feat: API v3 (alpha) — parallel /api/v3-alpha/ with slim refs, expand, and a tested query-count contract#15304

Draft

valentijnscholten wants to merge 35 commits into

devfrom

feature/api-v3-alpha

Commits on Jul 21, 2026

feat(api-v3): OS1 - kernel, findings read path, consolidated import (alpha)
valentijnscholten
committed
feat(api-v3): OS2 - kernel hardening
valentijnscholten
committed
feat(api-v3): OS3a - product_type, product, user CRUD
valentijnscholten
committed
feat(api-v3): OS3b - engagement/test CRUD + finding writes via service layer
valentijnscholten
committed
test(api-v3): whole-surface N+1 query sweep + report harness
valentijnscholten
committed
feat(api-v3): OS4 - locations resource + edge sub-resources
valentijnscholten
committed
feat(api-v3): OS5 - generic notes/tags/files sub-resources
valentijnscholten
committed
feat(api-v3): OS6 - verification sweep, docs, examples, benchmark
valentijnscholten
committed
docs(api-v3): finding write-path divergence analysis + fix proposal
valentijnscholten
committed
feat(api-v3): note side-effect parity + D17 delete JIRA-sync fix
valentijnscholten
committed
feat(api-v3): link v3 API docs from the profile menu
valentijnscholten
committed
feat(api-v3): D11 - rename wire surface to organizations/assets
valentijnscholten
committed
docs(api-v3): explain DRF boundary adapter + hand-declared DTO rationale
valentijnscholten
committed
test(api-v3): deny-by-default authz sweep + structural tripwire
valentijnscholten
committed
feat(api-v3): ?fields= opts lists up into detail fields + defer optimization
valentijnscholten
committed
docs(api-v3): implementation plan + combined debrief
valentijnscholten
committed
feat(api-v3): remove background import param and async-import references
valentijnscholten
committed
feat(api-v3): PUT (full replace) on the six writable resources
valentijnscholten
committed
feat(api-v3): cursor (keyset) pagination mode
valentijnscholten
committed
feat(api-v3): CSV export from the filter contract
valentijnscholten
committed
test(api-v3): port the v2 import/reimport corpus via dual-endpoint shim
valentijnscholten
committed
test(api-v3): JIRA push flow ports + v2 test-corpus disposition table
valentijnscholten
committed
docs(api-v3): record v2-sunset prerequisites for the test corpus
valentijnscholten
committed
feat(api-v3): FindingSlim carries vulnerability_ids and cwes
valentijnscholten
committed
feat(api-v3): TestDetail exposes dedupe matching policy (read-only)
valentijnscholten
committed
feat(api-v3): Scalar API reference via pinned CDN + SRI; record D7 decision
valentijnscholten
committed
feat(api-v3): accept a cwes list on finding writes
valentijnscholten
committed
feat(api-v3): serve Scalar from image-built static files, not CDN
valentijnscholten
committed
feat(api-v3): profile menu links both v3 docs UIs; rename v2 docs label
valentijnscholten
committed
feat(api-v3): docs menu entries in the classic UI template too
valentijnscholten
committed
fix(api-v3): non-superuser cannot change another user's email/username
valentijnscholten
committed
docs(api-v3): refresh captured examples for cursor/CSV/PUT/cwes
valentijnscholten
committed
test(api-v3): skip v3 tests when V3_FEATURE_LOCATIONS is off
valentijnscholten
committed
docs(api-v3): backlog TODO for a ref-registry completeness guard test
valentijnscholten
committed
fix(api-v3): point problem+json type URIs at a resolvable docs anchor
valentijnscholten
committed