chore: update the api reference spec

[kernel-internal]

Opened by the stlc generate workflow in kernel/kernel (8a7c2e54c191e8fca2a3fcd33768fa6876d7d36c). Merging redeploys the API reference from the updated spec.

---

Note

Low Risk
Documentation and contract-only changes in the OpenAPI spec; no runtime code in this PR, though clients will see new endpoints and deprecations when references redeploy.

Overview
Updates specs/openapi.documented.yml so the published API reference matches recent Kernel API surface and SDK generation.

Authentication: Adds GET /auth/context and AuthContext schemas (authentication method/source, principal, organization, credential vs effective scope). New Authentication tag and client code samples.

Browsers: Introduces proxy / BrowserProxyConfig / BrowserProxy with mode (direct | default) or proxy id / name, and documents that proxy only affects egress—not stealth or CAPTCHA solver. proxy_id and disable_default_proxy are deprecated with migration notes. stealth docs now state default proxy behavior and CAPTCHA solver coupling. Browser responses gain profile_save_changes and resolved proxy.

Managed auth: Adds nested browser (ManagedAuthBrowserConfig: stealth, proxy, telemetry) on connections and login flows; deprecates top-level proxy, proxy_id, and browser_telemetry. Submit-field docs now say to poll the connection instead of following SSE.

Audit logs: Audit log export destination routes drop x-stainless-skip, document Enterprise requirements, add 403 on list/export paths, and include SDK code samples.

^{Reviewed by Cursor Bugbot for commit a0544cf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Error		Aug 8, 2026 7:56pm

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now 6ffab4a4. Re-assessed from the full diff against the base.

What changed

• Single file: specs/openapi.documented.yml (+7 / −0)
• Adds optional boolean profile_save_changes (with description) to the browser session schema
• Documents existing 403 Forbidden responses on audit log list and export chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only; no application, runtime, or infrastructure code
• Additive schema/response documentation; no auth, billing, permissions, or production logic changes in this repo
• Small, easy to reason about; blast radius limited to published API reference docs
• Risk did not increase vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now c7fc0a54. Re-assessed from the full diff against the base (512e314...c7fc0a54).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+312 / −10)
• Adds optional boolean profile_save_changes to the browser session schema
• Updates managed-auth submit-fields description (SSE → poll)
• Removes x-stainless-skip on audit log export destination operations; keeps x-hidden / x-cli-skip
• Adds Enterprise-plan notes, operation descriptions, and JS/Python/Go x-codeSamples for those endpoints
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now ad083763. Re-assessed from the full diff against the base (3ad0d55...ad083763).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+470 / −10)
• Adds AuthContext* schemas and documents GET /auth/context (with JS/Python/Go x-codeSamples)
• Adds optional boolean profile_save_changes on the browser session schema
• Updates managed-auth submit-fields description (SSE → poll)
• Removes x-stainless-skip on audit log export destination operations; keeps x-hidden / x-cli-skip
• Adds Enterprise-plan notes, operation descriptions, and code samples for those endpoints
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now 305c7785. Re-assessed from the full diff against the base (b10953f6...305c7785).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+559 / −15)
• Adds AuthContext* schemas and documents GET /auth/context (with JS/Python/Go x-codeSamples)
• Adds structured BrowserProxy / BrowserProxyConfig / BrowserProxyMode; marks proxy_id and disable_default_proxy deprecated
• Adds optional profile_save_changes on the browser session schema
• Clarifies stealth description (CAPTCHA solver + default egress behavior)
• Updates managed-auth submit-fields description (SSE → poll)
• Removes x-stainless-skip on audit log export destination operations; adds Enterprise-plan notes, descriptions, and code samples
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs, deprecation markers, and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 305c778. Configure here.}

[cursor]

Response proxy oneOf rejects dual fields

Medium Severity

BrowserProxy is a resolved response schema but reuses request-style oneOf branches that require exactly one of mode, id, or name. A payload with both id and name matches two branches and fails validation, and a name-only variant conflicts with the description that selected proxies are returned by stable ID. Comparable response refs such as BrowserPoolRef use required id with optional name instead.

 

^{Reviewed by Cursor Bugbot for commit 305c778. Configure here.}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now 31bcf6c8. Re-assessed from the full diff against the base (b10953f6...31bcf6c8).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+603 / −20)
• Adds AuthContext* schemas and documents GET /auth/context (with JS/Python/Go x-codeSamples)
• Adds structured BrowserProxy / BrowserProxyConfig / BrowserProxyMode; marks proxy_id and disable_default_proxy deprecated
• Adds ManagedAuthBrowserConfig (browser.stealth / browser.proxy / browser.telemetry); deprecates top-level managed-auth proxy, browser_telemetry, and connection proxy_id in favor of browser.*
• Adds optional profile_save_changes on the browser session schema
• Clarifies stealth description (CAPTCHA solver + default egress behavior)
• Updates managed-auth submit-fields description (SSE → poll)
• Removes x-stainless-skip on audit log export destination operations; adds Enterprise-plan notes, descriptions, and code samples
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs, deprecation markers, and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Risk assessment: Very Low

Verdict: Prior approval remains valid (not re-approved)

Re-evaluation after synchronize

This PR was previously approved by this automation on commit 5aebdcbb. Head is now a0544cf7. Re-assessed from the full diff against the base (b10953f6...a0544cf7).

What changed (from the diff)

• Single file: specs/openapi.documented.yml (+603 / −20)
• Adds AuthContext* schemas and documents GET /auth/context (with JS/Python/Go x-codeSamples)
• Adds structured BrowserProxy / BrowserProxyConfig / BrowserProxyMode; marks proxy_id and disable_default_proxy deprecated
• Adds ManagedAuthBrowserConfig (browser.stealth / browser.proxy / browser.telemetry); deprecates top-level managed-auth proxy, browser_telemetry, and connection proxy_id in favor of browser.*
• Adds optional profile_save_changes on the browser session schema
• Clarifies stealth description (CAPTCHA solver + default egress behavior)
• Updates managed-auth submit-fields description (SSE → poll)
• Removes x-stainless-skip on audit log export destination operations; adds Enterprise-plan notes, descriptions, and code samples
• Documents 403 Forbidden on audit log list and export-chunk operations

Why Very Low

• Documentation/API-reference OpenAPI spec only in this Mintlify docs repo; no application, runtime, or infrastructure code
• Additive schema/response docs, deprecation markers, and example snippets; no auth, billing, permissions, or production logic changes here
• Blast radius limited to published API reference content after redeploy
• Risk did not increase above Very Low vs. the prior assessment → approval not dismissed
• No CODEOWNERS file/requirement detected

Action

• Not re-approving (an approval from this automation already exists)
• Not dismissing approval (risk remained Very Low)

  

_{Sent by Cursor Automation: Assign PR reviewers}