# SHAPI

> SHAPI finds the code that breaks when a third-party API changes (a renamed field, a new status code, a retired version or model), and fixes it test-first: it writes a contract test that fails before the fix and passes after, and opens a pull request.

Advisories are open data (CC BY 4.0). Each lists the endpoint, what changed, the effective date, and what to do.

## Docs

- [FAQ](https://shapi.dev/faq): Common questions about SHAPI: languages, providers, pull request limits, AI and licensing.
- [Coding agents (MCP)](https://shapi.dev/guide/agents): Use SHAPI from Claude Code, Cursor and other coding agents, through the CLI or the MCP server.
- [Signed attestations](https://shapi.dev/guide/attestations): Signed attestations on SHAPI fix PRs: the test result and the fix, over the files the PR changes, made with actions/attest and checked with gh attestation verify.
- [CLI reference](https://shapi.dev/guide/cli): Every shapi-cli command, option, exit code and environment variable.
- [Fix tiers](https://shapi.dev/guide/fix-tiers): How far SHAPI trusts its fixes for each recipe, provider and kind of change, and the benchmark runs that earned it.
- [How fixes are verified](https://shapi.dev/guide/fixes): How SHAPI checks a fix in a sandbox: a contract test where one can run the code, and a rescan where it can't.
- [GitHub App](https://shapi.dev/guide/github-app): What the SHAPI GitHub App does on each push, the permissions it asks for, its pull request limits, and plans.
- [How SHAPI works](https://shapi.dev/guide/how-it-works): How SHAPI maps your third-party API calls into an api.lock, matches them against advisories, and fixes what breaks.
- [Quickstart](https://shapi.dev/guide/quickstart): Scan a repository for the code a third-party API change breaks, then fix it test-first. Two commands, no account.
- [Traffic sensor (experimental)](https://shapi.dev/guide/sensor): SHAPI's experimental traffic sensor for Node and Python: what it sends (field names and types, never values), dry run, turning it on, and the three-account rule.
- [Spec churn index](https://shapi.dev/guide/spec-churn): How often each API provider's OpenAPI spec changes in a way that breaks clients, measured over the full history of the APIs.guru directory.
- [Security and code handling](https://shapi.dev/security): What SHAPI reads, runs and stores when it scans and fixes your code, and how customers are kept apart.

## Advisories by provider

- [Anthropic](https://shapi.dev/api/v1/providers/anthropic.json): 2 advisories, as JSON
- [GitHub](https://shapi.dev/api/v1/providers/github.json): 1 advisory, as JSON
- [Google APIs](https://shapi.dev/api/v1/providers/google.json): 2 advisories, as JSON
- [Google Gemini API](https://shapi.dev/api/v1/providers/google-gemini.json): 6 advisories, as JSON
- [HubSpot](https://shapi.dev/api/v1/providers/hubspot.json): 5 advisories, as JSON
- [Meta Graph API](https://shapi.dev/api/v1/providers/meta-graph.json): 11 advisories, as JSON
- [OpenAI](https://shapi.dev/api/v1/providers/openai.json): 8 advisories, as JSON
- [QuickBooks Online](https://shapi.dev/api/v1/providers/quickbooks.json): 3 advisories, as JSON
- [Reddit](https://shapi.dev/api/v1/providers/reddit.json): 1 advisory, as JSON
- [Salesforce](https://shapi.dev/api/v1/providers/salesforce.json): 3 advisories, as JSON
- [Shopify](https://shapi.dev/api/v1/providers/shopify.json): 24 advisories, as JSON
- [Slack](https://shapi.dev/api/v1/providers/slack.json): 1 advisory, as JSON
- [Stripe](https://shapi.dev/api/v1/providers/stripe.json): 5 advisories, as JSON
- [Twilio](https://shapi.dev/api/v1/providers/twilio.json): 4 advisories, as JSON
- [X (Twitter)](https://shapi.dev/api/v1/providers/x.json): 3 advisories, as JSON
- [Xero](https://shapi.dev/api/v1/providers/xero.json): 8 advisories, as JSON
- [All effective dates](https://shapi.dev/deadlines.ics): iCalendar

## Advisories

- [anthropic-version 2026-10-21 rejects temperature, top_p and top_k with 400](https://shapi.dev/advisories/anthropic-api-version-2026-10-21-sampling-params-400.md): Anthropic, effective 2026-10-21, verified
- [Claude Sonnet 4.5 retires on 2026-11-30](https://shapi.dev/advisories/anthropic-claude-sonnet-4-5-retirement.md): Anthropic, effective 2026-11-30, verified
- [workflow_dispatch returns 200 with a body instead of 204](https://shapi.dev/advisories/github-workflow-dispatch-204-to-200.md): GitHub, effective 2025-12-19, verified
- [Google Ads API v22 sunset on 2026-10-07](https://shapi.dev/advisories/google-ads-api-v22-sunset.md): Google APIs, effective 2026-10-07, verified
- [Custom Search JSON API discontinued on 2027-01-01](https://shapi.dev/advisories/google-custom-search-json-api-shutdown.md): Google APIs, effective 2027-01-01, verified
- [gemini-2.0-flash and gemini-2.0-flash-lite shut down on 2026-06-01](https://shapi.dev/advisories/google-gemini-2-0-flash-shutdown.md): Google Gemini API, effective 2026-06-01, verified
- [gemini-2.0-flash and gemini-2.0-flash-lite shut down on 2026-06-01 (model in the request body)](https://shapi.dev/advisories/google-gemini-2-0-flash-shutdown-sdk.md): Google Gemini API, effective 2026-06-01, verified
- [gemini-2.5-flash-image shuts down on 2027-03-15](https://shapi.dev/advisories/google-gemini-2-5-flash-image-shutdown.md): Google Gemini API, effective 2027-03-15, verified
- [gemini-2.5-flash-image shuts down on 2027-03-15 (model in the request body)](https://shapi.dev/advisories/google-gemini-2-5-flash-image-shutdown-sdk.md): Google Gemini API, effective 2027-03-15, verified
- [Gemini 2.5 preview TTS models shut down on 2026-11-17](https://shapi.dev/advisories/google-gemini-2-5-preview-tts-shutdown.md): Google Gemini API, effective 2026-11-17, verified
- [Gemini 2.5 preview TTS models shut down on 2026-11-17 (model in the request body)](https://shapi.dev/advisories/google-gemini-2-5-preview-tts-shutdown-sdk.md): Google Gemini API, effective 2026-11-17, verified
- [Contact Lists API v1 retired on 2026-04-30; endpoints return 404](https://shapi.dev/advisories/hubspot-contact-lists-v1-sunset.md): HubSpot, effective 2026-04-30, verified
- [v1 contact read endpoints stopped returning list memberships on 2026-04-30](https://shapi.dev/advisories/hubspot-contacts-v1-list-memberships-removed.md): HubSpot, effective 2026-04-30, verified
- [Marketing Email v3 stopped returning folderId on 2026-01-28](https://shapi.dev/advisories/hubspot-marketing-emails-folderid-removed.md): HubSpot, effective 2026-01-28, verified
- [Marketing Email API v1 sunset on 2025-11-01](https://shapi.dev/advisories/hubspot-marketing-emails-v1-sunset.md): HubSpot, effective 2025-11-01, verified
- [Pipelines API v1 retired on 2026-12-04](https://shapi.dev/advisories/hubspot-pipelines-v1-sunset.md): HubSpot, effective 2026-12-04, verified
- [Commerce Order Management API removed on all versions on 2026-10-27](https://shapi.dev/advisories/meta-graph-commerce-order-management-removed.md): Meta Graph API, effective 2026-10-27, verified
- [date_format query parameter returns an error from 2026-10-27](https://shapi.dev/advisories/meta-graph-date-format-param-removed.md): Meta Graph API, effective 2026-10-27, verified
- [Delivery Estimate drops daily_outcomes_curve, budget_guardrail and estimate_dau](https://shapi.dev/advisories/meta-graph-delivery-estimate-fields-removed.md): Meta Graph API, effective 2026-10-27, verified
- [oEmbed responses no longer return author and thumbnail fields](https://shapi.dev/advisories/meta-graph-instagram-oembed-fields-removed.md): Meta Graph API, effective 2025-11-03, verified
- [Marketing API v24.0 available until 2026-11-10](https://shapi.dev/advisories/meta-graph-marketing-api-v24-sunset.md): Meta Graph API, effective 2026-11-10, verified
- [Marketing API v25.0 available until 2027-02-23](https://shapi.dev/advisories/meta-graph-marketing-api-v25-sunset.md): Meta Graph API, effective 2027-02-23, verified
- [Page Insights impressions and page fans metrics removed on 2025-11-15](https://shapi.dev/advisories/meta-graph-page-insights-impressions-fans-removed.md): Meta Graph API, effective 2025-11-15, verified
- [Page Insights reach and 3-second video viewer metrics removed on 2026-06-15](https://shapi.dev/advisories/meta-graph-page-insights-reach-video-views-removed.md): Meta Graph API, effective 2026-06-15, verified
- [Root GET /?ids= multi-object lookup returns an error from 2026-10-27](https://shapi.dev/advisories/meta-graph-root-ids-lookup-removed.md): Meta Graph API, effective 2026-10-27, verified
- [Graph API v20.0 removed; calls fall forward to the next version](https://shapi.dev/advisories/meta-graph-v20-sunset.md): Meta Graph API, effective 2026-09-24, verified
- [Graph API v21.0 removed on 2027-01-21](https://shapi.dev/advisories/meta-graph-v21-sunset.md): Meta Graph API, effective 2027-01-21, verified
- [Assistants API removed on 2026-08-26](https://shapi.dev/advisories/openai-assistants-api-shutdown.md): OpenAI, effective 2026-08-26, verified
- [Assistants API threads, messages and runs removed on 2026-08-26](https://shapi.dev/advisories/openai-assistants-threads-api-shutdown.md): OpenAI, effective 2026-08-26, verified
- [/v1/audio/translations shuts down on 2027-02-26](https://shapi.dev/advisories/openai-audio-translations-endpoint-shutdown.md): OpenAI, effective 2027-02-26, verified
- [Evals API shuts down on 2026-11-30](https://shapi.dev/advisories/openai-evals-api-shutdown.md): OpenAI, effective 2026-11-30, verified
- [gpt-4o, gpt-4o-mini, gpt-4.1 and gpt-4.1-mini snapshots shut down on 2027-01-14](https://shapi.dev/advisories/openai-gpt-4o-gpt-4-1-snapshots-shutdown-2027-01-14.md): OpenAI, effective 2027-01-14, verified
- [gpt-4o, gpt-4o-mini, gpt-4.1 and gpt-4.1-mini snapshots shut down on 2027-01-14 (Responses API)](https://shapi.dev/advisories/openai-gpt-4o-gpt-4-1-snapshots-shutdown-2027-01-14-responses.md): OpenAI, effective 2027-01-14, verified
- [gpt-3.5-turbo, gpt-4, gpt-4-turbo, o1, o3-mini and o4-mini shut down on 2026-10-23](https://shapi.dev/advisories/openai-legacy-gpt-o-series-shutdown-2026-10-23.md): OpenAI, effective 2026-10-23, verified
- [gpt-3.5-turbo, gpt-4, gpt-4-turbo, o1, o3-mini and o4-mini shut down on 2026-10-23 (Responses API)](https://shapi.dev/advisories/openai-legacy-gpt-o-series-shutdown-2026-10-23-responses.md): OpenAI, effective 2026-10-23, verified
- [CompanyInfo no longer returns the NeoEnabled NameValue](https://shapi.dev/advisories/quickbooks-companyinfo-neoenabled-removed.md): QuickBooks Online, effective 2026-01-27, verified
- [Minor versions below 75 are silently answered as minor version 75](https://shapi.dev/advisories/quickbooks-minorversion-below-75-ignored.md): QuickBooks Online, effective 2025-08-01, verified
- [Refresh tokens hard-expire after five years, first ones in February 2027](https://shapi.dev/advisories/quickbooks-refresh-token-five-year-hard-expiry.md): QuickBooks Online, effective 2027-02-01, verified
- [Logged-out .json endpoints return 403](https://shapi.dev/advisories/reddit-logged-out-json-403.md): Reddit, effective 2026-05-30, unverified
- [SOAP login() from a broad IP range needs a security token from 2026-12-15](https://shapi.dev/advisories/salesforce-soap-login-broad-ip-range-token-required.md): Salesforce, effective 2026-12-15, verified
- [SOAP login() turned off in orgs with no use in six months, from 2026-12-15](https://shapi.dev/advisories/salesforce-soap-login-disabled-when-unused.md): Salesforce, effective 2026-12-15, verified
- [SOAP login() requires the Use Any API Auth permission from 2026-12-01](https://shapi.dev/advisories/salesforce-soap-login-use-any-api-auth-required.md): Salesforce, effective 2026-12-01, verified
- [Shopify Admin API version 2026-01 becomes unsupported on 2027-01-16](https://shapi.dev/advisories/shopify-admin-api-2026-01-unsupported.md): Shopify, effective 2027-01-16, verified
- [Shopify Admin API version 2026-04 becomes unsupported on 2027-04-16](https://shapi.dev/advisories/shopify-admin-api-2026-04-unsupported.md): Shopify, effective 2027-04-16, verified
- [Shopify removes the automaticDiscounts query in API version 2027-01](https://shapi.dev/advisories/shopify-automatic-discounts-query-removed.md): Shopify, effective 2027-01-01, unverified
- [Shopify carrierServiceCreate no longer adds the carrier service to the General shipping profile, as of 2026-10](https://shapi.dev/advisories/shopify-carrier-service-not-added-to-default-profile.md): Shopify, effective 2026-10-01, unverified
- [Shopify removes the metafieldInteger collection condition in API version 2027-01](https://shapi.dev/advisories/shopify-collection-metafield-integer-condition-removed.md): Shopify, effective 2027-01-01, unverified
- [Shopify customerPaymentMethodRemoteCreate requires a payment method identifier as of 2026-07](https://shapi.dev/advisories/shopify-customer-payment-method-remote-create-identifier-required.md): Shopify, effective 2026-07-01, unverified
- [Shopify shipping options move to rateGroups; rateProvider and methodConditions are legacy](https://shapi.dev/advisories/shopify-delivery-method-definition-rate-groups.md): Shopify, effective 2026-02-24, unverified
- [Shopify removes priceRule from DraftOrderDiscountNotAppliedWarning in API version 2026-10](https://shapi.dev/advisories/shopify-draft-order-warning-price-rule-removed.md): Shopify, effective 2026-10-01, unverified
- [Shopify Global Catalog REST API stops serving traffic on 2026-11-02](https://shapi.dev/advisories/shopify-global-catalog-rest-api-shutdown.md): Shopify, effective 2026-11-02, verified
- [Shopify inventoryActivate keeps existing quantities instead of resetting them to zero, as of 2026-04](https://shapi.dev/advisories/shopify-inventory-activate-preserves-quantities.md): Shopify, effective 2026-04-01, unverified
- [Shopify removes the inventorySetScheduledChanges mutation in API version 2026-07](https://shapi.dev/advisories/shopify-inventory-set-scheduled-changes-removed.md): Shopify, effective 2026-07-01, unverified
- [Shopify removes the marketCurrencySettingsUpdate mutation in API version 2027-01](https://shapi.dev/advisories/shopify-market-currency-settings-update-removed.md): Shopify, effective 2027-01-01, unverified
- [Shopify deprecates the PRIVATE and PUBLIC_READ metaobject admin access values](https://shapi.dev/advisories/shopify-metaobject-admin-access-private-public-read-removed.md): Shopify, effective 2027-01-01, unverified
- [Shopify rejects non-expiring offline access tokens from public apps on 2027-01-01](https://shapi.dev/advisories/shopify-non-expiring-offline-tokens-rejected.md): Shopify, effective 2027-01-01, verified
- [Shopify OrderDisplayFulfillmentStatus can return FULFILLMENT_NOT_REQUIRED as of 2026-10](https://shapi.dev/advisories/shopify-order-display-fulfillment-status-not-required.md): Shopify, effective 2026-10-01, unverified
- [Shopify fixes OrderTransaction.totalUnsettledSet for pending captures](https://shapi.dev/advisories/shopify-order-transaction-total-unsettled-fixed.md): Shopify, effective 2026-04-24, unverified
- [Shopify orderUpdate recalculates taxes when an unfulfilled order's shipping address changes, as of 2026-10](https://shapi.dev/advisories/shopify-order-update-shipping-address-recalculates-taxes.md): Shopify, effective 2026-10-01, unverified
- [Shopify's REST carrier service creation no longer adds it to the General shipping profile, as of 2026-10](https://shapi.dev/advisories/shopify-rest-carrier-service-not-added-to-default-profile.md): Shopify, effective 2026-10-01, unverified
- [Shopify's REST inventory_levels/connect keeps existing quantities instead of resetting them, as of 2026-04](https://shapi.dev/advisories/shopify-rest-inventory-connect-preserves-quantities.md): Shopify, effective 2026-04-01, unverified
- [Shopify removes pre_tax_price from REST order line items](https://shapi.dev/advisories/shopify-rest-order-line-item-pre-tax-price-removed.md): Shopify, effective 2026-03-23, unverified
- [Shopify's REST order update recalculates taxes when an unfulfilled order's shipping address changes, as of 2026-10](https://shapi.dev/advisories/shopify-rest-order-update-shipping-address-recalculates-taxes.md): Shopify, effective 2026-10-01, unverified
- [Shopify script tags stop running on storefronts on 2027-03-01](https://shapi.dev/advisories/shopify-script-tags-stop-running.md): Shopify, effective 2027-03-01, verified
- [Shopify segment query functions use MATCHES instead of = true as of API version 2026-10](https://shapi.dev/advisories/shopify-segment-query-function-syntax.md): Shopify, effective 2026-10-01, unverified
- [Shopify Tax managed mode rejects market and publishing writes that conflict with it](https://shapi.dev/advisories/shopify-tax-managed-mode-write-validation.md): Shopify, effective 2027-01-01, unverified
- [files.upload Web API method sunset on 2025-11-12](https://shapi.dev/advisories/slack-files-upload-retired.md): Slack, effective 2025-11-12, verified
- [Stripe 2026-03-25.dahlia renames Checkout Session ui_mode values](https://shapi.dev/advisories/stripe-checkout-session-ui-mode-values-renamed.md): Stripe, effective 2026-03-25, verified
- [Stripe 2026-09-30.endive requires an object for billing_cycle_anchor on subscription updates](https://shapi.dev/advisories/stripe-endive-billing-cycle-anchor-object.md): Stripe, effective 2026-09-30, unverified
- [Stripe 2026-09-30.endive removes payment_method_types from Checkout Session creation](https://shapi.dev/advisories/stripe-endive-checkout-session-payment-method-types-removed.md): Stripe, effective 2026-09-30, unverified
- [Stripe 2026-09-30.endive removes payment_method_types from Payment Intent create, update and confirm](https://shapi.dev/advisories/stripe-endive-payment-intent-payment-method-types-removed.md): Stripe, effective 2026-09-30, unverified
- [Stripe 2026-09-30.endive removes payment_method_types from Setup Intent create and update](https://shapi.dev/advisories/stripe-endive-setup-intent-payment-method-types-removed.md): Stripe, effective 2026-09-30, unverified
- [Twilio Conference list returns only in-progress conferences by default from 2026-09-30](https://shapi.dev/advisories/twilio-conference-list-default-in-progress.md): Twilio, effective 2026-09-30, verified
- [Twilio Notify reaches end of life on 2027-01-31](https://shapi.dev/advisories/twilio-notify-end-of-life.md): Twilio, effective 2027-01-31, verified
- [Twilio RCS unconfirmed-delivery error code changed from 30036 to 30046](https://shapi.dev/advisories/twilio-rcs-undelivered-error-code-30046.md): Twilio, effective 2026-08-10, verified
- [Twilio Voice Insights Call Summary drops attributes.conference_participant on 2026-08-01](https://shapi.dev/advisories/twilio-voice-insights-conference-participant-removed.md): Twilio, effective 2026-08-01, verified
- [X Activity API event types renamed from PascalCase to dot-separated lowercase](https://shapi.dev/advisories/x-activity-api-pascalcase-event-types-removed.md): X (Twitter), effective 2026-03-18, verified
- [Following users removed from X API self-serve tiers](https://shapi.dev/advisories/x-self-serve-follow-writes-removed.md): X (Twitter), effective 2026-04-16, verified
- [Liking Posts removed from X API self-serve tiers](https://shapi.dev/advisories/x-self-serve-like-writes-removed.md): X (Twitter), effective 2026-04-16, verified
- [Broad accounting.transactions scope replaced by granular scopes](https://shapi.dev/advisories/xero-accounting-transactions-scope-split.md): Xero, effective 2027-09-13, verified
- [Allocations between documents of different contacts are rejected](https://shapi.dev/advisories/xero-allocations-contact-mismatch-rejected.md): Xero, effective 2026-10-08, verified
- [AU Payroll pay item and earnings rate writes require IsQualifyingEarnings](https://shapi.dev/advisories/xero-au-payroll-isqualifyingearnings-required.md): Xero, effective 2026-09-10, verified
- [AU Payroll pay item and earnings rate writes require IsQualifyingEarnings (v2 earningsRates)](https://shapi.dev/advisories/xero-au-payroll-isqualifyingearnings-required-earningsrates.md): Xero, effective 2026-09-10, verified
- [Finance API Accounting Activities endpoints decommissioned](https://shapi.dev/advisories/xero-finance-accounting-activities-decommissioned.md): Xero, effective 2026-05-04, verified
- [Invoice email daily limit returns 429 instead of 500 from 2027-01-14](https://shapi.dev/advisories/xero-invoices-email-daily-limit-429.md): Xero, effective 2027-01-14, verified
- [NZ Payroll employee tax requests without KiwiSaverStatus return 400 from 2026-11-05](https://shapi.dev/advisories/xero-nz-payroll-employee-tax-kiwisaverstatus-required.md): Xero, effective 2026-11-05, verified
- [Organisation Class enum gains ULTRA](https://shapi.dev/advisories/xero-organisation-class-ultra-enum.md): Xero, effective 2026-06-30, verified