{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:f94358e3c57b6e575ca58c8031b9b7552cbfdb411f937b8ecdc3b042c4980a77", "snapshot_id": "sha256:0679a3f0d41c0733e76d10ab3fb1b331811893c7d428749740ec0f21ac731d3e", "artifact_sha256": "sha256:7472396c2449279d33e7a0fb2426f02a89991501262d1db8c04c81d57bdf9021", "data": { "entity_id": "ent_01kyxthgq3w0q894h0tadvr0cq", "entity_slug": "sentry", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01kzf0m4xh9j6rz3b1v8mp5td2", "entity_id": "ent_01kyxthgq3w0q894h0tadvr0cq", "scope": { "product": { "key": "sentry-web-api", "name": "Sentry Web API" }, "funnel": { "key": "issue-operations", "name": "Issue and project operations" } }, "catalog_binding": { "base_release_id": "sha256:cad9f851ab1bb553246eb2fb2b2803a4741814a33ccf28997014247439b9013d", "entity_revision_digest": "sha256:0acca7e30e16523f5718208ac027acb0b1b432e023c6310e1ae7161a05b6f422" }, "declaration_revision_digest": "sha256:df394c8bad741315c50fa635b608e071d5022d3f32281d60b6cc623c53012a5c", "declaration": { "declaration_id": "declaration_sentry_api_issue_operations", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "62b512f0c49352e55a399ba53866a5effa431d71", "path": "vendors/se/sentry.yaml", "git_blob_oid": "5afa8b37e840e0b23cff9c7368437e5944aa3ec3", "blob_digest": "sha256:b4021b863ee3fef9ba7bb4dcd08ff5f958446a3d84f13ec0b1dc0ef9711d3f57" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Create projects and manage issues through the Sentry Web API", "interface_ids": [ "issue-api" ] } ], "participants": [ { "participant_id": "sentry", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyxthgq3w0q894h0tadvr0cq" } } ], "resources": [ { "resource_id": "account-signup", "uri": "https://sentry.io/signup/", "roles": [ "access" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "api-reference", "uri": "https://docs.sentry.io/api/", "roles": [ "discovery", "documentation", "operations" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "authentication", "uri": "https://docs.sentry.io/api/auth/", "roles": [ "authentication", "descriptor", "documentation", "provisioning" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "issue-operations", "uri": "https://docs.sentry.io/api/events/", "roles": [ "documentation", "operations", "status" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "permissions", "uri": "https://docs.sentry.io/api/permissions/", "roles": [ "descriptor", "documentation", "operations" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "pricing", "uri": "https://sentry.io/pricing/", "roles": [ "checkout", "documentation", "pricing" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "project-provisioning", "uri": "https://docs.sentry.io/api/projects/create-a-new-project/", "roles": [ "documentation", "operations", "provisioning", "status" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "rate-limits", "uri": "https://docs.sentry.io/api/ratelimits/", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "self-service-plan", "uri": "https://www.sentry.help/en/articles/13965054-can-i-get-a-quote-for-sentry", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "service-terms", "uri": "https://sentry.io/terms/", "roles": [ "terms" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "support", "uri": "https://sentry.zendesk.com/hc/en-us", "roles": [ "documentation", "recovery" ], "operated_by_participant_id": "sentry", "standard_bindings": [] } ], "endpoints": [ { "endpoint_id": "registration", "uri": "https://sentry.io/signup/", "transport": "http", "roles": [ "registration" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "endpoint_id": "sentry-api", "uri": "https://sentry.io/api/0", "transport": "http", "roles": [ "service", "status" ], "operated_by_participant_id": "sentry", "standard_bindings": [] } ], "interfaces": [ { "interface_id": "api-authentication", "modality": "network_api", "functions": [ "authentication" ], "endpoint_ids": [], "resource_ids": [ "authentication" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "interface_id": "issue-api", "modality": "network_api", "functions": [ "service_operation" ], "endpoint_ids": [ "sentry-api" ], "resource_ids": [ "api-reference", "issue-operations", "permissions", "project-provisioning", "rate-limits" ], "operated_by_participant_id": "sentry", "standard_bindings": [] } ], "relations": [ { "relation_id": "authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "api-authentication" }, "to": { "node_kind": "interface", "node_id": "issue-api" } }, { "relation_id": "issues-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "issue-operations" }, "to": { "node_kind": "interface", "node_id": "issue-api" } }, { "relation_id": "projects-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "project-provisioning" }, "to": { "node_kind": "interface", "node_id": "issue-api" } }, { "relation_id": "reference-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "api-reference" }, "to": { "node_kind": "interface", "node_id": "issue-api" } }, { "relation_id": "signup-precedes-authentication", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "account-signup" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } } ], "surface_exclusions": [ { "exclusion_id": "separate-eligibility-resource", "role": "eligibility", "rationale": "Applicable access conditions are published within the service terms; no separate eligibility resource is declared." } ] }, "lifecycle": "active", "effective_from": "2026-08-20T14:33:24.000Z", "revision_digest": "sha256:f4aed7a4224898cdac6d922746b24fee741bdbb2ea56678b0b2c5482385fd438", "policy_digest": "sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139", "policy_version": "service-use-2026-08-20-public-evidence-r9", "policy_as_of": "2026-08-20T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "fail", "public_state": "blocked", "state_label": "Blocked", "grade": "D", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect actual Blocked stages by lifecycle severity.", "coverage_rule": "Every core graded metric must have supported, fresh, non-conflicting evidence. Barrier checks constrain the report when verified and cap an otherwise higher grade at B+ while unverified.", "outcome_rule": "Each stage takes its worst core metric or verified barrier, and the overall grade is derived from the five stage states plus the explicit unverified-barrier cap." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "sign_up", "stage_label": "Sign up", "public_state": "blocked", "finding": { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "A mandatory CAPTCHA has no supported agent-safe route.", "context": "Sentry explicitly states that the registration form is protected by reCAPTCHA, and no supported agent-safe bypass is established in the admitted evidence." }, "blocker": { "signal_code": "captcha_compatible_access", "code": "sign_up.captcha_compatible_access", "explanation": "A mandatory CAPTCHA has no supported agent-safe route." } }, "first_blocked_stage": { "stage": "sign_up", "stage_label": "Sign up", "finding": { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "A mandatory CAPTCHA has no supported agent-safe route.", "context": "Sentry explicitly states that the registration form is protected by reCAPTCHA, and no supported agent-safe bypass is established in the admitted evidence." }, "blocker": { "signal_code": "captcha_compatible_access", "code": "sign_up.captcha_compatible_access", "explanation": "A mandatory CAPTCHA has no supported agent-safe route." } }, "limitations": [ { "stage": "sign_up", "stage_label": "Sign up", "finding": { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Only part of the access flow is operable or a bounded human step remains.", "context": "The signup page provides form fields for Name, Organization, Email, Password, and Data Storage Location with a submit button ('Get set up'), but it includes a reCAPTCHA notice ('This form is protected by reCAPTCHA'), leaving the initial account creation flow only partially operable for automated agents without human interaction." }, "remediation": { "signal_code": "access_control_operability", "code": "improve.sign_up.access_control_operability", "instruction": "Expose deterministic controls, validation, and resumable authorization handoffs." } }, { "stage": "pay", "stage_label": "Pay", "finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "context": "Sentry discloses recurring pricing for Team ($26/mo) and Business ($80/mo) plans along with pay-as-you-go error rates in USD, but notes that annual and prepaid billing options with additional discounts are available during checkout, leaving those discounted terms contextual." }, "remediation": { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Sentry documents rate limit enforcement (fixed window requests per second and concurrent limits) and response headers for limit tracking. However, explicit details on safe retries, idempotency semantics, request cancellation, or reconciliation are not fully provided in the captured evidence." }, "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Sentry documents access token expiration and token refresh operations via POST requests, as well as 401 error handling for expired or revoked tokens. However, the provided documentation does not detail complete agent-operable credential rotation, revocation endpoints, or recovery mechanisms." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "context": "The Sentry web API is publicly documented under v0, and stable base domain entrypoints are explicitly identified (e.g., sentry.io, us.sentry.io, and de.sentry.io)." }, "secondary_context": [ { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "context": "The Sentry Terms of Service (version 3.0.0, February 12, 2024) are stable, retrievable, and define the complete legal agreement governing use of the service." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "context": "Sentry's terms explicitly define material eligibility conditions, requiring that customers be at least 16 years old, hold necessary rights and consents for submitted data, and warrant that they are not on U.S. restricted party lists or located in embargoed countries." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "context": "Sentry explicitly discloses pricing tiers (Free Developer plan at $0, Team plan at $26/mo when billed annually, Business plan at $80/mo) and pay-as-you-go rates in USD for usage exceeding base quotas." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:56.185Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:522c87bb63ac8001c34fe82d8084b4c103d56ee2a3dac28ed7e3ac0c20e47504", "capture_rung": "http" } ], "artifact_digests": [ "sha256:bfccbb51fa3c024dec1055d958ce8235cd34b3dab530c45fb01c6b8977abc158", "sha256:cb15a518946e5f6a481ba5ceea201b54152759ec496a779d1edb6431492bef25", "sha256:cfe624af516690115e577b5aad3a8ff8a1bfc077098f48f77a79feb4453600ea", "sha256:d8c68496dcee213a4c71346180bea8ad7ef349b104c3e9490e05d6ddbcf19cac" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:cfe624af516690115e577b5aad3a8ff8a1bfc077098f48f77a79feb4453600ea", "start_byte": 17701, "end_byte": 18492, "value_digest": "sha256:506781e64b18fcd697d8a71f9ad0569c4cf610749869b27ec30e7ff951baee9a" }, { "artifact_digest": "sha256:cfe624af516690115e577b5aad3a8ff8a1bfc077098f48f77a79feb4453600ea", "start_byte": 40156, "end_byte": 40959, "value_digest": "sha256:e3f1e56b6405abf38b1ee03c251d5c51ef0e62ccbae396e052b5befa5030ff39" } ] } ], "note": "Sentry's terms explicitly define material eligibility conditions, requiring that customers be at least 16 years old, hold necessary rights and consents for submitted data, and warrant that they are not on U.S. restricted party lists or located in embargoed countries." }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:55:59.830Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c109a7136fda7e87ca4d9cc3b5e40d9cb9917ac88617da65d524164898ac0ca9", "capture_rung": "http" } ], "artifact_digests": [ "sha256:5a28ff29eb7a1917969e535263cdb5e3a6343eb7f2a1e343d6c35280ead2381c", "sha256:6ee0d56590b72ba4327aa692b6f5b0bc6eb8b4981135b882a78c7502a577127a", "sha256:84f9686b1d5a7beb91ddbf94ae199636403876754cc82a5584742695986c1953", "sha256:af803614bb8791d99a99c109bbf91e5ff38a41eff22e491560e1f403df769d72" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:84f9686b1d5a7beb91ddbf94ae199636403876754cc82a5584742695986c1953", "start_byte": 10091, "end_byte": 10889, "value_digest": "sha256:09589196c339019255440032eda3217eba8540b7ea6c5ed44937faa2fc046c55" }, { "artifact_digest": "sha256:84f9686b1d5a7beb91ddbf94ae199636403876754cc82a5584742695986c1953", "start_byte": 15680, "end_byte": 16485, "value_digest": "sha256:ef485c2205f1955aaf420d25060d68d1310d605605cfba83638a79c80d805267" } ] } ], "note": "Sentry explicitly discloses pricing tiers (Free Developer plan at $0, Team plan at $26/mo when billed annually, Business plan at $80/mo) and pay-as-you-go rates in USD for usage exceeding base quotas." }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:11.048Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-reference" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:45325e642b14062fdde5003c01db8be1db105209a01258ea044669dd1c0f441d", "capture_rung": "http" } ], "artifact_digests": [ "sha256:18cb99da16286a0e81f2b25f2ec2b84b8cc0bcf92f56bcf0b33cc94b65e1c223", "sha256:64c91ed500336db29f3b898a923dd158b24dc71d2c4d653558416de008ecf71d", "sha256:9af24c95d017b001878c84614a329c98965c001174e2b835401694849b039607", "sha256:e018477628f8313e9827fc3c655d44cb668807159993a59449af9ddf6ec79450" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:18cb99da16286a0e81f2b25f2ec2b84b8cc0bcf92f56bcf0b33cc94b65e1c223", "start_byte": 2021, "end_byte": 2819, "value_digest": "sha256:4eb255e37b88b093d846d13a1f0beb383c82818fb3ad8583f9b160b53f507c5d" }, { "artifact_digest": "sha256:18cb99da16286a0e81f2b25f2ec2b84b8cc0bcf92f56bcf0b33cc94b65e1c223", "start_byte": 2820, "end_byte": 3620, "value_digest": "sha256:290865711cee24bdeafd87c9db9a112c49d5b39df00b99b9f565f199246ef150" } ] } ], "note": "The Sentry web API is publicly documented under v0, and stable base domain entrypoints are explicitly identified (e.g., sentry.io, us.sentry.io, and de.sentry.io)." }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Are verified structured discovery artifacts available?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] }, { "signal_code": "terms_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:56.185Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:522c87bb63ac8001c34fe82d8084b4c103d56ee2a3dac28ed7e3ac0c20e47504", "capture_rung": "http" } ], "artifact_digests": [ "sha256:9043949c4d8b4439ed17d101425f142c6fafe0a7f63143fe231435560f3dbf20", "sha256:cb15a518946e5f6a481ba5ceea201b54152759ec496a779d1edb6431492bef25", "sha256:cfe624af516690115e577b5aad3a8ff8a1bfc077098f48f77a79feb4453600ea", "sha256:d8c68496dcee213a4c71346180bea8ad7ef349b104c3e9490e05d6ddbcf19cac" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:cfe624af516690115e577b5aad3a8ff8a1bfc077098f48f77a79feb4453600ea", "start_byte": 9707, "end_byte": 10504, "value_digest": "sha256:e4ed6663896450b56ad912700e926852026c43bd309eb2fa34b18398effbf73b" }, { "artifact_digest": "sha256:cfe624af516690115e577b5aad3a8ff8a1bfc077098f48f77a79feb4453600ea", "start_byte": 7274, "end_byte": 8098, "value_digest": "sha256:915700905f7cb6f419696442c822aba4d372e9176b8c332fa2e6f001da70fb55" } ] } ], "note": "The Sentry Terms of Service (version 3.0.0, February 12, 2024) are stable, retrievable, and define the complete legal agreement governing use of the service." }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] } ], "blockers": [], "remediations": [] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "fail", "public_state": "blocked", "state_label": "Blocked", "primary_finding": { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "A mandatory CAPTCHA has no supported agent-safe route.", "context": "Sentry explicitly states that the registration form is protected by reCAPTCHA, and no supported agent-safe bypass is established in the admitted evidence." }, "secondary_context": [ { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The listed form fields do not establish that downstream phone verification is absent." }, { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Only part of the access flow is operable or a bounded human step remains.", "context": "The signup page provides form fields for Name, Organization, Email, Password, and Data Storage Location with a submit button ('Get set up'), but it includes a reCAPTCHA notice ('This form is protected by reCAPTCHA'), leaving the initial account creation flow only partially operable for automated agents without human interaction." }, { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "context": "Sentry provides a stable, canonical self-service registration entrypoint at https://sentry.io/signup/ with options to sign up via account details or single sign-on providers like Google, GitHub, and Azure DevOps." }, { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "context": "Sentry supports delegated authorization via OAuth2 (authorization code grant) with defined scopes, refresh tokens, and a Device Authorization Flow (RFC 8628) for headless CLI and automated environments." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Only part of the access flow is operable or a bounded human step remains.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:52.386Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:9abe4424089f08de3698e9ad6ca9f4c5b5de64934c83ce6f04cc7fc8fcc391e0", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:05faa932f97e078417a860fa2d703967a7c5ca5b041e46a71eefa6b2dcb6e4c5", "sha256:1a637c8bddfdc50563fb6ae30bc31a209c9985ee6785ed4db39d9d0b7f2a0aaf", "sha256:613be4aa52d0ec141684ceef57ecf40312882a8e5f1506026236ad6b71e98e8e", "sha256:759435422d0cf1a2a279bf175b117ea07115fae13417110e51517328ae442f5a", "sha256:a2eaf0a8e16122221393e1946f772e477aa90bb21988ef0ab8fb73ecf9f20196", "sha256:d38239ce7bd22e115d7ebd88c933f43bf39a2d069dcba700bbde368dbe59a066" ], "source_surface": { "node_kind": "endpoint", "node_id": "registration" }, "locators": [ { "artifact_digest": "sha256:05faa932f97e078417a860fa2d703967a7c5ca5b041e46a71eefa6b2dcb6e4c5", "start_byte": 7174, "end_byte": 7970, "value_digest": "sha256:301cd5d234944b72b07508e57d8257ddd77396e189b095aa9c2f488af00b6704" } ] } ], "note": "The signup page provides form fields for Name, Organization, Email, Password, and Data Storage Location with a submit button ('Get set up'), but it includes a reCAPTCHA notice ('This form is protected by reCAPTCHA'), leaving the initial account creation flow only partially operable for automated agents without human interaction.", "remediation": { "signal_code": "access_control_operability", "code": "improve.sign_up.access_control_operability", "instruction": "Expose deterministic controls, validation, and resumable authorization handoffs." } }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:52.386Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "account-signup" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:9abe4424089f08de3698e9ad6ca9f4c5b5de64934c83ce6f04cc7fc8fcc391e0", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:05faa932f97e078417a860fa2d703967a7c5ca5b041e46a71eefa6b2dcb6e4c5", "sha256:150dd90ab7b543d42bee082af1b1e7d6b203be88cd1808a04925e3899e44dec1", "sha256:1a637c8bddfdc50563fb6ae30bc31a209c9985ee6785ed4db39d9d0b7f2a0aaf", "sha256:759435422d0cf1a2a279bf175b117ea07115fae13417110e51517328ae442f5a", "sha256:a2eaf0a8e16122221393e1946f772e477aa90bb21988ef0ab8fb73ecf9f20196", "sha256:d38239ce7bd22e115d7ebd88c933f43bf39a2d069dcba700bbde368dbe59a066" ], "source_surface": { "node_kind": "resource", "node_id": "account-signup" }, "locators": [ { "artifact_digest": "sha256:05faa932f97e078417a860fa2d703967a7c5ca5b041e46a71eefa6b2dcb6e4c5", "start_byte": 4837, "end_byte": 5626, "value_digest": "sha256:d250ce4fccd2ac9a4c509da8f30e8f1ede029fc995b7e5bbfe0b7c49c006f4d6" }, { "artifact_digest": "sha256:05faa932f97e078417a860fa2d703967a7c5ca5b041e46a71eefa6b2dcb6e4c5", "start_byte": 7174, "end_byte": 7970, "value_digest": "sha256:301cd5d234944b72b07508e57d8257ddd77396e189b095aa9c2f488af00b6704" } ] } ], "note": "Sentry provides a stable, canonical self-service registration entrypoint at https://sentry.io/signup/ with options to sign up via account details or single sign-on providers like Google, GitHub, and Azure DevOps." }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "no", "value_label": "Blocked", "outcome": "fail", "public_state": "blocked", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "A mandatory CAPTCHA has no supported agent-safe route.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:52.386Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" }, { "node_kind": "resource", "node_id": "account-signup" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:9abe4424089f08de3698e9ad6ca9f4c5b5de64934c83ce6f04cc7fc8fcc391e0", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:05faa932f97e078417a860fa2d703967a7c5ca5b041e46a71eefa6b2dcb6e4c5", "sha256:1a637c8bddfdc50563fb6ae30bc31a209c9985ee6785ed4db39d9d0b7f2a0aaf", "sha256:613be4aa52d0ec141684ceef57ecf40312882a8e5f1506026236ad6b71e98e8e", "sha256:759435422d0cf1a2a279bf175b117ea07115fae13417110e51517328ae442f5a", "sha256:a2eaf0a8e16122221393e1946f772e477aa90bb21988ef0ab8fb73ecf9f20196", "sha256:d38239ce7bd22e115d7ebd88c933f43bf39a2d069dcba700bbde368dbe59a066" ], "source_surface": { "node_kind": "resource", "node_id": "account-signup" }, "locators": [ { "artifact_digest": "sha256:05faa932f97e078417a860fa2d703967a7c5ca5b041e46a71eefa6b2dcb6e4c5", "start_byte": 7174, "end_byte": 7970, "value_digest": "sha256:301cd5d234944b72b07508e57d8257ddd77396e189b095aa9c2f488af00b6704" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:9abe4424089f08de3698e9ad6ca9f4c5b5de64934c83ce6f04cc7fc8fcc391e0", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:05faa932f97e078417a860fa2d703967a7c5ca5b041e46a71eefa6b2dcb6e4c5", "sha256:1a637c8bddfdc50563fb6ae30bc31a209c9985ee6785ed4db39d9d0b7f2a0aaf", "sha256:613be4aa52d0ec141684ceef57ecf40312882a8e5f1506026236ad6b71e98e8e", "sha256:759435422d0cf1a2a279bf175b117ea07115fae13417110e51517328ae442f5a", "sha256:a2eaf0a8e16122221393e1946f772e477aa90bb21988ef0ab8fb73ecf9f20196", "sha256:d38239ce7bd22e115d7ebd88c933f43bf39a2d069dcba700bbde368dbe59a066" ], "source_surface": { "node_kind": "endpoint", "node_id": "registration" }, "locators": [ { "artifact_digest": "sha256:05faa932f97e078417a860fa2d703967a7c5ca5b041e46a71eefa6b2dcb6e4c5", "start_byte": 7174, "end_byte": 7970, "value_digest": "sha256:301cd5d234944b72b07508e57d8257ddd77396e189b095aa9c2f488af00b6704" } ] } ], "note": "Sentry explicitly states that the registration form is protected by reCAPTCHA, and no supported agent-safe bypass is established in the admitted evidence.", "blocker": { "signal_code": "captcha_compatible_access", "code": "sign_up.captcha_compatible_access", "explanation": "A mandatory CAPTCHA has no supported agent-safe route." }, "remediation": { "signal_code": "captcha_compatible_access", "code": "improve.sign_up.captcha_compatible_access", "instruction": "Provide a lawful verified-agent alternative or explicit resumable approval handoff." } }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:42.050Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0c0ac2a2fca3f03dd697c6a4329358d998d806f5c7b8c91cee264bc802070c74", "capture_rung": "http" } ], "artifact_digests": [ "sha256:cdbdef9b07860d6d277da9d8bf69bf0eadd6a0b232196f945752689dedd09791", "sha256:dfc1809eab855ddc761d56b8268166e5f4abf2e8d0cdddac76f242cc29041814", "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "sha256:fda38180303f5144e6fb49309c270bc679016a2c9730453d1bb70e78082e2450" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "start_byte": 3409, "end_byte": 4198, "value_digest": "sha256:68606515017ec8ea1fb5a65c44f9e8241035c55a548a26e416a71c7963f9aa66" }, { "artifact_digest": "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "start_byte": 7164, "end_byte": 7958, "value_digest": "sha256:34792ed5d1e1c889b70e92c9f100e9c4afa8193ac21de25e407e5bf2fedeb8cb" } ] } ], "note": "Sentry supports delegated authorization via OAuth2 (authorization code grant) with defined scopes, refresh tokens, and a Device Authorization Flow (RFC 8628) for headless CLI and automated environments." }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:52.386Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "account-signup" } ], "assessment_method": { "name": "bounded-headless-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f1212e8cd082308cfde3c097bc933c4a4b72046b1f242205c3e27a3b020b3311" }, "determination_bases": [], "note": "The listed form fields do not establish that downstream phone verification is absent." } ], "blockers": [ { "signal_code": "captcha_compatible_access", "code": "sign_up.captcha_compatible_access", "explanation": "A mandatory CAPTCHA has no supported agent-safe route." } ], "remediations": [ { "signal_code": "captcha_compatible_access", "code": "improve.sign_up.captcha_compatible_access", "instruction": "Provide a lawful verified-agent alternative or explicit resumable approval handoff." }, { "signal_code": "access_control_operability", "code": "improve.sign_up.access_control_operability", "instruction": "Expose deterministic controls, validation, and resumable authorization handoffs." } ] }, { "stage": "pay", "stage_label": "Pay", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "context": "Sentry discloses recurring pricing for Team ($26/mo) and Business ($80/mo) plans along with pay-as-you-go error rates in USD, but notes that annual and prepaid billing options with additional discounts are available during checkout, leaving those discounted terms contextual." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "context": "Sentry pricing and help documentation mention checkout for upgrades in settings/billing/checkout and annual/prepaid options during checkout. However, the evidence does not detail a complete deterministic flow for an agent to construct checkout, hand off approval safely, and resume." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The evidence references billing checkout and paying for plan upgrades, but does not document a delegated payment rail or human-confirmed authorization workflow with explicit scoped delegation and receipts." }, { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "context": "Sentry's Help Center explicitly states that existing customers can review plans and upgrade through the Manage Plan flow in their Sentry account settings billing checkout URL, providing a direct self-service path to paid access without requiring sales intervention for self-serve plans." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:36.374Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" }, { "node_kind": "resource", "node_id": "self-service-plan" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [], "note": "Sentry pricing and help documentation mention checkout for upgrades in settings/billing/checkout and annual/prepaid options during checkout. However, the evidence does not detail a complete deterministic flow for an agent to construct checkout, hand off approval safely, and resume." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:55:59.830Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c109a7136fda7e87ca4d9cc3b5e40d9cb9917ac88617da65d524164898ac0ca9", "capture_rung": "http" } ], "artifact_digests": [ "sha256:5a28ff29eb7a1917969e535263cdb5e3a6343eb7f2a1e343d6c35280ead2381c", "sha256:6ee0d56590b72ba4327aa692b6f5b0bc6eb8b4981135b882a78c7502a577127a", "sha256:84f9686b1d5a7beb91ddbf94ae199636403876754cc82a5584742695986c1953", "sha256:9ae5deeaf5ab178999214650da19bd7cc0ef34d0d0bf48c7b76be1bd21f76c19" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:84f9686b1d5a7beb91ddbf94ae199636403876754cc82a5584742695986c1953", "start_byte": 10890, "end_byte": 11686, "value_digest": "sha256:9065c7392bb75b37766438070f248d1e8ec7a94f5382e4c90d20ece5b3c1f50c" }, { "artifact_digest": "sha256:84f9686b1d5a7beb91ddbf94ae199636403876754cc82a5584742695986c1953", "start_byte": 14880, "end_byte": 15679, "value_digest": "sha256:dccd4820e7d408d3312ac0b6525145c879712aa8eb31800d43f883e7c1b92c77" } ] } ], "note": "Sentry discloses recurring pricing for Team ($26/mo) and Business ($80/mo) plans along with pay-as-you-go error rates in USD, but notes that annual and prepaid billing options with additional discounts are available during checkout, leaving those discounted terms contextual.", "remediation": { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:36.374Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" }, { "node_kind": "resource", "node_id": "self-service-plan" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [], "note": "The evidence references billing checkout and paying for plan upgrades, but does not document a delegated payment rail or human-confirmed authorization workflow with explicit scoped delegation and receipts." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:36.374Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" }, { "node_kind": "resource", "node_id": "self-service-plan" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:fa6e1a488e59ff0f47d58567acd9b3082b1505f77c8a2a143a17dd8dd6c44b38", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0fc3261831af6b8f1a3296c602ab7d3377d8036f7810f1291be08559832a9f47", "sha256:2345b904c7cc6f3538a9237aca315fab0f63f4327fe5e69e471197dce7fc254c", "sha256:4e1976ef092179df38c7d7943d85b0b8be4609aef9b6a882eaa7c9667d9e823b", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" ], "source_surface": { "node_kind": "resource", "node_id": "self-service-plan" }, "locators": [ { "artifact_digest": "sha256:0fc3261831af6b8f1a3296c602ab7d3377d8036f7810f1291be08559832a9f47", "start_byte": 2959, "end_byte": 3684, "value_digest": "sha256:42fa465f2b4660659fad87d47e7d4d630d75c3da491b0822a1811ca383655bc7" } ] } ], "note": "Sentry's Help Center explicitly states that existing customers can review plans and upgrade through the Manage Plan flow in their Sentry account settings billing checkout URL, providing a direct self-service path to paid access without requiring sales intervention for self-serve plans." } ], "blockers": [], "remediations": [ { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } ] }, { "stage": "provision", "stage_label": "Provision", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "Project provisioning can be initiated via an HTTP POST request to the team's projects API endpoint using a bearer auth token with project:write or project:admin scopes." }, "secondary_context": [ { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Credentials, grants, or configuration are delivered through a documented agent-usable flow.", "context": "Sentry documents agent-usable OAuth token exchange and Device Authorization Grant flows to deliver access tokens." }, { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "context": "The POST project creation endpoint synchronously returns a 201 success response containing the created project resource object." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Credentials, grants, or configuration are delivered through a documented agent-usable flow.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:42.050Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0c0ac2a2fca3f03dd697c6a4329358d998d806f5c7b8c91cee264bc802070c74", "capture_rung": "http" } ], "artifact_digests": [ "sha256:b4d35a16b956603eadcbdfe6ed93c99afdb91533d1294a9da3a4dea0a7028ecf", "sha256:cdbdef9b07860d6d277da9d8bf69bf0eadd6a0b232196f945752689dedd09791", "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "sha256:fda38180303f5144e6fb49309c270bc679016a2c9730453d1bb70e78082e2450" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "start_byte": 4886, "end_byte": 5631, "value_digest": "sha256:087de26cfe0d35c2bd5b011cd235b84624633c3da35f400cb23c862b42fee7ab" }, { "artifact_digest": "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "start_byte": 7164, "end_byte": 7958, "value_digest": "sha256:34792ed5d1e1c889b70e92c9f100e9c4afa8193ac21de25e407e5bf2fedeb8cb" } ] } ], "note": "Sentry documents agent-usable OAuth token exchange and Device Authorization Grant flows to deliver access tokens." }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:22.383Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "project-provisioning" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:6ff91bdf477b38c10b66f881336fcef4c88bba430fea64c14534adeb9fc09d80", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bfbe255d624f7860d33694564ab16582ebce9ba5d5db793fbe81cbc21fd8c0", "sha256:54837ecb6d45a34f19b54b7735ec7a203b64ff333505f4bd9393e2abd9a309ed", "sha256:572bf842e19da0da855d1945531b153e0b77327e830d8c34aa2de3f4483e5022", "sha256:957c8d25bc0efe83c5835cbea5b92c94d03e968f60e2800f5c7c079201a610f3" ], "source_surface": { "node_kind": "resource", "node_id": "project-provisioning" }, "locators": [ { "artifact_digest": "sha256:957c8d25bc0efe83c5835cbea5b92c94d03e968f60e2800f5c7c079201a610f3", "start_byte": 5663, "end_byte": 6459, "value_digest": "sha256:8a2fe83f81f8aafe9904f2026847e2cf8bea3e90e9ed970233e4f8bddf4165e0" }, { "artifact_digest": "sha256:957c8d25bc0efe83c5835cbea5b92c94d03e968f60e2800f5c7c079201a610f3", "start_byte": 6460, "end_byte": 7164, "value_digest": "sha256:852baabc265ff0c71f4b9b78273ab6518f943e7111c2910e27bc6067f493c7b9" } ] } ], "note": "The POST project creation endpoint synchronously returns a 201 success response containing the created project resource object." }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:42.050Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "project-provisioning" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0c0ac2a2fca3f03dd697c6a4329358d998d806f5c7b8c91cee264bc802070c74", "capture_rung": "http" } ], "artifact_digests": [ "sha256:ba62da7ae7fe5695f305325faf1f87129fdae5bad8c276be5ca0428c00aa3b75", "sha256:cdbdef9b07860d6d277da9d8bf69bf0eadd6a0b232196f945752689dedd09791", "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "sha256:fda38180303f5144e6fb49309c270bc679016a2c9730453d1bb70e78082e2450" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "start_byte": 5632, "end_byte": 6367, "value_digest": "sha256:55aa44b29bde97e816cb50530614a906f3f95a2e4694275c3c0d6bef3f47fd6d" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:6ff91bdf477b38c10b66f881336fcef4c88bba430fea64c14534adeb9fc09d80", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bfbe255d624f7860d33694564ab16582ebce9ba5d5db793fbe81cbc21fd8c0", "sha256:54837ecb6d45a34f19b54b7735ec7a203b64ff333505f4bd9393e2abd9a309ed", "sha256:957c8d25bc0efe83c5835cbea5b92c94d03e968f60e2800f5c7c079201a610f3", "sha256:a224481d9ac17fb69100b324860a6e646939464e4f93ae4b380fd7eecc2da3ae" ], "source_surface": { "node_kind": "resource", "node_id": "project-provisioning" }, "locators": [ { "artifact_digest": "sha256:957c8d25bc0efe83c5835cbea5b92c94d03e968f60e2800f5c7c079201a610f3", "start_byte": 5663, "end_byte": 6459, "value_digest": "sha256:8a2fe83f81f8aafe9904f2026847e2cf8bea3e90e9ed970233e4f8bddf4165e0" } ] } ], "note": "Project provisioning can be initiated via an HTTP POST request to the team's projects API endpoint using a bearer auth token with project:write or project:admin scopes." } ], "blockers": [], "remediations": [] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Sentry documents rate limit enforcement (fixed window requests per second and concurrent limits) and response headers for limit tracking. However, explicit details on safe retries, idempotency semantics, request cancellation, or reconciliation are not fully provided in the captured evidence." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding." }, { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Sentry documents access token expiration and token refresh operations via POST requests, as well as 401 error handling for expired or revoked tokens. However, the provided documentation does not detail complete agent-operable credential rotation, revocation endpoints, or recovery mechanisms." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "Sentry provides a usable Web API interface for all essential targets including managing organizations, teams, events, issues, projects, permissions, and rate limit tracking via HTTP endpoints." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "Request-time authentication with scoped authority is documented using Bearer authentication tokens with specific scopes, user personal tokens, internal integration tokens, and OAuth2 access tokens." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "The API reference, issue operations, permissions, project creation, and rate limits documentation clearly define endpoints, HTTP methods, required scopes, request path/body parameters, response status codes, and response schemas." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "missing", "freshness": "unknown", "tested_surfaces": [], "determination_bases": [] }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:42.050Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0c0ac2a2fca3f03dd697c6a4329358d998d806f5c7b8c91cee264bc802070c74", "capture_rung": "http" } ], "artifact_digests": [ "sha256:abe400fa5d76ff4fea2b0f50d0c3337312034fe155200a7d2596e2c3ba1d6a4c", "sha256:cdbdef9b07860d6d277da9d8bf69bf0eadd6a0b232196f945752689dedd09791", "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "sha256:fda38180303f5144e6fb49309c270bc679016a2c9730453d1bb70e78082e2450" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "start_byte": 16556, "end_byte": 16975, "value_digest": "sha256:12bafbf1aaa37c0845072bb32f083348f4507b55e12d782b3f3535b7775184a6" }, { "artifact_digest": "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "start_byte": 5632, "end_byte": 6367, "value_digest": "sha256:55aa44b29bde97e816cb50530614a906f3f95a2e4694275c3c0d6bef3f47fd6d" } ] } ], "note": "Sentry documents access token expiration and token refresh operations via POST requests, as well as 401 error handling for expired or revoked tokens. However, the provided documentation does not detail complete agent-operable credential rotation, revocation endpoints, or recovery mechanisms.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:44.597Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "rate-limits" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:f47066bd0c9a6df3b469982e64a8590133d9117b6db2fb65a877690ae5e9c5ee", "capture_rung": "http" } ], "artifact_digests": [ "sha256:83d7526e67d8e5f97f6f1d652a3c9fd513d4a337253baa404574e7fcdab3d7f0", "sha256:84fc874b212154ebfa6564f786029f031667d61a62623246ef700a7a54668d4b", "sha256:bf0289287a248e90f8d83f246ba3d853b77eb1347f9a2fe1eaab105ae902aeee", "sha256:dce72df22f0d916a84acebbaa1daf7cae66dd3178d97b367c6d014ea70e099b1" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:dce72df22f0d916a84acebbaa1daf7cae66dd3178d97b367c6d014ea70e099b1", "start_byte": 1619, "end_byte": 2418, "value_digest": "sha256:28b80e9c2ea4ac74620429160c4cb731d8e4fa719685946fedf0a905ac961725" }, { "artifact_digest": "sha256:dce72df22f0d916a84acebbaa1daf7cae66dd3178d97b367c6d014ea70e099b1", "start_byte": 2419, "end_byte": 3215, "value_digest": "sha256:14fe7c6ef197d6b48d04c74a0fdf467f21223c2031060b7b05e181b38ee51495" } ] } ], "note": "Sentry documents rate limit enforcement (fixed window requests per second and concurrent limits) and response headers for limit tracking. However, explicit details on safe retries, idempotency semantics, request cancellation, or reconciliation are not fully provided in the captured evidence.", "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:56:42.050Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:0c0ac2a2fca3f03dd697c6a4329358d998d806f5c7b8c91cee264bc802070c74", "capture_rung": "http" } ], "artifact_digests": [ "sha256:cdbdef9b07860d6d277da9d8bf69bf0eadd6a0b232196f945752689dedd09791", "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "sha256:f619ae4b437612f2f67f974696d219604936ebe971103bb8104ef0aa059c3727", "sha256:fda38180303f5144e6fb49309c270bc679016a2c9730453d1bb70e78082e2450" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "start_byte": 1807, "end_byte": 2607, "value_digest": "sha256:e483f8c30845501753d9f539a4f1b048e8852bf9f9f90577dc51f87432a8500c" }, { "artifact_digest": "sha256:e88c8759aad7fb0f4a904e9695d0003a145faf1e773ae8db782a949e2b4e22f2", "start_byte": 2608, "end_byte": 3408, "value_digest": "sha256:586509df0476af2abe8a0ed9421b9057c67c081de5a40e09f51c85382adf6f2d" } ] } ], "note": "Request-time authentication with scoped authority is documented using Bearer authentication tokens with specific scopes, user personal tokens, internal integration tokens, and OAuth2 access tokens." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:04.619Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "issue-api" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:45325e642b14062fdde5003c01db8be1db105209a01258ea044669dd1c0f441d", "capture_rung": "http" } ], "artifact_digests": [ "sha256:18cb99da16286a0e81f2b25f2ec2b84b8cc0bcf92f56bcf0b33cc94b65e1c223", "sha256:9af24c95d017b001878c84614a329c98965c001174e2b835401694849b039607", "sha256:e018477628f8313e9827fc3c655d44cb668807159993a59449af9ddf6ec79450", "sha256:f0bd31f5d8185cfb77eed47beafe20f0a722a1e7fb07a070e743bd08b2153221" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:18cb99da16286a0e81f2b25f2ec2b84b8cc0bcf92f56bcf0b33cc94b65e1c223", "start_byte": 2021, "end_byte": 2819, "value_digest": "sha256:4eb255e37b88b093d846d13a1f0beb383c82818fb3ad8583f9b160b53f507c5d" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:f47066bd0c9a6df3b469982e64a8590133d9117b6db2fb65a877690ae5e9c5ee", "capture_rung": "http" } ], "artifact_digests": [ "sha256:83d7526e67d8e5f97f6f1d652a3c9fd513d4a337253baa404574e7fcdab3d7f0", "sha256:84fc874b212154ebfa6564f786029f031667d61a62623246ef700a7a54668d4b", "sha256:dce72df22f0d916a84acebbaa1daf7cae66dd3178d97b367c6d014ea70e099b1", "sha256:f176005ec5046f52c3a566573cdc125ab2270e9db36271022ae7f796e6ca21cf" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:dce72df22f0d916a84acebbaa1daf7cae66dd3178d97b367c6d014ea70e099b1", "start_byte": 1619, "end_byte": 2418, "value_digest": "sha256:28b80e9c2ea4ac74620429160c4cb731d8e4fa719685946fedf0a905ac961725" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:ca0c9dd40f7874932fb219fd4af6276f546155f6d50145138ec90ac752964123", "capture_rung": "http" } ], "artifact_digests": [ "sha256:3c2d03871cbe117939a8a78737aacb0e834eb4524bca44899315a68b2a9a026c", "sha256:629e7322d73fcf1491ef382527c2673a86782ef4ccddfccc7af0072692bde5e7", "sha256:a2f97a95b5a8bfee2cb35f0b46faf5b535d57fc96e285d7ba5548e8e56e3b7a2", "sha256:a917820e9dd5ef3970ab8b222360730d2cfc2af698c6d97468e24b051d3e5c1b" ], "source_surface": { "node_kind": "resource", "node_id": "permissions" }, "locators": [ { "artifact_digest": "sha256:a2f97a95b5a8bfee2cb35f0b46faf5b535d57fc96e285d7ba5548e8e56e3b7a2", "start_byte": 1906, "end_byte": 2705, "value_digest": "sha256:ac8786bd52eb268d61c312f512bb49bcb5b8286ea6000b3c172641fee339e01d" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5194214d92b8e46434a1ee993a5bfecf1d864bd880be39b21befdb4eae52011b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:111fe10493663b49523440fee76aa4ebbafe83393b1a6177b49bbe8a8cf1b829", "sha256:42772ea3ae5a9999dcd450d19ca3fb2c213fb3535be720681a621724bee5e1dc", "sha256:ab7ff946576a91de39d1b9216b10f7d43ea8c68a2eca1e88c9c676e6e2060880", "sha256:f3526b7e3172ef428adf499d8a5111a154a4ce070804ba65066041cb136af5b3" ], "source_surface": { "node_kind": "resource", "node_id": "issue-operations" }, "locators": [ { "artifact_digest": "sha256:42772ea3ae5a9999dcd450d19ca3fb2c213fb3535be720681a621724bee5e1dc", "start_byte": 2830, "end_byte": 3627, "value_digest": "sha256:3add99255d242c0fdac5e5e60327919bcbef88ed43f7512c9a510de678d7dbe7" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:6ff91bdf477b38c10b66f881336fcef4c88bba430fea64c14534adeb9fc09d80", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bfbe255d624f7860d33694564ab16582ebce9ba5d5db793fbe81cbc21fd8c0", "sha256:54837ecb6d45a34f19b54b7735ec7a203b64ff333505f4bd9393e2abd9a309ed", "sha256:957c8d25bc0efe83c5835cbea5b92c94d03e968f60e2800f5c7c079201a610f3", "sha256:a224481d9ac17fb69100b324860a6e646939464e4f93ae4b380fd7eecc2da3ae" ], "source_surface": { "node_kind": "resource", "node_id": "project-provisioning" }, "locators": [ { "artifact_digest": "sha256:957c8d25bc0efe83c5835cbea5b92c94d03e968f60e2800f5c7c079201a610f3", "start_byte": 5663, "end_byte": 6459, "value_digest": "sha256:8a2fe83f81f8aafe9904f2026847e2cf8bea3e90e9ed970233e4f8bddf4165e0" } ] } ], "note": "The API reference, issue operations, permissions, project creation, and rate limits documentation clearly define endpoints, HTTP methods, required scopes, request path/body parameters, response status codes, and response schemas." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-08-20T15:57:04.619Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "issue-api" } ], "assessment_method": { "name": "public-http-semantic-assessment", "version": "2026-08-20", "method_digest": "sha256:f7c4219d9b75928a6bcff8d125dc30bbc718673e579a66f00d832172e8c9d43d" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:45325e642b14062fdde5003c01db8be1db105209a01258ea044669dd1c0f441d", "capture_rung": "http" } ], "artifact_digests": [ "sha256:18cb99da16286a0e81f2b25f2ec2b84b8cc0bcf92f56bcf0b33cc94b65e1c223", "sha256:9af24c95d017b001878c84614a329c98965c001174e2b835401694849b039607", "sha256:e018477628f8313e9827fc3c655d44cb668807159993a59449af9ddf6ec79450", "sha256:f0bd31f5d8185cfb77eed47beafe20f0a722a1e7fb07a070e743bd08b2153221" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:18cb99da16286a0e81f2b25f2ec2b84b8cc0bcf92f56bcf0b33cc94b65e1c223", "start_byte": 2021, "end_byte": 2819, "value_digest": "sha256:4eb255e37b88b093d846d13a1f0beb383c82818fb3ad8583f9b160b53f507c5d" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:f47066bd0c9a6df3b469982e64a8590133d9117b6db2fb65a877690ae5e9c5ee", "capture_rung": "http" } ], "artifact_digests": [ "sha256:83d7526e67d8e5f97f6f1d652a3c9fd513d4a337253baa404574e7fcdab3d7f0", "sha256:84fc874b212154ebfa6564f786029f031667d61a62623246ef700a7a54668d4b", "sha256:dce72df22f0d916a84acebbaa1daf7cae66dd3178d97b367c6d014ea70e099b1", "sha256:f176005ec5046f52c3a566573cdc125ab2270e9db36271022ae7f796e6ca21cf" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:dce72df22f0d916a84acebbaa1daf7cae66dd3178d97b367c6d014ea70e099b1", "start_byte": 1619, "end_byte": 2418, "value_digest": "sha256:28b80e9c2ea4ac74620429160c4cb731d8e4fa719685946fedf0a905ac961725" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:ca0c9dd40f7874932fb219fd4af6276f546155f6d50145138ec90ac752964123", "capture_rung": "http" } ], "artifact_digests": [ "sha256:3c2d03871cbe117939a8a78737aacb0e834eb4524bca44899315a68b2a9a026c", "sha256:629e7322d73fcf1491ef382527c2673a86782ef4ccddfccc7af0072692bde5e7", "sha256:a2f97a95b5a8bfee2cb35f0b46faf5b535d57fc96e285d7ba5548e8e56e3b7a2", "sha256:a917820e9dd5ef3970ab8b222360730d2cfc2af698c6d97468e24b051d3e5c1b" ], "source_surface": { "node_kind": "resource", "node_id": "permissions" }, "locators": [ { "artifact_digest": "sha256:a2f97a95b5a8bfee2cb35f0b46faf5b535d57fc96e285d7ba5548e8e56e3b7a2", "start_byte": 1906, "end_byte": 2705, "value_digest": "sha256:ac8786bd52eb268d61c312f512bb49bcb5b8286ea6000b3c172641fee339e01d" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5194214d92b8e46434a1ee993a5bfecf1d864bd880be39b21befdb4eae52011b", "capture_rung": "http" } ], "artifact_digests": [ "sha256:111fe10493663b49523440fee76aa4ebbafe83393b1a6177b49bbe8a8cf1b829", "sha256:42772ea3ae5a9999dcd450d19ca3fb2c213fb3535be720681a621724bee5e1dc", "sha256:ab7ff946576a91de39d1b9216b10f7d43ea8c68a2eca1e88c9c676e6e2060880", "sha256:f3526b7e3172ef428adf499d8a5111a154a4ce070804ba65066041cb136af5b3" ], "source_surface": { "node_kind": "resource", "node_id": "issue-operations" }, "locators": [ { "artifact_digest": "sha256:42772ea3ae5a9999dcd450d19ca3fb2c213fb3535be720681a621724bee5e1dc", "start_byte": 2830, "end_byte": 3627, "value_digest": "sha256:3add99255d242c0fdac5e5e60327919bcbef88ed43f7512c9a510de678d7dbe7" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:6ff91bdf477b38c10b66f881336fcef4c88bba430fea64c14534adeb9fc09d80", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bfbe255d624f7860d33694564ab16582ebce9ba5d5db793fbe81cbc21fd8c0", "sha256:54837ecb6d45a34f19b54b7735ec7a203b64ff333505f4bd9393e2abd9a309ed", "sha256:957c8d25bc0efe83c5835cbea5b92c94d03e968f60e2800f5c7c079201a610f3", "sha256:a224481d9ac17fb69100b324860a6e646939464e4f93ae4b380fd7eecc2da3ae" ], "source_surface": { "node_kind": "resource", "node_id": "project-provisioning" }, "locators": [ { "artifact_digest": "sha256:957c8d25bc0efe83c5835cbea5b92c94d03e968f60e2800f5c7c079201a610f3", "start_byte": 5663, "end_byte": 6459, "value_digest": "sha256:8a2fe83f81f8aafe9904f2026847e2cf8bea3e90e9ed970233e4f8bddf4165e0" } ] } ], "note": "Sentry provides a usable Web API interface for all essential targets including managing organizations, teams, events, issues, projects, permissions, and rate limit tracking via HTTP endpoints." } ], "blockers": [], "remediations": [ { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." }, { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 16, "covered_signals": 16, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 2, "barrier_ratio": 0.4 }, "last_tested_at": "2026-08-20T15:57:04.619Z", "freshness": "fresh", "provenance": { "tier": "observed", "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:57bf95fd6d0fe6fe9173a68b60e8d8dc2179b357c88ff4349675a72d0e1d4139", "freshness_policy_digest": "sha256:00f7f2a35f37b184e57ce2cc116f6a5e3feb4813991aacd7e29e322f2d3607a8", "basis_event_ids": [ "sha256:09720496a0f3bf74befc53720dd70635da736e8de93b803d8c428ca61e43647c", "sha256:09beb056a3714936702abddb0afc684ade5f691290895876990440d579ed1846", "sha256:11341f561d576145246c4c25d8750079c9c76618a3542386d24a525b965f908b", "sha256:142fff164fd713461b66998a3e50863ed53f228fe913b7844bb94e5af66e5bfa", "sha256:24ca81a3c892d2c312787f96b262927caa63d3803977de216863b9f299b0d98f", "sha256:2b05f2d8ee9daf4e0f3b95f19a3e805d1c8fd4d200fa17e54871e180766f3c3f", "sha256:374d7300199d664e09bf358a07539be2dd034594c242be1477ae7c0a47763443", "sha256:3ab3227d61b1be57ee0360d892488f5701cd59fead3f057553800cfa443d391a", "sha256:3f8263dac807a384854cca78188a23ee3aa1d54a8b5f4d468933b9ed994b5bda", "sha256:43d6a758f5e1fb0be8f10bfdd1e3d08290aeec2799360e531050e48bfca5356c", "sha256:4aad8916ca5b19ecfde33a9c27c2022e82132d06dd34fb37df27ad9b10a76eee", "sha256:604454f5231aca0bf82f41294f279f46052e5fc1216052043181ac9097cd7af3", "sha256:6149dede4903789026aa451e023444961806f41b21627083e2a01f92b33bb1a9", "sha256:659a516cf982dfc32e6ef9269e462ce1ef83021e25264a1b54d4144518468f9c", "sha256:6718979aa6a47a261caa30c9287a9f841d7e675f300771534107ca1bed89fa36", "sha256:6fdd8c12a35080051e4b2e095b5bf1a0260ca6a29d010c86136be501c72a065a", "sha256:70c4c8a2293eba826a7ba4398ec4129a7c75b2fc043f3a59363c13570a9ce2bd", "sha256:7df657fb18bac144f75c0890d25dd5cc5027f9e73fc809ad44d0b3b4ecf45aa2", "sha256:8a46858d69175695a9fa6b2f8ba5e6f1af2359ab5a1937766fbbce4a7df0a3aa", "sha256:959b74e153be26d9ff50d6b829648c06e907a48f896aa7ee96944f89bd3dfa5c", "sha256:95edc2dbd9b1035982033f7cd322fecd186fa78b688efdb9e34dd874aa24f7c3", "sha256:9aac991c4152be7469af82bb03ba1712eb47d61071a34f01902ac492479a78db", "sha256:9c7b97727eea1d8aea8b953399c63928abbfe0b802ff936c9194a788a3bcde64", "sha256:b32959e2613ca6cae0d4b255a78b86e8f24cb0fc5b132a72c810b2c027eeb035", "sha256:b49d542558d62cfb150497476c8983c21d74035c9b6aa7d46e20e65a579d634f", "sha256:bb3fbf9e9af13ff74eaebd62151331172f357ae5a380fb2835233218d62f6996", "sha256:bb7182bcbaf4a8e457f9ad14c751ce3c39fa00b01e7a385f113adf4abda6ea56", "sha256:c256bffc85b1e42e5bbb51df1fcdcc720e2dfe42b107f832339e95f89eb75412", "sha256:cdba8eca5d8cdad2619d6a987da9ba199658328fd1a9ceb3c32809c0f6eb2bf7", "sha256:d8ee4649a3f5c28c74c86dc0876b616010c924f42bd50414bc7ecb58006d4978", "sha256:e27f953782269c331457ee54dfd065440a3b4eb1249e3538f3137effcee9a893", "sha256:e56c7f3b7a1b9d95802e8e0cdc784e482a7d25b7103b97c485ed2f91dc7da3a9", "sha256:e57ada533c7ecc11adaa6572067fc2dced8a286b6d3ea13debd5e8d2d4ad5b72", "sha256:fec58bdf1186483e3cd6969ae3248030696fbb9e60a691d0baddc4fb5f57fdeb" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:2b05f2d8ee9daf4e0f3b95f19a3e805d1c8fd4d200fa17e54871e180766f3c3f" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:56.185Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:9c7b97727eea1d8aea8b953399c63928abbfe0b802ff936c9194a788a3bcde64" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:55:59.830Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:6718979aa6a47a261caa30c9287a9f841d7e675f300771534107ca1bed89fa36" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:11.048Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:b49d542558d62cfb150497476c8983c21d74035c9b6aa7d46e20e65a579d634f" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:56.185Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:3ab3227d61b1be57ee0360d892488f5701cd59fead3f057553800cfa443d391a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:52.386Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:9aac991c4152be7469af82bb03ba1712eb47d61071a34f01902ac492479a78db" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:52.386Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:70c4c8a2293eba826a7ba4398ec4129a7c75b2fc043f3a59363c13570a9ce2bd", "sha256:c256bffc85b1e42e5bbb51df1fcdcc720e2dfe42b107f832339e95f89eb75412" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:52.386Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:3f8263dac807a384854cca78188a23ee3aa1d54a8b5f4d468933b9ed994b5bda" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:42.050Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:24ca81a3c892d2c312787f96b262927caa63d3803977de216863b9f299b0d98f" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:52.386Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:142fff164fd713461b66998a3e50863ed53f228fe913b7844bb94e5af66e5bfa", "sha256:95edc2dbd9b1035982033f7cd322fecd186fa78b688efdb9e34dd874aa24f7c3" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:36.374Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:cdba8eca5d8cdad2619d6a987da9ba199658328fd1a9ceb3c32809c0f6eb2bf7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:55:59.830Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:b32959e2613ca6cae0d4b255a78b86e8f24cb0fc5b132a72c810b2c027eeb035", "sha256:e56c7f3b7a1b9d95802e8e0cdc784e482a7d25b7103b97c485ed2f91dc7da3a9" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:36.374Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:4aad8916ca5b19ecfde33a9c27c2022e82132d06dd34fb37df27ad9b10a76eee", "sha256:e57ada533c7ecc11adaa6572067fc2dced8a286b6d3ea13debd5e8d2d4ad5b72" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:36.374Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:fec58bdf1186483e3cd6969ae3248030696fbb9e60a691d0baddc4fb5f57fdeb" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:42.050Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:43d6a758f5e1fb0be8f10bfdd1e3d08290aeec2799360e531050e48bfca5356c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:22.383Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:659a516cf982dfc32e6ef9269e462ce1ef83021e25264a1b54d4144518468f9c", "sha256:bb7182bcbaf4a8e457f9ad14c751ce3c39fa00b01e7a385f113adf4abda6ea56" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:42.050Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:8a46858d69175695a9fa6b2f8ba5e6f1af2359ab5a1937766fbbce4a7df0a3aa" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:42.050Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:959b74e153be26d9ff50d6b829648c06e907a48f896aa7ee96944f89bd3dfa5c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:44.597Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:6fdd8c12a35080051e4b2e095b5bf1a0260ca6a29d010c86136be501c72a065a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:56:42.050Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:09720496a0f3bf74befc53720dd70635da736e8de93b803d8c428ca61e43647c", "sha256:09beb056a3714936702abddb0afc684ade5f691290895876990440d579ed1846", "sha256:11341f561d576145246c4c25d8750079c9c76618a3542386d24a525b965f908b", "sha256:bb3fbf9e9af13ff74eaebd62151331172f357ae5a380fb2835233218d62f6996", "sha256:d8ee4649a3f5c28c74c86dc0876b616010c924f42bd50414bc7ecb58006d4978" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:04.619Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:374d7300199d664e09bf358a07539be2dd034594c242be1477ae7c0a47763443", "sha256:604454f5231aca0bf82f41294f279f46052e5fc1216052043181ac9097cd7af3", "sha256:6149dede4903789026aa451e023444961806f41b21627083e2a01f92b33bb1a9", "sha256:7df657fb18bac144f75c0890d25dd5cc5027f9e73fc809ad44d0b3b4ecf45aa2", "sha256:e27f953782269c331457ee54dfd065440a3b4eb1249e3538f3137effcee9a893" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-08-20T15:57:04.619Z", "freshness": "fresh" } ] }, "canonical_url": "https://sourcey.com/catalog/sentry/agent-readiness/sentry-web-api/issue-operations", "projection_digest": "sha256:1ccaf98f7337f422b805942363dcff5884425ac1f9d26af0d6e90002ccd47ae3" } } }