chore: update the api reference spec

[kernel-internal]

Opened by the stlc generate workflow in kernel/kernel (8a7c2e54c191e8fca2a3fcd33768fa6876d7d36c). Merging redeploys the API reference from the updated spec.

---

Note

Low Risk
Documentation-only OpenAPI sync; no runtime code changes in this repo, though the spec describes auth and proxy contract changes customers may rely on after deploy.

Overview
Regenerates specs/openapi.documented.yml so the public API reference matches the latest Kernel API (from the stlc generate workflow).

New surface: GET /auth/context and AuthContext schemas expose authentication method, principal, organization, and credential vs effective scope without secrets.

Browser proxy model: BrowserProxyConfig / BrowserProxy replace proxy_id and disable_default_proxy (marked deprecated) with mode (direct / default), id, or name. Docs clarify that proxy only affects egress, not stealth or CAPTCHA solver behavior. Browser responses can include profile_save_changes and a resolved proxy object.

Managed auth: Connections and login flows gain a nested browser object (ManagedAuthBrowserConfig: stealth, proxy, telemetry). Top-level proxy and browser_telemetry are deprecated in favor of browser.*. Health-check interval copy adds the Free plan minimum (6 hours). Reauth readiness adds requires_customer_input.

Other doc fixes: Managed auth submit is described as polling (not SSE). Audit log export endpoints lose x-stainless-skip, gain Enterprise-plan notes, descriptions, and SDK code samples. Audit log list/export add 403 responses.

^{Reviewed by Cursor Bugbot for commit 9d3e536. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Error		Aug 10, 2026 4:33pm

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now 6ffab4a4. Re-assessed from the full diff against the base.

What changed

• Single file: specs/openapi.documented.yml (+7 / −0)
• Adds optional boolean profile_save_changes (with description) to the browser session schema
• Documents existing 403 Forbidden responses on audit log list and export chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only; no application, runtime, or infrastructure code
• Additive schema/response documentation; no auth, billing, permissions, or production logic changes in this repo
• Small, easy to reason about; blast radius limited to published API reference docs
• Risk did not increase vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now c7fc0a54. Re-assessed from the full diff against the base (512e314...c7fc0a54).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+312 / −10)
• Adds optional boolean profile_save_changes to the browser session schema
• Updates managed-auth submit-fields description (SSE → poll)
• Removes x-stainless-skip on audit log export destination operations; keeps x-hidden / x-cli-skip
• Adds Enterprise-plan notes, operation descriptions, and JS/Python/Go x-codeSamples for those endpoints
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now ad083763. Re-assessed from the full diff against the base (3ad0d55...ad083763).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+470 / −10)
• Adds AuthContext* schemas and documents GET /auth/context (with JS/Python/Go x-codeSamples)
• Adds optional boolean profile_save_changes on the browser session schema
• Updates managed-auth submit-fields description (SSE → poll)
• Removes x-stainless-skip on audit log export destination operations; keeps x-hidden / x-cli-skip
• Adds Enterprise-plan notes, operation descriptions, and code samples for those endpoints
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now 305c7785. Re-assessed from the full diff against the base (b10953f6...305c7785).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+559 / −15)
• Adds AuthContext* schemas and documents GET /auth/context (with JS/Python/Go x-codeSamples)
• Adds structured BrowserProxy / BrowserProxyConfig / BrowserProxyMode; marks proxy_id and disable_default_proxy deprecated
• Adds optional profile_save_changes on the browser session schema
• Clarifies stealth description (CAPTCHA solver + default egress behavior)
• Updates managed-auth submit-fields description (SSE → poll)
• Removes x-stainless-skip on audit log export destination operations; adds Enterprise-plan notes, descriptions, and code samples
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs, deprecation markers, and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 305c778. Configure here.}

[cursor]

Response proxy oneOf rejects dual fields

Medium Severity

BrowserProxy is a resolved response schema but reuses request-style oneOf branches that require exactly one of mode, id, or name. A payload with both id and name matches two branches and fails validation, and a name-only variant conflicts with the description that selected proxies are returned by stable ID. Comparable response refs such as BrowserPoolRef use required id with optional name instead.

 

^{Reviewed by Cursor Bugbot for commit 305c778. Configure here.}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now 31bcf6c8. Re-assessed from the full diff against the base (b10953f6...31bcf6c8).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+603 / −20)
• Adds AuthContext* schemas and documents GET /auth/context (with JS/Python/Go x-codeSamples)
• Adds structured BrowserProxy / BrowserProxyConfig / BrowserProxyMode; marks proxy_id and disable_default_proxy deprecated
• Adds ManagedAuthBrowserConfig (browser.stealth / browser.proxy / browser.telemetry); deprecates top-level managed-auth proxy, browser_telemetry, and connection proxy_id in favor of browser.*
• Adds optional profile_save_changes on the browser session schema
• Clarifies stealth description (CAPTCHA solver + default egress behavior)
• Updates managed-auth submit-fields description (SSE → poll)
• Removes x-stainless-skip on audit log export destination operations; adds Enterprise-plan notes, descriptions, and code samples
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs, deprecation markers, and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now a0544cf7. Re-assessed from the full diff against the base (b10953f6...a0544cf7).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+603 / −20)
• Adds AuthContext* schemas and documents GET /auth/context (with JS/Python/Go x-codeSamples)
• Adds structured BrowserProxy / BrowserProxyConfig / BrowserProxyMode; marks proxy_id and disable_default_proxy deprecated
• Adds ManagedAuthBrowserConfig (browser.stealth / browser.proxy / browser.telemetry); deprecates top-level managed-auth proxy, browser_telemetry, and connection proxy_id in favor of browser.*
• Adds optional profile_save_changes on the browser session schema
• Clarifies stealth description (CAPTCHA solver + default egress behavior)
• Updates managed-auth submit-fields description (SSE → poll)
• Removes x-stainless-skip on audit log export destination operations; adds Enterprise-plan notes, descriptions, and code samples
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs, deprecation markers, and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now 55dbe51b. Re-assessed from the full diff against the base (b10953f6...55dbe51b).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+605 / −20)
• Adds AuthContext* schemas and documents GET /auth/context (with JS/Python/Go x-codeSamples)
• Adds structured BrowserProxy / BrowserProxyConfig / BrowserProxyMode; marks proxy_id and disable_default_proxy deprecated
• Adds ManagedAuthBrowserConfig (browser.stealth / browser.proxy / browser.telemetry); deprecates top-level managed-auth proxy, browser_telemetry, and connection proxy_id in favor of browser.*
• Adds optional profile_save_changes on the browser session schema
• Clarifies stealth description (CAPTCHA solver + default egress behavior)
• Updates managed-auth submit-fields description (SSE → poll)
• Removes x-stainless-skip on audit log export destination operations; adds Enterprise-plan notes, descriptions, and code samples
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs, deprecation markers, and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now 9d3e536c. Re-assessed from the full diff against the base (94f398e2...9d3e536c).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+611 / −24)
• Adds AuthContext* schemas and documents GET /auth/context (with JS/Python/Go x-codeSamples)
• Adds structured BrowserProxy / BrowserProxyConfig / BrowserProxyMode; marks proxy_id and disable_default_proxy deprecated
• Adds ManagedAuthBrowserConfig (browser.stealth / browser.proxy / browser.telemetry); deprecates top-level managed-auth proxy, browser_telemetry, and connection proxy_id in favor of browser.*
• Adds optional profile_save_changes on the browser session schema
• Clarifies stealth description (CAPTCHA solver + default egress behavior)
• Updates managed-auth health-check interval copy (Free plan minimum 6 hours; default vs plan minimum)
• Updates managed-auth submit-fields description (SSE → poll)
• Adds requires_customer_input to reauth readiness enum/docs
• Removes x-stainless-skip on audit log export destination operations; adds Enterprise-plan notes, descriptions, and code samples
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs, deprecation markers, and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Incremental change since prior assessment is copy-only (health-check interval wording)
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}