers are unaffected.
UpsertModel	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
GetModel	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
ListModels	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
UpsertProvider	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
GetProvider	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
ListProviders	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
UpsertModel	bug fixes	Editing a model or provider through the catalog API no longer switches it back on. Every write used to assert "enabled" whether or not it mentioned enablement, so an administrator's deliberate disable was reverted by the next unrelated edit (a price correction or a rename was enough) with nothing recording it. Enablement now changes only when a request actually asks it to. One consequence: a provider created through the API now arrives disabled, because enabling a provider is what makes the data plane start fetching its credentials, and one created before it has a credential cannot serve. Existing providers are unaffected, and enabling a new one is a single further call. If you script provider creation and relied on it being immediately enabled, ask for it explicitly.
UpsertProvider	bug fixes	Editing a model or provider through the catalog API no longer switches it back on. Every write used to assert "enabled" whether or not it mentioned enablement, so an administrator's deliberate disable was reverted by the next unrelated edit (a price correction or a rename was enough) with nothing recording it. Enablement now changes only when a request actually asks it to. One consequence: a provider created through the API now arrives disabled, because enabling a provider is what makes the data plane start fetching its credentials, and one created before it has a credential cannot serve. Existing providers are unaffected, and enabling a new one is a single further call. If you script provider creation and relied on it being immediately enabled, ask for it explicitly.
UpsertModel	bug fixes	A partial edit through the catalog API no longer blanks the fields it did not mention. Changing one property of a model (its mode, say) cleared its capabilities, per-token prices and context window, because an omitted value was written over the stored one rather than skipped. Fields a request does not carry are now left as they are. The model's modalities, limits, backend URLs and pricing extras follow the same rule now that the API can carry them at all; they were never reachable before, so nothing was lost through them.

CustomerRequestLogsService

Operation	Kind	Change
GetCustomerRequestLogStats	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.
ListCustomerRequestLogs	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.
GetCustomerRequestLog	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.

IdentityService

Operation	Kind	Change
GetUser	security updates	Directory lookups through IdentityService.GetUser and ListUsers are now confined to the organizations the calling session belongs to. A signed-in user that held the users_reader scope, including every organization administrator, could previously resolve any user id in any tenant to email, name and role. GetUser now answers "not found" for a user outside the caller's organizations, and ListUsers omits them. A session with no project memberships resolves no users at all, including its own row. This affects users whose only access is an organization-level role, pending invites, and users whose only project is the reserved "default" project. Platform operators keep cross-tenant directory reads only through an explicit platform role binding. In a multi-tenant deployment that binding is a documented provisioning step (docs/runbooks/platform-directory-reach.md).
ListUsers	security updates	Directory lookups through IdentityService.GetUser and ListUsers are now confined to the organizations the calling session belongs to. A signed-in user that held the users_reader scope, including every organization administrator, could previously resolve any user id in any tenant to email, name and role. GetUser now answers "not found" for a user outside the caller's organizations, and ListUsers omits them. A session with no project memberships resolves no users at all, including its own row. This affects users whose only access is an organization-level role, pending invites, and users whose only project is the reserved "default" project. Platform operators keep cross-tenant directory reads only through an explicit platform role binding. In a multi-tenant deployment that binding is a documented provisioning step (docs/runbooks/platform-directory-reach.md).

McpOAuthClientsService

Operation	Kind	Change
CreateMcpOAuthClient	bug fixes	The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.
GetMcpOAuthClient	bug fixes	The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.
ListMcpOAuthClients	bug fixes	The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.
UpdateMcpOAuthClient	bug fixes	The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.
DeleteMcpOAuthClient	bug fixes	The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.

RequestLogsService

Operation	Kind	Change
GetRequestLogStats	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.
QueryRequestLogs	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.
GetRequestLog	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.

v0.1.5

AdminService

Operation	Kind	Change
AddProjectMember	security updates	Adding a member to a project now rejects an identity that does not exist, instead of recording a membership and role assignment against an unknown id: records that were inert until someone was later created with the same id and inherited the access. Both API surfaces enforce this.
ListProjectMembers	bug fixes	Listing a project's members now includes people whose access comes from a role or permission granted on that project, not only those added directly. Both let someone into the project, but only direct membership appeared on the list, so it under-reported who could reach the project, wrong for an access review or offboarding. Someone listed this way has no membership record to change, so they are reported without one, and their access is removed where it was granted rather than from the member list.
CreateServiceAccount	bug fixes	Creating or revoking a service account now takes effect in seconds rather than minutes. The published key set is refreshed immediately by the instance handling the change and within 30 seconds elsewhere, where previously either could take up to five minutes, long enough that a new service account was rejected as if its credentials were wrong, and a revoked one kept being accepted.
RevokeServiceAccount	bug fixes	Creating or revoking a service account now takes effect in seconds rather than minutes. The published key set is refreshed immediately by the instance handling the change and within 30 seconds elsewhere, where previously either could take up to five minutes, long enough that a new service account was rejected as if its credentials were wrong, and a revoked one kept being accepted.
ListProjects	bug fixes	Listing projects now paginates. The project list endpoints accepted a page token and ignored it, always reporting that no further pages existed, so a organization with more projects than one page silently saw only the first, and a caller had no way to tell a full page from a truncated one. Callers that follow the next-page token now receive every project.
ListProjects	bug fixes	Projects can now be listed in a requested order, by creation time or by project id, so a client no longer has to re-sort every response. An unsupported sort field, or a filter expression the endpoint does not implement, is now rejected with a clear error rather than silently ignored, which previously returned an unsorted or unfiltered list that looked like an answer.
CreateProject	bug fixes	A project created through the admin API now starts with its caller as an administrator, so it can be managed and have keys minted right away. Previously a project created this way could come out with no members: its management page read "unavailable" and nobody could administer it or mint keys for its users. A caller with no resolvable user identity (a legacy admin API key) still creates an unowned project, now recorded so it can be found and repaired.
GetSystemSetting	bug fixes	Reading and writing a system setting whose key contains a colon (for example dataplane-url:<workspace_id>) now works over REST. GET and PUT /admin/v1/system-settings/{key} previously returned an empty 200 response for such keys; both the raw and the percent-encoded forms of the key now resolve.
UpsertSystemSetting	bug fixes	Reading and writing a system setting whose key contains a colon (for example dataplane-url:<workspace_id>) now works over REST. GET and PUT /admin/v1/system-settings/{key} previously returned an empty 200 response for such keys; both the raw and the percent-encoded forms of the key now resolve.
CreateCustomer	bug fixes	Creating an organization now rejects an organization ID that does not match the documented slug format (lowercase letters, digits, and internal hyphens, 63 characters maximum). The API previously accepted any non-empty string. Existing organizations are not affected; the check applies only when an organization is created.
AddProjectMember	bug fixes	Adding a project member now fails with a 404 error when the given identity does not exist, instead of creating the membership and its RBAC binding anyway, records a user registering later with the same ID could inherit. The check and write run in one statement, so a concurrent identity deletion cannot slip through. The same call updates an existing member's role, and that path now also fails with a 404 when the member's identity was deleted. Member removal is unaffected, so cleanup of such rows still works.

AiKeysService

Operation	Kind	Change
Register	bug fixes	Project members can again register, list, and revoke their own user-scoped AI provider keys. The permission-only AI-key endpoints rejected members after the RBAC migration even though their role was intended to carry those permissions. Shared project keys remain owner-controlled.
List	bug fixes	Project members can again register, list, and revoke their own user-scoped AI provider keys. The permission-only AI-key endpoints rejected members after the RBAC migration even though their role was intended to carry those permissions. Shared project keys remain owner-controlled.
Revoke	bug fixes	Project members can again register, list, and revoke their own user-scoped AI provider keys. The permission-only AI-key endpoints rejected members after the RBAC migration even though their role was intended to carry those permissions. Shared project keys remain owner-controlled.

ApiKeysService

Operation	Kind	Change
UpdateApiKey	bug fixes	Changing an API key's policy tags, or enabling or disabling a key, now takes effect on the data plane promptly. Previously these changes only reached a project's gateways on the periodic resync, so a re-tagged key kept its old routing and fallback for up to ~30 minutes, a rate-limit change from a tag was not applied until an unrelated policy edit, and a disabled key kept serving until the resync.

CatalogService

Operation	Kind	Change
UpsertProvider	bug fixes	Editing a provider's connection settings through the catalog API (base URL or credential, or removing the provider) now takes effect on projects that route on their own hostname (strict isolation). Previously only the shared route map picked up the change, so a project with its own hostname kept serving the old provider configuration until an unrelated change happened to refresh it.
SetProviderCredential	bug fixes	Editing a provider's connection settings through the catalog API (base URL or credential, or removing the provider) now takes effect on projects that route on their own hostname (strict isolation). Previously only the shared route map picked up the change, so a project with its own hostname kept serving the old provider configuration until an unrelated change happened to refresh it.
DeleteProvider	bug fixes	Editing a provider's connection settings through the catalog API (base URL or credential, or removing the provider) now takes effect on projects that route on their own hostname (strict isolation). Previously only the shared route map picked up the change, so a project with its own hostname kept serving the old provider configuration until an unrelated change happened to refresh it.
UpsertModel	bug fixes	Editing or removing a model through the catalog API (its upstream name, capabilities, or pricing) now takes effect on projects that route on their own hostname (strict isolation). Previously only the shared route map picked up the change, so a project with its own hostname kept serving the old model configuration until an unrelated change happened to refresh it. Companion to the provider-config fix above.
DeleteModel	bug fixes	Editing or removing a model through the catalog API (its upstream name, capabilities, or pricing) now takes effect on projects that route on their own hostname (strict isolation). Previously only the shared route map picked up the change, so a project with its own hostname kept serving the old model configuration until an unrelated change happened to refresh it. Companion to the provider-config fix above.

ConfiguratorService

Operation	Kind	Change
SetDataplaneURL	security updates	The Configurator SetDataplaneURL and RevokeUserToken RPCs no longer accept an organization admin management API key. Repointing a workspace's data-plane URL and revoking gatekeeper user tokens by JTI are platform operations: they now require the dataplane_operator scope or the dataplane machine role (plus the managed-SaaS machine credential for SetDataplaneURL), so a leaked or over-privileged org admin key can no longer redirect a data plane or invalidate sessions. Tenant-facing equivalents under AdminService are unchanged. No CVE.
RevokeUserToken	security updates	The Configurator SetDataplaneURL and RevokeUserToken RPCs no longer accept an organization admin management API key. Repointing a workspace's data-plane URL and revoking gatekeeper user tokens by JTI are platform operations: they now require the dataplane_operator scope or the dataplane machine role (plus the managed-SaaS machine credential for SetDataplaneURL), so a leaked or over-privileged org admin key can no longer redirect a data plane or invalidate sessions. Tenant-facing equivalents under AdminService are unchanged. No CVE.
UpsertMCPCatalogServer	security updates	MCP catalog writes are now confined to the caller's own workspace. A data plane's service account could previously write catalog entries into another workspace, because the ownership check it was gated behind never ran. No CVE; requires a valid service-account credential.

InferenceIngressService

Operation	Kind	Change
GetDataplaneURL	bug fixes	Asking for a dataplane URL by project without naming an organization now answers 400 with the field to supply, instead of 500. Callers who belong to no project had no organization to infer, so the request failed as a server error quoting an internal argument contract. Naming the organization gives the same answer it always did.

MCPCatalogService

Operation	Kind	Change
UpsertCatalogServer	bug fixes	Editing, disabling, or deleting a shared MCP catalog server now refreshes the MCP profiles that route it within a worker poll. Previously only the per-gateway catalog directory was refreshed, so a profile serving that server kept the old address and tool set until the next periodic full sync, up to ~30 minutes. Both the catalog API and the operator dashboard now fan the change out to every affected profile owner.
SetCatalogServerEnabled	bug fixes	Editing, disabling, or deleting a shared MCP catalog server now refreshes the MCP profiles that route it within a worker poll. Previously only the per-gateway catalog directory was refreshed, so a profile serving that server kept the old address and tool set until the next periodic full sync, up to ~30 minutes. Both the catalog API and the operator dashboard now fan the change out to every affected profile owner.
DeleteCatalogServer	bug fixes	Editing, disabling, or deleting a shared MCP catalog server now refreshes the MCP profiles that route it within a worker poll. Previously only the per-gateway catalog directory was refreshed, so a profile serving that server kept the old address and tool set until the next periodic full sync, up to ~30 minutes. Both the catalog API and the operator dashboard now fan the change out to every affected profile owner.
DeleteCatalogServer	bug fixes	Deleting an MCP catalog server now succeeds when projects have granted that server. The delete removes the grant rows and the server in one transaction, then refreshes each granting project and each affected profile owner. Such a delete previously failed with a 500 error that exposed the database constraint name.

MCPProfilesService

Operation	Kind	Change
CreateMCPProfile	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.
UpdateMCPProfile	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.
DeleteMCPProfile	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.
AddMCPProfileServer	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.
RemoveMCPProfileServer	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.
SetMCPProfileServerTools	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.

MeService

Operation	Kind	Change
IssueMyKey	new features	Management keys can now receive built-in platform roles by explicit delegation when a key is issued or updated. The issuer's platform permissions bound what can be delegated. Legacy platform scopes are converted to explicit role bindings on upgrade, and bindings written by the retired scope inference are removed.
UpdateMyKey	new features	Management keys can now receive built-in platform roles by explicit delegation when a key is issued or updated. The issuer's platform permissions bound what can be delegated. Legacy platform scopes are converted to explicit role bindings on upgrade, and bindings written by the retired scope inference are removed.
ListMyProjects	new features	A new endpoint, GET /v1/me/projects, lists the projects you can access and your role in each: a console or client can answer "which projects am I in" with the caller's own credential instead of an administrator key or a direct database read. Access covers project membership, project-scoped and organization-wide RBAC grants, plus your organization's default project.
IssueMyKey	new features	A management API key's scopes are now readable: the key object returned when a key is issued, listed, or re-scoped carries its scope set, so an assignment can be confirmed directly instead of inferred from a refused call. An empty list means the key carries no explicit scopes and resolves through its owner's roles, not that it has none.
ListMyKeys	new features	A management API key's scopes are now readable: the key object returned when a key is issued, listed, or re-scoped carries its scope set, so an assignment can be confirmed directly instead of inferred from a refused call. An empty list means the key carries no explicit scopes and resolves through its owner's roles, not that it has none.
UpdateMyKey	new features	A management API key's scopes are now readable: the key object returned when a key is issued, listed, or re-scoped carries its scope set, so an assignment can be confirmed directly instead of inferred from a refused call. An empty list means the key carries no explicit scopes and resolves through its owner's roles, not that it has none.
IssueMyKey	bug fixes	Creating a management API key now follows the api_keys.create permission rather than the name of the role that carries it. A User Admin, a custom role, or a direct grant holding that permission was refused, so granting the permission the denial named could not work and only a Super Admin could create these keys. The console's key-type chooser follows the same permission, so the option appears for everyone who can use it. The key such a person creates carries their own access, not full administrative access. Only someone who can already administer the organization can put that on a key.

PolicyService

Operation	Kind	Change
AddApiKeyTag	bug fixes	Changing an API key's policy tags, or enabling or disabling a key, now takes effect on the data plane promptly. Previously these changes only reached a project's gateways on the periodic resync, so a re-tagged key kept its old routing and fallback for up to ~30 minutes, a rate-limit change from a tag was not applied until an unrelated policy edit, and a disabled key kept serving until the resync.
RemoveApiKeyTag	bug fixes	Changing an API key's policy tags, or enabling or disabling a key, now takes effect on the data plane promptly. Previously these changes only reached a project's gateways on the periodic resync, so a re-tagged key kept its old routing and fallback for up to ~30 minutes, a rate-limit change from a tag was not applied until an unrelated policy edit, and a disabled key kept serving until the resync.
UpdateBudgetPolicy	bug fixes	Updating a budget policy, a rate-limit policy, or a user group with the all-zero UUID (00000000-0000-0000-0000-000000000000) now returns a 400 error that names the invalid field. These requests previously returned a 500 error.
UpdateRateLimitPolicy	bug fixes	Updating a budget policy, a rate-limit policy, or a user group with the all-zero UUID (00000000-0000-0000-0000-000000000000) now returns a 400 error that names the invalid field. These requests previously returned a 500 error.
UpdateUserGroup	bug fixes	Updating a budget policy, a rate-limit policy, or a user group with the all-zero UUID (00000000-0000-0000-0000-000000000000) now returns a 400 error that names the invalid field. These requests previously returned a 500 error.
ListApiKeyTags	bug fixes	The API key tag endpoints now answer 400 invalid_argument for the all-zero api key id, instead of 500. The all-zero uuid has valid syntax, so it passed every id guard and reached the database layer, where it became an internal error. List tags for a key, add a tag, remove a tag, and the policy coverage check all report the bad id the same way. Remove a tag answered 404 not found for this id before. It now answers 400 with the other three.
AddApiKeyTag	bug fixes	The API key tag endpoints now answer 400 invalid_argument for the all-zero api key id, instead of 500. The all-zero uuid has valid syntax, so it passed every id guard and reached the database layer, where it became an internal error. List tags for a key, add a tag, remove a tag, and the policy coverage check all report the bad id the same way. Remove a tag answered 404 not found for this id before. It now answers 400 with the other three.
RemoveApiKeyTag	bug fixes	The API key tag endpoints now answer 400 invalid_argument for the all-zero api key id, instead of 500. The all-zero uuid has valid syntax, so it passed every id guard and reached the database layer, where it became an internal error. List tags for a key, add a tag, remove a tag, and the policy coverage check all report the bad id the same way. Remove a tag answered 404 not found for this id before. It now answers 400 with the other three.
GetPolicyCoverage	bug fixes	The API key tag endpoints now answer 400 invalid_argument for the all-zero api key id, instead of 500. The all-zero uuid has valid syntax, so it passed every id guard and reached the database layer, where it became an internal error. List tags for a key, add a tag, remove a tag, and the policy coverage check all report the bad id the same way. Remove a tag answered 404 not found for this id before. It now answers 400 with the other three.

ProjectsService

Operation	Kind	Change
AddProjectMember	security updates	Adding a member to a project now rejects an identity that does not exist, instead of recording a membership and role assignment against an unknown id: records that were inert until someone was later created with the same id and inherited the access. Both API surfaces enforce this.
ListProjectMembers	bug fixes	Listing a project's members now includes people whose access comes from a role or permission granted on that project, not only those added directly. Both let someone into the project, but only direct membership appeared on the list, so it under-reported who could reach the project, wrong for an access review or offboarding. Someone listed this way has no membership record to change, so they are reported without one, and their access is removed where it was granted rather than from the member list.
ListProjects	bug fixes	Listing projects now paginates. The project list endpoints accepted a page token and ignored it, always reporting that no further pages existed, so a organization with more projects than one page silently saw only the first, and a caller had no way to tell a full page from a truncated one. Callers that follow the next-page token now receive every project.
ListProjects	bug fixes	Projects can now be listed in a requested order, by creation time or by project id, so a client no longer has to re-sort every response. An unsupported sort field, or a filter expression the endpoint does not implement, is now rejected with a clear error rather than silently ignored, which previously returned an unsorted or unfiltered list that looked like an answer.
AddProjectMember	bug fixes	Adding a project member now fails with a 404 error when the given identity does not exist, instead of creating the membership and its RBAC binding anyway, records a user registering later with the same ID could inherit. The check and write run in one statement, so a concurrent identity deletion cannot slip through. The same call updates an existing member's role, and that path now also fails with a 404 when the member's identity was deleted. Member removal is unaffected, so cleanup of such rows still works.

RequestLogsService

Operation	Kind	Change
GetRequestLog	bug fixes	Fetching a request log by ID over REST now works when the ID contains a colon (for example default:<uuid>). Such a request previously returned an empty 200 response, because the route treated the text after the colon as a custom verb. Both the raw and the percent-encoded forms of the ID now resolve.
QueryRequestLogs	bug fixes	A management API key that holds the request_logs_reader scope can now read request logs and request-log stats. Every scoped key was previously refused on these endpoints with "scoped api key cannot call an operation without a tenant boundary", so the scope granted nothing. Results are confined to the key's own organization or project, and the three read endpoints accept an optional customer_id filter. Admin credentials and console sessions are unchanged.
GetRequestLog	bug fixes	A management API key that holds the request_logs_reader scope can now read request logs and request-log stats. Every scoped key was previously refused on these endpoints with "scoped api key cannot call an operation without a tenant boundary", so the scope granted nothing. Results are confined to the key's own organization or project, and the three read endpoints accept an optional customer_id filter. Admin credentials and console sessions are unchanged.
GetRequestLogStats	bug fixes	A management API key that holds the request_logs_reader scope can now read request logs and request-log stats. Every scoped key was previously refused on these endpoints with "scoped api key cannot call an operation without a tenant boundary", so the scope granted nothing. Results are confined to the key's own organization or project, and the three read endpoints accept an optional customer_id filter. Admin credentials and console sessions are unchanged.

TenancyService

Operation	Kind	Change
CreateCustomer	bug fixes	Creating an organization now rejects an organization ID that does not match the documented slug format (lowercase letters, digits, and internal hyphens, 63 characters maximum). The API previously accepted any non-empty string. Existing organizations are not affected; the check applies only when an organization is created.