API changelog
The Driftstack API is /v1/, and the
API reference
describes it as it is today. This page lists the changes you have
to act on: a breaking change or a deprecation, with its sunset
date; a Security fix, which ships at once under the
security-fix clause
of the versioning policy; and a change to the AI rate card
(Terms of Service, Section 8.11). Additions that need nothing from
you go straight into the reference.
Open notices
- Security — Changed: no address you send for a navigate step
or a tab may be a name only a private network answers.
For a navigate step you send
(
POST /v1/agent-sessions/:id/steps) and a tabopenalike, a name that only a private network answers is refused, as an address on this computer or a private network already is. That is a name with no dot (http://intranet/,http://metadata/, with or without a trailing dot) or with an empty label (http://a..b/); a name ending.lan,.corp,.home,.intranet,.privateor.svc; a name underlocalho.st,vcap.me,localhost.director1u.ms; and anip.io,sslip.io,xip.ioortraefik.mename that carries a private, loopback or link-local address in any form (dotted or dashed decimal, eight hex digits such as7f000001.nip.io, dashed IPv6 such as--1.sslip.io) or no address at all (foo.nip.io,nip.io). Before, these were opened through your proxy. The errors keep their codes: a navigate step is a failed row (unsafe_url) whose reason is “not run: the address names this computer, a private network, or a user name and password, which no step may open, so the page was not opened” (the same row, with the same reason, for a navigate the AI agent plans itself); a tabopenis a400validation-failedproblem whoseissues.fieldErrors.urlholds “names this computer, a private network or a user name and password, which a tab may not open”. To fix it, send a public http(s) address. These addresses are not stored; this notice is the announcement. This is a breaking change shipped without a deprecation window, under the security-fix clause of the versioning policy. Reference at /api/agent-sessions.
No breaking change or removal of the public API has a
sunset date yet. The reference marks what is deprecated or
planned (for example the legacy admin scope alias);
each is announced here, with its sunset date, before it changes.
Versioning policy
See the versioning policy for the full lifecycle:
- New endpoints + new optional fields ship without bumping the version.
- Removing a field or changing its type requires the 90-day
deprecation window documented in
/docs/api-versioning, with
a
Deprecationresponse header (RFC 9745) and aSunsetheader (RFC 8594) carrying the sunset date from the moment the deprecation lands. - Major-version bumps (next is v2) ship in lock-step with published migration notes and at least 12 months of v1 support.