{ "contract": "sourcey.site-record/v1alpha1", "release_id": "sha256:5f55a0147eca9a82d821b7cfb73339dd8059c146b9acbb6ed66c9e3d40a8e1b0", "snapshot_id": "sha256:fbf4583b80f8936d9b7b75906adc86f38f5612cd0a7329839daea7b71ad2b9ce", "artifact_sha256": "sha256:ec393385ec4e7be15a393d925f0df78d54a12787f2995a84fad1b570583dac06", "data": { "entity_id": "ent_01kyxthgq3w0q894h0tadvr0cq", "entity_slug": "sentry", "profile": { "projection_contract": "sourcey.agent-readiness-projection/v1alpha1", "agent_readiness_profile_id": "arp_01kzf0m4xh9j6rz3b1v8mp5td2", "entity_id": "ent_01kyxthgq3w0q894h0tadvr0cq", "scope": { "product": { "key": "sentry-web-api", "name": "Sentry Web API" }, "funnel": { "key": "issue-operations", "name": "Issue and project operations" } }, "catalog_binding": { "base_release_id": "sha256:8986cb1640fd748dd005e5c94c7b02d3f44a3d39ff6b72573091bd81af84c61e", "entity_revision_digest": "sha256:0acca7e30e16523f5718208ac027acb0b1b432e023c6310e1ae7161a05b6f422" }, "declaration_revision_digest": "sha256:df394c8bad741315c50fa635b608e071d5022d3f32281d60b6cc623c53012a5c", "declaration": { "declaration_id": "declaration_sentry_api_issue_operations", "provenance": { "repository": "sourcey/agent-ready-services", "commit": "ca383f7867c18d91567fcb8326be55f7411d9554", "path": "entities/se/sentry.yaml", "git_blob_oid": "5dddfb94bc16e8445b0cc22b283d88418fe23eb9", "blob_digest": "sha256:aa45666c7c4aa9cf805df1915bea0feae9cca1d53e16a0487be41d73c618020e" }, "status": "community_declared" }, "surface_catalog": { "assessment_targets": [ { "target_id": "service-use", "name": "Create projects and manage issues through the Sentry Web API", "interface_ids": [ "issue-api" ] } ], "participants": [ { "participant_id": "sentry", "roles": [ "access_operator", "identity_provider", "operations_provider", "payment_provider", "provisioning_provider", "subject" ], "identity": { "entity_id": "ent_01kyxthgq3w0q894h0tadvr0cq" } } ], "resources": [ { "resource_id": "account-signup", "uri": "https://sentry.io/signup/", "roles": [ "access" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "api-reference", "uri": "https://docs.sentry.io/api/", "roles": [ "discovery", "documentation", "operations" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "authentication", "uri": "https://docs.sentry.io/api/auth/", "roles": [ "authentication", "descriptor", "documentation", "provisioning" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "issue-operations", "uri": "https://docs.sentry.io/api/events/", "roles": [ "documentation", "operations", "status" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "permissions", "uri": "https://docs.sentry.io/api/permissions/", "roles": [ "descriptor", "documentation", "operations" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "pricing", "uri": "https://sentry.io/pricing/", "roles": [ "checkout", "documentation", "pricing" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "project-provisioning", "uri": "https://docs.sentry.io/api/projects/create-a-new-project/", "roles": [ "documentation", "operations", "provisioning", "status" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "rate-limits", "uri": "https://docs.sentry.io/api/ratelimits/", "roles": [ "documentation", "operations", "recovery", "status" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "self-service-plan", "uri": "https://www.sentry.help/en/articles/13965054-can-i-get-a-quote-for-sentry", "roles": [ "checkout", "documentation" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "service-terms", "uri": "https://sentry.io/terms/", "roles": [ "terms" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "resource_id": "support", "uri": "https://sentry.zendesk.com/hc/en-us", "roles": [ "documentation", "recovery" ], "operated_by_participant_id": "sentry", "standard_bindings": [] } ], "endpoints": [ { "endpoint_id": "registration", "uri": "https://sentry.io/signup/", "transport": "http", "roles": [ "registration" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "endpoint_id": "sentry-api", "uri": "https://sentry.io/api/0", "transport": "http", "roles": [ "service", "status" ], "operated_by_participant_id": "sentry", "standard_bindings": [] } ], "interfaces": [ { "interface_id": "api-authentication", "modality": "network_api", "functions": [ "authentication" ], "endpoint_ids": [], "resource_ids": [ "authentication" ], "operated_by_participant_id": "sentry", "standard_bindings": [] }, { "interface_id": "issue-api", "modality": "network_api", "functions": [ "service_operation" ], "endpoint_ids": [ "sentry-api" ], "resource_ids": [ "api-reference", "issue-operations", "permissions", "project-provisioning", "rate-limits" ], "operated_by_participant_id": "sentry", "standard_bindings": [] } ], "relations": [ { "relation_id": "authentication-authenticates-api", "kind": "authenticates", "from": { "node_kind": "interface", "node_id": "api-authentication" }, "to": { "node_kind": "interface", "node_id": "issue-api" } }, { "relation_id": "issues-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "issue-operations" }, "to": { "node_kind": "interface", "node_id": "issue-api" } }, { "relation_id": "projects-describe-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "project-provisioning" }, "to": { "node_kind": "interface", "node_id": "issue-api" } }, { "relation_id": "reference-describes-api", "kind": "describes", "from": { "node_kind": "resource", "node_id": "api-reference" }, "to": { "node_kind": "interface", "node_id": "issue-api" } }, { "relation_id": "signup-precedes-authentication", "kind": "precedes", "from": { "node_kind": "resource", "node_id": "account-signup" }, "to": { "node_kind": "interface", "node_id": "api-authentication" } } ], "surface_exclusions": [ { "exclusion_id": "separate-eligibility-resource", "role": "eligibility", "rationale": "Applicable access conditions are published within the service terms; no separate eligibility resource is declared." } ] }, "lifecycle": "active", "effective_from": "2026-09-06T08:47:58Z", "revision_digest": "sha256:71aea5dca4577c2bd45d8b6fdf3b8faf5a914aa513bfe8cb9671191e3dd63f07", "policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "policy_version": "service-use-2026-09-07-blocking-barriers-r12", "policy_as_of": "2026-09-07T00:00:00Z", "assessment_basis": { "principal": "authorized_human_or_organization", "initial_state": { "product_specific_account": false, "product_credentials": false, "paid_subscription": false, "provisioned_resource": false, "external_identity": "only_when_declared_by_exact_funnel" }, "permitted_human_boundaries": [ "account_ownership_confirmation", "delegated_identity_consent", "regulated_approval", "final_payment_or_irreversible_commitment" ], "required_handoff_properties": [ "exact_disclosure", "resumable_handoff", "deterministic_continuation" ], "forbidden_substitutions": [ "captcha_solving", "human_password_or_session_sharing", "concealed_agent_identity", "invented_eligibility", "unbound_out_of_band_code", "vendor_policy_bypass", "unapproved_consequential_action" ], "success": { "target_coverage": "every_declared_target", "interface_coverage": "at_least_one_declared_alternative", "authority": "scoped", "failure_semantics": "documented", "recovery": "supported" }, "observed_assessment": { "allowed_sources": [ "public_documentation", "public_metadata", "public_endpoints", "non_mutating_interaction", "operator_attested_public_observation" ], "consequential_claims": "certification_required" } }, "overall_outcome": "fail", "public_state": "blocked", "state_label": "Blocked", "grade": "D", "grade_derivation": { "label": "Five-stage Agent Readiness report card", "explanation": "A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.", "coverage_rule": "Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.", "outcome_rule": "Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states." }, "publication": { "visibility": "discoverable", "reasons": [] }, "primary_finding": { "stage": "sign_up", "stage_label": "Sign up", "public_state": "blocked", "finding": { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "A mandatory CAPTCHA has no supported agent-safe route.", "context": "The signup page explicitly states 'This form is protected by reCAPTCHA' without providing a supported agent alternative or resumable boundary across both captured targets." }, "blocker": { "signal_code": "captcha_compatible_access", "code": "sign_up.captcha_compatible_access", "explanation": "A mandatory CAPTCHA has no supported agent-safe route." } }, "first_blocked_stage": { "stage": "sign_up", "stage_label": "Sign up", "finding": { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "A mandatory CAPTCHA has no supported agent-safe route.", "context": "The signup page explicitly states 'This form is protected by reCAPTCHA' without providing a supported agent alternative or resumable boundary across both captured targets." }, "blocker": { "signal_code": "captcha_compatible_access", "code": "sign_up.captcha_compatible_access", "explanation": "A mandatory CAPTCHA has no supported agent-safe route." } }, "limitations": [ { "stage": "pay", "stage_label": "Pay", "finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "context": "Sentry discloses Team ($26/mo USD) and Business ($80/mo USD) recurring plan pricing, but pay-as-you-go event usage calculators and additional volume options are contextual and subject to estimation or checkout variations." }, "remediation": { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Sentry documents rate limit failure handling through fixed-window and concurrent rate limiters, 429 rejection behavior, and specific tracking headers (X-Sentry-Rate-Limit-Limit, X-Sentry-Rate-Limit-Remaining, X-Sentry-Rate-Limit-Reset, X-Sentry-Rate-Limit-ConcurrentLimit, X-Sentry-Rate-Limit-ConcurrentRemaining). Idempotency, cancellation, and reconciliation semantics are not documented in the evidence." }, "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "stage": "operate", "stage_label": "Operate", "finding": { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Sentry OAuth2 documentation explicitly defines access token expiration (30 days) and refreshing tokens via the POST /oauth/token/ endpoint using a refresh_token, as well as handling 401 error codes for expired or revoked tokens. Other lifecycle operations like explicit revocation or compromise recovery are not documented in the evidence." }, "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } } ], "stages": [ { "stage": "evaluate", "stage_label": "Evaluate", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "service_discovery", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "context": "The Sentry web API is publicly discoverable via stable documentation, with version v0, base domains like sentry.io, and region-specific domains such as us.sentry.io and de.sentry.io." }, "secondary_context": [ { "signal_code": "structured_evaluation_discovery", "condition": "Are verified structured discovery artifacts available?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained excerpts for Sentry Web API are human documentation pages; they contain no first-party statement that structured discovery artifacts are absent, and no artifact was captured or verified either way." }, { "signal_code": "verified_web_agent_access", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The captured API documentation pages do not contain explicit web agent or crawler access statements (such as robots.txt rules or bot authentication signatures)." }, { "signal_code": "terms_access", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "context": "Sentry's Terms of Service 3.0.0 (February 12, 2024) are stable, readable, retrievable, and define the complete legal agreement between Functional Software, Inc. and the customer." }, { "signal_code": "eligibility_decidability", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "context": "Sentry's terms specify explicit eligibility requirements and restrictions: customers must not submit PHI unless on an eligible plan with a BAA, must not submit Personal Data without a DPA, must ensure all Users are over 16 years old, and are responsible for Service Data accuracy and law compliance." }, { "signal_code": "pricing_decidability", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "context": "Pricing for Sentry is explicit: the Developer plan is free ($0), the Team plan is $26/mo when billed annually, the Business plan is $80/mo when billed annually, and pay-as-you-go rates/variables for usage over base quotas (such as $0.0003625 per error) are detailed in USD." } ], "signals": [ { "signal_code": "eligibility_decidability", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent decide every material eligibility condition before commitment?", "finding": "Eligibility conditions and required inputs are explicit and decidable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:29.829Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d93faf09076bd8c3bb775ebfda420c31f4155aa57f47c9127185174bae8fad4a", "capture_rung": "http" } ], "artifact_digests": [ "sha256:74f3ba25f02127d6cacc8d2ac5b1f91be07338e872e0bc19c561700ecda133de", "sha256:8e7187ff181d938f1a609ff3469f8e837fa6540e6ae9ef5d5e7d487bc6db2c5f", "sha256:d8c68496dcee213a4c71346180bea8ad7ef349b104c3e9490e05d6ddbcf19cac", "sha256:d9dfa71517b6059d54b8843ef6d3d7101a0eb57a575943e7fb93c0e626341aa6" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:74f3ba25f02127d6cacc8d2ac5b1f91be07338e872e0bc19c561700ecda133de", "start_byte": 16094, "end_byte": 16896, "value_digest": "sha256:c18a5d4312ba1e2a86f714d4052fff47c8beb6da6ff8ceb16d56368d621de20d" }, { "artifact_digest": "sha256:74f3ba25f02127d6cacc8d2ac5b1f91be07338e872e0bc19c561700ecda133de", "start_byte": 16897, "end_byte": 17693, "value_digest": "sha256:bafe70285a78006a98b5beafe93ccaa75ec12b127954f97f21dda7d5a4c804ef" } ] } ], "note": "Sentry's terms specify explicit eligibility requirements and restrictions: customers must not submit PHI unless on an eligible plan with a BAA, must not submit Personal Data without a DPA, must ensure all Users are over 16 years old, and are responsible for Service Data accuracy and law compliance." }, { "signal_code": "pricing_decidability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent estimate cost or confirm no-charge status before commitment?", "finding": "Price or no-charge status, variables, currency, and material conditions are explicit.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:43.821Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:53081e74ff1d94d58cb20f66e24bd99ca9dc5cba58fa4312fd77aad222f20e7c", "capture_rung": "http" } ], "artifact_digests": [ "sha256:11631b004e71afb2139e24488ef475a6c077c3825e1dfb2dda16394062c135f3", "sha256:5ba328589facc6863ad251fcab6b9094c5e9eb26a5c9bfa3ee4b7bcb4c208257", "sha256:6ee0d56590b72ba4327aa692b6f5b0bc6eb8b4981135b882a78c7502a577127a", "sha256:8deb56953d372ea6f7ec5a73ed79b79be109e3760626e1bc38d9cb8462fa790c" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:5ba328589facc6863ad251fcab6b9094c5e9eb26a5c9bfa3ee4b7bcb4c208257", "start_byte": 10088, "end_byte": 10881, "value_digest": "sha256:95fc33afdf7cc84847248e9da444b7ceae522b1601d62b24b56a96e9dc8f03c4" }, { "artifact_digest": "sha256:5ba328589facc6863ad251fcab6b9094c5e9eb26a5c9bfa3ee4b7bcb4c208257", "start_byte": 14841, "end_byte": 15641, "value_digest": "sha256:bb4b7b6e56da3380f4d1863a1d9234d68c8a4264dc8cfe5dfc5966d97ab2ddcf" } ] } ], "note": "Pricing for Sentry is explicit: the Developer plan is free ($0), the Team plan is $26/mo when billed annually, the Business plan is $80/mo when billed annually, and pay-as-you-go rates/variables for usage over base quotas (such as $0.0003625 per error) are detailed in USD." }, { "signal_code": "service_discovery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent find the exact service and its stable entrypoints?", "finding": "The exact service and stable evaluation or access entrypoints are publicly discoverable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:40.240Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-reference" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5b8d016dcdd390da9a3bf576a85fd4ece2409f2dd8be70910d2f42306acb3477", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0a03fd694ea9776b7004d92a4d3696cc619ebdc14c68404faad1fc785f46fb5e", "sha256:ad09f4d071264b298785ce0f469dc7b8b64c71261c03ffac64aaf27c4d5d07f2", "sha256:d1177a980d5ed2d97860b9bccff6c11cecd005be8b65b9ad5e45861a3f38ec79", "sha256:e018477628f8313e9827fc3c655d44cb668807159993a59449af9ddf6ec79450" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:d1177a980d5ed2d97860b9bccff6c11cecd005be8b65b9ad5e45861a3f38ec79", "start_byte": 2031, "end_byte": 2830, "value_digest": "sha256:f27e78635b4c71df27137f71d68c5240b8407fd9fd0204beae3c8fe960623957" }, { "artifact_digest": "sha256:d1177a980d5ed2d97860b9bccff6c11cecd005be8b65b9ad5e45861a3f38ec79", "start_byte": 2831, "end_byte": 3631, "value_digest": "sha256:36bab4ef0e0f53e726972faa91d63ddea59348660033b3f0d197ff0e5f9c7e28" } ] } ], "note": "The Sentry web API is publicly discoverable via stable documentation, with version v0, base domains like sentry.io, and region-specific domains such as us.sentry.io and de.sentry.io." }, { "signal_code": "structured_evaluation_discovery", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Are verified structured discovery artifacts available?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:52.908Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-reference" }, { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "permissions" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained excerpts for Sentry Web API are human documentation pages; they contain no first-party statement that structured discovery artifacts are absent, and no artifact was captured or verified either way." }, { "signal_code": "terms_access", "evaluation_role": "informational", "required": false, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent retrieve and understand the applicable commitment terms?", "finding": "Applicable terms are stable, readable, retrievable, and materially complete.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:29.829Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "service-terms" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:d93faf09076bd8c3bb775ebfda420c31f4155aa57f47c9127185174bae8fad4a", "capture_rung": "http" } ], "artifact_digests": [ "sha256:74f3ba25f02127d6cacc8d2ac5b1f91be07338e872e0bc19c561700ecda133de", "sha256:bec24f13532c78ac01213aa5cbe4b32d3b345bd8a051d393f019ff82fc8488e5", "sha256:d8c68496dcee213a4c71346180bea8ad7ef349b104c3e9490e05d6ddbcf19cac", "sha256:d9dfa71517b6059d54b8843ef6d3d7101a0eb57a575943e7fb93c0e626341aa6" ], "source_surface": { "node_kind": "resource", "node_id": "service-terms" }, "locators": [ { "artifact_digest": "sha256:74f3ba25f02127d6cacc8d2ac5b1f91be07338e872e0bc19c561700ecda133de", "start_byte": 9691, "end_byte": 10487, "value_digest": "sha256:de3f309b9ffab244cb634435d879ee3746bf40ac1b02780d045bf15c14d107b6" }, { "artifact_digest": "sha256:74f3ba25f02127d6cacc8d2ac5b1f91be07338e872e0bc19c561700ecda133de", "start_byte": 7269, "end_byte": 8093, "value_digest": "sha256:fbd2f00d499c38a8c6e0924e1564989d1db2fd5d56cf67c735ce898f2ed38db3" } ] } ], "note": "Sentry's Terms of Service 3.0.0 (February 12, 2024) are stable, readable, retrievable, and define the complete legal agreement between Functional Software, Inc. and the customer." }, { "signal_code": "verified_web_agent_access", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Does the vendor deliberately describe access for web agents?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:52.908Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "api-reference" }, { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "permissions" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The captured API documentation pages do not contain explicit web agent or crawler access statements (such as robots.txt rules or bot authentication signatures)." } ], "blockers": [], "remediations": [] }, { "stage": "sign_up", "stage_label": "Sign up", "outcome": "fail", "public_state": "blocked", "state_label": "Blocked", "primary_finding": { "signal_code": "captcha_compatible_access", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "A mandatory CAPTCHA has no supported agent-safe route.", "context": "The signup page explicitly states 'This form is protected by reCAPTCHA' without providing a supported agent alternative or resumable boundary across both captured targets." }, "secondary_context": [ { "signal_code": "access_control_operability", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The signup form contains fields for Name, Organization, Email, Password, and Data Storage Location, but the evidence does not establish complete end-to-end access control operability or validation handoffs." }, { "signal_code": "phone_verification_compatible", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence for the signup form does not mention phone verification or SMS requirements." }, { "signal_code": "access_entrypoint_stability", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "context": "A stable signup route and account creation form is directly available at https://sentry.io/signup/." }, { "signal_code": "delegated_identity_access", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "context": "Sentry documents OAuth2 authorization code grant, User authentication tokens with specific scopes, and the Device Authorization Flow (RFC 8628) for headless environments." } ], "signals": [ { "signal_code": "access_control_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent operate the access controls and safe handoffs deterministically?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:59.545Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The signup form contains fields for Name, Organization, Email, Password, and Data Storage Location, but the evidence does not establish complete end-to-end access control operability or validation handoffs." }, { "signal_code": "access_entrypoint_stability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is there a stable route to begin obtaining service access?", "finding": "A stable canonical route begins the required access bootstrap.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:59.545Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "account-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "direct_observation", "captures": [ { "retained_capture_digest": "sha256:21c2b9fd035e55d4d34afb7a78101bf48be134f8779d17b9d26ccc4804db1695", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:19bd7dae1a9049c78e2eb84e0b55581228c99c42fe4a438c0d6a1506fc155928", "sha256:5b88401218371e815bb84cae92cb117620ee00efbf41f77ad621f1dd8dbc23df", "sha256:644129647c53edb11e25710d37cc2601b2e8e088f96a45cf3a35e95c68ac3822", "sha256:806fdaf88d58cfe88d596e47317a6caabe271e28fa4f2cab453bbc5ef9968ba9", "sha256:a2eaf0a8e16122221393e1946f772e477aa90bb21988ef0ab8fb73ecf9f20196", "sha256:f0ab4bffa7d6e994f5d01e769495cb19679ca1a464be044246d0fdfc1b1461df" ], "locators": [ { "artifact_digest": "sha256:644129647c53edb11e25710d37cc2601b2e8e088f96a45cf3a35e95c68ac3822", "start_byte": 6373, "end_byte": 7171, "value_digest": "sha256:128cdafd5c29732a6da330da1036f6dbf7afa35b28f8b06a472044543929ce7d" } ] } ], "note": "A stable signup route and account creation form is directly available at https://sentry.io/signup/." }, { "signal_code": "captcha_compatible_access", "evaluation_role": "barrier", "required": false, "value": "no", "value_label": "Blocked", "outcome": "fail", "public_state": "blocked", "condition": "Can an agent obtain access without an unsupported CAPTCHA boundary?", "finding": "A mandatory CAPTCHA has no supported agent-safe route.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:59.545Z", "tested_surfaces": [ { "node_kind": "endpoint", "node_id": "registration" }, { "node_kind": "resource", "node_id": "account-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:21c2b9fd035e55d4d34afb7a78101bf48be134f8779d17b9d26ccc4804db1695", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:19bd7dae1a9049c78e2eb84e0b55581228c99c42fe4a438c0d6a1506fc155928", "sha256:33646506d81152d0ee91f9226b8537648a64dd2b9531bf18e7c385191401be94", "sha256:644129647c53edb11e25710d37cc2601b2e8e088f96a45cf3a35e95c68ac3822", "sha256:806fdaf88d58cfe88d596e47317a6caabe271e28fa4f2cab453bbc5ef9968ba9", "sha256:a2eaf0a8e16122221393e1946f772e477aa90bb21988ef0ab8fb73ecf9f20196", "sha256:f0ab4bffa7d6e994f5d01e769495cb19679ca1a464be044246d0fdfc1b1461df" ], "source_surface": { "node_kind": "endpoint", "node_id": "registration" }, "locators": [ { "artifact_digest": "sha256:644129647c53edb11e25710d37cc2601b2e8e088f96a45cf3a35e95c68ac3822", "start_byte": 7172, "end_byte": 7977, "value_digest": "sha256:1c1bc4463ec96046e09b07e72c1c4dadd807a39dff918e8aa7638be3d7e42df7" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:21c2b9fd035e55d4d34afb7a78101bf48be134f8779d17b9d26ccc4804db1695", "capture_rung": "headless" } ], "artifact_digests": [ "sha256:19bd7dae1a9049c78e2eb84e0b55581228c99c42fe4a438c0d6a1506fc155928", "sha256:33646506d81152d0ee91f9226b8537648a64dd2b9531bf18e7c385191401be94", "sha256:644129647c53edb11e25710d37cc2601b2e8e088f96a45cf3a35e95c68ac3822", "sha256:806fdaf88d58cfe88d596e47317a6caabe271e28fa4f2cab453bbc5ef9968ba9", "sha256:a2eaf0a8e16122221393e1946f772e477aa90bb21988ef0ab8fb73ecf9f20196", "sha256:f0ab4bffa7d6e994f5d01e769495cb19679ca1a464be044246d0fdfc1b1461df" ], "source_surface": { "node_kind": "resource", "node_id": "account-signup" }, "locators": [ { "artifact_digest": "sha256:644129647c53edb11e25710d37cc2601b2e8e088f96a45cf3a35e95c68ac3822", "start_byte": 7172, "end_byte": 7977, "value_digest": "sha256:1c1bc4463ec96046e09b07e72c1c4dadd807a39dff918e8aa7638be3d7e42df7" } ] } ], "note": "The signup page explicitly states 'This form is protected by reCAPTCHA' without providing a supported agent alternative or resumable boundary across both captured targets.", "blocker": { "signal_code": "captcha_compatible_access", "code": "sign_up.captcha_compatible_access", "explanation": "A mandatory CAPTCHA has no supported agent-safe route." }, "remediation": { "signal_code": "captcha_compatible_access", "code": "improve.sign_up.captcha_compatible_access", "instruction": "Provide a lawful verified-agent alternative or explicit resumable approval handoff." } }, { "signal_code": "delegated_identity_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent obtain scoped, revocable authority for this service?", "finding": "Scoped revocable credentials or delegated authorization have explicit consent and resumption boundaries.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:52.908Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c48cc10228d50c07e1ea55b2b15d01a568c12efee429e10ecd822daed2fa62ee", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "sha256:0f033ee5effb170eeb03f72e8b77f12047df3161e0d3e3447c17b0268539aa5d", "sha256:c5d5dc901d7b5349cb1bdc042001463336b2d12c06e15cdd8048d92b7f70742a", "sha256:cdbdef9b07860d6d277da9d8bf69bf0eadd6a0b232196f945752689dedd09791" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "start_byte": 3412, "end_byte": 4199, "value_digest": "sha256:58234fd1b6f9ae902b66cffc3a5dacfc2331002ce0f7a487d58f07a1d018eb6f" }, { "artifact_digest": "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "start_byte": 7179, "end_byte": 7973, "value_digest": "sha256:34792ed5d1e1c889b70e92c9f100e9c4afa8193ac21de25e407e5bf2fedeb8cb" } ] } ], "note": "Sentry documents OAuth2 authorization code grant, User authentication tokens with specific scopes, and the Device Authorization Flow (RFC 8628) for headless environments." }, { "signal_code": "phone_verification_compatible", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can required phone verification be completed through a supported boundary?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:59.545Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "account-signup" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence for the signup form does not mention phone verification or SMS requirements." } ], "blockers": [ { "signal_code": "captcha_compatible_access", "code": "sign_up.captcha_compatible_access", "explanation": "A mandatory CAPTCHA has no supported agent-safe route." } ], "remediations": [ { "signal_code": "captcha_compatible_access", "code": "improve.sign_up.captcha_compatible_access", "instruction": "Provide a lawful verified-agent alternative or explicit resumable approval handoff." } ] }, { "stage": "pay", "stage_label": "Pay", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "commitment_disclosure", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "context": "Sentry discloses Team ($26/mo USD) and Business ($80/mo USD) recurring plan pricing, but pay-as-you-go event usage calculators and additional volume options are contextual and subject to estimation or checkout variations." }, "secondary_context": [ { "signal_code": "checkout_operability", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "context": "Current admissible evidence does not establish an API, protocol, or accessible web flow supporting deterministic checkout, approval handoff, and resumption." }, { "signal_code": "payment_authorization", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained evidence mentions a billing checkout URL in account settings, but does not state a documented rail supporting scoped delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "context": "Sentry explicitly declares that self-serve plans do not receive emailed quotes and directs existing customers to upgrade or purchase directly through the Manage Plan checkout flow in their account settings without a vendor decision point." } ], "signals": [ { "signal_code": "checkout_operability", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can an agent construct checkout, hand off approval safely, and resume?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:36.983Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" }, { "node_kind": "resource", "node_id": "self-service-plan" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "Current admissible evidence does not establish an API, protocol, or accessible web flow supporting deterministic checkout, approval handoff, and resumption." }, { "signal_code": "commitment_disclosure", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Is the exact commercial commitment disclosed before authorization?", "finding": "The public commitment omits a material component until later in the flow.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:43.821Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:53081e74ff1d94d58cb20f66e24bd99ca9dc5cba58fa4312fd77aad222f20e7c", "capture_rung": "http" } ], "artifact_digests": [ "sha256:5ba328589facc6863ad251fcab6b9094c5e9eb26a5c9bfa3ee4b7bcb4c208257", "sha256:6ee0d56590b72ba4327aa692b6f5b0bc6eb8b4981135b882a78c7502a577127a", "sha256:75512355ec9ca5feef97459f0bc76bffaa8f9f7762f1bfa6ea508452e6a60f31", "sha256:8deb56953d372ea6f7ec5a73ed79b79be109e3760626e1bc38d9cb8462fa790c" ], "source_surface": { "node_kind": "resource", "node_id": "pricing" }, "locators": [ { "artifact_digest": "sha256:5ba328589facc6863ad251fcab6b9094c5e9eb26a5c9bfa3ee4b7bcb4c208257", "start_byte": 10882, "end_byte": 11678, "value_digest": "sha256:b26e553f5a2b53b5b489d0813e2b628275b52c887ca3c7331b2c39242d045e02" }, { "artifact_digest": "sha256:5ba328589facc6863ad251fcab6b9094c5e9eb26a5c9bfa3ee4b7bcb4c208257", "start_byte": 14841, "end_byte": 15641, "value_digest": "sha256:bb4b7b6e56da3380f4d1863a1d9234d68c8a4264dc8cfe5dfc5966d97ab2ddcf" } ] } ], "note": "Sentry discloses Team ($26/mo USD) and Business ($80/mo USD) recurring plan pricing, but pay-as-you-go event usage calculators and additional volume options are contextual and subject to estimation or checkout variations.", "remediation": { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } }, { "signal_code": "payment_authorization", "evaluation_role": "barrier", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Can payment be authorized within scoped agent or explicit human authority?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:36.983Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" }, { "node_kind": "resource", "node_id": "self-service-plan" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained evidence mentions a billing checkout URL in account settings, but does not state a documented rail supporting scoped delegation or explicit human-confirmed authorization with receipts." }, { "signal_code": "self_service_purchase", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Is a direct self-service path to paid access documented?", "finding": "A documented direct purchase path reaches paid access without a vendor decision point.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:36.983Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "pricing" }, { "node_kind": "resource", "node_id": "self-service-plan" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:a8c9e7ac7dfd3f535ccc92399242daf67bf5c258a070620202466b20828c707c", "capture_rung": "http" } ], "artifact_digests": [ "sha256:2c2ff29ed479b9ff35d21f6a2cbaa082a6944b327a40e56430b57898427f49ec", "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945", "sha256:5e6b784dcf4edfcbed3a94e1d1f279688e81d6cae65fd3f254bceb1788e64055", "sha256:d07deaeb68618dabd88b029507955271c0c50819b4e01945810e4b2fcf158c10" ], "source_surface": { "node_kind": "resource", "node_id": "self-service-plan" }, "locators": [ { "artifact_digest": "sha256:5e6b784dcf4edfcbed3a94e1d1f279688e81d6cae65fd3f254bceb1788e64055", "start_byte": 2959, "end_byte": 3685, "value_digest": "sha256:d534e3393c8b27a3421dac11c8f01d7ee60dc27891a6ae0e390ca9fec40c4aed" }, { "artifact_digest": "sha256:5e6b784dcf4edfcbed3a94e1d1f279688e81d6cae65fd3f254bceb1788e64055", "start_byte": 3686, "end_byte": 4430, "value_digest": "sha256:49e259ec40c996936b9f4c15837c819a6c73300b3b21b2d5d35338bd6a5460c4" } ] } ], "note": "Sentry explicitly declares that self-serve plans do not receive emailed quotes and directs existing customers to upgrade or purchase directly through the Manage Plan checkout flow in their account settings without a vendor decision point." } ], "blockers": [], "remediations": [ { "signal_code": "commitment_disclosure", "code": "improve.pay.commitment_disclosure", "instruction": "Disclose the complete commitment before payment authorization." } ] }, { "stage": "provision", "stage_label": "Provision", "outcome": "pass", "public_state": "ready", "state_label": "Ready", "primary_finding": { "signal_code": "provisioning_operability", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "context": "Sentry supports programmatic creation of projects by issuing an HTTP POST request to /api/0/teams/{organization_id_or_slug}/{team_id_or_slug}/projects/ using a bearer auth token with project:admin or project:write scopes." }, "secondary_context": [ { "signal_code": "access_material_delivery", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Credentials, grants, or configuration are delivered through a documented agent-usable flow.", "context": "Sentry documents OAuth2 token exchange and device authorization flows where access and refresh tokens are delivered programmatically via API responses." }, { "signal_code": "provisioning_completion", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "context": "Creating a new project via HTTP POST returns a synchronous 201 response containing the created project object with its ID, name, slug, access permissions, and features." } ], "signals": [ { "signal_code": "access_material_delivery", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can usable access material be delivered securely to an authorized agent?", "finding": "Credentials, grants, or configuration are delivered through a documented agent-usable flow.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:52.908Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c48cc10228d50c07e1ea55b2b15d01a568c12efee429e10ecd822daed2fa62ee", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "sha256:3c798a6577654c0737c2bc384f26096bfbdf9d9e03c5a5ca8a2a25e203e963e7", "sha256:c5d5dc901d7b5349cb1bdc042001463336b2d12c06e15cdd8048d92b7f70742a", "sha256:cdbdef9b07860d6d277da9d8bf69bf0eadd6a0b232196f945752689dedd09791" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "start_byte": 15915, "end_byte": 16570, "value_digest": "sha256:12f13ca49494f0596b3d52a7fa3273c392d494bb38f95a36fedd9dca5d7921b1" }, { "artifact_digest": "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "start_byte": 6383, "end_byte": 7178, "value_digest": "sha256:d0c15b411fd61cdafd04047327dc76ff384a1f746671656745a5ef479423567b" } ] } ], "note": "Sentry documents OAuth2 token exchange and device authorization flows where access and refresh tokens are delivered programmatically via API responses." }, { "signal_code": "provisioning_completion", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent determine successful provisioning completion and reconcile asynchronous failure?", "finding": "A synchronous success response returns a usable created resource or access material; otherwise asynchronous work exposes progress, terminal state, reconciliation, and a documented bound.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:42.125Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "project-provisioning" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:aaf9f02da8594e913823b6438c4c1ae3f4de05ba2e7cb8f561d4dda7e283fe5e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bfbe255d624f7860d33694564ab16582ebce9ba5d5db793fbe81cbc21fd8c0", "sha256:4b742d13e6df285f2b7514a0b2c340d135784a8b623f64bad0510438967a6d65", "sha256:6356389b504907e815006ab6a55cfb3d1839e8bc41eb6828e18834773e41d64b", "sha256:ac71ff746a6d3d5729b4c24aabd7d4a384be24925b04f8c4f3ccc7d5026c1b02" ], "source_surface": { "node_kind": "resource", "node_id": "project-provisioning" }, "locators": [ { "artifact_digest": "sha256:6356389b504907e815006ab6a55cfb3d1839e8bc41eb6828e18834773e41d64b", "start_byte": 5678, "end_byte": 6474, "value_digest": "sha256:8a2fe83f81f8aafe9904f2026847e2cf8bea3e90e9ed970233e4f8bddf4165e0" }, { "artifact_digest": "sha256:6356389b504907e815006ab6a55cfb3d1839e8bc41eb6828e18834773e41d64b", "start_byte": 6475, "end_byte": 7179, "value_digest": "sha256:852baabc265ff0c71f4b9b78273ab6518f943e7111c2910e27bc6067f493c7b9" } ] } ], "note": "Creating a new project via HTTP POST returns a synchronous 201 response containing the created project object with its ID, name, slug, access permissions, and features." }, { "signal_code": "provisioning_operability", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can provisioning be initiated within supported agent authority?", "finding": "Provisioning is machine-triggerable or follows deterministically from an allowed handoff.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:52.908Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" }, { "node_kind": "resource", "node_id": "project-provisioning" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:aaf9f02da8594e913823b6438c4c1ae3f4de05ba2e7cb8f561d4dda7e283fe5e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bfbe255d624f7860d33694564ab16582ebce9ba5d5db793fbe81cbc21fd8c0", "sha256:37e147449a19686ac1678b17c9d0b039f5f52dd2f2891177f321651444b23945", "sha256:4b742d13e6df285f2b7514a0b2c340d135784a8b623f64bad0510438967a6d65", "sha256:6356389b504907e815006ab6a55cfb3d1839e8bc41eb6828e18834773e41d64b" ], "source_surface": { "node_kind": "resource", "node_id": "project-provisioning" }, "locators": [ { "artifact_digest": "sha256:6356389b504907e815006ab6a55cfb3d1839e8bc41eb6828e18834773e41d64b", "start_byte": 5678, "end_byte": 6474, "value_digest": "sha256:8a2fe83f81f8aafe9904f2026847e2cf8bea3e90e9ed970233e4f8bddf4165e0" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c48cc10228d50c07e1ea55b2b15d01a568c12efee429e10ecd822daed2fa62ee", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "sha256:b667abc6ff252fab59fe7f2bc50d57f5feecf8d9f2418957eabb0cae11392e0c", "sha256:c5d5dc901d7b5349cb1bdc042001463336b2d12c06e15cdd8048d92b7f70742a", "sha256:cdbdef9b07860d6d277da9d8bf69bf0eadd6a0b232196f945752689dedd09791" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "start_byte": 3412, "end_byte": 4199, "value_digest": "sha256:58234fd1b6f9ae902b66cffc3a5dacfc2331002ce0f7a487d58f07a1d018eb6f" } ] } ], "note": "Sentry supports programmatic creation of projects by issuing an HTTP POST request to /api/0/teams/{organization_id_or_slug}/{team_id_or_slug}/projects/ using a bearer auth token with project:admin or project:write scopes." } ], "blockers": [], "remediations": [] }, { "stage": "operate", "stage_label": "Operate", "outcome": "constrained", "public_state": "limited", "state_label": "Limited", "primary_finding": { "signal_code": "failure_contract", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "context": "Sentry documents rate limit failure handling through fixed-window and concurrent rate limiters, 429 rejection behavior, and specific tracking headers (X-Sentry-Rate-Limit-Limit, X-Sentry-Rate-Limit-Remaining, X-Sentry-Rate-Limit-Reset, X-Sentry-Rate-Limit-ConcurrentLimit, X-Sentry-Rate-Limit-ConcurrentRemaining). Idempotency, cancellation, and reconciliation semantics are not documented in the evidence." }, "secondary_context": [ { "signal_code": "agent_protocol_interface", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "context": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Sentry Web API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "credential_lifecycle", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "context": "Sentry OAuth2 documentation explicitly defines access token expiration (30 days) and refreshing tokens via the POST /oauth/token/ endpoint using a refresh_token, as well as handling 401 error codes for expired or revoked tokens. Other lifecycle operations like explicit revocation or compromise recovery are not documented in the evidence." }, { "signal_code": "target_interface_access", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "context": "Every essential target endpoint across general API reference, issue operations, permissions, project provisioning, and rate limits has a documented HTTP REST API interface usable by automated agents." }, { "signal_code": "operation_authentication", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "context": "Request-time authentication for Sentry Web API operations is documented using Bearer auth tokens in HTTP Authorization headers, supporting user authentication tokens, internal integration tokens, and OAuth2 access tokens with organization scoping." }, { "signal_code": "operation_contract", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "context": "Across all required targets, Sentry documents stable HTTP methods, endpoint paths, path/body parameters, required permissions/scopes, response status codes, and JSON response schemas (e.g., POST /api/0/teams/{organization_id_or_slug}/{team_id_or_slug}/projects/)." } ], "signals": [ { "signal_code": "agent_protocol_interface", "evaluation_role": "informational", "required": false, "value": "unknown", "value_label": "Unknown", "outcome": "unknown", "public_state": "unknown", "condition": "Is an agent-native protocol interface verified against the essential targets?", "finding": "Current admissible evidence does not resolve this finding.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:50:40.240Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "issue-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [], "note": "The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for Sentry Web API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets." }, { "signal_code": "credential_lifecycle", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?", "finding": "Only part of the credential lifecycle is agent-operable.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:52.908Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c48cc10228d50c07e1ea55b2b15d01a568c12efee429e10ecd822daed2fa62ee", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "sha256:609ebe92eb0f415eb0220019bb1982792654d60a34f6133be5348f4e624bd952", "sha256:c5d5dc901d7b5349cb1bdc042001463336b2d12c06e15cdd8048d92b7f70742a", "sha256:cdbdef9b07860d6d277da9d8bf69bf0eadd6a0b232196f945752689dedd09791" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "start_byte": 3412, "end_byte": 4199, "value_digest": "sha256:58234fd1b6f9ae902b66cffc3a5dacfc2331002ce0f7a487d58f07a1d018eb6f" }, { "artifact_digest": "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "start_byte": 5647, "end_byte": 6382, "value_digest": "sha256:55aa44b29bde97e816cb50530614a906f3f95a2e4694275c3c0d6bef3f47fd6d" } ] } ], "note": "Sentry OAuth2 documentation explicitly defines access token expiration (30 days) and refreshing tokens via the POST /oauth/token/ endpoint using a refresh_token, as well as handling 401 error codes for expired or revoked tokens. Other lifecycle operations like explicit revocation or compromise recovery are not documented in the evidence.", "remediation": { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } }, { "signal_code": "failure_contract", "evaluation_role": "graded", "required": true, "value": "partial", "value_label": "Limited", "outcome": "constrained", "public_state": "limited", "condition": "Can an agent handle applicable failure modes safely?", "finding": "Safe failure handling is documented only partially.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:29.249Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "rate-limits" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e57c727e3dd4a9cf4b6fb81595ce2166dc5a28d0f805db18175e87d434fbc762", "capture_rung": "http" } ], "artifact_digests": [ "sha256:25766fc9addf710351efad78f54b1dbecc5cbc20d3782eb105a4de65415080c2", "sha256:53c771162eb0cac30023d72398d6aa0581dc6aca28700e05ef8f6af08b4bfef0", "sha256:83ba68cd2c994f9f415dd10b321a5acd05719bc8922153f1fd7103726094c87f", "sha256:83d7526e67d8e5f97f6f1d652a3c9fd513d4a337253baa404574e7fcdab3d7f0" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:83ba68cd2c994f9f415dd10b321a5acd05719bc8922153f1fd7103726094c87f", "start_byte": 1629, "end_byte": 2428, "value_digest": "sha256:ce6048500d1903b7ad2f3ab1f365aba94a3e28ce0bfb1f9bdb2738d05cc29d98" }, { "artifact_digest": "sha256:83ba68cd2c994f9f415dd10b321a5acd05719bc8922153f1fd7103726094c87f", "start_byte": 2429, "end_byte": 3189, "value_digest": "sha256:5ca5082c5305e55ea3d9bd0e50c8b54a76d08f9c28a58aecf02eb0f43e821aaf" } ] } ], "note": "Sentry documents rate limit failure handling through fixed-window and concurrent rate limiters, 429 rejection behavior, and specific tracking headers (X-Sentry-Rate-Limit-Limit, X-Sentry-Rate-Limit-Remaining, X-Sentry-Rate-Limit-Reset, X-Sentry-Rate-Limit-ConcurrentLimit, X-Sentry-Rate-Limit-ConcurrentRemaining). Idempotency, cancellation, and reconciliation semantics are not documented in the evidence.", "remediation": { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." } }, { "signal_code": "operation_authentication", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent authenticate service operations with scoped authority?", "finding": "Request-time authentication is documented and usable under scoped agent authority.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:52.908Z", "tested_surfaces": [ { "node_kind": "resource", "node_id": "authentication" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:c48cc10228d50c07e1ea55b2b15d01a568c12efee429e10ecd822daed2fa62ee", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "sha256:23d052ef5732d4b9b01973929dde7e7d1d60034863ed0dd4c6f263cf50892aa1", "sha256:c5d5dc901d7b5349cb1bdc042001463336b2d12c06e15cdd8048d92b7f70742a", "sha256:cdbdef9b07860d6d277da9d8bf69bf0eadd6a0b232196f945752689dedd09791" ], "source_surface": { "node_kind": "resource", "node_id": "authentication" }, "locators": [ { "artifact_digest": "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "start_byte": 2613, "end_byte": 3411, "value_digest": "sha256:354e5239c7e6fdfdaf61ee42c4cfdedc68a6b69c70a6265a074030475cab0678" }, { "artifact_digest": "sha256:0723436302f9d3eb88d0995aa6fb09c12a247d999dfbfaad79715408abbf0ecd", "start_byte": 6383, "end_byte": 7178, "value_digest": "sha256:d0c15b411fd61cdafd04047327dc76ff384a1f746671656745a5ef479423567b" } ] } ], "note": "Request-time authentication for Sentry Web API operations is documented using Bearer auth tokens in HTTP Authorization headers, supporting user authentication tokens, internal integration tokens, and OAuth2 access tokens with organization scoping." }, { "signal_code": "operation_contract", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Are essential operation inputs, outputs, and effects stable and decidable?", "finding": "Essential operations have stable readable request, response, and effect semantics.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:42.125Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "issue-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:aaf9f02da8594e913823b6438c4c1ae3f4de05ba2e7cb8f561d4dda7e283fe5e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bfbe255d624f7860d33694564ab16582ebce9ba5d5db793fbe81cbc21fd8c0", "sha256:37e147449a19686ac1678b17c9d0b039f5f52dd2f2891177f321651444b23945", "sha256:4b742d13e6df285f2b7514a0b2c340d135784a8b623f64bad0510438967a6d65", "sha256:6356389b504907e815006ab6a55cfb3d1839e8bc41eb6828e18834773e41d64b" ], "source_surface": { "node_kind": "resource", "node_id": "project-provisioning" }, "locators": [ { "artifact_digest": "sha256:6356389b504907e815006ab6a55cfb3d1839e8bc41eb6828e18834773e41d64b", "start_byte": 5678, "end_byte": 6474, "value_digest": "sha256:8a2fe83f81f8aafe9904f2026847e2cf8bea3e90e9ed970233e4f8bddf4165e0" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5b8d016dcdd390da9a3bf576a85fd4ece2409f2dd8be70910d2f42306acb3477", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0a03fd694ea9776b7004d92a4d3696cc619ebdc14c68404faad1fc785f46fb5e", "sha256:4d1672a8179a6393ffab3ee194d00f090000d80662fdabcc0d04188ef3639ed8", "sha256:d1177a980d5ed2d97860b9bccff6c11cecd005be8b65b9ad5e45861a3f38ec79", "sha256:e018477628f8313e9827fc3c655d44cb668807159993a59449af9ddf6ec79450" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:d1177a980d5ed2d97860b9bccff6c11cecd005be8b65b9ad5e45861a3f38ec79", "start_byte": 2031, "end_byte": 2830, "value_digest": "sha256:f27e78635b4c71df27137f71d68c5240b8407fd9fd0204beae3c8fe960623957" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:1e420effdfd4e005942ba434f83f900f1cf8baf1df582ee542832d973a8682d5", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0c1994d2ec784346d8cbe4f55b7214a6394212787706ac720b8cadc453795988", "sha256:0d4daf3ca0cc328d3dcdb1e3efe4015aca262fc944f7d6adfd64a6c8db6d46ce", "sha256:629e7322d73fcf1491ef382527c2673a86782ef4ccddfccc7af0072692bde5e7", "sha256:d74a9206081495fc6fc5d392cdf56c5b1cce92d5f282a5058b3558a2c4889a2a" ], "source_surface": { "node_kind": "resource", "node_id": "permissions" }, "locators": [ { "artifact_digest": "sha256:d74a9206081495fc6fc5d392cdf56c5b1cce92d5f282a5058b3558a2c4889a2a", "start_byte": 2717, "end_byte": 3464, "value_digest": "sha256:998a86c5a0576a51e7fc6643808ec2adbc10e6b6d6fa369e4e594b4f1729a654" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b54b817cebafbe5921d9ca0c2358084d9e72534fdb82f2984fd728f8e37c8b06", "capture_rung": "http" } ], "artifact_digests": [ "sha256:111fe10493663b49523440fee76aa4ebbafe83393b1a6177b49bbe8a8cf1b829", "sha256:1b2250621ce4b03ee48cc5c3d3cff24da8311ed1e874f6d0c8582b8afcc27232", "sha256:b42dd7b64a5b62f3b726b99fbbd3d339cea6e94935eceb459dadd0acded260f2", "sha256:d54db5b8a1448a4d1bf6a5f707b3723452865f94075c5a60d70bb63728fe376b" ], "source_surface": { "node_kind": "resource", "node_id": "issue-operations" }, "locators": [ { "artifact_digest": "sha256:b42dd7b64a5b62f3b726b99fbbd3d339cea6e94935eceb459dadd0acded260f2", "start_byte": 3743, "end_byte": 4543, "value_digest": "sha256:0ebae72c070145a8983bd43e40859f6e441f109468e32ea76085d300edb073dd" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e57c727e3dd4a9cf4b6fb81595ce2166dc5a28d0f805db18175e87d434fbc762", "capture_rung": "http" } ], "artifact_digests": [ "sha256:53c771162eb0cac30023d72398d6aa0581dc6aca28700e05ef8f6af08b4bfef0", "sha256:620bf22f9795df074ead1de5d6127abc10c3d4e1d65f0e8ed72d89739c3c8e5d", "sha256:83ba68cd2c994f9f415dd10b321a5acd05719bc8922153f1fd7103726094c87f", "sha256:83d7526e67d8e5f97f6f1d652a3c9fd513d4a337253baa404574e7fcdab3d7f0" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:83ba68cd2c994f9f415dd10b321a5acd05719bc8922153f1fd7103726094c87f", "start_byte": 1629, "end_byte": 2428, "value_digest": "sha256:ce6048500d1903b7ad2f3ab1f365aba94a3e28ce0bfb1f9bdb2738d05cc29d98" } ] } ], "note": "Across all required targets, Sentry documents stable HTTP methods, endpoint paths, path/body parameters, required permissions/scopes, response status codes, and JSON response schemas (e.g., POST /api/0/teams/{organization_id_or_slug}/{team_id_or_slug}/projects/)." }, { "signal_code": "target_interface_access", "evaluation_role": "graded", "required": true, "value": "yes", "value_label": "Ready", "outcome": "pass", "public_state": "ready", "condition": "Can an agent perform every essential assessment target through a usable interface?", "finding": "Every essential target has a stable documented agent-usable interface alternative.", "evidence_status": "supported", "freshness": "fresh", "observed_at": "2026-09-06T08:51:42.125Z", "tested_surfaces": [ { "node_kind": "interface", "node_id": "issue-api" } ], "assessment_method": { "name": "public-semantic-assessment", "version": "2026-09-06", "method_digest": "sha256:02ec902925d3816c86a32a3d15dc2e7af6ce9931c24b9cf264063e596952d1c4" }, "determination_bases": [ { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:aaf9f02da8594e913823b6438c4c1ae3f4de05ba2e7cb8f561d4dda7e283fe5e", "capture_rung": "http" } ], "artifact_digests": [ "sha256:12bfbe255d624f7860d33694564ab16582ebce9ba5d5db793fbe81cbc21fd8c0", "sha256:37e147449a19686ac1678b17c9d0b039f5f52dd2f2891177f321651444b23945", "sha256:4b742d13e6df285f2b7514a0b2c340d135784a8b623f64bad0510438967a6d65", "sha256:6356389b504907e815006ab6a55cfb3d1839e8bc41eb6828e18834773e41d64b" ], "source_surface": { "node_kind": "resource", "node_id": "project-provisioning" }, "locators": [ { "artifact_digest": "sha256:6356389b504907e815006ab6a55cfb3d1839e8bc41eb6828e18834773e41d64b", "start_byte": 5678, "end_byte": 6474, "value_digest": "sha256:8a2fe83f81f8aafe9904f2026847e2cf8bea3e90e9ed970233e4f8bddf4165e0" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:5b8d016dcdd390da9a3bf576a85fd4ece2409f2dd8be70910d2f42306acb3477", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0a03fd694ea9776b7004d92a4d3696cc619ebdc14c68404faad1fc785f46fb5e", "sha256:4d1672a8179a6393ffab3ee194d00f090000d80662fdabcc0d04188ef3639ed8", "sha256:d1177a980d5ed2d97860b9bccff6c11cecd005be8b65b9ad5e45861a3f38ec79", "sha256:e018477628f8313e9827fc3c655d44cb668807159993a59449af9ddf6ec79450" ], "source_surface": { "node_kind": "resource", "node_id": "api-reference" }, "locators": [ { "artifact_digest": "sha256:d1177a980d5ed2d97860b9bccff6c11cecd005be8b65b9ad5e45861a3f38ec79", "start_byte": 2031, "end_byte": 2830, "value_digest": "sha256:f27e78635b4c71df27137f71d68c5240b8407fd9fd0204beae3c8fe960623957" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:1e420effdfd4e005942ba434f83f900f1cf8baf1df582ee542832d973a8682d5", "capture_rung": "http" } ], "artifact_digests": [ "sha256:0c1994d2ec784346d8cbe4f55b7214a6394212787706ac720b8cadc453795988", "sha256:0d4daf3ca0cc328d3dcdb1e3efe4015aca262fc944f7d6adfd64a6c8db6d46ce", "sha256:629e7322d73fcf1491ef382527c2673a86782ef4ccddfccc7af0072692bde5e7", "sha256:d74a9206081495fc6fc5d392cdf56c5b1cce92d5f282a5058b3558a2c4889a2a" ], "source_surface": { "node_kind": "resource", "node_id": "permissions" }, "locators": [ { "artifact_digest": "sha256:d74a9206081495fc6fc5d392cdf56c5b1cce92d5f282a5058b3558a2c4889a2a", "start_byte": 2717, "end_byte": 3464, "value_digest": "sha256:998a86c5a0576a51e7fc6643808ec2adbc10e6b6d6fa369e4e594b4f1729a654" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:b54b817cebafbe5921d9ca0c2358084d9e72534fdb82f2984fd728f8e37c8b06", "capture_rung": "http" } ], "artifact_digests": [ "sha256:111fe10493663b49523440fee76aa4ebbafe83393b1a6177b49bbe8a8cf1b829", "sha256:1b2250621ce4b03ee48cc5c3d3cff24da8311ed1e874f6d0c8582b8afcc27232", "sha256:b42dd7b64a5b62f3b726b99fbbd3d339cea6e94935eceb459dadd0acded260f2", "sha256:d54db5b8a1448a4d1bf6a5f707b3723452865f94075c5a60d70bb63728fe376b" ], "source_surface": { "node_kind": "resource", "node_id": "issue-operations" }, "locators": [ { "artifact_digest": "sha256:b42dd7b64a5b62f3b726b99fbbd3d339cea6e94935eceb459dadd0acded260f2", "start_byte": 3743, "end_byte": 4543, "value_digest": "sha256:0ebae72c070145a8983bd43e40859f6e441f109468e32ea76085d300edb073dd" } ] }, { "kind": "explicit_first_party_declaration", "captures": [ { "retained_capture_digest": "sha256:e57c727e3dd4a9cf4b6fb81595ce2166dc5a28d0f805db18175e87d434fbc762", "capture_rung": "http" } ], "artifact_digests": [ "sha256:53c771162eb0cac30023d72398d6aa0581dc6aca28700e05ef8f6af08b4bfef0", "sha256:620bf22f9795df074ead1de5d6127abc10c3d4e1d65f0e8ed72d89739c3c8e5d", "sha256:83ba68cd2c994f9f415dd10b321a5acd05719bc8922153f1fd7103726094c87f", "sha256:83d7526e67d8e5f97f6f1d652a3c9fd513d4a337253baa404574e7fcdab3d7f0" ], "source_surface": { "node_kind": "resource", "node_id": "rate-limits" }, "locators": [ { "artifact_digest": "sha256:83ba68cd2c994f9f415dd10b321a5acd05719bc8922153f1fd7103726094c87f", "start_byte": 1629, "end_byte": 2428, "value_digest": "sha256:ce6048500d1903b7ad2f3ab1f365aba94a3e28ce0bfb1f9bdb2738d05cc29d98" } ] } ], "note": "Every essential target endpoint across general API reference, issue operations, permissions, project provisioning, and rate limits has a documented HTTP REST API interface usable by automated agents." } ], "blockers": [], "remediations": [ { "signal_code": "failure_contract", "code": "improve.operate.failure_contract", "instruction": "Document applicable structured errors, retry, cancellation, and reconciliation semantics." }, { "signal_code": "credential_lifecycle", "code": "improve.operate.credential_lifecycle", "instruction": "Provide scoped expiry, rotation, revocation, compromise, and recovery operations." } ] } ], "coverage": { "status": "complete", "required_signals": 14, "covered_signals": 14, "ratio": 1, "barrier_signals": 5, "verified_barrier_signals": 1, "barrier_ratio": 0.2 }, "last_tested_at": "2026-09-06T08:51:52.908Z", "freshness": "fresh", "provenance": { "freshness": "fresh", "dispute": "none", "coverage_policy_digest": "sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d", "freshness_policy_digest": "sha256:b71bacf415fdbef01024355fb3d080df7a9dca05d2cce9a2a1f691fe8a60f579", "basis_event_ids": [ "sha256:01dc13968f36bd8bc856de5bcc727fda1342b23a046d3f62110532c154383687", "sha256:0835d6095a6811821e7d4be5d7af06e2e4d65653a5fcd9134c42308b2d6e2888", "sha256:1a35215f670d61b90587324ea5db317db27b77ba124502c328a512abeb6d0fd2", "sha256:2c923b3710b1a6473ab122273edfbaf5a95b15642c8c2c928dd721869ddcff32", "sha256:3686e243cd2f6f4c329e28647ef2ebc4f29046cfe6953dacde3c1369e47f3ab7", "sha256:374c33e66760e439ed273982db288223468e0c6ec5a57637761332f9bdf75560", "sha256:4e4ad8f2f1b6ee853ddf7b84c1d5040e18c28b45bf2cf87a52aadda79dac9603", "sha256:5932fcd11f9183773c88e1659a948da2be1c53f5109805925c6358de5684457e", "sha256:5ed1a22902904e716c0c951bdfa3a3661f182bc96c80c66785e13c5eb5f3ecb8", "sha256:62c7ca198ee3bbd9038ad6ec728d9c2eb85b59d9c450ec6e62e852cc922c1924", "sha256:676d454b81cca980791f43ddc6af7f6ab1602a21596c1722b3340ee8d9d54fd0", "sha256:6ab6cba5f6ee2b1ce9c137c8e51b79cfd6edb9d801d8c6a41c6ce7aeb3333d84", "sha256:6f685c62caf1e509f89d46a723ccd1038a4cfc5bc4b7fe113b0584cc371d9fcf", "sha256:707734ad9f0c81d43e422ecc82a70cf781f06b47f9ed88edf354bc65476103e2", "sha256:738ef707be620c842d3c2dd098ce3c1e8962fccfd64da0e1c4f998c0f44542de", "sha256:8e94a91eac814e73d67d62e93c227e487876020a2e8f1b550bf3d4dad59834a2", "sha256:949ca0cef37c15c5f26591c547090e79dedd550b6e1ec0ed71db17a94f18de31", "sha256:9bd13a142245e4d01da12e4fb8f09f3766f3add56ea22ba5483485c74cdc7886", "sha256:9dc6262a1f6fadbcde839f39a96f7aeb40a1be7bcb87e8b913a507e932161831", "sha256:9e20e3be9524d8b323d9d78d8077bd787ca3b67c489bea204f603d03ee09c7f1", "sha256:a793b55821e10b14a95156195f4130d7345cdd871d822a0de3bccd2ed302f41b", "sha256:b09e6dc50ee6593c6fe1b5d11d59488d7f1bd0c110eabaa725a5d0cecd6603c9", "sha256:b20bca71fab4f1175d3d4f5c5b664013b97c6791860629aa5748f04116bdcf58", "sha256:b77dc56ad53d8505bb7dea162486ac09637b2efc406fbaa59c929fca9e9a0b97", "sha256:bd95db7dd5a645935abfc327cbf1a0863db07a8aa2a86d71f329f3cb5bd0e0ed", "sha256:beb77a224f58f261e4056a51e87438f9f0e1f13c4151930c874da6aa6d207178", "sha256:c6e3c5c8e84ebe6d1c09c266f058f037383ba744b17bcb1be675d53976cfb6a6", "sha256:ceb501813852bde483b906be82d5aa3d1e4ee6519c7b3a91acf9df7f4ebc3c7b", "sha256:cf74273bdd82085e6488a1fb9c9459e90b026ba3fe2eee5095bafecf387f44df", "sha256:d0aa8fe3d592b8095c7ebac36bcb36e401883eca1b229d8d6988897aa21f4c6a", "sha256:d362e09b336fc0be4ab83d8039be229b350a62b33deb37c7ae43a8e5ce104c7d", "sha256:db21f36c69c91d813fe2dde24cbf80fa8773c65a08fc42d8edbc8fe8dda8c672", "sha256:e05e60e5a9af16327493cde8d3ba26d195df874ce1605c67790283a968600c2b", "sha256:f45d85de32e05ce1ab3d2785e838adcebed762ac10c858bf90a09dd91d2c1294", "sha256:f4c8a2e6be97424323d80e4024e837d2200328c11220258d946a793bf5657387", "sha256:f6d89fcd8e5dfaa908b11dac14024de2eb40ea57b3d1fe3e7599d0b37decd10c" ], "fields": [ { "path": "/signals/0", "supporting_event_ids": [ "sha256:ceb501813852bde483b906be82d5aa3d1e4ee6519c7b3a91acf9df7f4ebc3c7b" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:29.829Z", "freshness": "fresh" }, { "path": "/signals/1", "supporting_event_ids": [ "sha256:2c923b3710b1a6473ab122273edfbaf5a95b15642c8c2c928dd721869ddcff32" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:43.821Z", "freshness": "fresh" }, { "path": "/signals/2", "supporting_event_ids": [ "sha256:b77dc56ad53d8505bb7dea162486ac09637b2efc406fbaa59c929fca9e9a0b97" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:40.240Z", "freshness": "fresh" }, { "path": "/signals/3", "supporting_event_ids": [ "sha256:01dc13968f36bd8bc856de5bcc727fda1342b23a046d3f62110532c154383687", "sha256:5932fcd11f9183773c88e1659a948da2be1c53f5109805925c6358de5684457e" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:52.908Z", "freshness": "fresh" }, { "path": "/signals/4", "supporting_event_ids": [ "sha256:4e4ad8f2f1b6ee853ddf7b84c1d5040e18c28b45bf2cf87a52aadda79dac9603" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:29.829Z", "freshness": "fresh" }, { "path": "/signals/5", "supporting_event_ids": [ "sha256:8e94a91eac814e73d67d62e93c227e487876020a2e8f1b550bf3d4dad59834a2", "sha256:c6e3c5c8e84ebe6d1c09c266f058f037383ba744b17bcb1be675d53976cfb6a6" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:52.908Z", "freshness": "fresh" }, { "path": "/signals/6", "supporting_event_ids": [ "sha256:9dc6262a1f6fadbcde839f39a96f7aeb40a1be7bcb87e8b913a507e932161831" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:59.545Z", "freshness": "fresh" }, { "path": "/signals/7", "supporting_event_ids": [ "sha256:949ca0cef37c15c5f26591c547090e79dedd550b6e1ec0ed71db17a94f18de31" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:59.545Z", "freshness": "fresh" }, { "path": "/signals/8", "supporting_event_ids": [ "sha256:707734ad9f0c81d43e422ecc82a70cf781f06b47f9ed88edf354bc65476103e2", "sha256:9e20e3be9524d8b323d9d78d8077bd787ca3b67c489bea204f603d03ee09c7f1" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:59.545Z", "freshness": "fresh" }, { "path": "/signals/9", "supporting_event_ids": [ "sha256:db21f36c69c91d813fe2dde24cbf80fa8773c65a08fc42d8edbc8fe8dda8c672" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:52.908Z", "freshness": "fresh" }, { "path": "/signals/10", "supporting_event_ids": [ "sha256:bd95db7dd5a645935abfc327cbf1a0863db07a8aa2a86d71f329f3cb5bd0e0ed" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:59.545Z", "freshness": "fresh" }, { "path": "/signals/11", "supporting_event_ids": [ "sha256:f4c8a2e6be97424323d80e4024e837d2200328c11220258d946a793bf5657387" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:36.983Z", "freshness": "fresh" }, { "path": "/signals/12", "supporting_event_ids": [ "sha256:b09e6dc50ee6593c6fe1b5d11d59488d7f1bd0c110eabaa725a5d0cecd6603c9" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:43.821Z", "freshness": "fresh" }, { "path": "/signals/13", "supporting_event_ids": [ "sha256:f45d85de32e05ce1ab3d2785e838adcebed762ac10c858bf90a09dd91d2c1294" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:36.983Z", "freshness": "fresh" }, { "path": "/signals/14", "supporting_event_ids": [ "sha256:d0aa8fe3d592b8095c7ebac36bcb36e401883eca1b229d8d6988897aa21f4c6a" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:36.983Z", "freshness": "fresh" }, { "path": "/signals/15", "supporting_event_ids": [ "sha256:5ed1a22902904e716c0c951bdfa3a3661f182bc96c80c66785e13c5eb5f3ecb8" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:52.908Z", "freshness": "fresh" }, { "path": "/signals/16", "supporting_event_ids": [ "sha256:3686e243cd2f6f4c329e28647ef2ebc4f29046cfe6953dacde3c1369e47f3ab7" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:42.125Z", "freshness": "fresh" }, { "path": "/signals/17", "supporting_event_ids": [ "sha256:6f685c62caf1e509f89d46a723ccd1038a4cfc5bc4b7fe113b0584cc371d9fcf", "sha256:d362e09b336fc0be4ab83d8039be229b350a62b33deb37c7ae43a8e5ce104c7d" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:52.908Z", "freshness": "fresh" }, { "path": "/signals/18", "supporting_event_ids": [ "sha256:0835d6095a6811821e7d4be5d7af06e2e4d65653a5fcd9134c42308b2d6e2888" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:50:40.240Z", "freshness": "fresh" }, { "path": "/signals/19", "supporting_event_ids": [ "sha256:9bd13a142245e4d01da12e4fb8f09f3766f3add56ea22ba5483485c74cdc7886" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:52.908Z", "freshness": "fresh" }, { "path": "/signals/20", "supporting_event_ids": [ "sha256:e05e60e5a9af16327493cde8d3ba26d195df874ce1605c67790283a968600c2b" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:29.249Z", "freshness": "fresh" }, { "path": "/signals/21", "supporting_event_ids": [ "sha256:62c7ca198ee3bbd9038ad6ec728d9c2eb85b59d9c450ec6e62e852cc922c1924" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:52.908Z", "freshness": "fresh" }, { "path": "/signals/22", "supporting_event_ids": [ "sha256:1a35215f670d61b90587324ea5db317db27b77ba124502c328a512abeb6d0fd2", "sha256:676d454b81cca980791f43ddc6af7f6ab1602a21596c1722b3340ee8d9d54fd0", "sha256:a793b55821e10b14a95156195f4130d7345cdd871d822a0de3bccd2ed302f41b", "sha256:b20bca71fab4f1175d3d4f5c5b664013b97c6791860629aa5748f04116bdcf58", "sha256:beb77a224f58f261e4056a51e87438f9f0e1f13c4151930c874da6aa6d207178" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:42.125Z", "freshness": "fresh" }, { "path": "/signals/23", "supporting_event_ids": [ "sha256:374c33e66760e439ed273982db288223468e0c6ec5a57637761332f9bdf75560", "sha256:6ab6cba5f6ee2b1ce9c137c8e51b79cfd6edb9d801d8c6a41c6ce7aeb3333d84", "sha256:738ef707be620c842d3c2dd098ce3c1e8962fccfd64da0e1c4f998c0f44542de", "sha256:cf74273bdd82085e6488a1fb9c9459e90b026ba3fe2eee5095bafecf387f44df", "sha256:f6d89fcd8e5dfaa908b11dac14024de2eb40ea57b3d1fe3e7599d0b37decd10c" ], "contradicting_event_ids": [], "accepted_proof_kinds": [ "observed" ], "evidence_proof_kinds": [ "observed" ], "latest_observation_at": "2026-09-06T08:51:42.125Z", "freshness": "fresh" } ], "vendor_attestation": { "status": "none" } }, "canonical_url": "https://sourcey.com/log/sentry/agent-readiness/sentry-web-api/issue-operations", "projection_digest": "sha256:ea0b23b9cc3076fbe5cdb5175180f1cc5586769ccdcb7bf4fa9e35a2276d9781" } } }