Driftwatch

GitHub / GitHub REST API /

Breakingdirection flip: their tools call this safe

allowed_custom_agents is no longer accepted

What changed

Usually ignored rather than rejected, so the call succeeds and does something subtly different.

Affects allowed_custom_agents on POST /agents/repos/{owner}/{repo}/automations. Grep for it: nothing else will tell you.

Who is affected

Code that sends POST /agents/repos/{owner}/{repo}/automations (allowed_custom_agents).

Before and after

WhereBeforeAfter
POST /agents/repos/{owner}/{repo}/automations · allowed_custom_agentspresentabsent
PATCH /agents/repos/{owner}/{repo}/automations/{automation_id} · allowed_custom_agentspresentabsent

Code that breaks

await client.post("/agents/repos/{owner}/{repo}/automations", {
  // allowed_custom_agents is now ignored, not rejected
  allowed_custom_agents: value,
});

Based on GitHub’s published API specification. How severity is decided.