Availability
Reports API routes are guarded capabilities. The OpenAPI contract documents implemented behavior, but route publication, tenant access, scopes, and production approval are four separate controls on top of it.
This is why "the endpoint is in the spec" and "I can call the endpoint" are different statements.
Availability checklist
Confirm all five before depending on an operation in production.
- The route family is enabled in the target environment.
- The tenant is approved for that capability.
- The client or human role has the documented authority.
- Required scopes, CSRF, MFA, and idempotency controls are satisfied.
- The production release is listed in the Reports API changelog.
Compatibility policy
| Change type | What to expect |
|---|---|
| Compatible addition | New optional fields, enum values, or operations can appear at any time. Clients must tolerate unknown fields and values. |
| Breaking replacement | Announced with a migration path and sunset information. |
| Deprecation | Minimum 180 days for stable operations. |
The contract uses semantic contract versions. Pin your expectations to the contract version, not to a snapshot of the response shape you happened to observe.
Support evidence
When reporting an integration problem, provide the operation, UTC timestamp, environment, sanitized request and response, public resource reference, and correlation identifier when available.
Never include credentials, bearer tokens, signing secrets, report files, or customer financial data.
Common questions
I get a denial on an operation I used last week. Is this an outage? Check tenant policy and route flags first. A capability denial is a configuration state and looks nothing like an outage in cause or remedy, even if it looks similar in your logs.
Should my client retry a capability denial? No. Retrying does not change a policy decision. Surface it to an operator instead.
How do I know a new operation is safe to adopt? When it appears in the changelog as a production release and your tenant is approved for it.
Was this page helpful?
Authentication
Authenticate Reports API machine clients with OAuth client credentials and understand why human operational sessions are a separate, non-substitutable surface.
Exchange one tenant-bound client credential for a short-lived bearer token.
Exchange one tenant-bound client credential for a short-lived bearer token. Review the documented request, response, authorization, and availability requirements before using this operation.