Trust & methodology
How Deprecast detects API changes
Every primary alert shows a trust receipt: source, method, and freshness. This page explains what those fields mean — and what we deliberately do not do.
What we watch
- OpenAPI diff — where a vendor publishes a machine-readable OpenAPI (or equivalent) spec, we snapshot and diff successive versions for removed paths, methods, required fields, and other breaking schema moves.
- Changelog — where vendors publish RSS/Atom or HTML changelogs, we fetch public feeds and classify entries for deprecation, sunset, and breaking language.
- Manual/curated — rare curated notices when a public feed is not yet wired; always labeled as such on the receipt.
What we do not do
- No customer API keys — we never ask for or store your production vendor credentials.
- No traffic sniffing, APM agents, or gateway mirrors of your runtime calls.
- We do not claim to see private / authenticated-only vendor docs behind your account.
Critical-only surfaces
Public radar, digests, and the default dashboard event stream filter to actionable API risk: deprecations, sunsets, removals, and breaking changes. Pure additive “new feature” notes are dropped so the feed stays operator-grade.
Severity chips (urgent vs digest) reflect how loud we think the signal should be — urgency is not a confidence score.
Reading a trust receipt
- Source
- Link to the vendor changelog, spec, or docs page when we have one. If missing, we say “Source unavailable” instead of hiding the field.
- Method
- How the change was detected: OpenAPI diff, Changelog, or Manual/curated.
- Freshness
- Prefer the vendor’s published release time when known; otherwise “First seen” when Deprecast first recorded the event. We do not invent clock precision the source did not provide.
Cadence, false positives, silence
- Fetch cadence is best-effort continuous monitoring — not a contractual SLA on Free or Indie.
- Silence can mean “nothing broke” or “source paused / fetch error.” Per-vendor scan health detail is a P1 follow-up; today, empty radar states say so honestly.
- Dashboard thumbs up/down (with optional reason chips) let you mark signal quality per event without removing a vendor from the watchlist.
- Labeled sample / demo events are for empty-stream onboarding only — never mixed in as live detections without a badge.