[flashduty]

Daily api-review — 2026-10-28

Window: 2026-10-27T09:36:16Z (previous successful run) → 2026-10-28T08:0xZ (this run). Basis per repo: origin/main, read through git show on the committed tree, never the work tree.

Result per module (added / updated / removed)

Module	added	updated	removed
on-call	0	0	0
monitors	0	0	0
platform	0	0	0
rum	0	1 operation (POST /rum/data/query) + 2 schemas (RumDataQueryOutput.error, RumDataQueryDefinition.dql)	0
safari	0	0	0

No path was added or removed, so docs.json (pages and the API bare-path redirects) and the two api-catalog.mdx are intentionally untouched.

The one real drift: RUM DQL parse errors are no longer InternalError

Source: fc-rum cc55956 — fix(query): accept a lone * and report unparsable DQL as a client error (in origin/main via merge 8edbb03).

• cmd/server/controller/data/fetch.go: buildQuery now returns srv.NewErrorWithMsg(srv.ErrInvalidParameter, "Invalid query %q: %v", …) for a DQL parse failure, and fetch returns it through srv.ToError(err, srv.ErrInternalError). srv.ToError (go-pkg srv/error.go) returns an existing *srv.Error unchanged.
• logic/dataquery/dataquery.go#ClientError now passes on an error whose HTTPStatusCode is 4xx; cmd/server/controller/data/query.go therefore writes that InvalidParameter into the failing entry's own error instead of falling through to errOut = srv.NewError(srv.ErrInternalError).
• Net wire effect: an unparsable dql fails only its own query entry with code InvalidParameter and a message naming the query, not InternalError.

The spec asserted the opposite in two places, so both were corrected (EN + ZH, split + consolidated):

1. /rum/data/query x-mint.content Usage bullet — invalid dql`` removed from the InternalError list, and the `InvalidParameter` case added.
2. RumDataQueryOutput.error description — The code is always InternalError`` replaced with InternalError, or `InvalidParameter` when `dql` cannot be parsed`.
3. RumDataQueryDefinition.dql description — added that a lone * matches every event (from logic/ast/dql/dql.go: if query == "" || strings.TrimSpace(query) == "*"), since callers that used Datadog-style * used to get a parse error.

Statements the same commit left true and therefore were not touched: malformed SQL / bad time_zone / out-of-range window still fail the whole request with InvalidParameter (they are rejected in query.Validate, before fetch), and search_after_ctx / unknown table or column / database errors remain per-entry InternalError.

Judged no change, with evidence

• fc-pgy cfabda27 (merged by d13bd002): /monit/api/edge/heartbeat AQps 20 → 64, AQpm dropped. The row is Auth: "data", i.e. not on the app_key public surface, and no registry row was added or removed, so no nav or catalog change either.
• fc-event 754b02e8b / afdaaf364: licenseReleasesPerSeat 2 → 100. Docs publish no numeric quota — LicenseListResponse.release_limited only says the release quota for the 30-day window is used up, which is still true.
• fc-event c1fa3e573: AI SRE /stop no longer opens a cancel card when there is nothing to rewrite — IM runtime behaviour, no Open API operation involved.
• fc-event bb1f0faff, d127b58d7, 0d926eb79, c31b2a778, b1be809d2: lint/test/onboarding-internal cleanups; no json:/binding: change and no public controller touched.
• monit-webapi 5c500da (merge 4cb7ff4): adds alert_key, created_at_ms, queue_delay_ms, receive_lag_ms to internal zap log lines only.
• fc-safari, the largest part of the window: 2c1729ae1/8c24108f1/785da2e17/b838546fb and their merges add vcs_credentials_disabled (cmd/api/environment/*, types/environment.go, model/environment) and runner_vcs_toggle (cmd/api/app/app.go). Every /safari/environment/* registry row is Auth: "jwt", so none of it is on the app_key surface and no published schema carries these fields. The 67d4a073d / 9c2236795 sync merges (PR #1657/#1658) add ChatAutomationExecutionGuard.reuse_current_session, PageContext.facts, config_only/config_target and IM delivery plumbing — all runtime envelopes (cmd/api/runtime/*, logic/session/actor/*), not response types returned by /safari/{skill,mcp,a2a-agent,session,automation}/*; types/automation.go is untouched, so the published automation schemas do not move. 1c05b18f9 only edits cmd/api/ambient/judge.go prompts and in-repo bootstrap skill markdown.
• fc-oncall, fc-statuspage, fc-datasource, go-pkg, monit-edge: no commits in the window.
• flashduty-docs itself: PR docs(rum): document element-level privacy overrides for session replay #1142 (078f8d06) added RUM session-replay privacy prose, unrelated to api-reference/.

Registry vs specs

scripts/parse_pgy_registry.py on fc-pgy/logic/api/api_test.go: 1240 rows, 393 with auth == "all"; after dropping /event/push/, 393 public operations vs 392 operation keys across the five split specs (on-call, monitors, platform, rum, safari). Gin-style :param is normalised to {param} before comparing.

• Unresolved (unchanged from previous rounds): 1 — POST /channel/incident/daily-counts (channel:read:incidentDailyCounts). The registry row exists but the handler only lives on fc-event's dev branch, so it is deliberately not in any spec.
• Operations documented but absent from the registry: 0.

Split vs consolidated

Deep compare ignoring dict key order, both languages, all five modules. Only the two established hand-edits differ, both left alone:

• DutyError.reason exists in the consolidated copies only, carrying x-flashduty-preserve-absence: true (on-call / platform / rum / safari splits).
• safari split components.responses: BadRequest.missingParameter keeps its summary and the safari-specific skill_id message, and Forbidden names its example accessDenied where the consolidated copy uses noEditPermission.

No new drift, and no drift was introduced by this change (the same three strings were edited on both sides).

Examples

No operation was added and no schema shape changed, so no new request/response example was needed and none was written. The dev API is not reachable from this environment, so no example was captured either — nothing here is constructed.

Validation

• python3 -c "import json; json.load(open(p))" for all 13 files under api-reference/ → all pass.
• python3 scripts/lint_openapi.py → OK: 12 spec files, no violations.
• python3 scripts/api_path_redirects.py --check → exit 0.
• Reverse-applying the three replacements reproduces the committed bytes exactly, so the diff contains only the intended spans (±12 lines, no reordering).
• mint broken-links was not run (no mint in this environment); no link or path changed, so no new link can exist.