# Changelog A timeline of every change to the public API, newest first. Auto-generated from the OpenAPI spec via [`oasdiff`](https://github.com/oasdiff/oasdiff). > **ℹ️ What counts as a change** **Breaking** — removing an operation or field, tightening a constraint, or otherwise changing a contract in a way that may force existing callers to update. Surfaced in a red callout below. **Non-breaking** — adding an optional field or new operation, broadening a constraint, or annotating an existing operation. Safe for callers to ignore until they want the new capability. ## ⚠️ October 2, 2026 *1 change · 1 breaking, 0 non-breaking* > **⚠️ Breaking changes** **📥 `GET` `/public/v1/vendors/{id}/portfolios`** - api path removed without deprecation ## ⚠️ October 2, 2026 *4 changes · 4 breaking, 0 non-breaking* > **⚠️ Breaking changes** **📥 `GET` `/public/v1/audit-logs`** - api path removed without deprecation **📤 `POST` `/public/v1/observations/actions/requests/new`** - api path removed without deprecation **📤 `POST` `/public/v1/questionnaires/{questionnaireId}/send`** - api path removed without deprecation **📤 `POST` `/public/v1/security-events/actions/remediation-requests`** - api path removed without deprecation ## ⚠️ October 1, 2026 *1 change · 1 breaking, 0 non-breaking* > **⚠️ Breaking changes** **📤 `POST` `/public/v1/observations/actions/requests/new`** - added the new required request property `contactsV3` ## October 1, 2026 *39 changes · 39 non-breaking* ### ✨ Non-breaking changes **📥 `GET` `/public/v1/audit-logs`** - endpoint added **📤 `POST` `/public/v1/avd/fourth-parties`** - endpoint added **📤 `POST` `/public/v1/avd/fourth-parties/groups`** - endpoint added **📤 `POST` `/public/v1/avd/fourth-parties/vendors`** - endpoint added **📤 `POST` `/public/v1/avd/vendors/summary`** - endpoint added **📤 `POST` `/public/v1/observations/actions`** - endpoint added **📤 `POST` `/public/v1/observations/actions/flag/groups`** - endpoint added **📤 `POST` `/public/v1/observations/actions/requests/new`** - endpoint added **📥 `GET` `/public/v1/observations/filter-options/values`** - endpoint added **📤 `POST` `/public/v1/observations/groups`** - endpoint added **📤 `POST` `/public/v1/observations/vendor-scores`** - endpoint added **📥 `GET` `/public/v1/observations/{orn}`** - endpoint added **📥 `GET` `/public/v1/questionnaire-templates`** - endpoint added **📥 `GET` `/public/v1/questionnaire-templates/{templateId}`** - endpoint added **📤 `POST` `/public/v1/questionnaires`** - endpoint added **📥 `GET` `/public/v1/questionnaires/{questionnaireId}`** - endpoint added **📤 `POST` `/public/v1/questionnaires/{questionnaireId}/send`** - endpoint added **📤 `POST` `/public/v1/security-events/actions`** - endpoint added **📤 `POST` `/public/v1/security-events/actions/remediation-requests`** - endpoint added **📤 `POST` `/public/v1/security-events/actions/vendor-response`** - endpoint added **📥 `GET` `/public/v1/security-events/event`** - endpoint added **📤 `POST` `/public/v1/security-events/feed`** - endpoint added **📤 `POST` `/public/v1/security-events/impacted-companies`** - endpoint added **📥 `GET` `/public/v1/security-events/vendor-detail`** - endpoint added **📤 `POST` `/public/v1/vendors`** - endpoint added **📤 `POST` `/public/v1/vendors/bulk-create`** - endpoint added **📤 `POST` `/public/v1/vendors/bulk-delete`** - endpoint added **📤 `POST` `/public/v1/vendors/bulk-import`** - endpoint added **📤 `POST` `/public/v1/vendors/bulk-offboard`** - endpoint added **📤 `POST` `/public/v1/vendors/create`** - endpoint added **📥 `GET` `/public/v1/vendors/groups`** - endpoint added **📤 `POST` `/public/v1/vendors/groups`** - endpoint added **📤 `POST` `/public/v1/vendors/groups/{id}/vendors`** - endpoint added **📤 `POST` `/public/v1/vendors/groups/{id}/vendors:remove`** - endpoint added **📥 `GET` `/public/v1/vendors/{id}`** - endpoint added **✏️ `PATCH` `/public/v1/vendors/{id}`** - endpoint added **📤 `POST` `/public/v1/vendors/{id}/offboard`** - endpoint added **📤 `POST` `/public/v1/vendors/{id}/onboard`** - endpoint added **📥 `GET` `/public/v1/vendors/{id}/portfolios`** - endpoint added ## September 29, 2026 *3 changes · 3 non-breaking* ### ✨ Non-breaking changes **📤 `POST` `/public/v1/observations`** - added the non-success response with the status `404` **📤 `POST` `/public/v1/observations/actions/flag`** - added the non-success response with the status `409` - added the non-success response with the status `503` ## ⚠️ September 13, 2026 *7 changes · 3 breaking, 4 non-breaking* > **⚠️ Breaking changes** **📤 `POST` `/public/v1/observations`** - the response`s body type/format changed from ``/`` to `object`/`` for status `400' - the response`s body type/format changed from ``/`` to `object`/`` for status `401' - the response`s body type/format changed from ``/`` to `object`/`` for status `403' ### ✨ Non-breaking changes **(spec-level)** - removed the schema `Status` **📤 `POST` `/public/v1/observations`** - added the required property `error` to the response with the `400` status - added the required property `error` to the response with the `401` status - added the required property `error` to the response with the `403` status ## September 3, 2026 *2 changes · 2 non-breaking* ### ✨ Non-breaking changes **(spec-level)** - removed the schema `PublicCompanyContact` - removed the schema `PublicContact` ## August 26, 2026 *1 change · 1 non-breaking* ### ✨ Non-breaking changes **(spec-level)** - removed the schema `File`