> ## Documentation Index
> Fetch the complete documentation index at: https://developer.secfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Versioning & deprecation

> How the API is versioned and how retiring endpoints are signalled.

## URL versioning

The API is versioned in the URL. All v1 endpoints live under `/v1` (and the token endpoint under
`/oauth`). A future major version would be served under a new prefix (`/v2`), leaving `/v1` intact.

## Backward compatibility

Within `/v1` we make **additive, non-breaking** changes freely — new endpoints, new optional
request fields, and new response fields. Every change to the API is checked by an automated
breaking-change gate against the published contract, so a backward-incompatible change to `/v1`
cannot ship by accident.

Breaking changes include: removing an endpoint, removing or renaming a field, narrowing a type, or
making a previously optional request field required.

## Deprecation signals

When an endpoint is eventually retired, it advertises it with standard
[RFC 8594](https://datatracker.ietf.org/doc/html/rfc8594) response headers before removal:

| Header                  | Meaning                                                |
| ----------------------- | ------------------------------------------------------ |
| `Deprecation`           | `true` — the endpoint is deprecated.                   |
| `Sunset`                | The date after which the endpoint may stop responding. |
| `Link` (`rel="sunset"`) | A link to migration guidance.                          |

No v1 endpoint is deprecated today. Watch for these headers and migrate before the `Sunset` date.