# AgentReady API deprecation policy

The versioned public REST API is the compatibility contract for integrations. New clients should use `/api/v1/scan` and `/api/v1/report`; `/api/scan` is retained as a compatibility alias.

Before retiring a version, AgentReady will:

1. Publish the proposed retirement and replacement in the developer documentation and this policy.
2. Give at least 180 days' notice unless a security, legal, or provider emergency requires a shorter window.
3. Return `Deprecation: true`, a `Sunset` HTTP date, and a successor `Link` header while the version is in its retirement window.
4. Keep the OpenAPI description and machine-readable API catalog aligned with the current status.

Deprecation does not mean that an endpoint is unavailable today. A sunset date is an expectation, not a guarantee that a provider or target website will remain reachable. Public scan and report responses are best-effort observations, not certifications or guarantees.

The public scan and report surfaces currently read public URLs and saved public report data without authentication. Future protected resources may require narrowly scoped authorization; clients must not assume that a future authenticated feature grants access to private projects or delegated write actions.