API changelog

The API operations each release changed, from the affects lists in the release notes. Each operation links to its section in the reference. Regenerate with make api.reference.generate.

v0.6.0

This release is not published yet. The operations below changed on main.

No API operations changed in this release.

v0.5.0

AdminService

Operation	Kind	Change
QueryAuditLogs	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
GetAuditLog	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
QueryAuditLogs	behaviour changes	Audit entries from the management plane's services now record the call that produced them -- source_ip, user_agent, http_method and endpoint -- and name the user an action was performed on under the subject_user_id metadata key. Key lifecycle entries use one vocabulary: ISSUE_MY_KEY, REVOKE_MY_KEY, ROTATE_CLIENT_KEY, UPDATE_API_KEY and DELETE_API_KEY, with resource_type api_key and actor_type USER or SERVICE.
QueryPlatformAuditLogs	behaviour changes	Audit entries from the management plane's services now record the call that produced them -- source_ip, user_agent, http_method and endpoint -- and name the user an action was performed on under the subject_user_id metadata key. Key lifecycle entries use one vocabulary: ISSUE_MY_KEY, REVOKE_MY_KEY, ROTATE_CLIENT_KEY, UPDATE_API_KEY and DELETE_API_KEY, with resource_type api_key and actor_type USER or SERVICE.
QueryAuditLogs	new features	QueryAuditLogs and QueryPlatformAuditLogs accept subject_user_id, which selects the entries where a user was acted upon rather than the entries they performed themselves. An admin minting a key for a service identity is now findable from either side: user_id names the admin, subject_user_id names the identity.
QueryPlatformAuditLogs	new features	QueryAuditLogs and QueryPlatformAuditLogs accept subject_user_id, which selects the entries where a user was acted upon rather than the entries they performed themselves. An admin minting a key for a service identity is now findable from either side: user_id names the admin, subject_user_id names the identity.
RecordCatalogSync	new features	The catalog API can now record and read a management plane's catalog sync state: which published catalog version it last read, which one it is actually on, when each happened and who ran it. The same pair is on the admin API, so a scheduled job authenticating with a plane's admin key writes the same record an operator's own run does.
GetCatalogSyncState	new features	The catalog API can now record and read a management plane's catalog sync state: which published catalog version it last read, which one it is actually on, when each happened and who ran it. The same pair is on the admin API, so a scheduled job authenticating with a plane's admin key writes the same record an operator's own run does.
UpsertCatalogProvider	new features	Catalog audit entries now say whether a write came from a batch. A sync run's several hundred UPSERT rows carry batched: true in their metadata and interactive edits carry batched: false, so the audit view can be filtered to just the changes a person made.
UpsertCatalogModel	new features	Catalog audit entries now say whether a write came from a batch. A sync run's several hundred UPSERT rows carry batched: true in their metadata and interactive edits carry batched: false, so the audit view can be filtered to just the changes a person made.
QueryAuditLogs	bug fixes	Scoped management API keys can now reach audit-log and metrics operations without organization or project fields. The handler applies the relevant workspace, organization or platform boundary for each operation.
GetAuditLog	bug fixes	Scoped management API keys can now reach audit-log and metrics operations without organization or project fields. The handler applies the relevant workspace, organization or platform boundary for each operation.

CatalogService

Operation	Kind	Change
RecordCatalogSync	new features	The catalog API can now record and read a management plane's catalog sync state: which published catalog version it last read, which one it is actually on, when each happened and who ran it. The same pair is on the admin API, so a scheduled job authenticating with a plane's admin key writes the same record an operator's own run does.
GetCatalogSyncState	new features	The catalog API can now record and read a management plane's catalog sync state: which published catalog version it last read, which one it is actually on, when each happened and who ran it. The same pair is on the admin API, so a scheduled job authenticating with a plane's admin key writes the same record an operator's own run does.
UpsertProvider	new features	Catalog audit entries now say whether a write came from a batch. A sync run's several hundred UPSERT rows carry batched: true in their metadata and interactive edits carry batched: false, so the audit view can be filtered to just the changes a person made.
UpsertModel	new features	Catalog audit entries now say whether a write came from a batch. A sync run's several hundred UPSERT rows carry batched: true in their metadata and interactive edits carry batched: false, so the audit view can be filtered to just the changes a person made.

CustomerRequestLogsService

Operation	Kind	Change
GetCustomerRequestLogStats	bug fixes	Request log stats now report the full billed amount. The group cost left out per-image generation cost, so a group of image generation traffic could read 0.00 while those requests were billed. The response-level total cost was never populated and was always empty. Both now count every cost component, so figures for image-heavy workloads rise to the amount that was always charged.
ListCustomerRequestLogs	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.
GetCustomerRequestLog	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.
GetCustomerRequestLogStats	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.

GuardrailProvidersService

Operation	Kind	Change
CreateGuardrailProvider	behaviour changes	Creating or updating an externalservice guardrail provider now rejects, with INVALID_ARGUMENT, a config the data plane could not use: an unknown key or non-string value, a service_url that is not an absolute http or https URL or names a link-local or metadata address, a blank endpoint or one without a leading slash, a blank timeout or one outside 0-30s, or a ca_cert_pem over 8 KiB, over four certificates or holding anything else. Its rules need a raw.threshold above 0 and at most 1.
UpdateGuardrailProvider	behaviour changes	Creating or updating an externalservice guardrail provider now rejects, with INVALID_ARGUMENT, a config the data plane could not use: an unknown key or non-string value, a service_url that is not an absolute http or https URL or names a link-local or metadata address, a blank endpoint or one without a leading slash, a blank timeout or one outside 0-30s, or a ca_cert_pem over 8 KiB, over four certificates or holding anything else. Its rules need a raw.threshold above 0 and at most 1.
CreateGuardrailProvider	security updates	Creating or updating a guardrail provider now rejects the config key api_key_file, and the credential keys api_key and auth_token, under any spelling, with INVALID_ARGUMENT. A stored api_key_file is no longer delivered to the data plane: the management plane sets that key itself, so a caller could otherwise choose which credential file a provider reads.
UpdateGuardrailProvider	security updates	Creating or updating a guardrail provider now rejects the config key api_key_file, and the credential keys api_key and auth_token, under any spelling, with INVALID_ARGUMENT. A stored api_key_file is no longer delivered to the data plane: the management plane sets that key itself, so a caller could otherwise choose which credential file a provider reads.
CreateGuardrailProvider	new features	tare api guardrails providers create and update take the provider as --provider, a JSON object in the API's shape, so a guardrail provider can be registered and enabled from the CLI. The flag is required.
UpdateGuardrailProvider	new features	tare api guardrails providers create and update take the provider as --provider, a JSON object in the API's shape, so a guardrail provider can be registered and enabled from the CLI. The flag is required.

GuardrailsService

Operation	Kind	Change
CreateGuardrailRule	behaviour changes	Creating or updating an externalservice guardrail provider now rejects, with INVALID_ARGUMENT, a config the data plane could not use: an unknown key or non-string value, a service_url that is not an absolute http or https URL or names a link-local or metadata address, a blank endpoint or one without a leading slash, a blank timeout or one outside 0-30s, or a ca_cert_pem over 8 KiB, over four certificates or holding anything else. Its rules need a raw.threshold above 0 and at most 1.
UpdateGuardrailRule	behaviour changes	Creating or updating an externalservice guardrail provider now rejects, with INVALID_ARGUMENT, a config the data plane could not use: an unknown key or non-string value, a service_url that is not an absolute http or https URL or names a link-local or metadata address, a blank endpoint or one without a leading slash, a blank timeout or one outside 0-30s, or a ca_cert_pem over 8 KiB, over four certificates or holding anything else. Its rules need a raw.threshold above 0 and at most 1.
CreateGuardrailRule	behaviour changes	Creating or updating a guardrail rule with the externalService configuration variant now fails with INVALID_ARGUMENT for every provider kind. A stored rule that still carries the variant stays readable and editable as long as the write does not send it back.
UpdateGuardrailRule	behaviour changes	Creating or updating a guardrail rule with the externalService configuration variant now fails with INVALID_ARGUMENT for every provider kind. A stored rule that still carries the variant stays readable and editable as long as the write does not send it back.
CreateGuardrailRule	deprecations	The externalService variant of a guardrail rule's configuration is deprecated: nothing reads it, and its headers were never sent as HTTP headers. Connection settings and the credential live on the provider; per-check parameters go in the rule's raw configuration, where threshold is the one reserved key.
UpdateGuardrailRule	deprecations	The externalService variant of a guardrail rule's configuration is deprecated: nothing reads it, and its headers were never sent as HTTP headers. Connection settings and the credential live on the provider; per-check parameters go in the rule's raw configuration, where threshold is the one reserved key.

IdentityService

Operation	Kind	Change
GetUser	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
ListUsers	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
SearchUsers	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
GetUserStats	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
CreateOrUpdateSSOProvider	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
ListSSOProviders	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
GetSSOProvider	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
DeleteSSOProvider	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
CreateOrUpdateSSOProvider	new features	Corporate SSO now supports SAML 2.0 as well as OIDC. Register the IdP entity id, sign-on URL and signing certificate, then import the service provider metadata the management API publishes for that provider. Encrypted assertions and IdP-initiated sign-in are not supported.
GetUser	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
ListUsers	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
SearchUsers	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
RevokeUserSessions	new features	Administrators can sign a user out of every session through the management plane API, for example after lowering their role. The user's API keys keep working and the account is not banned. It needs the same users.edit permission as banning a user, and only a signed-in administrator can call it, not an API key.

McpOAuthClientsService

Operation	Kind	Change
CreateMcpOAuthClient	new features	You can now register and connect an MCP server whose OAuth provider issues public clients, which have no client secret.
UpdateMcpOAuthClient	new features	You can now register and connect an MCP server whose OAuth provider issues public clients, which have no client secret.

MeService

Operation	Kind	Change
GetSSOProviderStatus	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
StartSSOLogin	new features	Corporate SSO can now be registered and used through the management API. Administrators holding sso_providers permissions can create, read and delete the OIDC provider, a sign-in page can ask whether corporate login is available before anyone signs in, and a browser can complete a corporate login against the management API itself. Set SSO_CALLBACK_BASE_URL to the management API's public origin to enable the browser flow.
StartSSOLogin	new features	Corporate SSO now supports SAML 2.0 as well as OIDC. Register the IdP entity id, sign-on URL and signing certificate, then import the service provider metadata the management API publishes for that provider. Encrypted assertions and IdP-initiated sign-in are not supported.
StartSocialLogin	new features	Google and GitHub sign-in can now be served by the management API. Set the provider's client id and secret to offer it; a provider missing either one is not offered. A Google or GitHub account whose email address the provider has not verified cannot sign in.
ListSocialProviders	new features	Google and GitHub sign-in can now be served by the management API. Set the provider's client id and secret to offer it; a provider missing either one is not offered. A Google or GitHub account whose email address the provider has not verified cannot sign in.
SignInWithPassword	new features	The management plane now serves password sign-in, reset, and change directly, using the same password format as the auth service. The surface stays off until ENABLE_PASSWORD_AUTH is true with corporate login off; reset mail also needs SMTP_HOST, and without it no reset links are issued.
RequestPasswordReset	new features	The management plane now serves password sign-in, reset, and change directly, using the same password format as the auth service. The surface stays off until ENABLE_PASSWORD_AUTH is true with corporate login off; reset mail also needs SMTP_HOST, and without it no reset links are issued.
ResetPassword	new features	The management plane now serves password sign-in, reset, and change directly, using the same password format as the auth service. The surface stays off until ENABLE_PASSWORD_AUTH is true with corporate login off; reset mail also needs SMTP_HOST, and without it no reset links are issued.
ChangePassword	new features	The management plane now serves password sign-in, reset, and change directly, using the same password format as the auth service. The surface stays off until ENABLE_PASSWORD_AUTH is true with corporate login off; reset mail also needs SMTP_HOST, and without it no reset links are issued.
SignUpWithPassword	new features	Self-serve sign-up now works against the management plane: confirm the emailed link once to verify and sign in (a second open does not mint another session). Where a challenge is configured, sign-up and sign-in ask for it; an unreachable challenge service blocks sign-up but lets sign-in continue. Needs ENABLE_PASSWORD_AUTH with corporate login off, and SMTP_HOST; sign-up itself stays off unless turned on.
SendVerificationEmail	new features	Self-serve sign-up now works against the management plane: confirm the emailed link once to verify and sign in (a second open does not mint another session). Where a challenge is configured, sign-up and sign-in ask for it; an unreachable challenge service blocks sign-up but lets sign-in continue. Needs ENABLE_PASSWORD_AUTH with corporate login off, and SMTP_HOST; sign-up itself stays off unless turned on.
VerifyEmail	new features	Self-serve sign-up now works against the management plane: confirm the emailed link once to verify and sign in (a second open does not mint another session). Where a challenge is configured, sign-up and sign-in ask for it; an unreachable challenge service blocks sign-up but lets sign-in continue. Needs ENABLE_PASSWORD_AUTH with corporate login off, and SMTP_HOST; sign-up itself stays off unless turned on.
CreateUser	new features	Self-serve sign-up now works against the management plane: confirm the emailed link once to verify and sign in (a second open does not mint another session). Where a challenge is configured, sign-up and sign-in ask for it; an unreachable challenge service blocks sign-up but lets sign-in continue. Needs ENABLE_PASSWORD_AUTH with corporate login off, and SMTP_HOST; sign-up itself stays off unless turned on.
UpdateMe	new features	Signed-in users can change their own display name through the management plane API. Only the name can be changed this way, and the call needs a browser or CLI sign-in rather than an API key.
ResolveMyPermissions	new features	The management plane now serves the RBAC read surface directly: a caller can resolve their own permissions at an organization or project, list the project ids they can reach, and read the deployment's permission catalog. These answer from the same bindings the platform already enforces against, so what the API reports and what a request is allowed to do cannot drift apart. Nothing changes for existing callers yet -- the console continues to use the auth service until it is moved over.
ListMyReachableProjects	new features	The management plane now serves the RBAC read surface directly: a caller can resolve their own permissions at an organization or project, list the project ids they can reach, and read the deployment's permission catalog. These answer from the same bindings the platform already enforces against, so what the API reports and what a request is allowed to do cannot drift apart. Nothing changes for existing callers yet -- the console continues to use the auth service until it is moved over.
GetPermissionCatalog	new features	The management plane now serves the RBAC read surface directly: a caller can resolve their own permissions at an organization or project, list the project ids they can reach, and read the deployment's permission catalog. These answer from the same bindings the platform already enforces against, so what the API reports and what a request is allowed to do cannot drift apart. Nothing changes for existing callers yet -- the console continues to use the auth service until it is moved over.
GetMe	new features	GetMe now returns session claims to a signed-in browser session: the caller's organization-level permission set and whether the deployment has an administrator. A console reading its session from the management plane gets the same permission view the auth service provides today, including the difference between "no access" and "could not tell". Callers using an API key see no change.

MetricsService

Operation	Kind	Change
GetMetric	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
GetRawMetric	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
ListMetrics	behaviour changes	Reaching a fleet-wide operation now requires an explicit platform binding for a caller that does not hold the admin scope. A management API key that reached one of these operations on a coarse scope alone, such as read or metrics_reader, is refused after this upgrade.
GetMetric	bug fixes	Scoped management API keys can now reach audit-log and metrics operations without organization or project fields. The handler applies the relevant workspace, organization or platform boundary for each operation.
GetRawMetric	bug fixes	Scoped management API keys can now reach audit-log and metrics operations without organization or project fields. The handler applies the relevant workspace, organization or platform boundary for each operation.
ListMetrics	bug fixes	Scoped management API keys can now reach audit-log and metrics operations without organization or project fields. The handler applies the relevant workspace, organization or platform boundary for each operation.

PatternsService

Operation	Kind	Change
ListPatterns	behaviour changes	Listing and reading guardrail patterns now requires the guardrail_patterns.read permission or a scope that grants guardrail reads. Keys with the read, write, admin, guardrails_reader or guardrails_admin scope keep access, as do the Super Admin and Viewer roles and anyone who can open the Admin Console's Patterns page today. A key scoped to an unrelated area, or a custom role with neither, now gets a permission error.
GetPattern	behaviour changes	Listing and reading guardrail patterns now requires the guardrail_patterns.read permission or a scope that grants guardrail reads. Keys with the read, write, admin, guardrails_reader or guardrails_admin scope keep access, as do the Super Admin and Viewer roles and anyone who can open the Admin Console's Patterns page today. A key scoped to an unrelated area, or a custom role with neither, now gets a permission error.

PolicyService

Operation	Kind	Change
DeleteUserGroup	behaviour changes	DeleteUserGroup now refuses with FailedPrecondition while the team still has members or is the target of an active budget policy. Previously, deleting a team with members failed with an internal error; deleting a team without members also deleted its budget policies.
ListUserGroups	behaviour changes	ListUserGroups now returns InvalidArgument for a non-empty page.filter or an unsupported page.order_by instead of silently ignoring them.
ListRequestAttributes	behaviour changes	ListRequestAttributes now accepts an optional search, returns unfiltered catalog stats, supports sorting by name, value_type or referencing_policy_count, and rejects unsupported page.filter or page.order_by values with InvalidArgument instead of ignoring them.
GetEffectivePolicy	new features	PolicyService can explain which attribute-routing policy governs a key or tag preview. It returns the enabled winner, ordered rules and precedence details, and reports how many eligible keys are covered. These views require the attribute_routing_policies.read permission.
GetPolicyCoverage	new features	PolicyService can explain which attribute-routing policy governs a key or tag preview. It returns the enabled winner, ordered rules and precedence details, and reports how many eligible keys are covered. These views require the attribute_routing_policies.read permission.
GetUserGroup	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
ListUserGroups	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
UpdateUserGroup	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
ListUserGroupMembers	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
AddUserGroupMembers	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
RemoveUserGroupMembers	new features	Teams can now be managed end to end through PolicyService instead of the console's own database. AddUserGroupMembers and RemoveUserGroupMembers move users in and out of a team (a user already in another team of the same organization is moved, and the response names the team they left), ListUserGroupMembers pages a team's members with a name or email search and name or recently-added order, and every read of a team carries its member count and the first five members. ListUserGroups can filter by whether a team has members, search descriptions, sort by name, member count, created or updated time, and report how many teams have members. UpdateUserGroup can clear a description with clear_description. A member's email, avatar and ban flag are returned only to credentials that hold users_reader and only for members inside the caller's directory boundary; otherwise callers see ids and names. Email search follows the same scope and per-member boundary rules. Directory reads hide team IDs outside the caller's organization boundary; team filters and counts use the same visible membership.
CreateFallbackChainPolicy	new features	Fallback policies can now define independent ordered fallback entries for each model, so requests fail over through the configured providers in the order specified. UpsertFallbackPolicy replaces the full set of entries for an organization, project, or API-key target in one idempotent call: omitted models are removed and an empty set deactivates the target. Existing policy clients using the flat chain representation remain compatible.
GetFallbackChainPolicy	new features	Fallback policies can now define independent ordered fallback entries for each model, so requests fail over through the configured providers in the order specified. UpsertFallbackPolicy replaces the full set of entries for an organization, project, or API-key target in one idempotent call: omitted models are removed and an empty set deactivates the target. Existing policy clients using the flat chain representation remain compatible.
UpdateFallbackChainPolicy	new features	Fallback policies can now define independent ordered fallback entries for each model, so requests fail over through the configured providers in the order specified. UpsertFallbackPolicy replaces the full set of entries for an organization, project, or API-key target in one idempotent call: omitted models are removed and an empty set deactivates the target. Existing policy clients using the flat chain representation remain compatible.
UpsertFallbackPolicy	new features	Fallback policies can now define independent ordered fallback entries for each model, so requests fail over through the configured providers in the order specified. UpsertFallbackPolicy replaces the full set of entries for an organization, project, or API-key target in one idempotent call: omitted models are removed and an empty set deactivates the target. Existing policy clients using the flat chain representation remain compatible.
ListPolicies	new features	The unified policy list now includes attribute-routing policies alongside the budget, rate-limit, fallback-chain and traffic-split rows, naming each policy's target, effective project, and monitor or enforce mode, and appearing only where the caller could read it directly. For these rows match_count counts the eligible keys for which the policy is the enabled winner; a paused policy reports zero.
UpsertFallbackPolicy	bug fixes	Fallback policies now keep independent ordered entries for each protected model and resolve project and organization policies, plus API-key policies, in the documented precedence order. Full-set updates converge on replay, remove omitted entries, and treat an explicit empty set as a deactivated override while preserving legacy fallback-chain aliases.

RbacService

Operation	Kind	Change
ListRoles	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
CreateRole	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
UpdateRole	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
DeleteRole	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
ListBindings	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
CreateBinding	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
UpdateBinding	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
DeleteBinding	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
ListGroups	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
CreateGroup	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
ListGroupMembers	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
AddGroupMember	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
RemoveGroupMember	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
GetTeamAccessGroup	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
EnsureTeamAccessGroup	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
DeleteTeamAccessGroup	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
GrantSuperAdmin	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.
RevokeSuperAdmin	new features	Administrators can now manage RBAC roles, bindings, groups, Team access groups, and super administrators through the management plane API. The API prevents callers from granting permissions they do not hold and protects the final project owner and final super administrator.

RequestLogsService

Operation	Kind	Change
GetRequestLogStats	bug fixes	Request log stats now report the full billed amount. The group cost left out per-image generation cost, so a group of image generation traffic could read 0.00 while those requests were billed. The response-level total cost was never populated and was always empty. Both now count every cost component, so figures for image-heavy workloads rise to the amount that was always charged.
QueryRequestLogs	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.
GetRequestLog	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.
GetRequestLogStats	deprecations	The microdollar cost fields are deprecated. They have always returned 0, because nothing ever wrote them, and the decimal string fields carry the real amount at full precision. Read total_cost for one request, or cost for a stats group. The fields stay in the API and keep returning 0.

v0.4.1

No API operations changed in this release.

v0.4.0

AdminService

Operation	Kind	Change
SetWorkspaceURL	security updates	Claiming a hostname that is already in use no longer exposes details about the existing configuration. The conflict message now says only that the hostname is in use, preventing a rejected claim from revealing information about another organization's resources.
SetDataplaneURL	security updates	Claiming a hostname that is already in use no longer exposes details about the existing configuration. The conflict message now says only that the hostname is in use, preventing a rejected claim from revealing information about another organization's resources.
CreateProjectGateway	security updates	Claiming a hostname that is already in use no longer exposes details about the existing configuration. The conflict message now says only that the hostname is in use, preventing a rejected claim from revealing information about another organization's resources.
UpdateProjectGateway	security updates	Claiming a hostname that is already in use no longer exposes details about the existing configuration. The conflict message now says only that the hostname is in use, preventing a rejected claim from revealing information about another organization's resources.
SetProjectGatewayURL	security updates	Claiming a hostname that is already in use no longer exposes details about the existing configuration. The conflict message now says only that the hostname is in use, preventing a rejected claim from revealing information about another organization's resources.
CreateUserToken	bug fixes	Creating or rotating a routing key through the API saves the key and its client membership together. If membership setup fails, no partial key or client records remain. Newly created standalone routing keys also appear in the client list; those created directly through the token API have no client title.

ClientsService

Operation	Kind	Change
CreateClientWithKey	bug fixes	Creating or rotating a routing key through the API saves the key and its client membership together. If membership setup fails, no partial key or client records remain. Newly created standalone routing keys also appear in the client list; those created directly through the token API have no client title.
RotateKeyInClient	bug fixes	Creating or rotating a routing key through the API saves the key and its client membership together. If membership setup fails, no partial key or client records remain. Newly created standalone routing keys also appear in the client list; those created directly through the token API have no client title.

GuardrailProvidersService

Operation	Kind	Change
CreateGuardrailProvider	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
UpdateGuardrailProvider	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
ListGuardrailProviders	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
GetGuardrailProvider	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
DeleteGuardrailProvider	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
SetGuardrailProviderSecret	behaviour changes	A guardrail provider's credential is no longer accepted in its configuration. Creating or updating a provider with an Azure AI Content Safety "api_key", or an external service's "auth_token", inside the configuration now fails with an error naming the new SetGuardrailProviderSecret operation, which is the only way a credential enters. The credential is stored encrypted, the provider keeps only a reference to it, no read returns it -- providers now report whether one is stored, not what it is -- and calling the operation again rotates the credential in place. Providers created before this release keep working and stay editable: their credential no longer appears in any API response, and editing such a provider preserves it rather than dropping it, so it can only be replaced through SetGuardrailProviderSecret. Deleting a provider, or its project, destroys the credential with it.
ListGuardrailProviders	behaviour changes	Listing and reading guardrail providers now requires either the "guardrail_providers.read" permission or a scope that grants guardrail reads, bringing provider reads into the same permission domain as the writes. Management API keys carrying the read, write, admin, guardrails_reader or guardrails_admin scope keep their access with no action needed, as do the Super Admin and Viewer roles and every console session. A key scoped only to an unrelated area -- audit logs, for example -- and any custom role that grants neither the new permission nor a guardrail read scope will now receive a permission error where a provider list or lookup previously succeeded. To restore access, add "guardrail_providers.read" to the custom role, or issue the key with a scope that includes guardrail reads.
GetGuardrailProvider	behaviour changes	Listing and reading guardrail providers now requires either the "guardrail_providers.read" permission or a scope that grants guardrail reads, bringing provider reads into the same permission domain as the writes. Management API keys carrying the read, write, admin, guardrails_reader or guardrails_admin scope keep their access with no action needed, as do the Super Admin and Viewer roles and every console session. A key scoped only to an unrelated area -- audit logs, for example -- and any custom role that grants neither the new permission nor a guardrail read scope will now receive a permission error where a provider list or lookup previously succeeded. To restore access, add "guardrail_providers.read" to the custom role, or issue the key with a scope that includes guardrail reads.
ListGuardrailProviders	security updates	A management API key scoped to an unrelated area can no longer enumerate a project's guardrail providers. Listing and reading providers required no permission and no scope at all, so any credential valid for the project could read every provider registered in it -- names, kinds and endpoints -- even though changing one had been restricted to administrators. Both operations are now gated. Callers holding a guardrail read scope are unaffected, which includes every console session, so this narrows the credentials that can reach provider configuration rather than closing the read to everyone without an explicit grant. No CVE; required a credential already valid for the project.
GetGuardrailProvider	security updates	A management API key scoped to an unrelated area can no longer enumerate a project's guardrail providers. Listing and reading providers required no permission and no scope at all, so any credential valid for the project could read every provider registered in it -- names, kinds and endpoints -- even though changing one had been restricted to administrators. Both operations are now gated. Callers holding a guardrail read scope are unaffected, which includes every console session, so this narrows the credentials that can reach provider configuration rather than closing the read to everyone without an explicit grant. No CVE; required a credential already valid for the project.
CreateGuardrailProvider	new features	Creating or updating a guardrail provider now fails with a clear message when the provider could never run: an Azure AI Content Safety provider must carry an endpoint that is an absolute http(s) URL, alongside the existing checks on provider kind and on an external service's declared checks. Such a provider used to be saved and shipped, and then quietly skipped by the gateway, so every rule bound to it stopped enforcing with nothing to see. Existing providers are untouched: only a write that actually changes the configuration is checked, so renaming or disabling one still works even if its stored configuration would not pass.
UpdateGuardrailProvider	new features	Creating or updating a guardrail provider now fails with a clear message when the provider could never run: an Azure AI Content Safety provider must carry an endpoint that is an absolute http(s) URL, alongside the existing checks on provider kind and on an external service's declared checks. Such a provider used to be saved and shipped, and then quietly skipped by the gateway, so every rule bound to it stopped enforcing with nothing to see. Existing providers are untouched: only a write that actually changes the configuration is checked, so renaming or disabling one still works even if its stored configuration would not pass.

GuardrailsService

Operation	Kind	Change
CreateGuardrailRule	behaviour changes	Editing a guardrail rule that is bound to a provider outside its own project is now refused. The rule keeps enforcing and reading it is unaffected, but any update that touches its provider, check type or configuration fails until the rule is repointed at a provider its own project owns -- which can be done in the same update call. Only rules the guardrail-provider ownership migration reports as still bound outside their project are affected; it names the count in a notice reading "N non-template rule(s) remain bound outside their own project".
UpdateGuardrailRule	behaviour changes	Editing a guardrail rule that is bound to a provider outside its own project is now refused. The rule keeps enforcing and reading it is unaffected, but any update that touches its provider, check type or configuration fails until the rule is repointed at a provider its own project owns -- which can be done in the same update call. Only rules the guardrail-provider ownership migration reports as still bound outside their project are affected; it names the count in a notice reading "N non-template rule(s) remain bound outside their own project".
CreateGuardrailRule	security updates	A guardrail rule can now be bound only to a provider its own project owns. A caller who knew another project's provider id could previously point a rule at it and send that project's traffic through another project's provider and credential, because the binding check asked only whether the provider existed and was usable, never who owned it. The refusal reads the same whether the id names another project's provider, a catalog template or nothing at all, so it cannot be used to discover which provider ids exist. Rules that already reference a provider in their own project are unaffected. No CVE; requires a caller authorized to write guardrails in some project.

Rules written before this release are NOT rewritten, and any that the upgrade left bound outside their own project keep enforcing -- and keep exporting the other project's provider configuration, its endpoint and credential reference included, into the referencing project's data-plane configuration. The upgrade reports how many such rules remain: the guardrail-provider ownership migration raises a notice reading "N non-template rule(s) remain bound outside their own project". Repoint each of them at a provider its own project owns; until you do, the next edit to the rule's provider, check type or configuration is refused. | | UpdateGuardrailRule | security updates | A guardrail rule can now be bound only to a provider its own project owns. A caller who knew another project's provider id could previously point a rule at it and send that project's traffic through another project's provider and credential, because the binding check asked only whether the provider existed and was usable, never who owned it. The refusal reads the same whether the id names another project's provider, a catalog template or nothing at all, so it cannot be used to discover which provider ids exist. Rules that already reference a provider in their own project are unaffected. No CVE; requires a caller authorized to write guardrails in some project. Rules written before this release are NOT rewritten, and any that the upgrade left bound outside their own project keep enforcing -- and keep exporting the other project's provider configuration, its endpoint and credential reference included, into the referencing project's data-plane configuration. The upgrade reports how many such rules remain: the guardrail-provider ownership migration raises a notice reading "N non-template rule(s) remain bound outside their own project". Repoint each of them at a provider its own project owns; until you do, the next edit to the rule's provider, check type or configuration is refused. |

IdentityService

Operation	Kind	Change
BanUser	new features	Administrators can ban and unban a user through the management API. Banning a user signs them out everywhere and disables their API keys. Unbanning lets them sign in again, and they issue new keys -- keys removed by the ban are not restored. Both calls require an interactive session holding the admin scope or the users.edit permission, which is the same authority the delete call requires. An API key is refused even when it carries that permission.
UnbanUser	new features	Administrators can ban and unban a user through the management API. Banning a user signs them out everywhere and disables their API keys. Unbanning lets them sign in again, and they issue new keys -- keys removed by the ban are not restored. Both calls require an interactive session holding the admin scope or the users.edit permission, which is the same authority the delete call requires. An API key is refused even when it carries that permission.
DeleteUser	new features	Platform operators can soft-delete and restore user accounts over the management API. DELETE /v1/users/{user_id} marks the account deleted, revokes its API keys, and ends its sessions in one atomic operation; POST /v1/users/{user_id}/restore reverses it. The delete refuses the last active administrator of the platform or of any organization the user administers, so a deployment cannot be left unadministrable.
RestoreUser	new features	Platform operators can soft-delete and restore user accounts over the management API. DELETE /v1/users/{user_id} marks the account deleted, revokes its API keys, and ends its sessions in one atomic operation; POST /v1/users/{user_id}/restore reverses it. The delete refuses the last active administrator of the platform or of any organization the user administers, so a deployment cannot be left unadministrable.
SearchUsers	new features	The management API now serves the user directory the Admin Console reads. POST /v1/users/search returns a page of users matched on name or email substring, filtered by account status, role, team or id set, sorted on a chosen field, and POST /v1/users/stats returns the per-status counts over those same filters. A request that names no status leaves deleted users out, so the active population is what a caller sees by default. A directory user also carries its account status, ban reason and deletion time, so a console can render a deleted user in history instead of resolving nothing.
GetUserStats	new features	The management API now serves the user directory the Admin Console reads. POST /v1/users/search returns a page of users matched on name or email substring, filtered by account status, role, team or id set, sorted on a chosen field, and POST /v1/users/stats returns the per-status counts over those same filters. A request that names no status leaves deleted users out, so the active population is what a caller sees by default. A directory user also carries its account status, ban reason and deletion time, so a console can render a deleted user in history instead of resolving nothing.

PolicyService

Operation	Kind	Change
ListBudgetPolicies	behaviour changes	Listing budget policies now returns INVALID_ARGUMENT for a non-empty page.filter or an unsupported page.order_by, including multiple sort fields. These inputs were previously ignored.
ListBudgetPolicies	new features	Budget policies can now report live billable spend and passthrough estimates, including per-member spend for teams and customer spend and near-limit, over-limit and unmeasured policy counts on list requests. Reads include target names, with user names and email addresses limited to the caller's directory permissions. Lists support target search and sorting, and inactive policies can be permanently removed. Statistics measure at most 500 active policies per request and indicate when more policies match. A failed measurement no longer discards the policy list; the response reports the number of failed measurements.
GetBudgetPolicy	new features	Budget policies can now report live billable spend and passthrough estimates, including per-member spend for teams and customer spend and near-limit, over-limit and unmeasured policy counts on list requests. Reads include target names, with user names and email addresses limited to the caller's directory permissions. Lists support target search and sorting, and inactive policies can be permanently removed. Statistics measure at most 500 active policies per request and indicate when more policies match. A failed measurement no longer discards the policy list; the response reports the number of failed measurements.
PurgeBudgetPolicy	new features	Budget policies can now report live billable spend and passthrough estimates, including per-member spend for teams and customer spend and near-limit, over-limit and unmeasured policy counts on list requests. Reads include target names, with user names and email addresses limited to the caller's directory permissions. Lists support target search and sorting, and inactive policies can be permanently removed. Statistics measure at most 500 active policies per request and indicate when more policies match. A failed measurement no longer discards the policy list; the response reports the number of failed measurements.
CreateRequestAttribute	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
GetRequestAttribute	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
ListRequestAttributes	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
UpdateRequestAttribute	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
DeleteRequestAttribute	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
CreateAttributeRoutingPolicy	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
GetAttributeRoutingPolicy	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
ListAttributeRoutingPolicies	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
UpdateAttributeRoutingPolicy	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
DeleteAttributeRoutingPolicy	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
SetAttributeRoutingPolicyStatus	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
SetAttributeRoutingPolicyMode	new features	Request attribute catalogs and attribute-based routing policies can now be managed through the API, with separate controls for activation and monitor or enforce mode.
PurgeBudgetPolicy	new features	The API can now permanently remove an inactive budget policy without changing the existing deactivation behavior of DELETE. Without the admin scope, purge reaches only PROJECT and API_KEY policies in the request project. Callers with the admin scope can also purge inactive policies with other scopes in their customer.
CreateBudgetPolicy	bug fixes	CreateBudgetPolicy now accepts only the released TEAM, TEAM_PER_USER_DEFAULT, and API_KEY scopes. Existing policies in legacy scopes remain available for reads, updates, enforcement, and resolution.

v0.3.0

AdminService

Operation	Kind	Change
UpdateProjectMember	security updates	A project can no longer be left with no administrator. Demoting or removing a project's last admin through the admin or tenancy member APIs is now refused with FailedPrecondition; the mutation is allowed again as soon as a second admin exists. Previously either call could strip the final admin and orphan the project, leaving no one able to manage its members. A project whose ownership is held only through a manual role grant (not a member row) is unaffected, and revoking that grant is still done separately.
RemoveProjectMember	security updates	A project can no longer be left with no administrator. Demoting or removing a project's last admin through the admin or tenancy member APIs is now refused with FailedPrecondition; the mutation is allowed again as soon as a second admin exists. Previously either call could strip the final admin and orphan the project, leaving no one able to manage its members. A project whose ownership is held only through a manual role grant (not a member row) is unaffected, and revoking that grant is still done separately.
CreateUserToken	bug fixes	Creating an API key now schedules a budget snapshot refresh instead of waiting for the next periodic rebuild, up to five minutes by default. Exhausted budgets begin enforcing on the new key once the updated snapshot reaches the data plane. The refresh runs in the background; it does not delay key creation.

ClientsService

Operation	Kind	Change
CreateClientWithKey	bug fixes	Creating an API key now schedules a budget snapshot refresh instead of waiting for the next periodic rebuild, up to five minutes by default. Exhausted budgets begin enforcing on the new key once the updated snapshot reaches the data plane. The refresh runs in the background; it does not delay key creation.
AddKeyToClient	bug fixes	A budget policy on a single API key now caps the client behind the key, within the key's project, instead of the key row. Rotating the key used to strand the policy on the retired key, leaving the replacement with no budget while the policy still listed as active; the budget now follows the rotation, the period's spend is summed across every key of the client in that project, and both keys of a rotation pair are governed while both are live. The client is recorded on the policy when it is written, and at most one active per-key policy per project, client and intent is allowed (one default and one bound may coexist): creating, retargeting or activating a second one on another key of the same client, or attaching an already-budgeted key to such a client, is refused. A key cannot be moved out of a client that other keys stay in while that client's budget is active; deactivate the budget first. A per-key budget can only be created on, or retargeted to, a key that belongs to the project named in the request; a key in another project is reported as not found.
RotateKeyInClient	bug fixes	A budget policy on a single API key now caps the client behind the key, within the key's project, instead of the key row. Rotating the key used to strand the policy on the retired key, leaving the replacement with no budget while the policy still listed as active; the budget now follows the rotation, the period's spend is summed across every key of the client in that project, and both keys of a rotation pair are governed while both are live. The client is recorded on the policy when it is written, and at most one active per-key policy per project, client and intent is allowed (one default and one bound may coexist): creating, retargeting or activating a second one on another key of the same client, or attaching an already-budgeted key to such a client, is refused. A key cannot be moved out of a client that other keys stay in while that client's budget is active; deactivate the budget first. A per-key budget can only be created on, or retargeted to, a key that belongs to the project named in the request; a key in another project is reported as not found.

PolicyService

Operation	Kind	Change
CreateBudgetPolicy	behaviour changes	Per-key budget storage changes with migration 0131. If two per-key budgets were active on two keys of the same client at the same intent, the upgrade keeps the earliest and deactivates the rest, and the surviving limit now applies to the client's combined spend.
UpdateBudgetPolicy	behaviour changes	Per-key budget storage changes with migration 0131. If two per-key budgets were active on two keys of the same client at the same intent, the upgrade keeps the earliest and deactivates the rest, and the surviving limit now applies to the client's combined spend.
CreateBudgetPolicy	bug fixes	Creating, changing, deleting, or disabling a budget policy now schedules a gateway refresh for every project it governs. Previously only one project's gateways were refreshed, leaving other projects enforcing the old policy until the next periodic rebuild. Removing the last budget also clears older gateway snapshots that could otherwise keep blocking requests until another configuration refresh.
UpdateBudgetPolicy	bug fixes	Creating, changing, deleting, or disabling a budget policy now schedules a gateway refresh for every project it governs. Previously only one project's gateways were refreshed, leaving other projects enforcing the old policy until the next periodic rebuild. Removing the last budget also clears older gateway snapshots that could otherwise keep blocking requests until another configuration refresh.
DeleteBudgetPolicy	bug fixes	Creating, changing, deleting, or disabling a budget policy now schedules a gateway refresh for every project it governs. Previously only one project's gateways were refreshed, leaving other projects enforcing the old policy until the next periodic rebuild. Removing the last budget also clears older gateway snapshots that could otherwise keep blocking requests until another configuration refresh.
SetBudgetPolicyStatus	bug fixes	Creating, changing, deleting, or disabling a budget policy now schedules a gateway refresh for every project it governs. Previously only one project's gateways were refreshed, leaving other projects enforcing the old policy until the next periodic rebuild. Removing the last budget also clears older gateway snapshots that could otherwise keep blocking requests until another configuration refresh.
CreateBudgetPolicy	bug fixes	A budget policy on a single API key now caps the client behind the key, within the key's project, instead of the key row. Rotating the key used to strand the policy on the retired key, leaving the replacement with no budget while the policy still listed as active; the budget now follows the rotation, the period's spend is summed across every key of the client in that project, and both keys of a rotation pair are governed while both are live. The client is recorded on the policy when it is written, and at most one active per-key policy per project, client and intent is allowed (one default and one bound may coexist): creating, retargeting or activating a second one on another key of the same client, or attaching an already-budgeted key to such a client, is refused. A key cannot be moved out of a client that other keys stay in while that client's budget is active; deactivate the budget first. A per-key budget can only be created on, or retargeted to, a key that belongs to the project named in the request; a key in another project is reported as not found.
UpdateBudgetPolicy	bug fixes	A budget policy on a single API key now caps the client behind the key, within the key's project, instead of the key row. Rotating the key used to strand the policy on the retired key, leaving the replacement with no budget while the policy still listed as active; the budget now follows the rotation, the period's spend is summed across every key of the client in that project, and both keys of a rotation pair are governed while both are live. The client is recorded on the policy when it is written, and at most one active per-key policy per project, client and intent is allowed (one default and one bound may coexist): creating, retargeting or activating a second one on another key of the same client, or attaching an already-budgeted key to such a client, is refused. A key cannot be moved out of a client that other keys stay in while that client's budget is active; deactivate the budget first. A per-key budget can only be created on, or retargeted to, a key that belongs to the project named in the request; a key in another project is reported as not found.
SetBudgetPolicyStatus	bug fixes	A budget policy on a single API key now caps the client behind the key, within the key's project, instead of the key row. Rotating the key used to strand the policy on the retired key, leaving the replacement with no budget while the policy still listed as active; the budget now follows the rotation, the period's spend is summed across every key of the client in that project, and both keys of a rotation pair are governed while both are live. The client is recorded on the policy when it is written, and at most one active per-key policy per project, client and intent is allowed (one default and one bound may coexist): creating, retargeting or activating a second one on another key of the same client, or attaching an already-budgeted key to such a client, is refused. A key cannot be moved out of a client that other keys stay in while that client's budget is active; deactivate the budget first. A per-key budget can only be created on, or retargeted to, a key that belongs to the project named in the request; a key in another project is reported as not found.
CreateBudgetPolicy	bug fixes	Budget policies with a block or fallback action are no longer accepted at the user and per-key-default team scopes, where enforcement does not evaluate them. Such a policy was stored and reported spend but never gated a request; creating one now returns an error naming the limitation, and monitor policies at these scopes remain supported. The few existing rows (internal testing only; the Console never authored these scopes) cannot be edited or re-activated while they keep the enforcing action; switching one to monitor or moving it to a scope enforcement governs unfreezes it, and deactivating or deleting it remains available either way.
UpdateBudgetPolicy	bug fixes	Budget policies with a block or fallback action are no longer accepted at the user and per-key-default team scopes, where enforcement does not evaluate them. Such a policy was stored and reported spend but never gated a request; creating one now returns an error naming the limitation, and monitor policies at these scopes remain supported. The few existing rows (internal testing only; the Console never authored these scopes) cannot be edited or re-activated while they keep the enforcing action; switching one to monitor or moving it to a scope enforcement governs unfreezes it, and deactivating or deleting it remains available either way.
SetBudgetPolicyStatus	bug fixes	Budget policies with a block or fallback action are no longer accepted at the user and per-key-default team scopes, where enforcement does not evaluate them. Such a policy was stored and reported spend but never gated a request; creating one now returns an error naming the limitation, and monitor policies at these scopes remain supported. The few existing rows (internal testing only; the Console never authored these scopes) cannot be edited or re-activated while they keep the enforcing action; switching one to monitor or moving it to a scope enforcement governs unfreezes it, and deactivating or deleting it remains available either way.

ProjectsService

Operation	Kind	Change
UpdateProjectMember	security updates	A project can no longer be left with no administrator. Demoting or removing a project's last admin through the admin or tenancy member APIs is now refused with FailedPrecondition; the mutation is allowed again as soon as a second admin exists. Previously either call could strip the final admin and orphan the project, leaving no one able to manage its members. A project whose ownership is held only through a manual role grant (not a member row) is unaffected, and revoking that grant is still done separately.
RemoveProjectMember	security updates	A project can no longer be left with no administrator. Demoting or removing a project's last admin through the admin or tenancy member APIs is now refused with FailedPrecondition; the mutation is allowed again as soon as a second admin exists. Previously either call could strip the final admin and orphan the project, leaving no one able to manage its members. A project whose ownership is held only through a manual role grant (not a member row) is unaffected, and revoking that grant is still done separately.

v0.2.1

No API operations changed in this release.

v0.2.0

AdminService

Operation	Kind	Change
ListUserTokens	security updates	Listing, reading and revoking user tokens through the admin API is now confined to the calling credential's own organization. A credential carrying the broad admin scope could previously act on any organization's tokens, because these operations matched a token by its id alone and never checked who was asking. Naming a different organization on the request is refused. Credentials that are not tied to an organization, such as an operator's environment-configured key, are unaffected. An organization administrator signed in to the dashboard can now list, read and revoke their own organization's tokens through these operations, which an organization-scoped API key still cannot do. Before upgrading a management plane that serves more than one organization, re-scope by hand any user tokens still stamped with the placeholder organization "default": until you do, the organization that owns them can no longer read or revoke them.
GetUserToken	security updates	Listing, reading and revoking user tokens through the admin API is now confined to the calling credential's own organization. A credential carrying the broad admin scope could previously act on any organization's tokens, because these operations matched a token by its id alone and never checked who was asking. Naming a different organization on the request is refused. Credentials that are not tied to an organization, such as an operator's environment-configured key, are unaffected. An organization administrator signed in to the dashboard can now list, read and revoke their own organization's tokens through these operations, which an organization-scoped API key still cannot do. Before upgrading a management plane that serves more than one organization, re-scope by hand any user tokens still stamped with the placeholder organization "default": until you do, the organization that owns them can no longer read or revoke them.
RevokeUserToken	security updates	Listing, reading and revoking user tokens through the admin API is now confined to the calling credential's own organization. A credential carrying the broad admin scope could previously act on any organization's tokens, because these operations matched a token by its id alone and never checked who was asking. Naming a different organization on the request is refused. Credentials that are not tied to an organization, such as an operator's environment-configured key, are unaffected. An organization administrator signed in to the dashboard can now list, read and revoke their own organization's tokens through these operations, which an organization-scoped API key still cannot do. Before upgrading a management plane that serves more than one organization, re-scope by hand any user tokens still stamped with the placeholder organization "default": until you do, the organization that owns them can no longer read or revoke them.
QueryAuditLogs	new features	The audit log query RPCs (QueryAuditLogs and QueryPlatformAuditLogs) can now return success and failure counts alongside the page of entries. Set include_stats and read the new stats field instead of running an extra query per count. The counts obey every filter except success, so a view filtered to one outcome still shows both numbers. The response is unchanged when include_stats is not set.
QueryPlatformAuditLogs	new features	The audit log query RPCs (QueryAuditLogs and QueryPlatformAuditLogs) can now return success and failure counts alongside the page of entries. Set include_stats and read the new stats field instead of running an extra query per count. The counts obey every filter except success, so a view filtered to one outcome still shows both numbers. The response is unchanged when include_stats is not set.

CatalogService

Operation	Kind	Change
UpsertProvider	behaviour changes	Creating a provider through the catalog API no longer enables it. A provider created without is_enabled now arrives disabled, and registering a model under it is refused until it is enabled: enabling a provider is what makes the data plane start fetching its credentials, so one created before it has a credential cannot serve. Existing providers are unaffected.
UpsertModel	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
GetModel	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
ListModels	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
UpsertProvider	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
GetProvider	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
ListProviders	new features	The catalog API now carries a model's whole record. Modalities, rate and size limits, per-model backend URLs, non-per-token pricing, the cache-write rate, and free-form metadata (including the display name and the deprecation and retirement dates) can now be written and read back, where before they could only be set by editing the database. Providers likewise carry their routing metadata (upstream type, backend schema, API-key flavor and per-operation variants), which had no representation at all. Listing providers or models also accepts include_disabled, so the full catalog can be read rather than only the enabled part.
UpsertModel	bug fixes	Editing a model or provider through the catalog API no longer switches it back on. Every write used to assert "enabled" whether or not it mentioned enablement, so an administrator's deliberate disable was reverted by the next unrelated edit (a price correction or a rename was enough) with nothing recording it. Enablement now changes only when a request actually asks it to. One consequence: a provider created through the API now arrives disabled, because enabling a provider is what makes the data plane start fetching its credentials, and one created before it has a credential cannot serve. Existing providers are unaffected, and enabling a new one is a single further call. If you script provider creation and relied on it being immediately enabled, ask for it explicitly.
UpsertProvider	bug fixes	Editing a model or provider through the catalog API no longer switches it back on. Every write used to assert "enabled" whether or not it mentioned enablement, so an administrator's deliberate disable was reverted by the next unrelated edit (a price correction or a rename was enough) with nothing recording it. Enablement now changes only when a request actually asks it to. One consequence: a provider created through the API now arrives disabled, because enabling a provider is what makes the data plane start fetching its credentials, and one created before it has a credential cannot serve. Existing providers are unaffected, and enabling a new one is a single further call. If you script provider creation and relied on it being immediately enabled, ask for it explicitly.
UpsertModel	bug fixes	A partial edit through the catalog API no longer blanks the fields it did not mention. Changing one property of a model (its mode, say) cleared its capabilities, per-token prices and context window, because an omitted value was written over the stored one rather than skipped. Fields a request does not carry are now left as they are. The model's modalities, limits, backend URLs and pricing extras follow the same rule now that the API can carry them at all; they were never reachable before, so nothing was lost through them.

CustomerRequestLogsService

Operation	Kind	Change
GetCustomerRequestLogStats	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.
ListCustomerRequestLogs	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.
GetCustomerRequestLog	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.

IdentityService

Operation	Kind	Change
GetUser	security updates	Directory lookups through IdentityService.GetUser and ListUsers are now confined to the organizations the calling session belongs to. A signed-in user that held the users_reader scope, including every organization administrator, could previously resolve any user id in any tenant to email, name and role. GetUser now answers "not found" for a user outside the caller's organizations, and ListUsers omits them. A session with no project memberships resolves no users at all, including its own row. This affects users whose only access is an organization-level role, pending invites, and users whose only project is the reserved "default" project. Platform operators keep cross-tenant directory reads only through an explicit platform role binding. In a multi-tenant deployment that binding is a documented provisioning step (docs/runbooks/platform-directory-reach.md).
ListUsers	security updates	Directory lookups through IdentityService.GetUser and ListUsers are now confined to the organizations the calling session belongs to. A signed-in user that held the users_reader scope, including every organization administrator, could previously resolve any user id in any tenant to email, name and role. GetUser now answers "not found" for a user outside the caller's organizations, and ListUsers omits them. A session with no project memberships resolves no users at all, including its own row. This affects users whose only access is an organization-level role, pending invites, and users whose only project is the reserved "default" project. Platform operators keep cross-tenant directory reads only through an explicit platform role binding. In a multi-tenant deployment that binding is a documented provisioning step (docs/runbooks/platform-directory-reach.md).

McpOAuthClientsService

Operation	Kind	Change
CreateMcpOAuthClient	bug fixes	The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.
GetMcpOAuthClient	bug fixes	The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.
ListMcpOAuthClients	bug fixes	The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.
UpdateMcpOAuthClient	bug fixes	The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.
DeleteMcpOAuthClient	bug fixes	The MCP OAuth clients API is now reachable. Every call to it (from the SDKs, the REST endpoints, or the API explorer) previously returned an empty success response and saved nothing, because the service was never routed on the management API. Creating, reading, updating and deleting MCP OAuth clients now works as documented.

RequestLogsService

Operation	Kind	Change
GetRequestLogStats	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.
QueryRequestLogs	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.
GetRequestLog	new features	Request-log statistics can now separate spend the organization was actually billed for from cost that is only estimated. Group or filter by usage_mode (managed, byok, passthrough) to keep BYOK and passthrough traffic out of a spend total. Group or filter by usage_source (actual, partial, estimated) to see how much of a figure rests on locally estimated token counts rather than counts the provider reported. Both work on the admin and customer stats endpoints and can be combined with an existing dimension, for example per-model billed spend. usage_mode is available for historical requests; usage_source is recorded from this release onward and is empty for earlier requests, for requests served by a data plane that has not been upgraded, and for rejected or budget-blocked requests. Individual request logs now carry usage_source too, which answers whether a request's token counts were measured or estimated, a question the usage_measured flag cannot answer.

v0.1.5

AdminService

Operation	Kind	Change
AddProjectMember	security updates	Adding a member to a project now rejects an identity that does not exist, instead of recording a membership and role assignment against an unknown id: records that were inert until someone was later created with the same id and inherited the access. Both API surfaces enforce this.
ListProjectMembers	bug fixes	Listing a project's members now includes people whose access comes from a role or permission granted on that project, not only those added directly. Both let someone into the project, but only direct membership appeared on the list, so it under-reported who could reach the project, wrong for an access review or offboarding. Someone listed this way has no membership record to change, so they are reported without one, and their access is removed where it was granted rather than from the member list.
CreateServiceAccount	bug fixes	Creating or revoking a service account now takes effect in seconds rather than minutes. The published key set is refreshed immediately by the instance handling the change and within 30 seconds elsewhere, where previously either could take up to five minutes, long enough that a new service account was rejected as if its credentials were wrong, and a revoked one kept being accepted.
RevokeServiceAccount	bug fixes	Creating or revoking a service account now takes effect in seconds rather than minutes. The published key set is refreshed immediately by the instance handling the change and within 30 seconds elsewhere, where previously either could take up to five minutes, long enough that a new service account was rejected as if its credentials were wrong, and a revoked one kept being accepted.
ListProjects	bug fixes	Listing projects now paginates. The project list endpoints accepted a page token and ignored it, always reporting that no further pages existed, so a organization with more projects than one page silently saw only the first, and a caller had no way to tell a full page from a truncated one. Callers that follow the next-page token now receive every project.
ListProjects	bug fixes	Projects can now be listed in a requested order, by creation time or by project id, so a client no longer has to re-sort every response. An unsupported sort field, or a filter expression the endpoint does not implement, is now rejected with a clear error rather than silently ignored, which previously returned an unsorted or unfiltered list that looked like an answer.
CreateProject	bug fixes	A project created through the admin API now starts with its caller as an administrator, so it can be managed and have keys minted right away. Previously a project created this way could come out with no members: its management page read "unavailable" and nobody could administer it or mint keys for its users. A caller with no resolvable user identity (a legacy admin API key) still creates an unowned project, now recorded so it can be found and repaired.
GetSystemSetting	bug fixes	Reading and writing a system setting whose key contains a colon (for example dataplane-url:<workspace_id>) now works over REST. GET and PUT /admin/v1/system-settings/{key} previously returned an empty 200 response for such keys; both the raw and the percent-encoded forms of the key now resolve.
UpsertSystemSetting	bug fixes	Reading and writing a system setting whose key contains a colon (for example dataplane-url:<workspace_id>) now works over REST. GET and PUT /admin/v1/system-settings/{key} previously returned an empty 200 response for such keys; both the raw and the percent-encoded forms of the key now resolve.
CreateCustomer	bug fixes	Creating an organization now rejects an organization ID that does not match the documented slug format (lowercase letters, digits, and internal hyphens, 63 characters maximum). The API previously accepted any non-empty string. Existing organizations are not affected; the check applies only when an organization is created.
AddProjectMember	bug fixes	Adding a project member now fails with a 404 error when the given identity does not exist, instead of creating the membership and its RBAC binding anyway, records a user registering later with the same ID could inherit. The check and write run in one statement, so a concurrent identity deletion cannot slip through. The same call updates an existing member's role, and that path now also fails with a 404 when the member's identity was deleted. Member removal is unaffected, so cleanup of such rows still works.

AiKeysService

Operation	Kind	Change
Register	bug fixes	Project members can again register, list, and revoke their own user-scoped AI provider keys. The permission-only AI-key endpoints rejected members after the RBAC migration even though their role was intended to carry those permissions. Shared project keys remain owner-controlled.
List	bug fixes	Project members can again register, list, and revoke their own user-scoped AI provider keys. The permission-only AI-key endpoints rejected members after the RBAC migration even though their role was intended to carry those permissions. Shared project keys remain owner-controlled.
Revoke	bug fixes	Project members can again register, list, and revoke their own user-scoped AI provider keys. The permission-only AI-key endpoints rejected members after the RBAC migration even though their role was intended to carry those permissions. Shared project keys remain owner-controlled.

ApiKeysService

Operation	Kind	Change
UpdateApiKey	bug fixes	Changing an API key's policy tags, or enabling or disabling a key, now takes effect on the data plane promptly. Previously these changes only reached a project's gateways on the periodic resync, so a re-tagged key kept its old routing and fallback for up to ~30 minutes, a rate-limit change from a tag was not applied until an unrelated policy edit, and a disabled key kept serving until the resync.

CatalogService

Operation	Kind	Change
UpsertProvider	bug fixes	Editing a provider's connection settings through the catalog API (base URL or credential, or removing the provider) now takes effect on projects that route on their own hostname (strict isolation). Previously only the shared route map picked up the change, so a project with its own hostname kept serving the old provider configuration until an unrelated change happened to refresh it.
SetProviderCredential	bug fixes	Editing a provider's connection settings through the catalog API (base URL or credential, or removing the provider) now takes effect on projects that route on their own hostname (strict isolation). Previously only the shared route map picked up the change, so a project with its own hostname kept serving the old provider configuration until an unrelated change happened to refresh it.
DeleteProvider	bug fixes	Editing a provider's connection settings through the catalog API (base URL or credential, or removing the provider) now takes effect on projects that route on their own hostname (strict isolation). Previously only the shared route map picked up the change, so a project with its own hostname kept serving the old provider configuration until an unrelated change happened to refresh it.
UpsertModel	bug fixes	Editing or removing a model through the catalog API (its upstream name, capabilities, or pricing) now takes effect on projects that route on their own hostname (strict isolation). Previously only the shared route map picked up the change, so a project with its own hostname kept serving the old model configuration until an unrelated change happened to refresh it. Companion to the provider-config fix above.
DeleteModel	bug fixes	Editing or removing a model through the catalog API (its upstream name, capabilities, or pricing) now takes effect on projects that route on their own hostname (strict isolation). Previously only the shared route map picked up the change, so a project with its own hostname kept serving the old model configuration until an unrelated change happened to refresh it. Companion to the provider-config fix above.

ConfiguratorService

Operation	Kind	Change
SetDataplaneURL	security updates	The Configurator SetDataplaneURL and RevokeUserToken RPCs no longer accept an organization admin management API key. Repointing a workspace's data-plane URL and revoking gatekeeper user tokens by JTI are platform operations: they now require the dataplane_operator scope or the dataplane machine role (plus the managed-SaaS machine credential for SetDataplaneURL), so a leaked or over-privileged org admin key can no longer redirect a data plane or invalidate sessions. Tenant-facing equivalents under AdminService are unchanged. No CVE.
RevokeUserToken	security updates	The Configurator SetDataplaneURL and RevokeUserToken RPCs no longer accept an organization admin management API key. Repointing a workspace's data-plane URL and revoking gatekeeper user tokens by JTI are platform operations: they now require the dataplane_operator scope or the dataplane machine role (plus the managed-SaaS machine credential for SetDataplaneURL), so a leaked or over-privileged org admin key can no longer redirect a data plane or invalidate sessions. Tenant-facing equivalents under AdminService are unchanged. No CVE.
UpsertMCPCatalogServer	security updates	MCP catalog writes are now confined to the caller's own workspace. A data plane's service account could previously write catalog entries into another workspace, because the ownership check it was gated behind never ran. No CVE; requires a valid service-account credential.

InferenceIngressService

Operation	Kind	Change
GetDataplaneURL	bug fixes	Asking for a dataplane URL by project without naming an organization now answers 400 with the field to supply, instead of 500. Callers who belong to no project had no organization to infer, so the request failed as a server error quoting an internal argument contract. Naming the organization gives the same answer it always did.

MCPCatalogService

Operation	Kind	Change
UpsertCatalogServer	bug fixes	Editing, disabling, or deleting a shared MCP catalog server now refreshes the MCP profiles that route it within a worker poll. Previously only the per-gateway catalog directory was refreshed, so a profile serving that server kept the old address and tool set until the next periodic full sync, up to ~30 minutes. Both the catalog API and the operator dashboard now fan the change out to every affected profile owner.
SetCatalogServerEnabled	bug fixes	Editing, disabling, or deleting a shared MCP catalog server now refreshes the MCP profiles that route it within a worker poll. Previously only the per-gateway catalog directory was refreshed, so a profile serving that server kept the old address and tool set until the next periodic full sync, up to ~30 minutes. Both the catalog API and the operator dashboard now fan the change out to every affected profile owner.
DeleteCatalogServer	bug fixes	Editing, disabling, or deleting a shared MCP catalog server now refreshes the MCP profiles that route it within a worker poll. Previously only the per-gateway catalog directory was refreshed, so a profile serving that server kept the old address and tool set until the next periodic full sync, up to ~30 minutes. Both the catalog API and the operator dashboard now fan the change out to every affected profile owner.
DeleteCatalogServer	bug fixes	Deleting an MCP catalog server now succeeds when projects have granted that server. The delete removes the grant rows and the server in one transaction, then refreshes each granting project and each affected profile owner. Such a delete previously failed with a 500 error that exposed the database constraint name.

MCPProfilesService

Operation	Kind	Change
CreateMCPProfile	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.
UpdateMCPProfile	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.
DeleteMCPProfile	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.
AddMCPProfileServer	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.
RemoveMCPProfileServer	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.
SetMCPProfileServerTools	bug fixes	An MCP profile created or changed through the MCPProfilesService API now becomes routable within seconds, the same as one changed from the dashboard. Where profiles are served on the shared URL rather than a per-project gateway hostname, the API path refreshed only part of the routing configuration, so a new profile's /mcp/ address returned 404 until the next periodic full sync (up to ~38 minutes) during which an app given that address silently had none of its tools. Every profile mutation on the API now fires the same per-user refresh the dashboard does.

MeService

Operation	Kind	Change
IssueMyKey	new features	Management keys can now receive built-in platform roles by explicit delegation when a key is issued or updated. The issuer's platform permissions bound what can be delegated. Legacy platform scopes are converted to explicit role bindings on upgrade, and bindings written by the retired scope inference are removed.
UpdateMyKey	new features	Management keys can now receive built-in platform roles by explicit delegation when a key is issued or updated. The issuer's platform permissions bound what can be delegated. Legacy platform scopes are converted to explicit role bindings on upgrade, and bindings written by the retired scope inference are removed.
ListMyProjects	new features	A new endpoint, GET /v1/me/projects, lists the projects you can access and your role in each: a console or client can answer "which projects am I in" with the caller's own credential instead of an administrator key or a direct database read. Access covers project membership, project-scoped and organization-wide RBAC grants, plus your organization's default project.
IssueMyKey	new features	A management API key's scopes are now readable: the key object returned when a key is issued, listed, or re-scoped carries its scope set, so an assignment can be confirmed directly instead of inferred from a refused call. An empty list means the key carries no explicit scopes and resolves through its owner's roles, not that it has none.
ListMyKeys	new features	A management API key's scopes are now readable: the key object returned when a key is issued, listed, or re-scoped carries its scope set, so an assignment can be confirmed directly instead of inferred from a refused call. An empty list means the key carries no explicit scopes and resolves through its owner's roles, not that it has none.
UpdateMyKey	new features	A management API key's scopes are now readable: the key object returned when a key is issued, listed, or re-scoped carries its scope set, so an assignment can be confirmed directly instead of inferred from a refused call. An empty list means the key carries no explicit scopes and resolves through its owner's roles, not that it has none.
IssueMyKey	bug fixes	Creating a management API key now follows the api_keys.create permission rather than the name of the role that carries it. A User Admin, a custom role, or a direct grant holding that permission was refused, so granting the permission the denial named could not work and only a Super Admin could create these keys. The console's key-type chooser follows the same permission, so the option appears for everyone who can use it. The key such a person creates carries their own access, not full administrative access. Only someone who can already administer the organization can put that on a key.

PolicyService

Operation	Kind	Change
AddApiKeyTag	bug fixes	Changing an API key's policy tags, or enabling or disabling a key, now takes effect on the data plane promptly. Previously these changes only reached a project's gateways on the periodic resync, so a re-tagged key kept its old routing and fallback for up to ~30 minutes, a rate-limit change from a tag was not applied until an unrelated policy edit, and a disabled key kept serving until the resync.
RemoveApiKeyTag	bug fixes	Changing an API key's policy tags, or enabling or disabling a key, now takes effect on the data plane promptly. Previously these changes only reached a project's gateways on the periodic resync, so a re-tagged key kept its old routing and fallback for up to ~30 minutes, a rate-limit change from a tag was not applied until an unrelated policy edit, and a disabled key kept serving until the resync.
UpdateBudgetPolicy	bug fixes	Updating a budget policy, a rate-limit policy, or a user group with the all-zero UUID (00000000-0000-0000-0000-000000000000) now returns a 400 error that names the invalid field. These requests previously returned a 500 error.
UpdateRateLimitPolicy	bug fixes	Updating a budget policy, a rate-limit policy, or a user group with the all-zero UUID (00000000-0000-0000-0000-000000000000) now returns a 400 error that names the invalid field. These requests previously returned a 500 error.
UpdateUserGroup	bug fixes	Updating a budget policy, a rate-limit policy, or a user group with the all-zero UUID (00000000-0000-0000-0000-000000000000) now returns a 400 error that names the invalid field. These requests previously returned a 500 error.
ListApiKeyTags	bug fixes	The API key tag endpoints now answer 400 invalid_argument for the all-zero api key id, instead of 500. The all-zero uuid has valid syntax, so it passed every id guard and reached the database layer, where it became an internal error. List tags for a key, add a tag, remove a tag, and the policy coverage check all report the bad id the same way. Remove a tag answered 404 not found for this id before. It now answers 400 with the other three.
AddApiKeyTag	bug fixes	The API key tag endpoints now answer 400 invalid_argument for the all-zero api key id, instead of 500. The all-zero uuid has valid syntax, so it passed every id guard and reached the database layer, where it became an internal error. List tags for a key, add a tag, remove a tag, and the policy coverage check all report the bad id the same way. Remove a tag answered 404 not found for this id before. It now answers 400 with the other three.
RemoveApiKeyTag	bug fixes	The API key tag endpoints now answer 400 invalid_argument for the all-zero api key id, instead of 500. The all-zero uuid has valid syntax, so it passed every id guard and reached the database layer, where it became an internal error. List tags for a key, add a tag, remove a tag, and the policy coverage check all report the bad id the same way. Remove a tag answered 404 not found for this id before. It now answers 400 with the other three.
GetPolicyCoverage	bug fixes	The API key tag endpoints now answer 400 invalid_argument for the all-zero api key id, instead of 500. The all-zero uuid has valid syntax, so it passed every id guard and reached the database layer, where it became an internal error. List tags for a key, add a tag, remove a tag, and the policy coverage check all report the bad id the same way. Remove a tag answered 404 not found for this id before. It now answers 400 with the other three.

ProjectsService

Operation	Kind	Change
AddProjectMember	security updates	Adding a member to a project now rejects an identity that does not exist, instead of recording a membership and role assignment against an unknown id: records that were inert until someone was later created with the same id and inherited the access. Both API surfaces enforce this.
ListProjectMembers	bug fixes	Listing a project's members now includes people whose access comes from a role or permission granted on that project, not only those added directly. Both let someone into the project, but only direct membership appeared on the list, so it under-reported who could reach the project, wrong for an access review or offboarding. Someone listed this way has no membership record to change, so they are reported without one, and their access is removed where it was granted rather than from the member list.
ListProjects	bug fixes	Listing projects now paginates. The project list endpoints accepted a page token and ignored it, always reporting that no further pages existed, so a organization with more projects than one page silently saw only the first, and a caller had no way to tell a full page from a truncated one. Callers that follow the next-page token now receive every project.
ListProjects	bug fixes	Projects can now be listed in a requested order, by creation time or by project id, so a client no longer has to re-sort every response. An unsupported sort field, or a filter expression the endpoint does not implement, is now rejected with a clear error rather than silently ignored, which previously returned an unsorted or unfiltered list that looked like an answer.
AddProjectMember	bug fixes	Adding a project member now fails with a 404 error when the given identity does not exist, instead of creating the membership and its RBAC binding anyway, records a user registering later with the same ID could inherit. The check and write run in one statement, so a concurrent identity deletion cannot slip through. The same call updates an existing member's role, and that path now also fails with a 404 when the member's identity was deleted. Member removal is unaffected, so cleanup of such rows still works.

RequestLogsService

Operation	Kind	Change
GetRequestLog	bug fixes	Fetching a request log by ID over REST now works when the ID contains a colon (for example default:<uuid>). Such a request previously returned an empty 200 response, because the route treated the text after the colon as a custom verb. Both the raw and the percent-encoded forms of the ID now resolve.
QueryRequestLogs	bug fixes	A management API key that holds the request_logs_reader scope can now read request logs and request-log stats. Every scoped key was previously refused on these endpoints with "scoped api key cannot call an operation without a tenant boundary", so the scope granted nothing. Results are confined to the key's own organization or project, and the three read endpoints accept an optional customer_id filter. Admin credentials and console sessions are unchanged.
GetRequestLog	bug fixes	A management API key that holds the request_logs_reader scope can now read request logs and request-log stats. Every scoped key was previously refused on these endpoints with "scoped api key cannot call an operation without a tenant boundary", so the scope granted nothing. Results are confined to the key's own organization or project, and the three read endpoints accept an optional customer_id filter. Admin credentials and console sessions are unchanged.
GetRequestLogStats	bug fixes	A management API key that holds the request_logs_reader scope can now read request logs and request-log stats. Every scoped key was previously refused on these endpoints with "scoped api key cannot call an operation without a tenant boundary", so the scope granted nothing. Results are confined to the key's own organization or project, and the three read endpoints accept an optional customer_id filter. Admin credentials and console sessions are unchanged.

TenancyService

Operation	Kind	Change
CreateCustomer	bug fixes	Creating an organization now rejects an organization ID that does not match the documented slug format (lowercase letters, digits, and internal hyphens, 63 characters maximum). The API previously accepted any non-empty string. Existing organizations are not affected; the check applies only when an organization is created.