chore(api): sync OpenAPI contract by kong[bot] · Pull Request #51 · Kong/volcano-cli

kong · 2026-07-13T20:39:20Z

Summary

Sync the vendored OpenAPI contract from Kong/volcano-hosting@75814c3b38fc.
Regenerate checked-in client or contract types with this repository's pinned tooling.

API change report

Public API

New Endpoints: 11

GET /projects/{id}/auth/pages/appearance
DELETE /projects/{id}/auth/pages/theme
PUT /projects/{id}/auth/pages/theme
DELETE /projects/{id}/auth/pages/{pageType}/layout
PUT /projects/{id}/auth/pages/{pageType}/layout
GET /projects/{id}/auth/pages/{pageType}/preview
POST /projects/{id}/auth/pages/{pageType}/preview
PUT /projects/{id}/shared-variables
DELETE /projects/{id}/source-export
GET /projects/{id}/source-export
POST /projects/{id}/source-export

Deleted Endpoints: 1

POST /projects/{id}/git-connection/repository

Modified Endpoints: 62

POST /auth/oauth/{provider}/call-api

Description changed from 'Make an authenticated request to an OAuth provider's API on behalf of the user.
The user's stored access token is automatically used and refreshed if needed.

The request is always sent to the provider's fixed API base URL joined with
the caller-supplied endpoint. endpoint must be a relative path beginning
with / (optionally with a query string); it cannot change the target host.
Absolute URLs, protocol-relative //host values, or userinfo (@host) are
rejected with 400 so the request can never be redirected to another host.

Examples of endpoint:

Google userinfo: /oauth2/v1/userinfo
GitHub repositories: /user/repos
Microsoft Graph profile: /me

The response is the raw JSON response from the provider's API.
' to 'Make an authenticated request to an OAuth provider's API on behalf of the user.
The user's stored access token is automatically used and refreshed if needed.

The request is always sent to the provider's fixed API base URL joined with
the caller-supplied endpoint. endpoint must be a relative path beginning
with / (optionally with a query string); it cannot change the target host.
Absolute URLs, protocol-relative //host values, or userinfo (@host) are
rejected with 400 so the request can never be redirected to another host.

Examples of endpoint:

Google userinfo: /oauth2/v1/userinfo
GitHub repositories: /user/repos
Microsoft Graph profile: /me

The response wraps the provider's raw JSON value with request metadata.
An empty provider body is represented as data: null; the envelope
preserves the provider's HTTP status in status_code, including errors.
Provider response bodies are limited to 8 MiB after decompression.
Transport failures, invalid JSON (including invalid UTF-8), and oversized
bodies return 502. Provider redirects to another origin are blocked and
return 400.
'

Responses changed
- New response: 404
- New response: 500
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Description changed from 'Raw response from the OAuth provider's API' to 'OAuth provider API response envelope'
        
        AdditionalProperties changed from true to null
        
        Required changed
        
        New required property: data
        
        New required property: endpoint
        
        New required property: provider
        
        New required property: status_code
        
        Properties changed
        
        New property: data
        
        New property: endpoint
        
        New property: provider
        
        New property: status_code
- Modified response: 400
  - Description changed from 'Invalid request (for example: missing endpoint, an endpoint that is
    not a relative path, or an unsupported HTTP method).
    ' to 'Invalid request (for example: missing endpoint, an endpoint that is
    not a relative path, or an unsupported HTTP method), or a provider
    redirect to another origin.
    '
- Modified response: 502
  - Description changed from 'Provider API error' to 'Provider transport failure, invalid JSON, or response body larger than 8 MiB'

GET /databases/regions

Description changed from 'Returns the regions enabled for database provisioning in this platform environment.
This is a public endpoint that doesn't require authentication.
' to 'Returns the regions enabled for database provisioning in this platform environment.
These are the same regions offered for function deployment, and the only values
the region field of a database accepts.
This is a public endpoint that doesn't require authentication.
'
Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Items changed
        
        Properties changed
        
        Modified property: name
        
        Description changed from 'Human-readable region name' to 'Human-readable region location'
        
        Example changed from 'AWS US East 1 (N. Virginia)' to 'US East (N. Virginia)'

POST /databases/{databaseName}/branches/{branchName}/query/delete

Responses changed
- New response: 503
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/branches/{branchName}/query/insert

Responses changed
- New response: 503
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/branches/{branchName}/query/ping

Responses changed
- New response: 503
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/branches/{branchName}/query/select

Responses changed
- New response: 503
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/branches/{branchName}/query/update

Responses changed
- New response: 503
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/query/delete

Responses changed
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/query/insert

Responses changed
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/query/ping

Responses changed
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/query/select

Responses changed
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /databases/{databaseName}/query/update

Responses changed
- Modified response: 429
  - Description changed from 'The query was rejected by a monthly usage cap: either the platform user's
    bandwidth cap (aggregate ingress + egress across owned projects) or the
    project's monthly database-request cap. Enforcement is eventual: queries
    are rejected until the relevant cap increases (plan/override) or the
    calendar-month meter resets. The error message identifies which cap.
    ' to 'The query was rejected by a billing-cycle allowance: either the owning
    platform user's bandwidth allowance (aggregate ingress + egress across
    owned projects) or their database-request allowance. Enforcement is
    eventual: queries are rejected until the allowance increases or the
    next anniversary cycle begins. The error message identifies the resource.
    '

POST /functions/{functionId}/invoke

Description changed from 'Invoke a serverless function.

With Service Key (admin/background operations):

Use for background jobs, webhooks, cron, admin operations
Function receives payload only (no user context)
Database queries bypass RLS (admin access)

With Auth User Token (user-facing):

Use for user-initiated actions

Function receives payload + __volcano_auth context:

{
  user_id: "uuid",
  email: "user@example.com",
  project_id: "uuid",
  role: "authenticated" or "anonymous"
}

Database queries enforce RLS (user-scoped data)

With Anon Key (public function only):

Requires anon key permission: functions.invoke
Function must have is_public: true
Function receives payload only (no __volcano_auth)

Transport and CORS:

Direct invocation endpoint is intended for http://api.<domain>/functions/{functionId}/invoke
DNS invocation endpoint is https://{functionId}.functions.<domain>/
CORS preflight for invocation allows only POST, OPTIONS
' to 'Invoke a serverless function.

With Service Key (admin/background operations):

Use for background jobs, webhooks, cron, admin operations
Function receives payload only (no user context)
Database queries bypass RLS (admin access)

With Auth User Token (user-facing):

Use for user-initiated actions

Function receives payload + __volcano_auth context:

{
  user_id: "uuid",
  email: "user@example.com",
  project_id: "uuid",
  role: "authenticated" or "anonymous"
}

Database queries enforce RLS (user-scoped data)

With Anon Key (public function only):

Requires anon key permission: functions.invoke
Function must have is_public: true
Function receives payload only (no __volcano_auth)

Transport and CORS:

This operation is the authenticated direct RPC endpoint and always uses the
POST {payload: ...} contract, including for functions whose DNS ingress is
configured in HTTP mode.
The geo-routed DNS ingress is https://{functionId}.functions.<domain>/.
RPC-mode DNS ingress accepts POST at /. HTTP-mode DNS ingress accepts GET,
HEAD, POST, PUT, PATCH, and DELETE at / and nested paths.
Direct and RPC-mode CORS preflight advertises POST, OPTIONS. HTTP-mode DNS
preflight advertises GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS.
http_auth_mode: none applies only to public HTTP-mode DNS ingress; this
direct operation always requires a Volcano credential.
'
Responses changed
- Modified response: 429
  - Description changed from 'Rate limit exceeded (per-function or project-wide limit), or the
    owning platform user's monthly bandwidth cap (aggregate ingress +
    egress) was exceeded.
    ' to 'Rate limit exceeded (per-function or project-wide limit), or the
    owning platform user's billing-cycle bandwidth allowance (aggregate ingress +
    egress) was exceeded.
    '

GET /projects

Description changed from 'Returns projects that are not deleting or deleted, newest first.
Supports two mutually exclusive pagination modes. Offset mode uses
page and limit. Cursor mode uses cursor or ending_before with
limit, returns next_cursor/prev_cursor, and supports a bounded
offset past the cursor anchor. Supplying limit without page
selects cursor mode. search applies a case-insensitive project-name
filter in either mode. Sending page with cursor or ending_before,
or sending both cursor directions, returns 400.
' to 'Returns projects that are not deleting or deleted, newest first.
Supports two mutually exclusive pagination modes. Offset mode uses
page and limit. Cursor mode uses cursor or ending_before with
limit, returns next_cursor/prev_cursor, and supports a bounded
offset past the cursor anchor. Supplying limit without page
selects cursor mode. search applies a case-insensitive project-name
filter in either mode. include optionally expands each returned
project with its Git connection and/or aggregate health summary using
git_connection and health. Sending page with cursor or ending_before,
or sending both cursor directions, returns 400.
'
New query param: include
Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        Modified property: data
        
        Items changed
        
        Properties changed
        
        New property: git_connection
        
        New property: health

POST /projects

Responses changed
- Modified response: 201
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        New property: git_connection
        
        New property: health

GET /projects/{id}

Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        New property: git_connection
        
        New property: health

PATCH /projects/{id}

Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        New property: git_connection
        
        New property: health

GET /projects/{id}/auth/hosted-pages/{pageType}

Modified path param: pageType
- Schema changed
  - New enum values: [signup forgot-password device verify-email]
Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        Modified property: page
        
        Property 'AllOf' changed
        
        Modified schema: #/components/schemas/AuthHostedPage
        
        Properties changed
        Modified property: page_type
        New enum values: [signup forgot-password device verify-email]

PUT /projects/{id}/auth/hosted-pages/{pageType}

Modified path param: pageType
- Schema changed
  - New enum values: [signup forgot-password device verify-email]
Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        Modified property: page
        
        Property 'AllOf' changed
        
        Modified schema: #/components/schemas/AuthHostedPage
        
        Properties changed
        Modified property: page_type
        New enum values: [signup forgot-password device verify-email]

GET /projects/{id}/auth/hosted/{pageType}

Summary changed from 'Render managed reset-password page' to 'Render a managed auth page'
Description changed from 'Public HTML endpoint for the managed reset-password page.
Requires Accept: text/html.
Returns 404 when managed hosted pages are disabled for the project.
' to 'Public HTML endpoint for signup, forgot-password, device approval,
verify-email, and reset-password pages. Login uses the path without a
page type.
Requires Accept: text/html.
Returns 404 when managed hosted pages are disabled for the project.
'
Modified path param: pageType
- Schema changed
  - New enum values: [signup forgot-password device verify-email]

GET /projects/{id}/config

Description changed from 'Exports the project's current user-facing configuration as a
declarative manifest. Returns JSON by default. Request the canonical
volcano-config.yaml rendering with Accept: application/yaml or
?format=yaml; the YAML is returned verbatim as the raw response body
(Content-Type: application/yaml) and is meant to be saved as-is.
Write-only secrets (SMTP password, OAuth client secrets, TLS material)
are omitted from the export; the YAML rendering adds a header comment
describing how to set them via CLI environment interpolation.
' to 'Exports the project's current user-facing configuration as a
declarative manifest. Returns JSON by default. Request the canonical
volcano-config.yaml rendering with Accept: application/yaml or
?format=yaml; the YAML is returned verbatim as the raw response body
(Content-Type: application/yaml) and is meant to be saved as-is.
Variable values and write-only secrets (SMTP password, OAuth client secrets, TLS material)
are omitted from the export; shared_variables contains names only; the YAML rendering adds a header comment
describing how to set them via CLI environment interpolation.
'
Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Description changed from 'Declarative project configuration manifest (the JSON form of
        volcano-config.yaml). Omitted sections are left untouched. Within
        declared entries, omitted optional fields keep their current server
        values (patch semantics). Declared collection keys are fully synced to
        the manifest: variables, buckets[].policies, auth.providers.oauth,
        auth.email.templates, and functions[].schedulers are reconciled to
        exactly match, deleting resources absent from the manifest.
        shared_variables is fully synced the same way, but membership only:
        names absent from a declared list stop being shared and remain as
        non-shared variables, with their values untouched. Functions,
        frontends, databases, and buckets are never created or deleted through
        this manifest; entries referencing resources that do not exist are
        skipped and reported.
        ' to 'Declarative project configuration manifest (the JSON form of
        volcano-config.yaml). Omitted sections are left untouched. Within
        declared entries, omitted optional fields keep their current server
        values (patch semantics). Declared collection keys are fully synced to
        the manifest: variables, buckets[].policies, auth.providers.oauth,
        auth.email.templates, and functions[].schedulers are reconciled to
        exactly match, deleting resources absent from the manifest. Functions,
        frontends, databases, and buckets are never created or deleted through
        this manifest; entries referencing resources that do not exist are
        skipped and reported.
        '
        
        Properties changed
        
        Modified property: auth
        
        Properties changed
        
        Modified property: managed_pages
        
        Properties changed
        New property: appearance
        
        Modified property: pages
        Properties changed
        New property: device
        
        New property: forgot_password
        
        New property: signup
        
        New property: verify_email
        
        Modified property: functions
        
        Items changed
        
        Properties changed
        
        New property: http_auth_mode
        
        New property: invocation_mode
        
        New property: openapi_spec
        
        Modified property: variable_scope
        Description changed from 'Which project variables this function receives. all (the default)
        gives it every project variable. scoped gives it only the variables
        it selects: every name declared in variables, plus the names
        Volcano detects in its source that the project defines.
        ' to 'Which project variables this function receives. all (the default)
        gives it the project variables marked shared: true. scoped gives it only the variables
        it selects: every name declared in variables, plus the names
        Volcano detects in its source that the project defines.
        '
        
        Modified property: variables
        
        Items changed
        
        Properties changed
        
        New property: shared

PUT /projects/{id}/config

Request body changed
- Content changed
  - Modified media type: application/json
    - Schema changed
      - Description changed from 'Declarative project configuration manifest (the JSON form of
        volcano-config.yaml). Omitted sections are left untouched. Within
        declared entries, omitted optional fields keep their current server
        values (patch semantics). Declared collection keys are fully synced to
        the manifest: variables, buckets[].policies, auth.providers.oauth,
        auth.email.templates, and functions[].schedulers are reconciled to
        exactly match, deleting resources absent from the manifest.
        shared_variables is fully synced the same way, but membership only:
        names absent from a declared list stop being shared and remain as
        non-shared variables, with their values untouched. Functions,
        frontends, databases, and buckets are never created or deleted through
        this manifest; entries referencing resources that do not exist are
        skipped and reported.
        ' to 'Declarative project configuration manifest (the JSON form of
        volcano-config.yaml). Omitted sections are left untouched. Within
        declared entries, omitted optional fields keep their current server
        values (patch semantics). Declared collection keys are fully synced to
        the manifest: variables, buckets[].policies, auth.providers.oauth,
        auth.email.templates, and functions[].schedulers are reconciled to
        exactly match, deleting resources absent from the manifest. Functions,
        frontends, databases, and buckets are never created or deleted through
        this manifest; entries referencing resources that do not exist are
        skipped and reported.
        '
      - Properties changed
        
        Modified property: auth
        
        Properties changed
        
        Modified property: managed_pages
        
        Properties changed
        
        New property: appearance
        
        Modified property: pages
        Properties changed
        New property: device
        
        New property: forgot_password
        
        New property: signup
        
        New property: verify_email
        
        Modified property: functions
        
        Items changed
        
        Properties changed
        
        New property: http_auth_mode
        
        New property: invocation_mode
        
        New property: openapi_spec
        
        Modified property: variable_scope
        
        Description changed from 'Which project variables this function receives. all (the default)
        gives it every project variable. scoped gives it only the variables
        it selects: every name declared in variables, plus the names
        Volcano detects in its source that the project defines.
        ' to 'Which project variables this function receives. all (the default)
        gives it the project variables marked shared: true. scoped gives it only the variables
        it selects: every name declared in variables, plus the names
        Volcano detects in its source that the project defines.
        '
        
        Modified property: variables
        
        Items changed
        
        Properties changed
        
        New property: shared
Responses changed
- New response: 503

GET /projects/{id}/databases

New query param: status

POST /projects/{id}/databases

Description changed from 'Creates a serverless PostgreSQL database in the project.
Each project can contain up to 100 databases. Requests over this cap return 403.
' to 'Creates a serverless PostgreSQL database in the project.
Each project can hold 1 database on Free and up to 10,000 on Pro.
Requests over the plan's cap return 403.
'
Request body changed
- Content changed
  - Modified media type: application/json
    - Schema changed
      - Properties changed
        
        Modified property: region
        
        Description changed from 'Region for database hosting' to 'Region for database hosting. The accepted values are the regions this
        environment runs in, so read them from GET /databases/regions rather
        than hardcoding a list. A region the environment does not offer is
        rejected with 400.
        '
        
        Deleted enum values: [aws-us-east-1 aws-us-east-2 aws-us-west-2 aws-eu-central-1 aws-eu-west-2 aws-ap-southeast-1 aws-ap-southeast-2 aws-sa-east-1]

DELETE /projects/{id}/databases/{databaseName}

Responses changed
- New response: 503

PUT /projects/{id}/databases/{databaseName}/backup-schedule

Responses changed
- Modified response: 400
  - Description changed from 'Invalid schedule' to 'The schedule names a recurrence that cannot fire: a weekly or
    monthly one with no day, or a day outside its frequency's range
    (1-7 for weekly, 1-28 for monthly). The response says which.
    '
- Modified response: 409
  - Description changed from 'The database is not active' to 'The database is not active, or a restore is running on it — a restore
    moves the data to a new branch, and the provider keeps the schedule
    per branch.
    '

GET /projects/{id}/databases/{databaseName}/backups

Responses changed
- Modified response: 200
  - Content changed
    - Modified media type: application/json
      - Schema changed
        
        Properties changed
        
        Modified property: restore_window
        
        Description changed from 'The span a point-in-time restore may target. Empty when the owner's plan
        does not include point-in-time restore.
        ' to 'The span a point-in-time restore may target. Absent from the response
        when the owner's plan does not include point-in-time restore, and while
        the storage provider has no history window in place yet — briefly the
        case after an upgrade, since the window is applied asynchronously. The
        window is read from the provider rather than from the plan, so it never
        advertises a point a restore could not actually reach.
        '

POST /projects/{id}/databases/{databaseName}/backups

Responses changed
- Modified response: 409
  - Description changed from 'A backup of that name already exists, the database is not active, or
    a backup was taken too recently.
    ' to 'A backup of that name already exists, the database is not active, a
    restore is running on it, or a backup was taken too recently.
    '

DELETE /projects/{id}/databases/{databaseName}/backups/{backupName}

Description changed from 'Deletes the backup and frees its storage. Scheduled backups can be
deleted too. A backup that is already gone reports 404, so a name
that never existed and a name that no longer does read the same.

Refused with 409 while the database is being restored.
' to 'Deletes the backup and frees its storage. Scheduled backups can be
deleted too. A backup that is already gone reports 404, so a name
that never existed and a name that no longer does read the same.
Refused with 409 while the database is being restored.
'

POST /projects/{id}/databases/{databaseName}/branches

Responses changed
- Modified response: 409
  - Description changed from 'A branch of that name already exists on this database, or the
    database cannot be branched right now because it is still
    provisioning, failed, or being deleted.
    ' to 'A branch of that name already exists on this database, or the
    database cannot be branched right now because it is still
    provisioning, being restored, failed, or being deleted.
    '

DELETE /projects/{id}/databases/{databaseName}/branches/{branchName}

Description changed from 'Marks the branch for teardown and returns immediately. The branch stops
accepting connections at once; its fork and its row are removed by a
background job, so a provider outage cannot leave the call hanging or the
branch half-deleted.

Deleting a branch that is still provisioning is allowed and stops the
build. Deleting a branch that is already gone succeeds.
' to 'Marks the branch for teardown and returns immediately. The branch stops
accepting connections at once; its fork and its row are removed by a
background job, so a provider outage cannot leave the call hanging or the
branch half-deleted.

Deleting a branch that is still provisioning is allowed and stops the
build, and repeating the call while teardown is in progress is accepted
again. Once the branch is gone the call returns 404.
'

POST /projects/{id}/databases/{databaseName}/branches/{branchName}/reset

Responses changed
- Modified response: 409
  - Description changed from 'The branch is not active, or a reset is already in progress.
    ' to 'The branch is not active, a reset is already in progress, the parent
    database is being restored, or the parent was restored within the
    last 24 hours — a reset re-forks from the parent, and the provider
    holds a child's reset shut for that long afterwards.
    '

POST /projects/{id}/databases/{databaseName}/branches/{branchName}/reset-password

Description changed from 'Issues a new password for the branch and invalidates the previous
connection string. Existing connections are not interrupted; new ones
must use the returned string.

The parent database's credentials are untouched.
' to 'Issues a new password for the branch and invalidates the previous
connection string. Existing connections are not interrupted; new ones
must use the returned string. Proxies pick the rotation up within a few
seconds, so the previous password can still open new connections until
then.

The parent database's credentials are untouched.
'

POST /projects/{id}/databases/{databaseName}/reset-password

Description changed from 'Rotates the Volcano-managed PostgreSQL password used by clients when connecting
through pgproxy. This does not rotate or expose the internal owner password.
The returned password and connection string are the only client credentials that
will authenticate through pgproxy after reset.
' to 'Rotates the Volcano-managed PostgreSQL password used by clients when connecting
through pgproxy. This does not rotate or expose the internal owner password.
The returned password and connection string are the only client credentials that
will authenticate through pgproxy after reset.

Existing connections are not interrupted; new ones must use the returned
string. Proxies pick the rotation up within a few seconds, so the previous
password can still open new connections until then.
'

Responses changed
- New response: 503

POST /projects/{id}/databases/{databaseName}/restores

Request body changed
- Content changed
  - Modified media type: application/json
    - Schema changed
      - Properties changed
        
        Modified property: backup_name
        
        Description changed from 'A backup of this database to restore.' to 'A backup of this database to restore, exactly as returned by the list
        endpoint.

Deliberately looser than the names you can create, like the backup
path parameter: a backup made by a schedule is named for you, so
restoring one accepts any name a backup can have.
'
- MinLength changed from 0 to 1
- MaxLength changed from 63 to 128
- Pattern changed from '^[a-z0-9][a-z0-9_-]{0,62}$' to ''

PATCH /projects/{id}/databases/{databaseName}/type

Responses changed
- New response: 503

POST /projects/{id}/frontends

Description changed from 'Creates and deploys a frontend for the project.
If a frontend with the same name already exists in the project, this operation updates that
frontend using the uploaded archive and starts a new deployment. A deployment that starts
immediately returns status: provisioning, then transitions to active, degraded, or
failed. If another deployment is running, the response preserves the frontend's current status
and exposes the queued deployment through pending_deployment_id.
Existing frontend traffic continues to use an available runtime while the new deployment builds
and provisions. Each deployment publishes its own static assets before the runtimes switch to its
build, and the live build's assets keep serving until the new deployment is live, so a page loaded
mid-deployment resolves its assets whichever build served it. A failed redeploy puts the runtimes
back on the build they were running, leaves the frontend active on the previous deployment, and
records the attempted deployment as failed. degraded means the runtime remains available but
edge synchronization requires recovery; Volcano retries the edge step without rebuilding. Only one deployment may run for a
given frontend, while independent frontends and projects can deploy concurrently.
For monorepos, provide app_root as a relative path from the uploaded archive root
to the Next.js app that should be built. Omit it for single-app archives.
Supported frontend environments are Next.js 15.x and 16.x with Node.js
22.x or 24.x. The Node.js runtime is inferred from
package.json engines.node; if omitted, Volcano uses Node.js 22.x.
The selected Node.js family must also satisfy the installed Next.js package's
engines.node constraint. Volcano tests Next 15.5.23 (^18.18.0 || ^19.8.0 || >=20.0.0) and Next 16.3.2 (>=20.9.0).
Source archive size is enforced by the API with SOURCE_ARCHIVE_SIZE_LIMIT_MB; the CLI
does not apply its own source archive size limit. After the final container images are
built, the publish build enforces LAMBDA_TARGET_CONTAINER_SIZE_LIMIT_MB before pushing.
This operation is limited by plan-based frontend deployment quotas (FREE_FRONTEND_DEPLOYMENTS, PRO_FRONTEND_DEPLOYMENTS).
Each project can contain up to 10,000 frontends regardless of plan.
' to 'Creates and deploys a frontend for the project.
If a frontend with the same name already exists in the project, this operation updates that
frontend using the uploaded archive and starts a new deployment. A deployment that starts
immediately returns status: provisioning, then transitions to active, degraded, or
failed. If another deployment is running, the response preserves the frontend's current status
and exposes the queued deployment through pending_deployment_id.
Existing frontend traffic continues to use an available runtime while the new deployment builds
and provisions. Each deployment publishes its own static assets before the runtimes switch to its
build, and the live build's assets keep serving until the new deployment is live, so a page loaded
mid-deployment resolves its assets whichever build served it. A failed redeploy puts the runtimes
back on the build they were running, leaves the frontend active on the previous deployment, and
records the attempted deployment as failed. degraded means the runtime remains available but
edge synchronization requires recovery; Volcano retries the edge step without rebuilding. Only one deployment may run for a
given frontend, while independent frontends and projects can

Report truncated; see the source commit for the complete contract diff.

Validation

Contract generation completed in the source workflow run.
Target repository CI validates the generated result.

CLAassistant · 2026-07-13T20:39:30Z

All committers have signed the CLA.

kong Bot force-pushed the chore/sync-openapi branch 10 times, most recently from 04d66d1 to b8d922a Compare July 20, 2026 13:54

kong Bot force-pushed the chore/sync-openapi branch 10 times, most recently from ee0bdba to eb217d3 Compare July 27, 2026 22:41

kong Bot force-pushed the chore/sync-openapi branch 9 times, most recently from bc4afe5 to 7b3fd89 Compare July 31, 2026 00:52

kong Bot force-pushed the chore/sync-openapi branch 9 times, most recently from 3d85dcf to 9f5fc74 Compare August 22, 2026 01:21

kong Bot force-pushed the chore/sync-openapi branch 10 times, most recently from 61e1bcc to 882ac57 Compare August 29, 2026 05:35

kong Bot force-pushed the chore/sync-openapi branch 8 times, most recently from 5187d45 to 1d7604f Compare September 5, 2026 02:49

kong Bot force-pushed the chore/sync-openapi branch 2 times, most recently from d4953ec to 1e2ab55 Compare September 10, 2026 22:00

chore(api): sync OpenAPI contract

d245d67

Navigation Menu

Uh oh!

chore(api): sync OpenAPI contract - #51

chore(api): sync OpenAPI contract#51
kong[bot] wants to merge 1 commit into
mainfrom
chore/sync-openapi

kong Bot commented Jul 13, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Jul 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

kong Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

API change report

Public API

New Endpoints: 11

Deleted Endpoints: 1

Modified Endpoints: 62

Validation

Uh oh!

CLAassistant commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kong Bot commented Jul 13, 2026 •

edited

Loading

CLAassistant commented Jul 13, 2026 •

edited

Loading