CONFORMANCE.md

<!-- GENERATED by conformance/cmd/genmatrix — do not edit by hand.
     Regenerate with `just conformance-matrix`; CI regenerates and fails on drift.
     SDK versions are read live from conformance/go.mod and
     conformance/node/package.json, so they cannot go stale here. -->

# SDK conformance matrix

Every reference adapter, and how it is verified. The conformance suites drive
**real official SDKs** — their serialization, their request signing, their
client-side validation — against booted stunt adapters, not hand-rolled HTTP
calls.

Verification tiers:

- **SDK** — an official provider SDK is driven against the adapter in CI (Go
  suites run against the engine; Node suites boot the real `stunt` binary
  and go through the CLI end to end).
- **VM** — handler-level Go tests (`adapters/<name>_test.go`) execute the
  adapter's Starlark handlers directly.
- **boot** — clears `stunt adapter lint`, the all-scripts-parse guard and
  the all-adapters-boot guard on every CI run; no SDK suite drives it yet.
- Every adapter additionally documents its behavior in depth in its README.

**SDK coverage is go and node only.** Every client in the Official SDK(s)
column is one of those languages. No client written in any other language is driven
against any adapter today, so this matrix says nothing about how such an SDK would
behave. A `—` in that column means *no client is driven* — which is not the
same as *no client existing*.

**Version annotations.** A version with no annotation is an exact `go.mod` entry, so a run reproduces from it. *(floor)* marks a declared *minimum* — the npm caret range in `package.json` — so the version actually exercised may be higher than the one printed. Prefer a pinned version when you need to reproduce a run exactly.

**99 adapters** — 2 SDK+VM, 34 SDK-only, 59 VM-only, 4 boot-tier.

**45 adapters carry derived provider-surface coverage**: their real-API route totals come from the route tables embedded in the pinned official SDKs (Google Discovery docs inside `google-api-go-client`; generated tables inside the Node clients) or from official specs vendored under `conformance/surfaces/` (refreshed by `just surfaces-fetch`) — mechanical and network-free at generation time. For those rows the derived not-implemented list supplements the curated Missing column; adapters without one have no trustworthy machine-readable surface and stay fully curated.

Behavior columns come in two kinds: **verified** (an official SDK was driven against the adapter and the check passed — the Behaviors counts in the matrix above) and **derived** (static analysis of the handler scripts — every adapter's *Derived behavior tags* block below says what the code does, not that a client confirmed it).

| Adapter | API | Routes | Verification | Official SDK(s) | Behaviors | Missing | Deviations |
|---|---|---|---|---|---|---|---|
| [adyen-style](adapters/adyen-style/) | Adyen Checkout + Notification API `v68` | 14 | VM | — | — | [4](#adyen-style) | [8](#adyen-style) |
| [anaplan-style](adapters/anaplan-style/) | Anaplan API `2.0` | 18 | VM | — | — | [4](#anaplan-style) | [5](#anaplan-style) |
| [apple-apns-style](adapters/apple-apns-style/) | Apple Push Notification service (APNs) `v2` | 2 | VM | — | — | [4](#apple-apns-style) | [3](#apple-apns-style) |
| [apple-appstoreconnect-style](adapters/apple-appstoreconnect-style/) | App Store Connect API `v3` | 15 | VM | — | — | [7](#apple-appstoreconnect-style) | [7](#apple-appstoreconnect-style) |
| [apple-music-style](adapters/apple-music-style/) | Apple Music API `1.0` | 18 | VM | — | — | [5](#apple-music-style) | [5](#apple-music-style) |
| [apple-searchads-style](adapters/apple-searchads-style/) | Apple Search Ads API `v4` | 12 | VM | — | — | [4](#apple-searchads-style) | [5](#apple-searchads-style) |
| [apps-script-style](adapters/apps-script-style/) | Google Apps Script API `v1` | 11 | SDK | google-api-go-client @ v0.299.0 | 6 | [2](#apps-script-style) | [3](#apps-script-style) |
| [auth0-style](adapters/auth0-style/) | Auth0 Authentication & Management API `v2` | 17 | VM | — | — | [3](#auth0-style) | [4](#auth0-style) |
| [avalara-style](adapters/avalara-style/) | Avalara AvaTax REST API `2` | 8 | VM | — | — | [5](#avalara-style) | [3](#avalara-style) |
| [aws-cognito-style](adapters/aws-cognito-style/) | Amazon Cognito Identity Provider API `2016-04-18` | 7 | VM | — | — | [6](#aws-cognito-style) | [3](#aws-cognito-style) |
| [aws-iam-sts-style](adapters/aws-iam-sts-style/) | AWS STS + IAM API `2011-06-15` | 2 | SDK | aws-sdk-go-v2 @ v1.47.1 | 2 | [3](#aws-iam-sts-style) | [3](#aws-iam-sts-style) |
| [aws-s3-style](adapters/aws-s3-style/) | Amazon S3 API `2006-03-01` | 9 | SDK | aws-sdk-go-v2 @ v1.47.1 | 16 | [9](#aws-s3-style) | [16](#aws-s3-style) |
| [azure-devops-style](adapters/azure-devops-style/) | Azure DevOps REST API `7.1` | 17 | VM | — | — | [8](#azure-devops-style) | [6](#azure-devops-style) |
| [azure-servicebus-style](adapters/azure-servicebus-style/) | Azure Service Bus + Storage `2024-01-01` | 18 | VM | — | — | [6](#azure-servicebus-style) | [3](#azure-servicebus-style) |
| [azure-storage-style](adapters/azure-storage-style/) | Azure Storage Blob REST API `2024-08-04` | 9 | VM | — | — | [6](#azure-storage-style) | [3](#azure-storage-style) |
| [blog-style](adapters/blog-style/) | GraphQL demo `1.0` | 0 +GQL | boot | — | — | — | — |
| [bluesky-style](adapters/bluesky-style/) | Bluesky AT Protocol `com.atproto (2024-Q4)` | 7 | SDK | atproto @ 0.20.41 (floor) | 8 | [7](#bluesky-style) | [4](#bluesky-style) |
| [braintree-style](adapters/braintree-style/) | Braintree GraphQL + REST API `2024-09-01` | 15 +GQL | VM | — | — | [8](#braintree-style) | [7](#braintree-style) |
| [braze-style](adapters/braze-style/) | Braze REST API `2.0` | 12 | VM | — | — | [8](#braze-style) | [6](#braze-style) |
| [chainlink-style](adapters/chainlink-style/) | Chainlink Data Feeds + Functions + Automation `1.0` | 21 | VM | — | — | [6](#chainlink-style) | [7](#chainlink-style) |
| [cloudflare-style](adapters/cloudflare-style/) | Cloudflare API `4` | 35 | SDK | cloudflare-go @ v0.119.0 | 7 | [8](#cloudflare-style) | [6](#cloudflare-style) |
| [cloudkit-style](adapters/cloudkit-style/) | CloudKit Web Services API `1` | 5 | VM | — | — | [6](#cloudkit-style) | [2](#cloudkit-style) |
| [discord-style](adapters/discord-style/) | Discord API `v10` | 26 (+1 ws) | SDK | discord-node @ 2.6.3 (floor) | 5 | [8](#discord-style) | [5](#discord-style) |
| [drive-style](adapters/drive-style/) | Google Drive API `v3` | 13 | SDK | google-api-go-client @ v0.299.0 | 8 | [7](#drive-style) | [5](#drive-style) |
| [dropbox-style](adapters/dropbox-style/) | Dropbox API `2` | 8 | VM | — | — | [8](#dropbox-style) | [4](#dropbox-style) |
| [dune-style](adapters/dune-style/) | Dune Analytics API `v1` | 6 | VM | — | — | [5](#dune-style) | [4](#dune-style) |
| [dynamodb-style](adapters/dynamodb-style/) | Amazon DynamoDB API `2012-08-10` | 1 | SDK + VM | aws-sdk-go-v2 @ v1.47.1 | 8 | [8](#dynamodb-style) | [5](#dynamodb-style) |
| [echo-style](adapters/echo-style/) | gRPC echo demo `1.0` | 0 (+1 ws) | boot | — | — | — | — |
| [emailoctopus-style](adapters/emailoctopus-style/) | EmailOctopus API `2.0.0` | 21 | VM | — | — | [2](#emailoctopus-style) | [3](#emailoctopus-style) |
| [entra-id-style](adapters/entra-id-style/) | Microsoft Graph / Entra ID `v1.0` | 9 | SDK | microsoft-graph-client @ 3.0.7 (floor) | 8 | [8](#entra-id-style) | [3](#entra-id-style) |
| [erc4337-style](adapters/erc4337-style/) | ERC-4337 Bundler RPC `0.7` | 2 | VM | — | — | [5](#erc4337-style) | [6](#erc4337-style) |
| [escrow-style](adapters/escrow-style/) | Escrow.com API `2017-09-01` | 9 | VM | — | — | [3](#escrow-style) | [4](#escrow-style) |
| [eth-jsonrpc-style](adapters/eth-jsonrpc-style/) | Ethereum JSON-RPC `1.0` | 1 | SDK | go-ethereum @ v1.17.5 | 5 | [5](#eth-jsonrpc-style) | [4](#eth-jsonrpc-style) |
| [etherscan-style](adapters/etherscan-style/) | Etherscan API `1.0` | 1 | VM | — | — | [3](#etherscan-style) | [2](#etherscan-style) |
| [fattureincloud-style](adapters/fattureincloud-style/) | Fatture in Cloud API v2 `2.0.29` | 42 | VM | — | — | [3](#fattureincloud-style) | [6](#fattureincloud-style) |
| [firebase-style](adapters/firebase-style/) | Firebase Auth + Firestore + Cloud Messaging API `v1` | 22 | VM | — | — | [4](#firebase-style) | [8](#firebase-style) |
| [ga4-style](adapters/ga4-style/) | Google Analytics Data API + Admin API `v1beta` | 7 | SDK | google-api-go-client @ v0.299.0 | 7 | [4](#ga4-style) | [3](#ga4-style) |
| [gcalendar-style](adapters/gcalendar-style/) | Google Calendar API `v3` | 10 | SDK | google-api-go-client @ v0.299.0 | 8 | [4](#gcalendar-style) | [2](#gcalendar-style) |
| [gdocs-style](adapters/gdocs-style/) | Google Docs API `v1` | 5 | SDK | google-api-go-client @ v0.299.0 | 5 | [3](#gdocs-style) | [5](#gdocs-style) |
| [github-style](adapters/github-style/) | GitHub REST + GraphQL API `2022-11-28` | 26 +GQL | SDK | go-github/v89 @ v89.0.0<br>octokit @ 5.0.5 (floor) | 6 | [7](#github-style) | [4](#github-style) |
| [gmail-style](adapters/gmail-style/) | Gmail API `v1` | 16 | SDK | google-api-go-client @ v0.299.0 | 9 | [6](#gmail-style) | [3](#gmail-style) |
| [google-admin-style](adapters/google-admin-style/) | Google Admin SDK Directory API `directory_v1` | 13 | SDK | google-api-go-client @ v0.299.0 | 8 | [4](#google-admin-style) | [4](#google-admin-style) |
| [google-cloudtasks-style](adapters/google-cloudtasks-style/) | Google Cloud Tasks API `v2` | 16 | boot | — | — | [7](#google-cloudtasks-style) | [7](#google-cloudtasks-style) |
| [google-iam-style](adapters/google-iam-style/) | Google Cloud IAM API + Service Accounts `v1` | 10 | SDK | google-api-go-client @ v0.299.0 | 7 | [4](#google-iam-style) | [2](#google-iam-style) |
| [google-style](adapters/google-style/) | Google OAuth2 API `v2` | 4 | SDK | x/oauth2 @ v0.37.0<br>google-api-go-client/idtoken @ v0.299.0 | 7 | [2](#google-style) | [2](#google-style) |
| [gsearchconsole-style](adapters/gsearchconsole-style/) | Google Search Console API `v1` | 11 | SDK | google-api-go-client @ v0.299.0 | 7 | [2](#gsearchconsole-style) | [4](#gsearchconsole-style) |
| [gsheets-style](adapters/gsheets-style/) | Google Sheets API `v4` | 10 | SDK | google-api-go-client @ v0.299.0 | 8 | [4](#gsheets-style) | [3](#gsheets-style) |
| [gtasks-style](adapters/gtasks-style/) | Google Tasks API `v1` | 11 | SDK | google-api-go-client @ v0.299.0 | 8 | [3](#gtasks-style) | [2](#gtasks-style) |
| [helius-style](adapters/helius-style/) | Helius Solana RPC + Enhanced API `v0` | 11 | VM | — | — | [3](#helius-style) | [6](#helius-style) |
| [hn-style](adapters/hn-style/) | Hacker News Firebase API `v0` | 11 | VM | — | — | [3](#hn-style) | [4](#hn-style) |
| [hubspot-style](adapters/hubspot-style/) | HubSpot CRM API `v3` | 33 | SDK | hubspot-node @ 14.0.1 (floor) | 5 | [4](#hubspot-style) | — |
| [instagram-style](adapters/instagram-style/) | Instagram Graph API `v21.0` | 10 | VM | — | — | [4](#instagram-style) | [5](#instagram-style) |
| [jira-style](adapters/jira-style/) | Jira Cloud REST API `3` | 32 | SDK | jira-js @ 6.1.0 (floor) | 7 | [5](#jira-style) | [6](#jira-style) |
| [jumio-style](adapters/jumio-style/) | Jumio API `v1` | 5 | VM | — | — | [3](#jumio-style) | [6](#jumio-style) |
| [linkedin-style](adapters/linkedin-style/) | LinkedIn API `v2` | 8 | VM | — | — | [4](#linkedin-style) | [3](#linkedin-style) |
| [llm-style](adapters/llm-style/) | OpenAI API + Anthropic API `OpenAI v1 / Anthropic v1` | 3 | SDK | openai-node @ 7.5.0 (floor) | 2 | [4](#llm-style) | [3](#llm-style) |
| [marketo-style](adapters/marketo-style/) | Marketo Engage REST API `1.0` | 21 | VM | — | — | [5](#marketo-style) | [3](#marketo-style) |
| [microsoft-graph-style](adapters/microsoft-graph-style/) | Microsoft Graph API `v1.0` | 55 | SDK | microsoft-graph-client @ 3.0.7 (floor) | 10 | [8](#microsoft-graph-style) | [6](#microsoft-graph-style) |
| [netsuite-style](adapters/netsuite-style/) | NetSuite SuiteTalk REST API `1.0` | 9 | VM | — | — | [4](#netsuite-style) | [3](#netsuite-style) |
| [oneinch-style](adapters/oneinch-style/) | 1inch Aggregation Protocol API `v6.0` | 5 | VM | — | — | [3](#oneinch-style) | [4](#oneinch-style) |
| [onfido-style](adapters/onfido-style/) | Onfido API `v3.6` | 7 | VM | — | — | [5](#onfido-style) | [6](#onfido-style) |
| [opensea-style](adapters/opensea-style/) | OpenSea API `2.0.0` | 7 | VM | — | — | [4](#opensea-style) | [4](#opensea-style) |
| [paypal-style](adapters/paypal-style/) | PayPal Orders API `v2` | 17 | VM | — | — | [6](#paypal-style) | [8](#paypal-style) |
| [persona-style](adapters/persona-style/) | Persona Inquiry API `2023-01-05` | 5 | VM | — | — | [5](#persona-style) | [6](#persona-style) |
| [photos-style](adapters/photos-style/) | Google Photos Library API `v1` | 12 | VM | — | — | [5](#photos-style) | [5](#photos-style) |
| [pinata-style](adapters/pinata-style/) | Pinata API `1.0` | 6 | VM | — | — | [4](#pinata-style) | [3](#pinata-style) |
| [plaid-style](adapters/plaid-style/) | Plaid API `2020-09-14` | 13 | SDK | plaid-node @ 32.0.0 (floor) | 4 | [5](#plaid-style) | [3](#plaid-style) |
| [powerplatform-style](adapters/powerplatform-style/) | Microsoft Power Platform API `2` | 9 | VM | — | — | [4](#powerplatform-style) | [6](#powerplatform-style) |
| [printful-style](adapters/printful-style/) | Printful API `v2` | 13 | VM | — | — | [5](#printful-style) | [3](#printful-style) |
| [printify-style](adapters/printify-style/) | Printify API `v1` | 16 | VM | — | — | [5](#printify-style) | [4](#printify-style) |
| [producthunt-style](adapters/producthunt-style/) | Product Hunt GraphQL API `2` | 0 +GQL | boot | — | — | [3](#producthunt-style) | [2](#producthunt-style) |
| [psd2-style](adapters/psd2-style/) | Open Banking / PSD2 (Berlin Group NextGenPSD2) `1.3.6` | 19 | VM | — | — | [6](#psd2-style) | [7](#psd2-style) |
| [qbo-style](adapters/qbo-style/) | QuickBooks Online API `v3` | 11 | VM | — | — | [6](#qbo-style) | [4](#qbo-style) |
| [reddit-style](adapters/reddit-style/) | Reddit API `1.0` | 2 | VM | — | — | [5](#reddit-style) | [3](#reddit-style) |
| [resend-style](adapters/resend-style/) | Resend API `1.0.0` | 6 | SDK | resend-node @ 6.22.0 (floor) | 4 | [6](#resend-style) | [3](#resend-style) |
| [revenuecat-style](adapters/revenuecat-style/) | RevenueCat API `v1` | 7 | VM | — | — | [5](#revenuecat-style) | [5](#revenuecat-style) |
| [salesforce-style](adapters/salesforce-style/) | Salesforce REST API `v60.0` | 29 | SDK | jsforce @ 3.10.27 (floor) | 6 | [7](#salesforce-style) | [4](#salesforce-style) |
| [sendgrid-style](adapters/sendgrid-style/) | Twilio SendGrid v3 API `v3` | 5 | VM | — | — | [7](#sendgrid-style) | [6](#sendgrid-style) |
| [servicenow-style](adapters/servicenow-style/) | ServiceNow Table API `2` | 44 | VM | — | — | [5](#servicenow-style) | [1](#servicenow-style) |
| [shopify-style](adapters/shopify-style/) | Shopify Admin REST + GraphQL API `2024-10` | 21 +GQL | SDK | go-shopify/v4 @ v4.7.0 | 5 | [7](#shopify-style) | [4](#shopify-style) |
| [signin-with-apple-style](adapters/signin-with-apple-style/) | Sign in with Apple `v2` | 3 | VM | — | — | [3](#signin-with-apple-style) | [2](#signin-with-apple-style) |
| [slack-style](adapters/slack-style/) | Slack Web API `1.0` | 7 | SDK | slack-node @ 7.19.0 (floor) | 4 | [6](#slack-style) | [2](#slack-style) |
| [smartbill-style](adapters/smartbill-style/) | SmartBill Cloud API `1.0` | 18 | VM | — | — | [3](#smartbill-style) | [4](#smartbill-style) |
| [sqs-style](adapters/sqs-style/) | Amazon SQS API `2012-11-05` | 2 | SDK + VM | aws-sdk-go-v2 @ v1.47.1 | 6 | [4](#sqs-style) | [5](#sqs-style) |
| [square-style](adapters/square-style/) | Square API `2024-08-21` | 18 | SDK | square-node @ 45.1.0 (floor) | 4 | [7](#square-style) | [2](#square-style) |
| [stripe-style](adapters/stripe-style/) | Stripe API `2025-01-27.acacia` | 158 | SDK | stripe-go/v86 @ v86.3.0<br>stripe-node @ 22.6.2 (floor) | 9 | [7](#stripe-style) | [5](#stripe-style) |
| [tenderly-style](adapters/tenderly-style/) | Tenderly Simulation API `v1` | 5 | VM | — | — | [3](#tenderly-style) | [4](#tenderly-style) |
| [thegraph-style](adapters/thegraph-style/) | The Graph (GraphQL over subgraphs) `1.0` | 1 +GQL | VM | — | — | [3](#thegraph-style) | [2](#thegraph-style) |
| [threads-style](adapters/threads-style/) | Threads API (Meta) `v1.0` | 8 | VM | — | — | [3](#threads-style) | [6](#threads-style) |
| [twilio-style](adapters/twilio-style/) | Twilio API `2010-04-01` | 6 | SDK | twilio-go @ v1.31.2<br>twilio-node @ 6.1.0 (floor) | 8 | [6](#twilio-style) | [4](#twilio-style) |
| [twitter-style](adapters/twitter-style/) | Twitter/X API `v2` | 9 | VM | — | — | [6](#twitter-style) | [5](#twitter-style) |
| [walletconnect-style](adapters/walletconnect-style/) | WalletConnect (Relay Protocol v2) `2.0` | 7 | VM | — | — | [3](#walletconnect-style) | [5](#walletconnect-style) |
| [whatsapp-style](adapters/whatsapp-style/) | WhatsApp Business Cloud API (Meta) `v21.0` | 8 | VM | — | — | [5](#whatsapp-style) | [7](#whatsapp-style) |
| [workday-style](adapters/workday-style/) | Workday REST API `v40.0` | 8 | VM | — | — | [4](#workday-style) | [3](#workday-style) |
| [x-articles-style](adapters/x-articles-style/) | X (Twitter) Articles API `v2` | 8 | VM | — | — | [4](#x-articles-style) | [4](#x-articles-style) |
| [xero-style](adapters/xero-style/) | Xero Accounting API `2.0` | 15 | VM | — | — | [6](#xero-style) | [5](#xero-style) |
| [youtube-style](adapters/youtube-style/) | YouTube Data API `v3` | 14 | SDK | google-api-go-client @ v0.299.0 | 8 | [7](#youtube-style) | [2](#youtube-style) |
| [zendesk-style](adapters/zendesk-style/) | Zendesk REST API `2` | 37 | SDK | node-zendesk @ 6.0.1 (floor) | 6 | [8](#zendesk-style) | [5](#zendesk-style) |
| [zuora-style](adapters/zuora-style/) | Zuora REST API `v1` | 20 | VM | — | — | [8](#zuora-style) | [5](#zuora-style) |

## Verified behaviors

What each suite actually asserts, as written in the test sources
(`Record(...)` literals in `conformance/*_test.go`; `// =====`
sections in `conformance/node/tests/*.test.ts`).

### atproto @ 0.20.41 (floor)

**bluesky-style**

- login rides createSession and adopts did/handle/tokens
- agent.post creates an app.bsky.feed.post record
- searchPosts finds the created post by its text
- getProfile resolves the session actor with counts
- resolveHandle is a public read (no session)
- unauthenticated record writes surface as XRPC 401s
- deletePost removes the record from search
- refreshSession rotates the token pair via the SDK

### aws-sdk-go-v2 @ v1.47.1

**aws-iam-sts-style**

- GetCallerIdentity with real SigV4 signature
- AssumeRole -> credentials

**aws-s3-style**

- CreateBucket
- PutObject (binary body)
- GetObject byte-exact round-trip (incl. non-UTF-8)
- HeadObject metadata
- ListObjectsV2 paginator follows continuation (4 over MaxKeys=2)
- DeleteObject
- CreateMultipartUpload
- UploadPart
- ListParts
- DeleteBucket refused while a multipart upload is in progress
- AbortMultipartUpload releases the blocked bucket delete
- CompleteMultipartUpload with the SDK's XML-escaped ETag
- Object tagging subresources refused without touching the object
- Presigned GET URL (real presigner, signed headers sent)
- Presigned DELETE (real presigner)
- Presigned GET rejects a tampered signature

**dynamodb-style**

- CreateTable via real SigV4
- typed item Put/Get round-trip (S/N/BOOL/SS)
- UpdateItem SET/ADD with exact decimal arithmetic
- ConditionExpression → ConditionalCheckFailedException
- Query numeric sort-key ordering (1,2,10)
- Query BETWEEN + ScanIndexForward=false
- Scan with FilterExpression
- typed ResourceNotFoundException surface

**sqs-style**

- CreateQueue/GetQueueUrl via real SigV4
- SendMessage/ReceiveMessage with ms-precision system attributes
- visibility timeout: in-flight hidden, expiry redelivers
- DeleteMessage consumes the redelivered message
- SendMessageBatch correlated results
- missing-queue typed error surface

### cloudflare-go @ v0.119.0

**cloudflare-style**

- Zones list returns the seeded zone
- Zones list filters by name
- CreateZone + ZoneDetails round-trip
- Duplicate CreateZone -> error code 1061
- DNS records create + list + update round-trip
- Firewall rules batch create + list with filter expression
- DNS record delete + zone delete then details fails

### discord-node @ 2.6.3 (floor)

**discord-style**

- users/@me resolves the bot user
- guilds resolve with channels
- message post lands in the channel history
- single-message fetch round-trips
- add-reaction is the real PUT and returns 204

### go-ethereum @ v1.17.5

**eth-jsonrpc-style**

- ethclient.ChainID + BlockNumber
- BalanceAt decodes seeded hex-quantity wei
- CodeAt returns empty (no EVM execution)
- HeaderByNumber returns the genesis header
- PendingNonceAt for an untouched account

### go-github/v89 @ v89.0.0

**github-style**

- Issues.Create x5 (number assignment)
- Issues.ListByRepo walks Link headers across pages
- Issues.CreateComment
- Issues.ListComments round-trip
- Issues.Edit state transition

### go-shopify/v4 @ v4.7.0

**shopify-style**

- Webhook.Create (orders/create)
- Order.Create x4 (numeric ids)
- Order.Create with embedded customer (numeric id round-trip)
- Order.ListWithPagination walks page_info cursors
- webhooks verify through the SDK's VerifyWebhookRequest HMAC validator

### google-api-go-client @ v0.299.0

**apps-script-style**

- Projects.Create + Projects.Get round-trip
- Projects content update + get round-trip
- Scripts.Run returns a done Operation with the function result
- Scripts.Run passes parameters into the simulation
- Deployments.Create + Deployments.List round-trip
- Unknown project content Get -> googleapi 404

**drive-style**

- Files.List returns the seeded folder
- Files.Create + Files.List round-trip
- Files.Get returns the created metadata (int64 size decodes)
- Files.Update renames the file
- Files.List q= filters by mimeType and parents
- Files.List PageSize + PageToken walk pages
- Files.Delete then Get -> googleapi 404
- Changes.List replays mutations from startPageToken

**ga4-style**

- Admin Accounts.List returns the seeded account
- Admin Properties.List filters by parent account
- Admin DataStreams.List returns the property streams
- Data runReport returns headers, rows, and rowCount
- Data runReport limit pages rows deterministically
- Data runRealtimeReport returns rows
- Unknown dimension runReport -> googleapi 400

**gcalendar-style**

- Calendars.Get resolves the primary calendar
- CalendarList.List returns the seeded primary entry
- Events.Insert + Events.Get round-trip the event body
- Events.List Q matches summary/description text
- Events.List MaxResults + PageToken walk pages
- Events.Patch updates fields and bumps sequence + etag
- Events.Instances expands an RRULE into per-occurrence events
- Events.Delete then Get -> googleapi 404

**gdocs-style**

- Documents.Create returns documentId + title
- Documents.Get returns the structural body model
- batchUpdate insertText applies and replies 1:1
- batchUpdate applies ordered requests at indexes
- Unknown document Get -> googleapi 404

**gmail-style**

- Labels.List returns seeded system labels
- Labels.Create + Labels.List round-trip
- Messages.Send raw rfc822 -> id + threadId
- Messages.Get parses the sent raw message into payload headers
- Messages.List includes sent messages
- Messages.List MaxResults + PageToken walk pages
- Messages.Modify AddLabelIds applies
- Messages.Get Format=metadata returns headers without body
- Messages.Delete then Get -> googleapi 404

**google-admin-style**

- Users.List Customer=my_customer returns the seeded directory
- Users.Insert + Users.Get round-trip by numeric id and email
- Users.List Domain narrows to a single email domain
- Users.List Query isSuspended=true returns only suspended users
- Users.Update renames the primary email; old key stops resolving
- Users.Delete then Get -> decoded googleapi 404
- Groups.Insert + Members.Insert + Members.List round-trip
- Groups.List UserKey returns only the groups holding that member

**google-iam-style**

- jwt-bearer exchange mints the SDK's access token
- ServiceAccounts.List returns the seeded account
- ServiceAccounts.Create + Get round-trip
- ServiceAccounts.Keys.List returns managed keys
- Roles.QueryGrantableRoles returns grantable roles
- ServiceAccounts.Delete then Get -> googleapi 404
- Garbage bearer -> googleapi 401

**gsearchconsole-style**

- Sites.List returns the seeded properties
- Sites.Get returns the property with permissionLevel
- Sites.Add starts unverified and lists immediately
- Searchanalytics.Query returns keyed metric rows
- Sitemaps.Submit + List round-trip
- UrlInspection.Index.Inspect returns an index-status verdict
- Unknown site Get -> googleapi 404

**gsheets-style**

- Spreadsheets.Create + Get round-trip
- Values.Update + Values.Get round-trip an A1 range
- Values.Get MajorDimension=COLUMNS transposes the grid
- Values.Append writes after the last populated row
- Values.BatchUpdate writes multiple ranges in one call
- Values.BatchGet reads a range over GET query params
- Spreadsheets.BatchUpdate addSheet adds a tab Values can write to
- Get on an unknown spreadsheet -> googleapi 404

**gtasks-style**

- Tasklists.List returns the seeded default list
- Tasklists.Insert + Tasklists.List round-trip
- Tasks.Insert + Tasks.Get round-trip fields
- Tasks.Patch status=completed derives the completed stamp
- Tasks.List ShowCompleted=false hides completed tasks
- Tasks.Move Parent/Previous re-parents and repositions
- Tasks.List MaxResults + PageToken walk pages
- Tasks.Delete then Tasks.Get -> googleapi 404

**youtube-style**

- OAuth2 authorize + exchange mint the access token the SDK presents
- Videos.Insert metadata-only + Videos.List id= round-trip with part projection
- Videos.List without id lists every user video
- Videos.List MaxResults + PageToken walk pages
- Channels.List mine=true returns the authenticated user's channel
- Playlists.Insert + Playlists.List mine=true round-trip
- PlaylistItems.Insert adds the video, Delete removes it
- Videos.Delete -> 204; re-delete surfaces a googleapi 404

### google-api-go-client/idtoken @ v0.299.0

**google-style**

- idtoken.Validate verifies the adapter's RS256 id_token via its JWKS
- tampered id_token rejected by idtoken.Validate
- adapter serves a real JWKS

### hubspot-node @ 14.0.1 (floor)

**hubspot-style**

- basicApi.create assigns an id and echoes properties
- basicApi.getById round-trips
- basicApi.update patches a property
- searchApi.doSearch finds the record by name
- archive hides the record from reads

### jira-js @ 6.1.0 (floor)

**jira-style**

- myself + project resolve
- create assigns a TEST-n key
- get round-trips; edit persists
- JQL search finds it
- add comment + list
- transition moves the status
- delete removes it

### jsforce @ 3.10.27 (floor)

**salesforce-style**

- SDK-driven login: with clientId+clientSecret configured, jsforce's conn.login rides the OAuth2 password grant itself, and adopts the adapter's echoed instance_url as its API base
- sobject create assigns an id
- retrieve round-trips the fields
- update patches and persists
- SOQL through the SDK's query parser
- destroy removes the record

### microsoft-graph-client @ 3.0.7 (floor)

**entra-id-style**

- authorize redirects with code + state
- token exchange mints a JWKS-verifiable RS256 bearer
- authProvider feeds the SDK; /v1.0/me resolves the token's user
- users create + get round-trip (by id and by UPN)
- users list pages via $top + $skipToken + PageIterator
- applications + servicePrincipals reads
- refresh grant rotates the token the SDK presents
- error decoding: 404 and 401 surface as GraphError

**microsoft-graph-style**

- /me resolves the signed-in profile
- users directory pages via $top and the @odata.nextLink cursor
- $filter and $select are applied server-side
- draft lifecycle: create, PATCH, send, land in Sent Items
- sendMail posts straight to Sent Items (no draft)
- subscription lifecycle with clientState-echoed notifications
- calendar: create, calendarView window, accept records the response
- teams chat: create chat, send message, list, delete
- drive: quota, simple upload round-trip, path resolution
- error envelope: unknown user 404, unknown token 401

### node-zendesk @ 6.0.1 (floor)

**zendesk-style**

- create assigns a numeric id
- show round-trips; status update persists
- comment created at ticket-create time is readable
- list includes the ticket
- substring search finds it by subject
- delete removes it

### octokit @ 5.0.5 (floor)

**github-style**

- issue CRUD + paginate over Link headers

### openai-node @ 7.5.0 (floor)

**llm-style**

- models.list returns the catalog
- chat.completions.create returns a typed echo response

### plaid-node @ 32.0.0 (floor)

**plaid-style**

- link/token/create mints a session
- sandbox public_token -> exchange -> item with accounts
- accounts/balance/get over the SDK's typed response
- transactions/sync cursor round-trip

### resend-node @ 6.22.0 (floor)

**resend-style**

- emails.send mints a re_* id
- emails.get round-trips the message
- emails.list includes it
- delivery state derives on read (sent -> delivered)

### slack-node @ 7.19.0 (floor)

**slack-style**

- auth.test validates the seeded bearer token
- conversations.create + list round-trip
- chat.postMessage lands in conversations.history
- reactions.add on the posted message

### square-node @ 45.1.0 (floor)

**square-style**

- oAuth.obtainToken mints the bearer the adapter validates
- payments.create + payments.get round-trip
- orders.create prices line items and mints an order id
- orders.get round-trips the priced order

### stripe-go/v86 @ v86.3.0

**stripe-style**

- customer.New (form+bracket body)
- customer.Get round-trip
- paymentintent create+confirm -> succeeded
- charge.New (typed amount round-trip)
- SDK iterator walks has_more pages (4+ over limit=2)
- webhook.ConstructEvent verifies HMAC + parses data.object

### stripe-node @ 22.6.2 (floor)

**stripe-style**

- Typed create/get (form+bracket encoded by the SDK)
- autoPagingEach walks has_more pages
- Webhook registration, delivery verified by the SDK's own constructEvent

### twilio-go @ v1.31.2

**twilio-style**

- CreateMessage (SM sid assigned)
- FetchMessage poll reaches terminal state
- +15005550001 magic number -> failed
- ListMessage To filter honored
- status callbacks verify against Twilio's HMAC-SHA1 formula

### twilio-node @ 6.1.0 (floor)

**twilio-style**

- Create + SDK fetches drive the lifecycle
- Callbacks verified by twilio-node's own validateRequest
- The magic invalid number -> failed

### x/oauth2 @ v0.37.0

**google-style**

- authorize redirect mints a single-use code
- authorization-code exchange -> tokens + id_token
- refresh grant rotates the access token
- userinfo honors the refreshed token


### vm (handler-level Go suites)

What the engine-level suites in `adapters/<name>_style_test.go` assert — the
adapter's real handlers execute against the real engine; no SDK is involved.
Named by their `// =====` section markers.

**adyen-style**

- a missing X-API-Key is a 401 security envelope
- an unseeded API key is rejected identically
- the seeded test key authorises; header spelling does not matter
- the gate spans the whole surface, not just /payments
- a plain card authorises instantly with a 16-digit 881 pspReference
- the refused test card (...0002) answers Refused with refusalReason, still 200
- simulate_fail refuses an instant payment outright
- Idempotency-Key replays the same pspReference; a fresh call mints a new one
- GET ?reference= returns the payment object; unknown references are 422 010
- the unfiltered list is cursor-paginated; a garbage cursor is a 400
- a 3DS card returns IdentifyShopper with a threeDS2 action and no pspReference yet
- submitting the fingerprint authorises and mints the pspReference
- paymentData tokens are single-use
- challenge cards (...0081) add a ChallengeShopper round with a fresh token
- simulate_fail refuses at completion with threeDSError
- a missing paymentData or missing fingerprint is a 422 validation error
- an idempotent replay re-renders the payment's CURRENT state, not the original response (deviation, asserted as-is)
- the catalogue is scheme/ideal/paypal/applepay/googlepay, storedPaymentMethods empty
- merchantAccount is required
- any merchantAccount string is accepted — no account registry (deviation, asserted as-is)
- creating a link assigns PL-N, defaults expiresAt to +24h, starts active
- a zero amount or missing reference is a 422
- an unknown link id is a 404 with errorCode 191
- authorising a payment on the link's reference completes the link on read
- a past expiresAt flips the link to expired on read, and terminal statuses persist
- capture chains a CAP-prefixed pspReference and returns status received
- a partial capture keeps the remainder capturable; over-capture is 422 702
- refunds draw down the captured balance; over-refund is 422 705
- refund before capture is 704, currency mismatch 708, zero amount 703
- cancel is only for uncaptured payments; reversal is terminal from captured
- a cancelled payment rejects every later modification
- an unknown pspReference is a 422 010
- webhook registration masks the hmacKey in every view
- an authorisation delivers the standard envelope signed with the hook's own key
- a capture chains originalReference and signs with the mock key via the events filter
- a refused payment notifies AUTHORISATION with success "false"
- only the first matching hook receives an event (deviation, asserted as-is)
- deleting a hook silences it; the next matching hook takes over
- the merchant-side receiver answers [accepted] and tolerates redelivery

**anaplan-style**

- missing or unrecognized credentials draw the 401 failure envelope
- the workspace list is seeded with Anaplan paging metadata
- paging walks the opaque offset cursor and rejects a bad token
- models are workspace-scoped and a single model round-trips or 404s
- catalog lists serve the seeded per-model action catalog
- a full-body upload replaces file content byte-exact on POST and PUT
- chunked uploads append in order and reject gaps and malformed ranges
- invalid identifiers and unknown files get 400/404 envelopes
- an import task walks CREATED → NOT_STARTED → IN_PROGRESS → COMPLETE
- completion applies the import once and the export renders the model data
- simulate_fail completes with every row failed
- an import over an empty upload reports no contents
- unknown import, export, and task ids get 404 failure envelopes
- catalog ids resolve only within their model
- task status is scoped to its workspace and model

**apple-apns-style**

- the provider token gate distinguishes missing invalid and expired tokens
- a push to the known device returns 200 with a canonical uuid apns-id
- unknown device tokens are 400 baddevicetoken
- empty aps payloads are 400 payloadempty
- sent notifications are retrievable per device

**apple-appstoreconnect-style**

- a rejected credential answers Apple's 401 errors array, not a bare status
- the JOSE header must declare ES256 and carry a kid
- structural validity is not enough: the exact JWT string must be registered
- the seeded app reads back through list and single-get, with 404 NOT_FOUND for unknown ids
- create assigns numeric ids, persists into the list, and dedupes bundleId
- bracketed filter[...], leading-dash sort, and fields[apps] projections apply before paging
- PATCH /v1/apps/{id} renames and refuses bundleId collisions
- limit/cursor paging surfaces meta.paging and a links.next cursor
- limit defaults to 50 and clamps at the documented maximum 200
- a malformed cursor is total: 200 with data null (Apple answers 400 — deviation)
- versionString is required and duplicate versionStrings collide per app
- the app's first version adopts its unattached build
- PATCH works only in the editable states (PREPARE_FOR_SUBMISSION, REJECTED)
- submission drives WAITING_FOR_REVIEW → IN_REVIEW → READY_FOR_SALE on the clock
- simulate_fail rejects, and a REJECTED version stays editable and resubmittable
- a fresh app's build reads PROCESSING and the processingState filter agrees
- the 3s window settles VALID and GET /v1/builds/{id} agrees
- a simulate_fail app settles its build INVALID
- users seed once and answer the bracketed role/username filters and sort
- salesReports echoes the bracketed report filters with DAILY/SALES defaults

**apple-music-style**

- a missing bearer answers 401 in Apple's error envelope
- malformed schemes, segments, algs and signatures are all 401
- the registered deterministic developer token reads the catalog
- the developer token dies when its registry entry expires
- search without a term is a 400 invalid_parameter
- results group by requested type in meta order with next links
- the term matches names, artists and album text case-insensitively
- unknown search and chart types are 400 invalid_parameter
- charts order the seed by release date within each requested type
- include=tracks embeds track resources; without it only an href
- storefront codes are validated and normalized (US -> us)
- unknown ids answer Apple's 404 error body
- a known album and artist fetch with storefront-derived hrefs
- pages walk by offset and the last partial page has no next
- limits clamp to the endpoint default and max
- library lists page with meta.total
- /v1/me checks the developer JWT before the Music-User-Token
- adding resources to the library is idempotent and validates ids
- played bumps playCount and stamps lastPlayedDate at play time
- recently-added lists newest first across mixed resource types
- fields[type] projects library attributes
- delete addresses the catalog id or the library id, then 404s
- an unrated resource reads 0; love/dislike/clear round-trip
- invalid values and unknown targets keep the documented shapes

**apple-searchads-style**

- a missing, malformed or unknown bearer is a 401 in the Search Ads envelope
- the seeded static test token passes the gate
- a client_credentials exchange mints a bearer valid for exactly one hour
- malformed grants and client secrets are oauth-shaped 400s
- campaign create assigns a numeric id and fills the v4 defaults
- create without a name is a 400
- the campaign reads back by numeric id; unknown ids are 404s
- update merges fields, maps status onto servingStatus, and bumps only modificationTime
- an invalid status is a 400 that writes nothing
- ad groups create under a campaign; unknown campaigns are 404s
- find lists the seed with default pagination and clock-derived stamps
- conditions filter with EQUALS, CONTAINS and amount ranges
- values within one condition are OR'd; multi-value NOT_EQUALS excludes all
- orderBy sorts and pagination slices with totalResults before the slice
- first touch seeds three keywords scoped to the campaign
- keyword find speaks the same selector (conditions, orderBy, pagination)
- create takes a single keyword or a batch body
- single update merges partial fields and validates them
- bulk update takes id-addressed rows; an unknown id 404s the batch
- delete removes the keyword and find no longer sees it
- startTime, endTime and groupBy are validated
- one row per campaign with deterministic metrics and summed grandTotals
- the report selector filters rows and grandTotals follow

**auth0-style**

- discovery and JWKS are self-consistent for the host
- authorize issues a code; the grant mints a real RS256 token pair
- userinfo resolves the token to the seeded user; login_hint picks another
- spent and mismatched-redirect codes answer invalid_grant
- authorization codes expire after five minutes
- zero-based pages cover every user exactly once with true totals
- control characters in claims round-trip as escaped JSON
- a control-char audience survives the adapter's own token check
- patching onto another user's email is a 409 Conflict envelope
- fresh and self-owned email patches both succeed
- bad clients, redirect_uris, response types, and login hints get OAuth error redirects
- a missing redirect_uri is a 400, not a redirect
- the refresh grant returns fresh tokens without rotation
- revoke is idempotent and actually kills the token
- the access token dies at its 1-hour exp on both APIs
- the refresh token outlives it, then dies at 30 days
- client_credentials mints a bare JWS that drives the Management API
- the M2M token cannot call userinfo; a bad secret is invalid_client
- list returns the seeded users without leaking password internals
- q search and zero-based paging narrow the list
- create/get/patch round-trip the user and its metadata
- validation errors and delete leave the documented envelopes
- role create/list round-trip with conflict and name validation
- assignment is additive, idempotent, and validated
- signup creates an unverified user the Management API can see
- duplicate, weak, and unknown-client signups are rejected

**avalara-style**

- every v2 endpoint demands a credential: a bare call is a 401 AuthenticationRequired envelope
- any Bearer or any HTTP Basic credential opens the gate
- a non-Basic/Non-Bearer scheme does not count as a credential
- the effective rate keys off the address state (CA 0.095) with a State/County/City/Special breakdown
- the summary aggregates the taxable base per jurisdiction
- per-line tax rounds to cents: two lines aggregate, line 2 keeps its own tax
- SDK decimal strings ("100.00") price identically to JSON numbers
- the shipFrom/shipTo form keys off shipTo (NY 0.0875)
- unknown or missing addresses fall back to the synthetic 0.0825 default
- create prices the document, mints id/code/companyId and applies AvaTax defaults
- an omitted date defaults to the clock's today, and advances with it
- read round-trips by id; unknown ids are 404 NotFound
- the list supports OData $filter and $orderBy with @recordsetCount
- $top/$skip pages through an @odata.nextLink that round-trips
- void flips status to Cancelled and the record reads back cancelled
- re-void is idempotent
- the companies catalog lists DEFAULT and STORE1 with default locations
- nexus $filter literals are typed: id eq 1001 matches ints, hasNexus eq true matches bools
- the taxcode catalog is filterable by taxCode

**aws-cognito-style**

- a reset code older than one hour answers ExpiredCodeException
- a NEW_PASSWORD_REQUIRED session works until AuthSessionValidity lapses
- past the session window the challenge answer is NotAuthorizedException
- refresh tokens are reusable without rotation; access tokens rotate
- the refresh token dies at its 30-day expiry with invalid_grant
- two authorize flows bind the same seeded demo-user
- authorize never mints new users into the collection

**azure-devops-style**

- a missing, unknown, or non-PAT credential gets the UnauthorizedRequestException 401 envelope
- both PAT wire forms — Basic base64(PAT:) and Bearer — authenticate
- the projects list returns the two seeded projects in the Azure DevOps shape
- $top/$skip walk pages each project exactly once via continuationToken, and a bad token 400s
- creating on the typed route applies the patch document and defaults area/iteration
- the fully-qualified $type route normalizes to the bare type
- read-back returns the integer id; an unknown id is the WIT 404 envelope
- a patch bumps rev, applies field ops, and refreshes audit fields
- relations are added at - and removed by numeric index only
- malformed patches answer the PatchOperationFailed / Argument envelopes
- ids= returns the asked work items and fields= projects to those columns
- WIQL ANDs string and numeric predicates and matches CONTAINS
- ORDER BY sorts by the field and $top caps the result
- OR and non-WorkItems FROM targets answer the 400 envelope
- the repos list is scoped to the project
- a push stores content that items serves at the branch and at a pinned commit
- the commits list walks newest-first along the parent chain and filters by refName
- git faults: unknown repo, missing path, unknown path, malformed versionDescriptor
- pipelines list and get round-trip, and unknown ids answer 404
- a queued run derives inProgress then completed from the clock, once each
- simulate_fail drives the completed result to failed
- a registered subscription receives the service-hook envelope when a work item is created
- iterations list the two sprints and page under $top

**azure-servicebus-style**

- a correctly signed SAS token sends the message
- a tampered signature is 401 InvalidSignature
- an expired se is 401 ExpiredToken
- structurally broken tokens map to MalformedToken or InvalidSignature
- Entra Bearer tokens are accepted alongside SAS
- the storage-queue endpoint accepts the same SAS verifier
- a tampered storage-queue signature is 401 InvalidSignature

**azure-storage-style**

- container create passes auth with clock-driven Last-Modified and ETag
- blob upload passes auth with byte-exact content
- blob download round-trips bytes with the stored ETag
- ListContainers includes the container with query params signed
- a tampered signature gets the 403 AuthenticationFailed XML envelope
- an account outside the key table fails closed with 403

**braintree-style**

- ping answers true and introspection names the query root
- unknown fields and operations fail validation before execution
- createCustomer assigns an id and the customer query reads it back
- a charge is born SUBMITTED_FOR_SETTLEMENT; an authorization is AUTHORIZED
- resolver failures surface as errors[] with a null field, not an HTTP status
- searchTransactions speaks the criteria vocabulary with enum normalization
- the charge settles at +3s, derived on read
- REST handlers require credentials; Bearer or Basic both unlock
- client tokens and vaulted payment methods come back in Braintree shapes
- the transaction lifecycle derives on the clock
- guard failures carry the real Braintree error codes
- refunds default to the unrefunded balance and cap at it
- an uncaptured authorization expires past its window
- an Idempotency-Key replays the original create
- advanced_search maps the search-criteria vocabulary onto typed filters
- registration stores the hook and delivers a signed check
- settled transactions fire one signed notification per new state, filtered by kind
- subscriptions bill per cycle, expire at the last, and cancel only while Active
- inbound verification splits 200/400

**braze-style**

- a missing credential is the 401 message envelope
- an unknown app-group key is rejected
- x-authorization carries the raw app-group key
- track ingests attributes, events, and purchases
- re-tracking the same external_id updates one profile
- export aggregates custom events and purchases, dedups ids
- fields_to_export projects the profile
- per-record errors keep partial success
- _update_existing_only never creates
- fatal envelopes: the 75-id cap and undecodable JSON
- alias/new creates an alias-only profile track can target
- identify re-keys an alias-only profile when the external_id is new
- identify merges an alias-only profile into an existing one
- send fatals: message, variant, and recipient rules
- send succeeds with a 32-hex dispatch id and emits message.sent
- campaigns/trigger/send validates the campaign id
- schedule/create mints a UUID-shaped schedule id
- end_time is required
- upcoming broadcasts list both schedules
- the send transition derives on read, exactly once
- segments list seeds and pages by cursor
- one identifier type per delete
- delete removes the profile and its dependent records

**chainlink-style**

- the five default feeds seed on first read and narrow by network
- the feed summary and latestRoundData agree at the same instant
- rounds roll one per virtual minute with phase-1 string roundIds
- round history pages newest-first and getRoundData resolves ids
- unknown feeds and rounds answer the documented 404 envelopes
- v2 endpoints reject missing and wrong bearers
- encryptSecrets is a deterministic version-0 canonical envelope
- createSecrets bumps the slot version and never leaks plaintext
- a request walks queued -> running -> fulfilled on the virtual clock
- the fulfill event packs chainId << 64 | gasUsed
- simulate_fail lands the real fulfillment-code vocabulary
- registration validates the registry shape and funds in juels
- the keepers network performs on cadence until the LINK runs out
- check gates eligibility and a manual perform charges the premium
- cadence performs interleave chronologically with manual ones
- cancel freezes the upkeep and withdraw pays out exactly once
- the upkeep list derives state for every entry and 404s unknown ids
- ccip messages require the bearer token
- lane status echoes the requested pair with its ramp addresses
- the seeded test token dies after its ten-year virtual window

**cloudkit-style**

- the s2s signature gate rejects unsigned tampered stale and foreign-key requests
- users current returns the s2s owner identity
- zones list seeds defaults filters by prefix and pages
- records lookup returns the seeded shape with inline NOT_FOUND
- records query filters sorts and pages on a numeric resultsLimit
- records modify creates updates and deletes round-trip

**dropbox-style**

- upload takes the JSON {path, content} convenience body (documented deviation)
- the real RPC upload (Dropbox-API-Arg header + raw octet-stream body) lands identically
- re-uploading an existing path answers the real mode:"add" conflict
- mode overwrite replaces in place; autorename forks a suffixed path
- list_folder returns the whole path-prefix subtree, not one level
- the root listing spans everything; unknown and file paths carry distinct 409 tags
- paging slices the filtered subtree by body cursor, ignoring query strings
- download streams raw bytes by path and by id, with metadata alongside
- folders and unknown paths decline under the 409 path envelope
- get_temporary_link pairs the file's metadata with the synthetic link
- a presented bearer must be registered: unknown and expired tokens get distinct 401 tags
- an absent Authorization header stays open (documented deviation)
- create_folder mints folder metadata and conflicts case-insensitively
- get_current_account returns the synthetic /2/users snapshot
- deleting a folder removes its entire subtree from every read path
- trash tombstones audit the exact cascade batch
- delete is permanent: a re-created path is a brand-new entry

**dune-style**

- the api-key gate rejects missing, empty and non-bearer authorization
- an execution walks PENDING -> EXECUTING -> COMPLETED as the clock advances
- a missing required parameter is the 400 envelope and both SDK parameter shapes resolve
- simulate_fail terminates QUERY_STATE_FAILED and results carry the failure envelope
- the inline-result route completes synchronously
- results pages honor limit/offset with a followable next_uri
- the CSV variant streams text/csv for the same page

**dynamodb-style**

- an unsigned request is 403; a real SigV4 signature passes
- tampered signatures, wrong secrets, and clock skew are all 403
- CreateTable returns ACTIVE; duplicate and bad-schema creates throw the real exceptions
- Describe/List/Delete round out the lifecycle with table paging
- typed values round-trip verbatim through PutItem/GetItem
- projection, misses, and malformed keys take the documented paths
- SET upserts, ADD does exact-decimal math, REMOVE drops with UPDATED_OLD
- non-numeric ADD and bogus ReturnValues are ValidationExceptions
- numeric sort keys order numerically (10 after 9)
- BETWEEN, >=, descending, and begins_with shape the key range
- Limit + ExclusiveStartKey pages queries; bad conditions are rejected
- Scan returns the whole table and filters by expression
- Select COUNT, pagination, and error paths round out Scan
- attribute_not_exists guards writes; failed checks return the old item
- conditional deletes enforce the condition; consumed capacity echoes
- batch writes and gets round-trip with empty Unprocessed maps
- oversized, unknown-table, and invalid batches are rejected atomically
- unsupported constructs fail with named ValidationExceptions
- a leading "." answers ValidationException instead of wedging the tokenizer
- "|" in key values cannot collide two composite keys
- set members dedupe by string and numeric value
- "-0" and "0" name the same stored item

**emailoctopus-style**

- a missing API key is 401 problem+json
- a blank name is 422 with the field error
- list create/get round-trip
- an unknown list is 404 on contact routes too
- contacts create into the list
- limit/starting_after paging pages contacts without repeats
- get by contact id round-trips the email
- delete removes the contact; reads 404 after

**erc4337-style**

- supportedEntryPoints, chainId, and the JSON-RPC envelope
- estimateUserOperationGas validates the full v0.7 field set
- sendUserOperation answers a deterministic hash and defaults the entry point
- the op walks mempool -> bundled -> included on the virtual clock
- simulate_fail reverts on inclusion with the AA95 reason
- the paymaster signs the op into paymasterAndData
- missing or invalid userOps are 400s

**escrow-style**

- missing, Bearer, and malformed Authorization are 401s with the challenge header
- the documented credentials unlock the customer record
- the gate covers the transaction and webhook surfaces alike
- create assigns the first numeric id, stamps creation_date, and defaults currency
- the initiating party is auto-agreed; the counterparty is not
- items carry the 2017-09-01 defaults and schedule amounts as decimal strings
- the default escrow fee is 3.25% charged to the buyer
- get by id returns the same shape — amounts survive the store round trip
- unknown ids are 404s keyed on the id field
- party validation answers the nested Escrow field errors
- amounts parse from decimal strings identically to numbers
- multi-entry schedules sum into the default fee
- a caller-supplied fee split is honored, in the schedule's dollar units
- an unparseable amount stores 0.00 rather than 400ing (deviation, asserted as-is)
- a non-JSON body is a 400 body error, not a 500
- the default page returns every transaction in creation order
- per_page slices; page walks the remainder; past the end is empty
- junk pagination params fall back to the defaults (page 1, per_page 10)
- a reference resolves to its transaction
- an unknown reference is a 404 keyed on the reference field
- agree needs a party's email and rejects strangers
- funding waits for every party's agreement
- the counterparty's agreement unlocks funding; every schedule entry secures
- accept flips every item and stamps close_date off the virtual clock
- PATCH actions and funding on unknown ids are 404s
- ship marks the item shipped, receive marks it received
- cancel flags every item and the transaction itself, without closing it
- unknown or missing actions are 400s on the action field
- registration assigns integer ids and echoes the URL
- the list carries every registered webhook
- a missing or blank url is the can't-be-blank field error

**etherscan-style**

- the apikey query parameter gates every module call
- unknown modules and actions answer the NOTOK envelope over HTTP 200
- balance reads the seeded ledger; unknown addresses default to "0"
- txlist scopes by address then applies block filters, sort and paging
- contract verification: ABI, source, and the unverified fallback
- stats and token holders keep every number a decimal string

**fattureincloud-style**

- auth failures answer the flat OAuth envelope; any non-empty bearer passes
- an unknown company id is the nested NOT_FOUND 404
- document create wraps the v2 defaults, an int id, and decimal-string amounts
- modify merges, delete clears, and the after-states keep the v2 envelope
- the Laravel pagination envelope is exact and clamps page and per_page
- type, date, and q filters narrow received documents inclusively
- the metodata endpoint lists the sorted categories in use
- subscriptions round-trip the real data.sink shape; a missing sink is a validation 400
- deliveries are HMAC-signed, real-typed, and respect the types filter
- F24 taxes stamp the virtual clock and flip status through the lifecycle

**firebase-style**

- signUp mints the Identity Toolkit token set with a padded localId
- duplicate and email-less signUps are Firebase-coded 400s
- password sign-in round-trips the user; bad credentials answer the real codes
- signInWithIdp provisions a verified Google user
- the v3 relyingparty dispatcher mirrors verifyPassword and 404s unknown actions
- endpoints accept Bearer or key and reject anonymous requests 401
- getAccountInfo resolves each idToken to the user it was minted for
- unknown and empty idTokens are 401 INVALID_ID_TOKEN
- the idToken dies at 1h while its refresh token survives
- v3 refreshToken rotates the token pair for the bound user
- unknown and missing refresh tokens are 400 INVALID_REFRESH_TOKEN
- POST /v1/token exchanges a refresh token in the securetoken shape
- the grant rejects wrong grant types and unknown tokens
- create wraps fields in Firestore typed values under a full resource name
- get reads the document back; unknown ids are 404 NOT_FOUND
- PATCH merges fields, bumps updateTime, and upserts unknown ids
- explicit documentIds are scoped per project+collection and 409 on reuse
- delete returns an empty 200 and leaves 404s behind (its own project only)
- list pages with pageSize/pageToken and rejects a malformed token
- subcollections nest under their parent document path
- runQuery filters, sorts, and limits over typed fields
- IN and ARRAY_CONTAINS resolve over array values
- queries are project-scoped and malformed bodies are 400 INVALID_ARGUMENT
- a token send is stored with its recipient and answers with its resource name
- a send must carry exactly one target
- topic and condition sends fan out to the subscribed tokens
- unsubscribing shrinks the fanout and a bare subscribe is a 400
- the stored message list is project-scoped

**helius-style**

- the api-key query gate rejects both surfaces
- the JSON-RPC reads answer deterministic values; an unknown method is a -32601 envelope
- sendTransaction walks null → processed → confirmed → finalized, firing the enhanced webhook exactly once at first confirmation
- simulate_fail lands an on-chain InstructionError while confirmation still proceeds
- the enhanced history seeds once per address, newest first, in the Helius parsed shape
- type/source filters and before/until/limit paging narrow the history
- a sent transaction joins its address's history; other addresses do not see it
- the parse-transactions contract holds and the balances/nfts/names lookups are deterministic
- webhook registration round-trips the Helius config shape with 404s for unknown ids
- deliveries are unsigned, carry authHeader as Authorization, honor transactionTypes and fire exactly once

**hn-style**

- item reads resolve the .json route capture into the full Firebase story shape
- comments link up via parent and kids, omit story-only fields, and count their subtree in descendants
- unknown items and users answer 200 with the literal null, not a 404
- story lists are bare integer arrays: top and best rank by score, new is newest-first
- ask and show partition the story set by title prefix; jobs stay type-only and off the story lists
- Firebase REST query params (print=pretty, orderBy, limitToFirst) are accepted and ignored
- user reads resolve .json ids into created/karma/about/submitted with by/submitted agreeing
- users without a bio omit about, matching the sparse Firebase shape
- reads are public: no credential is required and a stray bearer gates nothing
- maxitem and updates are not modeled: the read surface is the six lists plus item and user

**instagram-style**

- authorize without redirect_uri, state or client_id is invalid_request
- authorize redirects back with a fresh code and the state echoed
- a redirect_uri that already carries a query is joined with &
- the exchange demands grant_type=authorization_code
- an unknown code is 400 invalid_grant
- a good exchange mints a token bound to a fresh IG user
- the code is single-use: a replay is invalid_grant
- client mismatches are 400 invalid_client
- a mismatched attempt must not burn the code
- a second flow mints a distinct user
- a missing bearer is 401 in the Graph error envelope
- wrong schemes and unknown bearers answer the same 190
- every API route enforces the same gate
- a bearer dies at its clock-derived 60-day expiry
- me returns the OAuth-bound profile
- media_count starts at 0 and tracks published media
- a second user's profile counts only its own media
- a container without image_url or video_url is a code-100 400
- create assigns a c_* container id
- a fresh container polls IN_PROGRESS and publish is gated
- the status derives FINISHED after the ~3s window
- publishing a FINISHED container assigns an m_* media id
- simulate_fail ends in ERROR and never publishes
- unknown container ids answer the catch-all 404
- a video container publishes VIDEO media carrying the video url
- the media edge lists newest first (reverse chronological)
- ?fields= projects each row and drops unknown fields
- limit pages through after cursors with a next that keeps the query
- a malformed after cursor is a code-100 400
- the list is scoped to the path user
- all four manifest metrics return in canonical order
- values are deterministic across reads
- ?metric= filters to the requested names
- an unknown metric name empties the data set (deviation, as-is)
- insights for an unknown media id are the catch-all 404
- comments authorize via the access_token query param
- the bearer header authorizes the identical read
- a bad query token is the 190 envelope
- since hides comments at-or-before the cutoff
- comments on an unknown media id are a code-100 OAuthException 404
- refresh demands a token (query param or bearer)
- an unknown token is rejected with 190
- refresh mints a fresh 60-day token; the old one keeps working
- the refreshed token outlives the original's expiry

**jumio-style**

- a missing, bare or wrong-scheme token is a 401 in the Jumio error envelope
- a scan create answers PENDING with a synthetic decimal scan reference
- sequential creates advance the reference sequence
- a create without merchantScanReference is a 400
- PENDING holds through the processing window then flips to DONE
- a FAILED scan carries a real reject reason and its description
- unknown scans are 404 on every parameterized route
- extracted data is None while the scan is PENDING
- DONE exposes the synthetic document extraction
- FAILED scans answer data with a 409 repeating the reason
- delete removes the scan and later reads are 404s
- deleting after the terminal window still advances the lifecycle
- a correctly MACed webhook body is accepted
- a tampered body, wrong MAC or missing header is a 401
- the terminal transition emits exactly one signed scan.completed
- failed scans emit scan.failed carrying the rejection reason
- a delete-driven terminal transition also emits, then nothing more

**linkedin-style**

- authorize without redirect_uri, state or client_id is invalid_request
- authorize redirects back with a fresh code and the state echoed
- a redirect_uri that already carries a query is joined with &
- the exchange demands grant_type=authorization_code
- an unknown code is 400 invalid_grant
- a good exchange mints a 60-day token pair for a fresh member
- the code is single-use: a replay is invalid_grant
- client mismatches are 400 invalid_client
- a mismatched attempt must not burn the code
- a second flow mints a distinct member
- the refresh grant demands client creds
- an unknown refresh token is invalid_grant
- refresh rotates the pair and keeps the member
- the presented refresh token is single-use
- rotation chains: the new refresh token refreshes again
- a missing bearer is 401 in the service error envelope
- wrong schemes and unknown bearers answer the same 401
- every API route enforces the same gate
- a bearer dies at its clock-derived 60-day expiry
- userinfo returns the OAuth member profile
- publishing as anyone but the token's member is a 403
- a good publish mints a ugcPost urn echoed in x-linkedin-id
- the post resolves to a share urn carrying its own author
- resolving an unknown urn is a 404
- unconfigured, publishing is unthrottled
- arming fail_after injects 429 REQUEST_LIMIT_EXCEEDED
- the limit is per member
- a throttled attempt creates no post
- q must be author
- reply resolves urn:li:person:me to the authenticated member
- commenting as anyone but the caller is a 403
- replying to an unknown object is a 404
- ingest lists only the token member's comments
- member B's comment resolved me and lists only under B
- createdOn is clock-stamped and monotonic
- count pages with a next link that round-trips the query
- without count the whole list returns unpaged
- a malformed start cursor is a 400
- an unknown entity is a 404
- each queryType totals base+3/5/7/11 split across two daily buckets
- entity accepts both the parenthesized and bare urn forms
- start past the data returns an empty page
- an unknown queryType falls back to the base total (deviation, as-is)

**marketo-style**

- only client_credentials mints a token
- an invalid token gets the 403 success=false envelope
- create assigns ids through the input array
- get by id round-trips the fields
- createOrUpdate dedupes by email in place
- batchSize/nextPageToken paging walks leads without overlap

**netsuite-style**

- a request without Authorization is 401 INVALID_LOGIN in the o: envelope
- TBA without oauth_signature is rejected: the signature's presence is the gate
- TBA, NLAuth and Bearer all pass the structural gate
- every route family sits behind the gate
- create answers 204 No Content with the record's URL in Location
- internal ids are numeric strings minted past the seed range
- the created record reads back verbatim under its id
- POST with a seen externalId is an upsert: the existing record's Location, no duplicate
- DELETE answers 204 and the record is gone afterwards
- unknown ids and unknown record types are distinct 404 codes
- a transaction record without entity is 400 USER_ERROR naming the field
- entity references resolve by id or refName against stored customers
- a dangling entity reference is 400 INVALID_KEY_OR_REF
- customerPayment demands both customer and payment
- a body that is not a JSON object is 400 INVALID_REQUEST
- PATCH merges the sent fields into the stored record and answers 204
- numeric patches round-trip through the collection as floats
- an id in the PATCH body cannot move the record
- PATCH on an unknown record id or type is a 404
- a malformed PATCH body is 400 INVALID_REQUEST
- the list envelope is items/count/hasMore/links with a self link
- limit windows the page and hasMore adds a next link with the following offset
- following the next link returns the tail and clears hasMore
- an offset past the end is an empty page, not an error
- q filters and orderBy sorts before paging
- an unparseable q is 400 INVALID_SEARCH_PARAMETER, not silent unfiltered rows
- the metadata catalog lists the record types the parameterized routes serve
- SuiteQL returns the FROM table's live rows in the query envelope
- created records are visible to SuiteQL
- SQL LIMIT/OFFSET window the page and mint a next link
- limit/offset query params page when the SQL has no clauses
- unknown tables, FROM-less and missing statements are 400 INVALID_REQUEST
- the /services/rest/v1/suiteql alias runs the same handler
- a salesOrder bills into an invoice dated today, due in 30 days
- the invoice settles into a customerPayment and flips its source to Paid in Full
- the clock drives trandate
- request-body fields override the mapped defaults
- impossible chains, unknown sources and dangling overrides use NetSuite's real codes

**oneinch-style**

- a quote returns token pairs, a decimal toAmount and a 100-point split
- quotes are deterministic and address matching is case-insensitive
- the toAmount scales linearly with the input amount
- a same-token quote scales the amount by the pseudo-rate (as-is)
- missing params and unknown tokens are 400 error envelopes
- a swap returns router-addressed calldata with gas and gasPrice
- the swap toAmount matches the quote for the same input
- slippage is optional and ignored (as-is)
- missing params and unknown tokens are 400s
- the spender is the router contract address
- approve calldata targets the token with the max allowance
- a missing or unknown token is a 400
- the token list is an address-keyed map of six tokens
- every token in the list is quotable as a source

**onfido-style**

- a missing or non-Token Authorization header is 401 authorization_error
- applicant create flags exactly the blank names and reads back by id
- document and live photo uploads bind to a real applicant and default side
- check create demands report_names and a known applicant
- the check completes from the clock and emits check.completed exactly once
- simulate_fail completes with consider and consider breakdowns
- the webhook receiver MACs the exact raw bytes

**opensea-style**

- the X-API-KEY gate 401s every surface with the V1ErrorWrapper envelope
- the asset list seeds five mock-punks NFTs and filters by collection_slug
- single-asset reads match the address case-insensitively and 404 unknown shapes
- collections read back contracts and string-typed stats; unknown slugs 404
- limit/next cursor pagination walks the pages and 400s a malformed cursor
- events filter by collection_slug and event_type
- listings carry the Seaport ask shape: the NFT in offer, payment in consideration
- offers invert the shape: payment in offer, the NFT in consideration
- created offers are stateful, deterministic, and defaulted

**paypal-style**

- client_credentials over Basic auth mints a distinct Bearer with PayPal's token envelope
- the minted bearer authorizes the Orders API
- minting without HTTP Basic client auth is a 401 AUTHENTICATION_FAILURE envelope
- a bearer that was never minted is rejected with 401
- the advertised 9-hour expires_in is enforced — the token dies past it
- any Basic credentials mint a token — no client registry (deviation, asserted as-is)
- create assigns ORDERID-N, stamps create_time, and echoes intent + purchase_units
- a CREATED order carries self/approve/capture links
- get round-trips the order; unknown ids are 404 INVALID_RESOURCE_ID
- orders are accepted without purchase_units — no create-time validation (deviation, asserted as-is)
- capture or authorize before payer approval is 422 ORDER_NOT_APPROVED
- simulate_fail approval keeps the order CREATED with 422 PAYER_ACTION_REQUIRED
- approval flips CREATED -> APPROVED and swaps in capture/authorize links
- re-approval is idempotent
- capture completes the order and embeds a COMPLETED capture in purchase_units
- the capture resource is readable via the payments API
- re-capturing the order is 422 ORDER_ALREADY_CAPTURED
- authorize completes the order and lands a CREATED authorization
- re-authorizing the order is 422 ORDER_ALREADY_AUTHORIZED
- GET shows the auth with a 3-day honor window from the virtual clock
- reauthorize refreshes the honor window and syncs the embedded order copy
- void is 204, moves the auth to VOIDED, and syncs the order
- a voided authorization rejects every action with 422
- malformed, mismatched-currency, and over-authorization amounts are 400s with real issue codes
- a partial capture keeps final_capture false and moves the auth to CAPTURED
- the capture is appended to the order and links up to the authorization
- a captured authorization is terminal
- refunds are created PENDING and reserve the unrefunded balance
- the 3-second settle window flips PENDING -> COMPLETED on read
- the settled refund is reported as refunded_amount on the capture
- a FAILED refund frees the balance again
- PayPal-Request-Id replays return the same order
- a replay returns the order's current state, not a cached snapshot (deviation, asserted as-is)
- requests without the header (or with a new one) are not deduplicated
- webhook registration round-trips through the list
- signature verification answers SUCCESS only for known webhook ids
- deletion is 204, and repeats are 404

**persona-style**

- a missing, bare or wrong-scheme token is a 401 in the JSON:API error envelope
- a create mints a zero-padded inq_ id in the JSON:API envelope
- sequential creates advance the id sequence
- any Bearer is accepted: the gate checks presence, not a store (as-is)
- a create missing template_id or reference_id is a 400 invalid_request
- the status derives from the clock created to pending to completed
- resume restarts the clock at pending without duplicating verifications
- simulate_fail declines at the terminal transition and seeds nothing
- unknown inquiries are JSON:API 404s on every parameterized route
- verifications are empty until the terminal transition fires
- completion seeds the government-id and selfie verifications
- a fresh correctly-signed webhook is accepted
- a tampered body or wrong MAC is a 401 invalid_signature
- a stale or far-future t is a 401 invalid_timestamp
- a missing header or unparseable signature is a 401
- polling through pending still emits exactly one inquiry.completed
- re-reads and post-resume re-completions do not re-emit
- a declined inquiry emits inquiry.declined signed the same way

**photos-style**

- authorize without redirect_uri, state or client_id is 400 invalid_request
- authorize redirects with a fresh code and echoes the state
- a redirect_uri that already carries a query joins with &
- exchanging an unknown code is 400 invalid_grant
- a client mismatch answers invalid_client but leaves the code usable
- the happy exchange mints the bearer pair
- the minted bearer reads the data plane
- authorization codes are single-use
- unknown grant types are unsupported_grant_type
- refresh without client credentials is 400 invalid_client
- refresh with an unknown refresh token is 400 invalid_grant
- refresh mints a new access token but keeps the refresh token
- the refreshed token serves the same user's library
- refresh-issued access tokens expire like any other
- every data surface answers 401 UNAUTHENTICATED without a bearer
- non-Bearer schemes and unknown or empty tokens are equally 401
- the minted bearer passes the gate on every surface
- the access token dies at its expiry on the virtual clock
- /v1/uploads answers a plain-text uploadToken
- batchCreate links the token to a media item
- mime types follow the file extension
- an unknown upload token answers the per-item status error
- mixed batches keep request order
- upload tokens are single-use
- an albumId is accepted without validation (as-is)
- an empty batch answers an empty result list
- =d serves the original bytes with the recorded content type
- =dv serves the same original bytes
- a bare baseUrl serves the derivative payload instead
- baseUrl is computed from the request host at read time
- unknown ids answer the 404 envelope
- pages walk by pageToken and the last partial page has no next
- the default page holds 25 items
- pageSize clamps at 100
- a single item fetch and the 404 envelope
- items are private to their user
- an unfiltered search returns everything in creation order
- mediaTypeFilter selects PHOTO or VIDEO by mime prefix
- dateFilter ranges and exact dates bound creationTime
- partial dates span their whole period
- multiple ranges are OR'd and keep upload order
- media type and date filters compose
- albumId scopes the search
- search paginates from the JSON body
- create returns the album shape
- a missing album title defaults to Untitled Album
- unknown albums answer the 404 envelope
- list walks pages with the 20 default and the 50 clamp
- albums are private to their user
- delete removes the album but leaves its media

**pinata-style**

- missing or half-present credentials are 401 with the error envelope
- the API key pair and a Bearer JWT both open testAuthentication
- pinJSONToIPFS pins content to a real CIDv0
- re-pinning identical content is isDuplicate, not a new pin
- pinFileToIPFS sizes and names the pin from the multipart parts
- pinList filters by hash, size, status, and metadata name
- pinStart/pinEnd bound the date-pinned window
- pinByHash requires hash and matches the CID exactly
- pinList pages at the real default of 10 rows
- unpin removes the CID; a second unpin is 403 FORBIDDEN

**powerplatform-style**

- every route sits behind the entra bearer gate: a missing, non-bearer, or empty token answers 401 in the microsoft error envelope
- the gate does not validate the token: any well-formed bearer passes (as-is)
- environments list as the odata value envelope with arm resource ids and nested properties
- the api-version query convention is not modeled: the param is ignored (version is baked into the /v2 path — reported)
- environment lifecycle is not modeled: states are static and nothing moves on the clock (reported)
- the collection lazily seeds two dataverse accounts on first read
- create answers 201 with a location entity uri and OData-Version header, echoing the record
- the accounts({accountid}) key convention retrieves and 404s with the dataverse 0x80040217 envelope
- a client-supplied accountid is honored and targeted by later reads
- patch is a partial merge answering 204; delete answers 204 and a second delete 404s
- $filter supports eq/contains with AND and numeric comparisons on unquoted literals
- $orderby sorts asc and desc; $skip applies before paging
- $select projects fields and $count=true reports the post-filter pre-paging total
- $top/$skipToken walk every account exactly once with @odata.nextLink only between pages
- a nextLink round-trips the caller's $filter and $select so a paged walk stays filtered
- paging is disabled without $top and an invalid skipToken answers 400 badrequest
- an environment with no flows falls back to the seeded welcome flow
- creating a flow persists it per environment behind arm flow ids; other environments keep the seeded fallback
- connectors are static arm api resources with tiers

**printful-style**

- a missing or non-Bearer Authorization is the 401 error envelope
- any non-empty bearer key is accepted — the dev-key model
- a sync product mints a sequential id; variants read back verbatim
- unknown products get the 404 error envelope
- an unpaged list is a bare data array with no paging object
- limit/offset pages walk the paging envelope without repeats
- a malformed offset cursor is the 400 error envelope
- v1 create is result-wrapped with an integer id and draft status
- v1 GET round-trips the result; unknown ids are 404
- the v2 list serves one canonical order doc per order, from both create surfaces
- the status csv filter applies before paging
- a status update flips the canonical doc both surfaces read
- order timestamps are sequence-derived, not wall-clock (documented mock choice)
- STANDARD and EXPRESS quotes scale with the item count
- an unset configuration reads as an empty result
- POST sets and PUT replaces the single config; the secret stays masked
- DELETE returns success, empties the read, and silences delivery
- a config without a url is the 400 error envelope
- deliveries are HMAC-SHA256-signed over the exact delivered bytes
- the types filter delivers only subscribed topics
- an empty types list subscribes to every event type
- a v1-created order emits the v1 result shape as the event data

**printify-style**

- a missing or non-Bearer Authorization is a flat 401 at every surface
- the static catalog serves both blueprints and their variant tables
- product create mints sequential hex ids for each blueprint/provider pair
- product lists are shop-scoped and walk the page cursor without repeats
- update merges under the clock and delete leaves a flat 404
- both order-create route forms build the same priced pending document
- order polling strips .json and send flips it to fulfilled
- the global order list pages by limit/page and rejects garbage cursors
- webhook secrets stay masked through every read, and delete leaves a flat 404
- deliveries are HMAC-signed by the subscribing hook's own secret

**psd2-style**

- the tpp token endpoint mints a bearer; other grants and missing or unknown bearers are rejected
- a created consent answers 201 received with self and startAuthorisation links, and reads back
- the sca redirect flow advances one hop per PUT: started → psuAuthenticated → scaReceived
- an update carrying neither method nor OTP is a 400 PARAMETER_INVALID that leaves the chain put
- after the 1s challenge window a read derives finalised and the consent reads valid
- delete terminates the consent and consent-bound reads then reject it
- account reads require a valid consent: 401 CONSENT_INVALID without one
- a valid consent unlocks the seeded account list with per-account links
- withBalance=true embeds an interimBooked balance in each account entry
- the balances read returns interimBooked and forwardAvailable pairs and 404s unknown accounts
- the transaction report requires bookingStatus and dateFrom
- bookingStatus splits booked from pending and dateFrom/dateTo bound the report
- a restricted consent scopes the account list and 404s uncovered reads
- a consent past its validUntil finalises but gates reads with 401 CONSENT_EXPIRED
- with no Consent-ID header, only-expired consents still answer CONSENT_EXPIRED
- an unknown Consent-ID is 400 CONSENT_INVALID; a not-yet-finalised one is 401 CONSENT_INVALID
- page/size walks every account exactly once with a next link only between pages
- the next href round-trips the caller's other query params (withBalance)
- a malformed page cursor is 400 FORMAT_ERROR; a cursor past the end is an empty last page
- the tpp bearer dies at its 3600s expires_in with 401 TOKEN_EXPIRED
- a payment validates its product and amount before answering 201 RCVD with startAuthorisation
- the payment SCA chain mirrors the consent chain and finalises on read
- the transaction status walks RCVD → ACTC → ACSC on the clock and terminal payments refuse cancellation
- a non-terminal payment cancels to 204/CANC and simulate_fail drives RJCT

**qbo-style**

- authorize without client_id/redirect_uri/state is invalid_request
- authorize 302s back to the redirect_uri with code, state and a fresh realmId
- the auth code exchanges once into a token pair; reuse is invalid_grant
- refresh rotates the refresh token and kills the old one (the QBO churn)
- unknown grants and unknown codes are OAuth 400s
- v3 calls demand a live bearer: absent, unknown and expired tokens are 401 fault 32001
- the bearer is realm-bound: another company's path is 401
- DisplayName is required: a 400 fault 610
- customer create assigns Id, SyncToken 0 and QBO defaults
- reads by path id and ?id= round-trip; unknown ids are 404 fault 620
- POST with Id updates: a sparse merge bumps SyncToken and leaves unspecified fields alone
- DELETE deactivates: the record stays readable by id but leaves the active list
- invoice create prices its Line items into TotalAmt/Balance and mints a DocNumber
- a Line is required: a 400 fault 610
- void flips status Voided and zeroes Balance, keeping the record
- DELETE is a hard delete: the record is gone afterwards
- entity detection follows the FROM token, so CustomerRef.value reads Invoices
- WHERE filters by equality, LIKE and IN over stored fields
- ORDER BY DESC with MAXRESULTS caps the page and reports maxResults
- the POST query endpoint takes the statement from the body
- default reads hide deactivated customers; WHERE Active = False surfaces them
- an unknown entity answers an empty QueryResponse; a statement without one is a 400 fault
- STARTPOSITION pages with MAXRESULTS: row 2 of the sorted set

**reddit-style**

- a missing or generic User-Agent is 429 on both routes
- the token endpoint requires HTTP Basic client credentials
- a permanent authorization_code mints access and refresh together
- a refresh grant returns a fresh access token and no new refresh
- submit requires a bearer the adapter itself minted
- a valid submit returns the t3_ thing envelope
- missing sr or title stay HTTP 200 with Reddit error triples
- an access token dies after its one-hour window

**revenuecat-style**

- a missing or unknown key is a 401 {code, message} envelope
- the public pk_ SDK key passes subscriber reads and receipt posts but is 401 on restricted writes
- GET subscriber is get-or-create and answers in the v1 CustomerInfo envelope
- receipt validation mirrors the real 400 order: app_user_id, platform, fetch_token, bad token
- an ios receipt grants the pro entitlement with real trial math, and renewals stack
- a google-play dict receipt feeds the product and lands in non_subscriptions
- revoke lapses a live subscription; delete and the 404 envelopes
- expiry is derived on read: a lapsed trial drops its entitlement

**sendgrid-style**

- the bearer gate rejects missing and unknown keys with SendGrid's grant envelope
- mail send answers 202 with an empty body, an X-Message-Id, and flattened personalizations
- the retrieval endpoint pages with limit and the opaque offset cursor
- the delivery lifecycle derives processed -> delivered (or dropped) on read, exactly once
- the Email Activity query language narrows the list
- event webhook settings round-trip and require a URL when enabled
- deliveries are ECDSA P-256 signed over timestamp + raw body and fire once per recipient stage

**servicenow-style**

- unknown credentials are 401 at the gate
- create assigns a sys_id and INC number
- get round-trips the fields
- update persists the new state
- sysparm_query narrows the list with a total count
- offset/limit pagination pages via the Link header without repeats
- tables are isolated from each other
- unknown sys_id and unknown table are 404
- delete removes the record for good

**signin-with-apple-style**

- authorize redirects with a single-use code plus state and validates its params
- the token exchange mints a real es256 id_token with apple claim shapes
- the served jwks verifies the minted id_token signature
- auth codes are single-use and client_secrets are verified cryptographically
- the refresh grant rotates access tokens and rejects stale or foreign inputs

**smartbill-style**

- requests without credentials are turned away with the errorText envelope
- non-Basic schemes, malformed base64, and colon-less pairs are 401, never a 5xx
- any username:token Basic pair is accepted, under any header case
- the company bootstrap registers a cif and echoes it without internal fields
- a missing cif is a 422 and an unknown cif is a plain 404
- invoice create answers 200 with an empty body and numbers documents sequentially
- totals are computed per line and returned as JSON numbers on read-back
- the read-back drops internal fields and defaults issueDate from the clock
- documents are scoped by series: the FCT number space is not the PRO one
- cancel marks the invoice canceled and records the cancellation tax
- restore flips the document back to active
- canceling an unknown invoice is the 404 errorText envelope
- a payment whose invoicesList number is a JSON number lands on its invoice
- paymentstatus walks to paid and clamps overpayment at zero
- deleting a payment un-pays the invoice; a second delete is 404
- a payment body without the payment envelope is 422
- estimates number on their own PRO counter and cancel like invoices
- purchase invoices number on the ACH counter and carry the supplier object
- stock movements seed quantities that read back grouped by warehouse
- out movements decrement stock and cannot drain a product that was never in
- productName and productCode filters narrow the grouped read
- tax and series metadata are static {list} envelopes with no cif
- document send records the message; a missing envelope is 422
- undecodable and non-object bodies are a 400 errorText, never a 5xx
- an empty body still creates when the cif rides in the query

**sqs-style**

- signed calls pass on both transports with the real MD5
- missing and garbage auth are 403
- tampered signatures and wrong or unknown keys are 403
- a stale x-amz-date is RequestTimeTooSkewed; a fresh signature passes
- a delayed send is not receivable until the delay lapses
- MaxNumberOfMessages bounds are enforced
- receive hides the message until the timeout lapses, counted NotVisible
- redelivery mints a fresh receipt handle and bumps the receive count
- ChangeMessageVisibility extends the in-flight window
- delete removes the message; stale handles are ReceiptHandleIsInvalid
- one bad entry fails alone; the rest of the batch still sends
- delivered entries round-trip their message attributes
- oversize and duplicate-id batches are rejected
- purge empties the queue immediately over the queue-URL transport
- a second purge inside 60s is 403, then works again after the window
- create, GetQueueUrl, and prefix-filtered ListQueues round-trip
- identical re-create is idempotent; conflicting attributes are QueueAlreadyExists
- SetQueueAttributes persists; unknown names are InvalidAttributeName
- DeleteQueue tears the queue down for its messages too
- the throttled profile alternates empty receives deterministically

**tenderly-style**

- the access-key gate rejects missing and unknown bearers with the slug envelope
- networks answer the bare array and switch to the paged envelope under perPage
- a plain simulation round-trips the deterministic Tenderly shape
- a value transfer emits the ERC-20 Transfer log and balance overrides
- reverting simulations carry the ABI-encoded Error(string) output
- bundles fan out per simulation and stored results list and retrieve by id

**thegraph-style**

- pools collection arguments sort by volume and join token0/token1
- where filters map the graph-node suffix operators
- validation failures and the first cap surface as GraphQL errors
- domains join owner/resolvedAddress; lookups miss as null
- _meta reports the deployment head; Token.pools joins in reverse
- the REST SDL surface is public and rejects unknown bearer keys

**threads-style**

- authorize without redirect_uri, state or client_id is invalid_request
- authorize redirects back with a fresh code and the state echoed
- a redirect_uri that already carries a query is joined with &
- the exchange demands grant_type=authorization_code
- an unknown code is 400 invalid_grant
- a good exchange mints a token, user and refresh token
- the code is single-use: a replay is invalid_grant
- client mismatches are 400 invalid_client
- a mismatched attempt leaves the code redeemable (house rule)
- a second flow mints a distinct user
- a missing bearer is 401 in the Graph error envelope
- wrong schemes and unknown bearers answer the same 190
- every API route enforces the same gate
- a bearer dies at its clock-derived 60-day expiry
- me returns the static mock profile
- every user's token sees the same static profile (deviation, as-is)
- ?fields= is ignored: the full profile always comes back
- a container without media_type=TEXT and text is a code-100 400
- create assigns a c_* container id
- a TEXT container polls finished immediately (no processing window)
- back-to-back publish assigns an m_* media id
- republishing the same container mints a second media (deviation, as-is)
- simulate_fail ends in error and never publishes
- unknown container ids answer the catch-all 404
- the inbox lists the user's media newest first
- each post carries one synthetic reply child
- the inbox is scoped to the path user
- ?fields= projection is ignored (deviation, as-is)
- all four manifest metrics return in canonical order
- values are deterministic across reads
- ?metric= projects to the requested names in canonical order
- an unknown metric name empties the data set (deviation, as-is)
- insights for an unknown media id are the catch-all 404
- refresh demands a known refresh_token
- a refresh mints a fresh 60-day token bound to the same user
- the response omits the rotated refresh_token (deviation, as-is)
- the used refresh token is single-use: a replay is invalid_grant
- the original access token keeps its own 60-day life
- the refreshed token outlives the original's expiry

**twitter-style**

- the mock oauth2 endpoint mints a bearer and the bearer gate is never enforced
- create enforces the 280-char limit and reply-chain integrity with v2 400 envelopes
- create answers 201 {data:{id,text}} with kv-sequence ids and clock-stamped created_at
- read by id projects tweet.fields and expands author_id into includes
- delete answers {data:{deleted:true}} and later reads are 404s
- /me resolves the literal route before /2/users/{id} and returns v2's default field set
- show by id and lookup by username round-trip the seeded users
- unknown users are resource-not-found 404s in the v2 envelope
- the timeline is newest-first and loses nothing by default
- start_time/end_time bound created_at and exclude=replies drops threads
- max_results pages via meta.next_token; an invalid pagination_token is a 400
- the tweet list shares the same v2 paging and stays unpaged without max_results

**walletconnect-style**

- every route demands a projectId — body, query, or bearer all pass
- a wc: URI pairing round-trips its topic, relay protocol, and symKey
- an auto pairing mints a fresh topic and a 64-hex symKey
- proposing requires pairingTopic — and accepts one never paired
- approve acknowledges the session and derives eip155 namespaces
- the session list is a bare array capped by limit
- the approval gate is missing: an unacknowledged session still answers
- wallet requests answer in a JSON-RPC 2.0 envelope with monotonic ids
- signing and transaction methods return synthetic 0x-hex hashes
- extend echoes the fixed session TTL without persisting anything
- disconnect retires the topic and every later call 404s

**whatsapp-style**

- a missing bearer is 401 in the Meta error envelope
- wrong schemes, bare tokens and unknown bearers answer the same 190
- every route enforces the same gate
- the seeded test token dies at its clock-derived 10-year expiry
- a text send answers Meta's contacts + messages envelope
- message ids are a zero-padded monotonic sequence
- a template send is accepted and reads back as type template
- a send without a usable recipient is a code-131026 400
- mark-as-read is unmodeled: a status=read body falls into the send path
- a fresh message reads back sent
- the status stays sent through the in-flight window
- delivered is derived at +3s and stays delivered
- simulate_fail ends at failed (simulator extension, as-is)
- unknown wamids are a code-803 404
- each send emits exactly one signed messages webhook
- no status webhook fires before the terminal window
- the terminal transition emits the statuses webhook exactly once
- a multipart upload stores real bytes and reports their digest
- the content download returns the exact bytes at the stored mime
- a specific part content-type outranks the filename extension
- a metadata-only JSON upload has no bytes to download
- uploads demand messaging_product=whatsapp (code 100)
- a multipart body without a file part is a 1304 400
- the seeded phone reads back its registration profile
- register answers success true and the phone stays readable
- register on an unknown phone id still succeeds (as-is)
- an unknown resource id is a code-803 404
- the seeded welcome_message template lists APPROVED
- a created template starts PENDING and echoes its payload
- the approval lifecycle moves PENDING to APPROVED and REJECTED
- an invalid status target leaves the template unchanged (as-is)
- unknown template ids are a code-803 404
- templates page by limit + after cursors
- a malformed after cursor is a code-100 400

**workday-style**

- requests without a Bearer or Basic scheme are 401 at the gate
- both Bearer and Basic credentials clear the gate
- Create_Worker mints an id that reads back through staffing
- the RaaS custom report wraps rows in Report_Entry
- search narrows the worker list before paging
- limit/offset pages tile the list without repeats
- compensation serves the seed shelf and empty for created workers
- payroll, positions, and financials share the list envelope
- an unknown worker is a 404 with the Workday error envelope

**x-articles-style**

- authorize 302s to the redirect_uri carrying a fresh code and the echoed state
- authorize demands redirect_uri, the S256 method and a non-empty challenge
- the token endpoint demands HTTP Basic client creds and a known grant type
- a valid code exchange mints a bearer+refresh pair and the code is single-use
- a mismatched redirect_uri or a missing verifier fails without burning the code
- refresh grants rotate the pair and retire the presented token
- the bearer gate is never enforced
- media upload mints media_id_strings that attach as cover_media_id
- draft create validates title and content_state.blocks
- a draft reads back with its full metadata
- publish flips the draft and attaches the minted post_id
- republishing mints a fresh post_id
- unknown article ids are 404s on get and publish
- create enforces required text and the inclusive 280-char limit
- replies must target a known tweet
- tweets read back whole and unknown ids are 404s

**xero-style**

- a missing or unknown bearer gets the same 401 TokenExpired envelope; the seeded static token passes
- GET /connections needs only the bearer and lists the two demo tenants
- api.xro calls without xero-tenant-id are 400 TenantRequired, and the header matches case-insensitively
- the seeded static token expires on the virtual clock, and the bearer gate outranks the tenant gate
- PUT /Invoices sums every line into the totals and echoes each computed LineAmount
- a single-object body creates one invoice with clock-derived Date and DueDate defaults
- GET /Invoices/{id} round-trips the stored invoice; unknown ids are the 404 envelope
- payments accumulate on the ledger and are echoed with their own PaymentID
- a negative amount is a refund bounded by what was paid
- over-payment (and an over-refund) is Xero's validation error and leaves the ledger untouched
- the invoice flips to PAID exactly at a zero balance and then refuses further payments
- DRAFT invoices are not payable and unknown ids are the 404 envelope
- DELETE voids to 204 and the record survives with Status VOIDED and a zeroed balance
- the voided invoice stays listable via the Statuses filter
- re-voiding, voiding a PAID invoice, and unknown ids are rejected
- PUT /Contacts creates with Xero defaults and reads back by id
- the Contacts array upserts by ContactID and ContactNumber, merging over the stored record
- duplicate active names are Xero's real validation error, in Elements
- archive is an update: the contact stays readable and releases its name
- invalid statuses and unknown ids are the plain ValidationError / NotFound envelopes
- where ANDs clauses in Xero's grammar, and Statuses/InvoiceNumber/ContactID filter the invoice list
- order sorts by any field in both directions (dates sort as instants)
- contacts search matches name and email case-blind, while where Name.Contains is case-sensitive
- the seeded chart of accounts and the static catalogs speak the same grammar
- page/pageSize walk every contact exactly once, with nextPage only between pages
- without pageSize paging is off; a page past the end is an empty 200 page
- a malformed page falls back to page 1 (as-is: no 400)
- a delivery signed with base64(HMAC-SHA256(key, raw bytes)) is accepted
- missing, tampered, and wrong-key signatures all answer the 401 envelope Xero requires

**zuora-style**

- an unknown bearer is 401
- account create assigns an id and reads back
- subscribing to a catalog plan prices the subscription
- unknown accounts and empty plan lists are 400s
- EndOfTerm cancel stays Active and a second cancel is rejected
- ZOQL finds the account by name
- webhook registration round-trips through the list

## Adapter surface detail

Per adapter: the **covered surface** — the exact routes served, read
straight from `adapter.yaml` — and the curated gaps from
`conformance/matrix.yaml`: **missing** (a real-API capability that is
absent) vs **deviations** (covered, but documented to differ). Deep
behavior notes live in each adapter's README.

### adyen-style

**Covered** — 14 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v68/payments` |
| POST | `/v68/payments/details` |
| GET | `/v68/payments` |
| POST | `/v68/paymentMethods` |
| POST | `/v68/paymentLinks` |
| GET | `/v68/paymentLinks/{linkId}` |
| POST | `/v68/payments/{paymentPspReference}/captures` |
| POST | `/v68/payments/{paymentPspReference}/refunds` |
| POST | `/v68/payments/{paymentPspReference}/reversals` |
| POST | `/v68/payments/{paymentPspReference}/cancels` |
| POST | `/v68/notifications/test` |
| POST | `/v68/webhooks` |
| GET | `/v68/webhooks` |
| DELETE | `/v68/webhooks/{webhookId}` |

</details>

**Provider surface** — derived from spec adyen-openapi CheckoutService-v68 + PaymentService-v68 @ 68, 68: 39 real routes · 9 covered · 23% · 30 not implemented

<details><summary>not implemented (30)</summary>

- `POST` `/v68/adjustAuthorisation`
- `POST` `/v68/applePay/sessions`
- `POST` `/v68/authorise`
- `POST` `/v68/authorise3d`
- `POST` `/v68/authorise3ds2`
- `POST` `/v68/cancel`
- `POST` `/v68/cancelOrRefund`
- `POST` `/v68/cancels`
- `POST` `/v68/capture`
- `POST` `/v68/cardDetails`
- `POST` `/v68/donate`
- `POST` `/v68/donationCampaigns`
- `POST` `/v68/donations`
- `POST` `/v68/forward`
- `POST` `/v68/getAuthenticationResult`
- `POST` `/v68/orders`
- `POST` `/v68/orders/cancel`
- `POST` `/v68/originKeys`
- `PATCH` `/v68/paymentLinks/{linkId}`
- `POST` `/v68/paymentMethods/balance`
- `POST` `/v68/payments/{paymentPspReference}/amountUpdates`
- `POST` `/v68/paypal/updateOrder`
- `POST` `/v68/refund`
- `POST` `/v68/retrieve3ds2Result`
- `POST` `/v68/sessions`
- `GET` `/v68/sessions/{sessionId}`
- `POST` `/v68/storedPaymentMethods`
- `POST` `/v68/technicalCancel`
- `POST` `/v68/validateShopperId`
- `POST` `/v68/voidPendingRefund`

</details>

**Missing** (4)

- No Payouts, Disputes, or Terminal API (cloud/POS) endpoints
- No paymentMethods/balance, gift-card, or stored-value endpoints
- No amountUpdates, technicalCancels, or auto-rescue modification routes
- No stored payment method lifecycle — tokens cannot be stored, listed, or disabled

**Deviations** (8)

- Per-hook hmacKey and events filter are local extensions — real Adyen hides the key
- simulate_fail flag on /v68/payments forces Refused (simulator-only failure injection)
- paymentLinks url is synthetic — no hosted checkout page; pay via the link reference
- paymentMethods serves a fixed 5-method catalog with empty storedPaymentMethods
- Webhook HMAC signs the base64-encoded signing string with eventCode in field 7; deliveries go to the first matching hook only
- Idempotency replay re-renders the payment's current state, not the original response
- Modification pspReferences carry CAP/REF/REV/CAN prefixes; real Adyen's are numeric
- paymentMethods accepts any merchantAccount; real Adyen 403s on unknown accounts

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v68/payments` — body, stateful, webhooks, clock
- `POST` `/v68/payments/details` — body, stateful, webhooks, clock
- `GET` `/v68/payments` — query, stateful, paginate, clock
- `POST` `/v68/paymentMethods` — body, stateful, clock
- `POST` `/v68/paymentLinks` — body, stateful, clock
- `GET` `/v68/paymentLinks/{linkId}` — params, stateful, clock
- `POST` `/v68/payments/{paymentPspReference}/captures` — body, params, stateful, webhooks, clock
- `POST` `/v68/payments/{paymentPspReference}/refunds` — body, params, stateful, webhooks, clock
- `POST` `/v68/payments/{paymentPspReference}/reversals` — body, params, stateful, webhooks, clock
- `POST` `/v68/payments/{paymentPspReference}/cancels` — body, params, stateful, webhooks, clock
- `POST` `/v68/notifications/test` — body, stateful, clock
- `POST` `/v68/webhooks` — body, stateful, clock
- `GET` `/v68/webhooks` — stateful, clock
- `DELETE` `/v68/webhooks/{webhookId}` — params, stateful, clock

</details>

### anaplan-style

**Covered** — 18 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/2/0/workspaces` |
| GET | `/2/0/workspaces/{workspaceId}/models` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/modules` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/files` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` |
| POST | `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` |
| PUT | `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}/chunks` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/imports` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/exports` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/actions` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/processes` |
| POST | `/2/0/workspaces/{workspaceId}/models/{modelId}/imports/{importId}/tasks` |
| POST | `/2/0/workspaces/{workspaceId}/models/{modelId}/imports/{importId}/jobs` |
| POST | `/2/0/workspaces/{workspaceId}/models/{modelId}/exports/{exportId}/tasks` |
| POST | `/2/0/workspaces/{workspaceId}/models/{modelId}/exports/{exportId}/jobs` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/tasks/{taskId}` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}` |

</details>

**Missing** (4)

- No line-item, list, view, or module-data endpoints — data moves via CSV only
- No file DELETE; no workspace or model CRUD (catalogs are read-only)
- No ALM surface — revisions, comparisons, synthetic models
- No Anaplan token service (/token/authenticate) — Basic/Bearer only

**Deviations** (5)

- Task state derives from the clock — IN_PROGRESS at +1s, COMPLETE at +3s
- simulate_fail in the task body is a simulator-only trigger (real Anaplan has none)
- PUT file upload is the same surface as POST; /jobs aliases /tasks
- links[0].href pinned to api.anaplan.com regardless of request host
- Unknown workspace/model scope returns 200 + empty items rather than 404

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/2/0/workspaces` — query, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models` — query, params, auth, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/modules` — query, params, auth, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/files` — query, params, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` — params, auth, stateful, errors
- `POST` `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` — params, auth, stateful, errors
- `PUT` `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` — params, auth, stateful, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}/chunks` — query, params, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/imports` — query, params, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/exports` — query, params, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/actions` — query, params, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/processes` — query, params, auth, stateful, paginate, errors
- `POST` `/2/0/workspaces/{workspaceId}/models/{modelId}/imports/{importId}/tasks` — body, params, auth, stateful, errors, clock
- `POST` `/2/0/workspaces/{workspaceId}/models/{modelId}/imports/{importId}/jobs` — body, params, auth, stateful, errors, clock
- `POST` `/2/0/workspaces/{workspaceId}/models/{modelId}/exports/{exportId}/tasks` — body, params, auth, stateful, errors, clock
- `POST` `/2/0/workspaces/{workspaceId}/models/{modelId}/exports/{exportId}/jobs` — body, params, auth, stateful, errors, clock
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/tasks/{taskId}` — params, auth, stateful, errors, clock
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}` — params, auth, errors

</details>

### apple-apns-style

**Covered** — 2 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/3/device/{deviceToken}` |
| GET | `/3/device/{deviceToken}/notifications` |

</details>

**Missing** (4)

- No apns-topic, apns-push-type, apns-priority, or apns-collapse-id handling
- No provider-certificate auth — only JWT provider tokens
- No 429 TooManyRequests or 503 ServiceUnavailable rate-limit responses
- No Web Push endpoints (Safari webpush) or VOIP push handling

**Deviations** (3)

- Provider JWT verified against one fixed P-256 key whose private half is published
- GET /3/device/{token}/notifications is a simulator-only endpoint (no real fetch API)
- sent_at on the notifications endpoint is a constant; 410 Unregistered is modeled but unreachable

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/3/device/{deviceToken}` — body, params, auth, stateful, errors, clock
- `GET` `/3/device/{deviceToken}/notifications` — params, auth, stateful, clock

</details>

### apple-appstoreconnect-style

**Covered** — 15 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1/apps` |
| POST | `/v1/apps` |
| POST | `/v1/appStoreVersionSubmissions` |
| GET | `/v1/users` |
| GET | `/v1/salesReports` |
| GET | `/v1/apps/{id}` |
| PATCH | `/v1/apps/{id}` |
| GET | `/v1/apps/{id}/appStoreVersions` |
| POST | `/v1/apps/{id}/appStoreVersions` |
| GET | `/v1/apps/{id}/builds` |
| GET | `/v1/apps/{id}/appPrices` |
| GET | `/v1/builds/{id}` |
| GET | `/v1/appStoreVersions/{id}` |
| PATCH | `/v1/appStoreVersions/{id}` |
| GET | `/v1/appStoreVersions/{id}/builds` |

</details>

**Provider surface** — derived from spec App Store Connect OpenAPI Specification @ 4.4.1: 1263 real routes · 10 covered · 0% · 1253 not implemented

<details><summary>not implemented (1253)</summary>

- `POST` `/v1/accessibilityDeclarations`
- `DELETE` `/v1/accessibilityDeclarations/{id}`
- `GET` `/v1/accessibilityDeclarations/{id}`
- `PATCH` `/v1/accessibilityDeclarations/{id}`
- `GET` `/v1/actors`
- `GET` `/v1/actors/{id}`
- `PATCH` `/v1/ageRatingDeclarations/{id}`
- `GET` `/v1/alternativeDistributionDomains`
- `POST` `/v1/alternativeDistributionDomains`
- `DELETE` `/v1/alternativeDistributionDomains/{id}`
- `GET` `/v1/alternativeDistributionDomains/{id}`
- `GET` `/v1/alternativeDistributionKeys`
- `POST` `/v1/alternativeDistributionKeys`
- `DELETE` `/v1/alternativeDistributionKeys/{id}`
- `GET` `/v1/alternativeDistributionKeys/{id}`
- `GET` `/v1/alternativeDistributionPackageDeltas/{id}`
- `GET` `/v1/alternativeDistributionPackageVariants/{id}`
- `GET` `/v1/alternativeDistributionPackageVersions/{id}`
- `GET` `/v1/alternativeDistributionPackageVersions/{id}/deltas`
- `GET` `/v1/alternativeDistributionPackageVersions/{id}/relationships/deltas`
- `GET` `/v1/alternativeDistributionPackageVersions/{id}/relationships/variants`
- `GET` `/v1/alternativeDistributionPackageVersions/{id}/variants`
- `POST` `/v1/alternativeDistributionPackages`
- `GET` `/v1/alternativeDistributionPackages/{id}`
- `GET` `/v1/alternativeDistributionPackages/{id}/relationships/versions`
- `GET` `/v1/alternativeDistributionPackages/{id}/versions`
- `GET` `/v1/analyticsReportInstances/{id}`
- `GET` `/v1/analyticsReportInstances/{id}/relationships/segments`
- `GET` `/v1/analyticsReportInstances/{id}/segments`
- `POST` `/v1/analyticsReportRequests`
- `DELETE` `/v1/analyticsReportRequests/{id}`
- `GET` `/v1/analyticsReportRequests/{id}`
- `GET` `/v1/analyticsReportRequests/{id}/relationships/reports`
- `GET` `/v1/analyticsReportRequests/{id}/reports`
- `GET` `/v1/analyticsReportSegments/{id}`
- `GET` `/v1/analyticsReports/{id}`
- `GET` `/v1/analyticsReports/{id}/instances`
- `GET` `/v1/analyticsReports/{id}/relationships/instances`
- `POST` `/v1/androidToIosAppMappingDetails`
- `DELETE` `/v1/androidToIosAppMappingDetails/{id}`
- `GET` `/v1/androidToIosAppMappingDetails/{id}`
- `PATCH` `/v1/androidToIosAppMappingDetails/{id}`
- `GET` `/v1/appCategories`
- `GET` `/v1/appCategories/{id}`
- `GET` `/v1/appCategories/{id}/parent`
- `GET` `/v1/appCategories/{id}/relationships/parent`
- `GET` `/v1/appCategories/{id}/relationships/subcategories`
- `GET` `/v1/appCategories/{id}/subcategories`
- `POST` `/v1/appClipAdvancedExperienceImages`
- `GET` `/v1/appClipAdvancedExperienceImages/{id}`
… and 1203 more


</details>

**Missing** (7)

- No TestFlight beta testing (betaGroups, betaTesters, buildBetaDetails)
- No IAP or subscriptions (inAppPurchasesV2, subscriptionGroups)
- No provisioning surface — bundleIds, certificates, devices, profiles
- No app metadata: localizations, ageRating, categories, phased release
- No customer reviews endpoints (customerReviews and responses)
- No user invitations or user CRUD (GET /v1/users list only)
- No App Analytics (analyticsReportRequests, metrics) — salesReports only

**Deviations** (7)

- JWT signature crypto NOT verified — structural plus registry check only
- Review is clock-driven: WAITING_FOR_REVIEW +1s to IN_REVIEW, +3s to READY_FOR_SALE
- Builds settle PROCESSING to VALID at +3s — no separate in-flight state
- simulate_fail extension: app create forces build INVALID, version create REJECTED
- A first build is minted at app create — no build upload path
- A malformed cursor answers 200 with data null; real ASC answers 400
- salesReports returns a JSON:API object; real ASC streams a gzip TSV and 400s on missing filters

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1/apps` — query, auth, stateful, paginate, filter, clock
- `POST` `/v1/apps` — body, auth, stateful, clock
- `POST` `/v1/appStoreVersionSubmissions` — body, auth, stateful, clock
- `GET` `/v1/users` — query, auth, stateful, paginate, filter, clock
- `GET` `/v1/salesReports` — query, auth, stateful, clock
- `GET` `/v1/apps/{id}` — params, auth, stateful, clock
- `PATCH` `/v1/apps/{id}` — body, params, auth, stateful, clock
- `GET` `/v1/apps/{id}/appStoreVersions` — query, params, auth, stateful, filter, clock
- `POST` `/v1/apps/{id}/appStoreVersions` — body, params, auth, stateful, clock
- `GET` `/v1/apps/{id}/builds` — query, params, auth, stateful, filter, clock
- `GET` `/v1/apps/{id}/appPrices` — params, auth, stateful, clock
- `GET` `/v1/builds/{id}` — params, auth, stateful, clock
- `GET` `/v1/appStoreVersions/{id}` — params, auth, stateful, clock
- `PATCH` `/v1/appStoreVersions/{id}` — body, params, auth, stateful, clock
- `GET` `/v1/appStoreVersions/{id}/builds` — query, params, auth, stateful, filter, clock

</details>

### apple-music-style

**Covered** — 18 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1/catalog/{storefront}/search` |
| GET | `/v1/catalog/{storefront}/charts` |
| GET | `/v1/catalog/{storefront}/songs` |
| GET | `/v1/catalog/{storefront}/albums` |
| GET | `/v1/catalog/{storefront}/artists` |
| GET | `/v1/catalog/{storefront}/playlists` |
| GET | `/v1/catalog/{storefront}/songs/{id}` |
| GET | `/v1/catalog/{storefront}/albums/{id}` |
| GET | `/v1/catalog/{storefront}/artists/{id}` |
| GET | `/v1/me/library/songs` |
| GET | `/v1/me/library/albums` |
| GET | `/v1/me/library/playlists` |
| GET | `/v1/me/library/recently-added` |
| POST | `/v1/me/library` |
| DELETE | `/v1/me/library/{type}/{id}` |
| POST | `/v1/me/played` |
| GET | `/v1/me/ratings/{type}/{id}` |
| PUT | `/v1/me/ratings/{type}/{id}` |

</details>

**Missing** (5)

- No music-videos, stations, genres, or curators catalog endpoints
- No storefronts endpoint (GET /v1/storefronts)
- No library search (GET /v1/me/library/search)
- No personal playlist create or add-tracks (POST /v1/me/library/playlists)
- No recommendations or play history (heavy-rotation, recent/played)

**Deviations** (5)

- Developer JWT signature not verified — structural check plus exact-string token registry
- Music-User-Token accepts any non-empty value — no real user-token validation
- Only registered developer tokens pass the gate; real Apple accepts any properly signed ES256 token
- Storefront codes are validated but do not scope the catalog (gb == us)
- Library lists carry a meta.total the real API does not return

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1/catalog/{storefront}/search` — query, params, stateful, paginate, clock
- `GET` `/v1/catalog/{storefront}/charts` — query, params, stateful, paginate, filter, clock
- `GET` `/v1/catalog/{storefront}/songs` — query, params, stateful, paginate, clock
- `GET` `/v1/catalog/{storefront}/albums` — query, params, stateful, paginate, clock
- `GET` `/v1/catalog/{storefront}/artists` — query, params, stateful, paginate, clock
- `GET` `/v1/catalog/{storefront}/playlists` — query, params, stateful, paginate, clock
- `GET` `/v1/catalog/{storefront}/songs/{id}` — params, stateful, clock
- `GET` `/v1/catalog/{storefront}/albums/{id}` — params, stateful, clock
- `GET` `/v1/catalog/{storefront}/artists/{id}` — params, stateful, clock
- `GET` `/v1/me/library/songs` — query, stateful, paginate, clock
- `GET` `/v1/me/library/albums` — query, params, stateful, paginate, clock
- `GET` `/v1/me/library/playlists` — query, stateful, paginate, clock
- `GET` `/v1/me/library/recently-added` — query, params, stateful, paginate, filter, clock
- `POST` `/v1/me/library` — body, query, params, stateful, clock
- `DELETE` `/v1/me/library/{type}/{id}` — params, stateful, clock
- `POST` `/v1/me/played` — body, query, stateful, clock
- `GET` `/v1/me/ratings/{type}/{id}` — params, stateful, clock
- `PUT` `/v1/me/ratings/{type}/{id}` — body, params, stateful, clock

</details>

### apple-searchads-style

**Covered** — 12 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/oauth2/token` |
| POST | `/api/v4/campaigns/find` |
| POST | `/api/v4/campaigns` |
| POST | `/api/v4/reports/campaigns` |
| GET | `/api/v4/campaigns/{campaign_id}` |
| PUT | `/api/v4/campaigns/{campaign_id}` |
| POST | `/api/v4/campaigns/{campaign_id}/ads` |
| POST | `/api/v4/campaigns/{campaign_id}/keywords/targeting/find` |
| PUT | `/api/v4/campaigns/{campaign_id}/keywords/targeting/bulk` |
| POST | `/api/v4/campaigns/{campaign_id}/keywords/targeting` |
| PUT | `/api/v4/campaigns/{campaign_id}/keywords/targeting/{keyword_id}` |
| DELETE | `/api/v4/campaigns/{campaign_id}/keywords/targeting/{keyword_id}` |

</details>

**Missing** (4)

- No ad group find or update — only POST campaigns/{id}/ads create
- No negative keywords endpoints (keywords/negative find/create/update)
- No search-terms, keyword, or ads reports — only /reports/campaigns
- No audience targeting, geo/demographic dimensions, or bid adjustments

**Deviations** (5)

- ES256 client-secret JWT is not signature-verified — structural checks only
- Reports group by campaign only; any other groupBy key returns 400
- Selector conditions cover a fixed field set per resource (id, name, budget, status, times)
- Bulk keyword update is non-atomic: rows before an unknown id persist though the batch 404s
- Unknown selector condition fields are silently ignored; real find/report 400s

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/oauth2/token` — body, stateful, errors, clock
- `POST` `/api/v4/campaigns/find` — body, auth, stateful, filter, clock
- `POST` `/api/v4/campaigns` — body, auth, stateful, errors, clock
- `POST` `/api/v4/reports/campaigns` — body, auth, stateful, filter, errors, clock
- `GET` `/api/v4/campaigns/{campaign_id}` — params, auth, stateful, errors, clock
- `PUT` `/api/v4/campaigns/{campaign_id}` — body, params, auth, stateful, errors, clock
- `POST` `/api/v4/campaigns/{campaign_id}/ads` — body, params, auth, stateful, errors, clock
- `POST` `/api/v4/campaigns/{campaign_id}/keywords/targeting/find` — body, params, auth, stateful, filter, errors, clock
- `PUT` `/api/v4/campaigns/{campaign_id}/keywords/targeting/bulk` — body, params, auth, stateful, errors, clock
- `POST` `/api/v4/campaigns/{campaign_id}/keywords/targeting` — body, params, auth, stateful, errors, clock
- `PUT` `/api/v4/campaigns/{campaign_id}/keywords/targeting/{keyword_id}` — body, params, auth, stateful, errors, clock
- `DELETE` `/api/v4/campaigns/{campaign_id}/keywords/targeting/{keyword_id}` — params, auth, stateful, errors, clock

</details>

### apps-script-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1/projects` |
| POST | `/v1/projects` |
| GET | `/v1/projects/{scriptId}` |
| DELETE | `/v1/projects/{scriptId}` |
| GET | `/v1/projects/{scriptId}/content` |
| PUT | `/v1/projects/{scriptId}/content` |
| POST | `/v1/projects/{scriptId}/content` |
| POST | `/v1/projects/{scriptId}/deployments` |
| GET | `/v1/projects/{scriptId}/deployments` |
| POST | `/v1/scripts/{scriptId}:run` |
| POST | `/v1/projects/{scriptId}/scripts/{functionName}/run` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 16 real routes · 7 covered · 43% · 9 not implemented

<details><summary>not implemented (9)</summary>

- `GET` `/v1/processes`
- `GET` `/v1/processes:listScriptProcesses`
- `DELETE` `/v1/projects/{scriptId}/deployments/{deploymentId}`
- `GET` `/v1/projects/{scriptId}/deployments/{deploymentId}`
- `PUT` `/v1/projects/{scriptId}/deployments/{deploymentId}`
- `GET` `/v1/projects/{scriptId}/metrics`
- `GET` `/v1/projects/{scriptId}/versions`
- `POST` `/v1/projects/{scriptId}/versions`
- `GET` `/v1/projects/{scriptId}/versions/{versionNumber}`

</details>

**Missing** (2)

- No deployment get/update/delete — only create and list
- No versions endpoint (GET /v1/projects/{scriptId}/versions)

**Deviations** (3)

- :run never executes code — known patterns return canned results, others echo parameters
- scripts.run also served at a legacy path form (projects/{id}/scripts/{fn}/run)
- content update accepts POST as well as the real API's PUT

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1/projects` — query, auth, stateful, paginate, clock
- `POST` `/v1/projects` — body, auth, stateful, clock
- `GET` `/v1/projects/{scriptId}` — params, auth, stateful, clock
- `DELETE` `/v1/projects/{scriptId}` — params, auth, stateful, clock
- `GET` `/v1/projects/{scriptId}/content` — params, auth, stateful, clock
- `PUT` `/v1/projects/{scriptId}/content` — body, params, auth, stateful, clock
- `POST` `/v1/projects/{scriptId}/content` — body, params, auth, stateful, clock
- `POST` `/v1/projects/{scriptId}/deployments` — body, params, auth, stateful, clock
- `GET` `/v1/projects/{scriptId}/deployments` — params, auth, stateful, clock
- `POST` `/v1/scripts/{scriptId}:run` — body, params, auth, stateful, clock
- `POST` `/v1/projects/{scriptId}/scripts/{functionName}/run` — body, params, auth, stateful, clock

</details>

### auth0-style

**Covered** — 17 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/.well-known/openid-configuration` |
| GET | `/.well-known/jwks.json` |
| GET | `/authorize` |
| POST | `/oauth/token` |
| GET | `/userinfo` |
| POST | `/oauth/revoke` |
| POST | `/dbconnections/signup` |
| GET | `/api/v2/users` |
| POST | `/api/v2/users` |
| GET | `/api/v2/roles` |
| POST | `/api/v2/roles` |
| GET | `/api/v2/users/{id}` |
| PATCH | `/api/v2/users/{id}` |
| DELETE | `/api/v2/users/{id}` |
| GET | `/api/v2/users/{id}/roles` |
| POST | `/api/v2/users/{id}/roles` |
| DELETE | `/api/v2/users/{id}/roles` |

</details>

**Provider surface** — derived from spec Auth0 Management API OAS @ 2.0: 469 real routes · 10 covered · 2% · 459 not implemented

<details><summary>not implemented (459)</summary>

- `GET` `/api/v2/actions/actions`
- `POST` `/api/v2/actions/actions`
- `GET` `/api/v2/actions/actions/{actionId}/versions`
- `GET` `/api/v2/actions/actions/{actionId}/versions/{id}`
- `POST` `/api/v2/actions/actions/{actionId}/versions/{id}/deploy`
- `DELETE` `/api/v2/actions/actions/{id}`
- `GET` `/api/v2/actions/actions/{id}`
- `PATCH` `/api/v2/actions/actions/{id}`
- `POST` `/api/v2/actions/actions/{id}/deploy`
- `POST` `/api/v2/actions/actions/{id}/test`
- `GET` `/api/v2/actions/executions/{id}`
- `GET` `/api/v2/actions/modules`
- `POST` `/api/v2/actions/modules`
- `DELETE` `/api/v2/actions/modules/{id}`
- `GET` `/api/v2/actions/modules/{id}`
- `PATCH` `/api/v2/actions/modules/{id}`
- `GET` `/api/v2/actions/modules/{id}/actions`
- `POST` `/api/v2/actions/modules/{id}/rollback`
- `GET` `/api/v2/actions/modules/{id}/versions`
- `POST` `/api/v2/actions/modules/{id}/versions`
- `GET` `/api/v2/actions/modules/{id}/versions/{versionId}`
- `GET` `/api/v2/actions/triggers`
- `GET` `/api/v2/actions/triggers/{triggerId}/bindings`
- `PATCH` `/api/v2/actions/triggers/{triggerId}/bindings`
- `GET` `/api/v2/agents`
- `POST` `/api/v2/agents`
- `DELETE` `/api/v2/agents/{id}`
- `GET` `/api/v2/agents/{id}`
- `PATCH` `/api/v2/agents/{id}`
- `DELETE` `/api/v2/anomaly/blocks/ips/{id}`
- `GET` `/api/v2/anomaly/blocks/ips/{id}`
- `GET` `/api/v2/attack-protection/bot-detection`
- `PATCH` `/api/v2/attack-protection/bot-detection`
- `GET` `/api/v2/attack-protection/breached-password-detection`
- `PATCH` `/api/v2/attack-protection/breached-password-detection`
- `GET` `/api/v2/attack-protection/brute-force-protection`
- `PATCH` `/api/v2/attack-protection/brute-force-protection`
- `GET` `/api/v2/attack-protection/captcha`
- `PATCH` `/api/v2/attack-protection/captcha`
- `GET` `/api/v2/attack-protection/phone-provider-protection`
- `PATCH` `/api/v2/attack-protection/phone-provider-protection`
- `GET` `/api/v2/attack-protection/suspicious-ip-throttling`
- `PATCH` `/api/v2/attack-protection/suspicious-ip-throttling`
- `GET` `/api/v2/branding`
- `PATCH` `/api/v2/branding`
- `GET` `/api/v2/branding/phone/providers`
- `POST` `/api/v2/branding/phone/providers`
- `DELETE` `/api/v2/branding/phone/providers/{id}`
- `GET` `/api/v2/branding/phone/providers/{id}`
- `PATCH` `/api/v2/branding/phone/providers/{id}`
… and 409 more


</details>

**Missing** (3)

- No MFA, Organizations, actions/hooks/flows, or email delivery
- No user blocking or password change endpoints
- No from/take checkpoint paging (page/per_page only)

**Deviations** (4)

- No hosted login or consent screen — /authorize auto-authenticates login_hint or first user
- OAuth errors still 302 to unvalidated redirect_uri (RFC 6749 would refuse)
- q is exact-match or substring only (no Lucene)
- No scope enforcement — any valid RS256 token may call /api/v2/*

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/.well-known/openid-configuration` — —
- `GET` `/.well-known/jwks.json` — —
- `GET` `/authorize` — query, stateful, filter, clock
- `POST` `/oauth/token` — body, stateful, clock
- `GET` `/userinfo` — stateful, clock
- `POST` `/oauth/revoke` — body, stateful
- `POST` `/dbconnections/signup` — body, stateful, clock
- `GET` `/api/v2/users` — query, stateful, paginate, filter, clock
- `POST` `/api/v2/users` — body, stateful, clock
- `GET` `/api/v2/roles` — query, stateful, paginate, filter, clock
- `POST` `/api/v2/roles` — body, stateful, clock
- `GET` `/api/v2/users/{id}` — params, stateful, clock
- `PATCH` `/api/v2/users/{id}` — body, params, stateful, clock
- `DELETE` `/api/v2/users/{id}` — params, stateful, clock
- `GET` `/api/v2/users/{id}/roles` — params, stateful, clock
- `POST` `/api/v2/users/{id}/roles` — body, params, stateful, clock
- `DELETE` `/api/v2/users/{id}/roles` — body, params, stateful, clock

</details>

### avalara-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v2/tax/calculate` |
| POST | `/v2/transactions/create` |
| GET | `/v2/transactions` |
| GET | `/v2/transactions/{id}` |
| POST | `/v2/transactions/{id}/void` |
| GET | `/v2/companies` |
| GET | `/v2/definitions/nexuses` |
| GET | `/v2/definitions/taxcodes` |

</details>

**Missing** (5)

- No company CRUD — GET /v2/companies list only
- No address validation (/v2/addresses/resolve)
- No createoradjust, settle, or per-line transaction operations
- No customers, certificates, or exemption endpoints
- No jurisdiction lookups — definitions serve nexuses and taxcodes only

**Deviations** (3)

- Tax is a deterministic split — State 50%, County 25%, City 20%, Special 5% of the rate
- Void returns a minimal {id, status} envelope; real AvaTax returns the full TransactionModel
- Re-void is idempotent 200; real AvaTax rejects voiding a Cancelled document

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v2/tax/calculate` — body
- `POST` `/v2/transactions/create` — body, stateful, clock
- `GET` `/v2/transactions` — query, stateful, paginate, filter
- `GET` `/v2/transactions/{id}` — params, stateful
- `POST` `/v2/transactions/{id}/void` — params, stateful
- `GET` `/v2/companies` — query, stateful, paginate, filter
- `GET` `/v2/definitions/nexuses` — query, paginate, filter
- `GET` `/v2/definitions/taxcodes` — query, paginate, filter

</details>

### aws-cognito-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth2/authorize` |
| POST | `/oauth2/token` |
| GET | `/oauth2/userInfo` |
| GET | `/login` |
| GET | `/logout` |
| POST | `/` |
| GET | `/{userPoolId}/.well-known/jwks.json` |

</details>

**Missing** (6)

- No USER_SRP_AUTH — only USER_PASSWORD_AUTH and admin flows
- No AdminGetUser, AdminDeleteUser, or attribute-update operations
- No groups, custom auth challenges, or lambda triggers
- No ResendConfirmationCode or ChangePassword operations
- No GetOpenIdToken or developer-authenticated identity flows
- No hosted-UI OIDC discovery or /oauth2/revoke endpoints

**Deviations** (3)

- Service API SigV4 is structure-checked only — signature not cryptographically enforced
- Verification/reset codes are the last 6 digits of the username, zero-padded
- Hosted UI has no login page — authorize auto-binds login_hint user or seeded demo-user

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth2/authorize` — query, stateful, errors
- `POST` `/oauth2/token` — body, stateful, errors, clock
- `GET` `/oauth2/userInfo` — auth, stateful, clock
- `GET` `/login` — query
- `GET` `/logout` — query
- `POST` `/` — body, stateful, errors, clock
- `GET` `/{userPoolId}/.well-known/jwks.json` — —

</details>

### aws-iam-sts-style

**Covered** — 2 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/` |
| POST | `/` |

</details>

**Missing** (3)

- No UpdateRole/DeleteRole, role policy ops, user CRUD, groups, or policies
- No access-key list/update/delete beyond CreateAccessKey
- No AssumeRoleWithSAML

**Deviations** (3)

- Canonical path/query rebuilt from decoded values — duplicate query keys indistinguishable
- RFC 1123 Date header fallback not parsed — x-amz-date is required
- Only the documented example AKID/secret validates (single credential pair)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/` — body, query, auth, stateful, paginate, filter, errors, clock
- `POST` `/` — body, query, auth, stateful, paginate, filter, errors, clock

</details>

### aws-s3-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/{bucket}` |
| POST | `/{bucket}` |
| PUT | `/{bucket}` |
| DELETE | `/{bucket}` |
| PUT | `/{bucket}/{key+}` |
| GET | `/{bucket}/{key+}` |
| HEAD | `/{bucket}/{key+}` |
| DELETE | `/{bucket}/{key+}` |
| POST | `/{bucket}/{key+}` |

</details>

**Missing** (9)

- No bucket policy, tagging, ACL, CORS, lifecycle, or website subresources
- No object versioning (?versions listing, versionId delete) or object lock
- No CopyObject (x-amz-copy-source) or UploadPartCopy
- No browser form POST uploads (POST policy) — POST /{bucket} returns 501 NotImplemented when SigV4-signed, but a real browser form upload (which authenticates with form fields, so carries no Authorization header) is refused earlier with 403 MissingSecurityHeader
- No object-lock configuration subresource (?object-lock) on the bucket
- No ListMultipartUploads (GET /{bucket}?uploads returns 501 NotImplemented)
- No multi-object DeleteObjects (POST /{bucket}?delete returns 501 NotImplemented)
- No object-level subresources: ?acl, ?tagging, ?retention, ?legal-hold, ?torrent, ?attributes, ?annotation, ?encryption — 501 NotImplemented rather than falling through to the object operation
- No SelectObjectContent (?select) or RestoreObject (?restore) — POST verbs, answered 501 NotImplemented (a bare POST /{bucket}/{key} with no query is 405)

**Deviations** (16)

- ETags are MD5 hex (multipart MD5(binary-concat)-N)
- Multipart 5 MiB minimum part size not enforced (small parts allowed)
- DELETE of a missing bucket is an idempotent 204 (real S3: 404 NoSuchBucket)
- DeleteBucket is refused with 409 BucketNotEmpty while a multipart upload is in progress — AWS documents and enforces this for directory buckets, while for general-purpose buckets it documents only that all objects must be deleted and says nothing about an upload in progress, so refusing the delete is an inference there
- Unimplemented subresources return 501 NotImplemented rather than falling through to the object operation on the same route. The mutating routes use an allowlist and reject every query parameter except the SigV4 presigned-auth ones and the route's own; the read routes use a denylist. The guard runs before the multipart dispatch
- Starlark handlers are step-bounded: a single ListObjectsV2 or DeleteBucket over a large enough bucket exhausts the budget and returns a JSON 500 rather than S3 XML. The reachable threshold for ListObjectsV2 is a few hundred objects in one un-paginated page; DeleteBucket did not reproduce it in a few hundred rows
- x-amz-meta-* suffixes are lowercased and the first occurrence wins
- On mutating routes (bucket PUT/DELETE, object PUT/POST/DELETE) x-id must name an operation this adapter routes; the SDK's x-id=CopyObject, x-id=RestoreObject, x-id=SelectObjectContent, x-id=PutObjectLegalHold and x-id=UploadPartCopy all return 501 rather than falling through. AbortMultipartUpload is routed and must not be refused
- CopyObject selected by the x-amz-copy-source header alone, with no x-id query parameter, still writes a zero-byte object; the query allowlist cannot see a header-selected subresource
- PUT /{bucket}/{key}?partNumber=N without uploadId returns 400 InvalidRequest rather than falling through to PutObject
- Per-chunk STREAMING signatures not verified (header SigV4 only)
- Streaming checksum trailers discarded (unsupported-checksum)
- DELETE object against a missing bucket is 204 (real S3: 404 NoSuchBucket)
- GET/HEAD object against a missing bucket is 404 NoSuchKey (real S3: 404 NoSuchBucket)
- SigV4 canonical URI/query rebuilt from decoded values — duplicates indistinguishable
- No RFC 1123 Date fallback; canonical header whitespace collapsing not applied

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/{bucket}` — query, params, stateful, paginate, filter, errors, clock
- `POST` `/{bucket}` — query, params, stateful, clock
- `PUT` `/{bucket}` — body, query, params, stateful, errors, clock
- `DELETE` `/{bucket}` — query, params, stateful, errors, clock
- `PUT` `/{bucket}/{key+}` — query, params, stateful, errors, clock
- `GET` `/{bucket}/{key+}` — query, params, stateful, errors, clock
- `HEAD` `/{bucket}/{key+}` — query, params, stateful, errors, clock
- `DELETE` `/{bucket}/{key+}` — query, params, stateful, errors, clock
- `POST` `/{bucket}/{key+}` — query, params, stateful, errors, clock

</details>

### azure-devops-style

**Covered** — 17 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/{org}/_apis/projects` |
| GET | `/{org}/{project}/_apis/pipelines` |
| GET | `/{org}/{project}/_apis/pipelines/{pipelineId}` |
| GET | `/{org}/{project}/_apis/pipelines/{pipelineId}/runs` |
| POST | `/{org}/{project}/_apis/pipelines/{pipelineId}/runs` |
| GET | `/{org}/{project}/_apis/pipelines/{pipelineId}/runs/{runId}` |
| GET | `/{org}/{project}/_apis/git/repositories` |
| GET | `/{org}/{project}/_apis/git/repositories/{repoId}/items` |
| GET | `/{org}/{project}/_apis/git/repositories/{repoId}/commits` |
| POST | `/{org}/{project}/_apis/git/repositories/{repoId}/pushes` |
| GET | `/{org}/{project}/_apis/work/teamsettings/iterations` |
| GET | `/{org}/{project}/_apis/wit/workitems` |
| GET | `/{org}/{project}/_apis/wit/workitems/{id}` |
| PATCH | `/{org}/{project}/_apis/wit/workitems/{id}` |
| POST | `/{org}/{project}/_apis/wit/workitems/{type}` |
| POST | `/{org}/{project}/_apis/wit/wiql` |
| POST | `/{org}/_apis/hooks/subscriptions` |

</details>

**Provider surface** — derived from spec vsts-rest-api-specs core 7.2 + pipelines/git/wit/hooks/work 7.1 @ 7.2-preview, 7.1, 7.1, 7.1, 7.1, 7.1: 305 real routes · 17 covered · 5% · 277 not implemented

<details><summary>not implemented (277)</summary>

- `GET` `/{collection}/_apis/hooks/consumers`
- `GET` `/{collection}/_apis/hooks/consumers/{consumerId}`
- `GET` `/{collection}/_apis/hooks/consumers/{consumerId}/actions`
- `GET` `/{collection}/_apis/hooks/consumers/{consumerId}/actions/{consumerActionId}`
- `POST` `/{collection}/_apis/hooks/notificationsquery`
- `GET` `/{collection}/_apis/hooks/publishers`
- `GET` `/{collection}/_apis/hooks/publishers/{publisherId}`
- `GET` `/{collection}/_apis/hooks/publishers/{publisherId}/eventtypes`
- `GET` `/{collection}/_apis/hooks/publishers/{publisherId}/eventtypes/{eventTypeId}`
- `POST` `/{collection}/_apis/hooks/publishers/{publisherId}/inputValuesQuery`
- `POST` `/{collection}/_apis/hooks/publishersquery`
- `GET` `/{collection}/_apis/hooks/subscriptions`
- `DELETE` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}`
- `GET` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}`
- `PUT` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}`
- `GET` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}/diagnostics`
- `PUT` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}/diagnostics`
- `GET` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}/notifications`
- `GET` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}/notifications/{notificationId}`
- `POST` `/{collection}/_apis/hooks/subscriptionsquery`
- `POST` `/{collection}/_apis/hooks/testnotifications`
- `GET` `/{collection}/_apis/wit/artifactlinktypes`
- `GET` `/{collection}/_apis/wit/workitemicons`
- `GET` `/{collection}/_apis/wit/workitemicons/{icon}`
- `GET` `/{collection}/_apis/wit/workitemrelationtypes`
- `GET` `/{collection}/_apis/wit/workitemrelationtypes/{relation}`
- `GET` `/{collection}/_apis/wit/workitemtransitions`
- `GET` `/{collection}/_apis/work/accountmyworkrecentactivity`
- `GET` `/{collection}/{project}/_apis/git/deletedrepositories`
- `GET` `/{collection}/{project}/_apis/git/favorites/refs`
- `POST` `/{collection}/{project}/_apis/git/favorites/refs`
- `DELETE` `/{collection}/{project}/_apis/git/favorites/refs/{favoriteId}`
- `GET` `/{collection}/{project}/_apis/git/favorites/refs/{favoriteId}`
- `GET` `/{collection}/{project}/_apis/git/policy/configurations`
- `GET` `/{collection}/{project}/_apis/git/pullrequests`
- `GET` `/{collection}/{project}/_apis/git/pullrequests/{pullRequestId}`
- `GET` `/{collection}/{project}/_apis/git/recycleBin/repositories`
- `DELETE` `/{collection}/{project}/_apis/git/recycleBin/repositories/{repositoryId}`
- `PATCH` `/{collection}/{project}/_apis/git/recycleBin/repositories/{repositoryId}`
- `POST` `/{collection}/{project}/_apis/git/repositories`
- `DELETE` `/{collection}/{project}/_apis/git/repositories/{repositoryId}`
- `GET` `/{collection}/{project}/_apis/git/repositories/{repositoryId}`
- `PATCH` `/{collection}/{project}/_apis/git/repositories/{repositoryId}`
- `POST` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/annotatedtags`
- `GET` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/annotatedtags/{objectId}`
- `POST` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/blobs`
- `GET` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/blobs/{sha1}`
- `GET` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/cherryPicks`
- `POST` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/cherryPicks`
- `GET` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/cherryPicks/{cherryPickId}`
… and 227 more


</details>

**Missing** (8)

- No WIQL OR predicates, @Me/@Project macros, or non-WorkItems FROM targets
- No work-item comments, links/attachments, or revisions endpoints
- No project CRUD — projects are list-only
- No pipeline create/update or run artifacts/logs/approvals endpoints
- No repo create, refs/branch ops, pull requests, or tags
- No team-settings writes — iterations are list-only, no boards/columns
- No service-hook list/update/delete or publisher/consumer discovery
- No project-create and no pull-request routes (repos/pushes/commits/items only)

**Deviations** (6)

- Run state derives from clock — inProgress at +1s, completed/succeeded at +3s
- simulate_fail run parameter (templateParameters or top-level) forces result failed
- Run-state webhooks may double-emit when list/bulk reads race single-run polls
- A non-JSON versionDescriptor is silently ignored (falls back to the default branch); real ADO 400s
- Items always returns the JSON envelope with inline content; real ADO serves raw bytes for single items
- A no-op replace patch skips the rev bump and audit fields

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/{org}/_apis/projects` — query, auth, stateful, paginate, errors, clock
- `GET` `/{org}/{project}/_apis/pipelines` — query, auth, stateful, paginate, errors, clock
- `GET` `/{org}/{project}/_apis/pipelines/{pipelineId}` — params, auth, stateful, clock
- `GET` `/{org}/{project}/_apis/pipelines/{pipelineId}/runs` — query, params, auth, stateful, paginate, webhooks, errors, clock
- `POST` `/{org}/{project}/_apis/pipelines/{pipelineId}/runs` — body, params, auth, stateful, clock
- `GET` `/{org}/{project}/_apis/pipelines/{pipelineId}/runs/{runId}` — params, auth, stateful, webhooks, clock
- `GET` `/{org}/{project}/_apis/git/repositories` — query, params, auth, stateful, paginate, errors, clock
- `GET` `/{org}/{project}/_apis/git/repositories/{repoId}/items` — query, params, auth, stateful, clock
- `GET` `/{org}/{project}/_apis/git/repositories/{repoId}/commits` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/{org}/{project}/_apis/git/repositories/{repoId}/pushes` — body, params, auth, stateful, webhooks, clock
- `GET` `/{org}/{project}/_apis/work/teamsettings/iterations` — query, auth, stateful, paginate, errors, clock
- `GET` `/{org}/{project}/_apis/wit/workitems` — query, auth, stateful, clock
- `GET` `/{org}/{project}/_apis/wit/workitems/{id}` — params, auth, stateful, errors, clock
- `PATCH` `/{org}/{project}/_apis/wit/workitems/{id}` — body, params, auth, stateful, webhooks, clock
- `POST` `/{org}/{project}/_apis/wit/workitems/{type}` — body, params, auth, stateful, webhooks, clock
- `POST` `/{org}/{project}/_apis/wit/wiql` — body, query, auth, stateful, filter, clock
- `POST` `/{org}/_apis/hooks/subscriptions` — body, auth, stateful, clock

</details>

### azure-servicebus-style

**Covered** — 18 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/{queue}/messages` |
| DELETE | `/{queue}/messages/head` |
| POST | `/{queue}/messages/{lockToken}/{action}` |
| GET | `/$topicInfo` |
| GET | `/topics` |
| PUT | `/topics/{topic}` |
| GET | `/topics/{topic}` |
| DELETE | `/topics/{topic}` |
| POST | `/topics/{topic}/messages` |
| GET | `/topics/{topic}/subscriptions` |
| PUT | `/topics/{topic}/subscriptions/{sub}` |
| GET | `/topics/{topic}/subscriptions/{sub}` |
| DELETE | `/topics/{topic}/subscriptions/{sub}` |
| POST | `/topics/{topic}/subscriptions/{sub}/messages` |
| POST | `/topics/{topic}/subscriptions/{sub}/messages/{lockToken}/{action}` |
| POST | `/{account}/{queue}/messages` |
| GET | `/{account}/{queue}/messages` |
| DELETE | `/{account}/{queue}/messages/{messageid}` |

</details>

**Missing** (6)

- No queue management — queues are neither created nor listed
- No subscription rules — fan-out is the default match-all broadcast only
- No dead-letter settle action or DLQ receive (subqueue $deadletterqueue)
- No sessions, scheduled send, or duplicate detection
- No AMQP 1.0 transport — HTTP/REST surface only
- No Storage queue peek, update, clear, or queue create/list/delete

**Deviations** (3)

- Default 30s peek-lock, overridable via simulator-only lockduration query param
- Bearer auth accepted with any non-empty token — only SAS is verified
- Storage queue send accepts JSON MessageText in place of the real XML body

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/{queue}/messages` — body, query, params, stateful, clock
- `DELETE` `/{queue}/messages/head` — params, stateful, clock
- `POST` `/{queue}/messages/{lockToken}/{action}` — query, params, stateful, clock
- `GET` `/$topicInfo` — query, stateful, clock
- `GET` `/topics` — stateful, clock
- `PUT` `/topics/{topic}` — body, params, stateful, clock
- `GET` `/topics/{topic}` — params, stateful, clock
- `DELETE` `/topics/{topic}` — params, stateful, clock
- `POST` `/topics/{topic}/messages` — body, params, stateful, clock
- `GET` `/topics/{topic}/subscriptions` — params, stateful, clock
- `PUT` `/topics/{topic}/subscriptions/{sub}` — body, params, stateful, clock
- `GET` `/topics/{topic}/subscriptions/{sub}` — params, stateful, clock
- `DELETE` `/topics/{topic}/subscriptions/{sub}` — params, stateful, clock
- `POST` `/topics/{topic}/subscriptions/{sub}/messages` — query, params, stateful, clock
- `POST` `/topics/{topic}/subscriptions/{sub}/messages/{lockToken}/{action}` — query, params, stateful, clock
- `POST` `/{account}/{queue}/messages` — body, params, stateful, clock
- `GET` `/{account}/{queue}/messages` — query, params, stateful, clock
- `DELETE` `/{account}/{queue}/messages/{messageid}` — query, params, stateful, clock

</details>

### azure-storage-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/` |
| PUT | `/{container}` |
| GET | `/{container}` |
| HEAD | `/{container}` |
| DELETE | `/{container}` |
| PUT | `/{container}/{blob}` |
| GET | `/{container}/{blob}` |
| HEAD | `/{container}/{blob}` |
| DELETE | `/{container}/{blob}` |

</details>

**Provider surface** — derived from spec azure-rest-api-specs BlobStorage 2026-06-06 @ 2026-06-06: 69 real routes · 5 covered · 7% · 3 not implemented

<details><summary>not implemented (3)</summary>

- `POST` `/?comp=batch`
- `PUT` `/?restype=service&comp=properties`
- `POST` `/{containerName}/{blob}?comp=query`

</details>

**Missing** (6)

- No Append Blob or Page Blob types — Block Blob only
- No lease operations (?comp=lease) on blobs or containers
- No blob snapshots or copy (?comp=copy, from URL)
- No container ACL or metadata set/get — HEAD metadata only
- No service-level properties, stats, CORS, or user delegation keys
- No blob tags/index (?comp=tags) or soft delete/immutability

**Deviations** (3)

- Content-MD5 is returned unconditionally; real Azure returns it only when the request carried a Content-MD5 header
- SAS checked structurally (sv/sig/se present) and any non-empty bearer accepted
- PUT on an existing container updates it in place 201 (real Azure: 409 conflict)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/` — query, stateful, paginate, clock
- `PUT` `/{container}` — query, params, stateful, clock
- `GET` `/{container}` — query, params, stateful, paginate, errors, clock
- `HEAD` `/{container}` — query, params, stateful, errors, clock
- `DELETE` `/{container}` — query, params, stateful
- `PUT` `/{container}/{blob}` — query, params, stateful, errors, clock
- `GET` `/{container}/{blob}` — query, params, stateful, errors, clock
- `HEAD` `/{container}/{blob}` — query, params, stateful, errors, clock
- `DELETE` `/{container}/{blob}` — query, params, stateful

</details>

### blog-style

**Covered** — 0 routes · GraphQL schema

### bluesky-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/xrpc/com.atproto.server.createSession` |
| POST | `/xrpc/com.atproto.server.refreshSession` |
| POST | `/xrpc/com.atproto.repo.createRecord` |
| POST | `/xrpc/com.atproto.repo.deleteRecord` |
| GET | `/xrpc/com.atproto.identity.resolveHandle` |
| GET | `/xrpc/app.bsky.actor.getProfile` |
| GET | `/xrpc/app.bsky.feed.searchPosts` |

</details>

**Provider surface** — derived from spec atproto lexicons app.bsky.* + com.atproto.* (XRPC: query=GET, procedure=POST; records/objects/subscriptions skipped): 202 real routes · 7 covered · 3% · 195 not implemented

<details><summary>not implemented (195)</summary>

- `GET` `/xrpc/app.bsky.actor.getPreferences`
- `GET` `/xrpc/app.bsky.actor.getProfiles`
- `GET` `/xrpc/app.bsky.actor.getSuggestions`
- `POST` `/xrpc/app.bsky.actor.putPreferences`
- `GET` `/xrpc/app.bsky.actor.searchActors`
- `GET` `/xrpc/app.bsky.actor.searchActorsTypeahead`
- `POST` `/xrpc/app.bsky.ageassurance.begin`
- `GET` `/xrpc/app.bsky.ageassurance.getConfig`
- `GET` `/xrpc/app.bsky.ageassurance.getState`
- `POST` `/xrpc/app.bsky.bookmark.createBookmark`
- `POST` `/xrpc/app.bsky.bookmark.deleteBookmark`
- `GET` `/xrpc/app.bsky.bookmark.getBookmarks`
- `POST` `/xrpc/app.bsky.contact.dismissMatch`
- `GET` `/xrpc/app.bsky.contact.getMatches`
- `GET` `/xrpc/app.bsky.contact.getSyncStatus`
- `POST` `/xrpc/app.bsky.contact.importContacts`
- `POST` `/xrpc/app.bsky.contact.removeData`
- `POST` `/xrpc/app.bsky.contact.sendNotification`
- `POST` `/xrpc/app.bsky.contact.startPhoneVerification`
- `POST` `/xrpc/app.bsky.contact.verifyPhone`
- `POST` `/xrpc/app.bsky.draft.createDraft`
- `POST` `/xrpc/app.bsky.draft.deleteDraft`
- `GET` `/xrpc/app.bsky.draft.getDrafts`
- `POST` `/xrpc/app.bsky.draft.updateDraft`
- `GET` `/xrpc/app.bsky.embed.getEmbedExternalView`
- `GET` `/xrpc/app.bsky.feed.describeFeedGenerator`
- `GET` `/xrpc/app.bsky.feed.getActorFeeds`
- `GET` `/xrpc/app.bsky.feed.getActorLikes`
- `GET` `/xrpc/app.bsky.feed.getAuthorFeed`
- `GET` `/xrpc/app.bsky.feed.getFeed`
- `GET` `/xrpc/app.bsky.feed.getFeedGenerator`
- `GET` `/xrpc/app.bsky.feed.getFeedGenerators`
- `GET` `/xrpc/app.bsky.feed.getFeedSkeleton`
- `GET` `/xrpc/app.bsky.feed.getLikes`
- `GET` `/xrpc/app.bsky.feed.getListFeed`
- `GET` `/xrpc/app.bsky.feed.getPostThread`
- `GET` `/xrpc/app.bsky.feed.getPosts`
- `GET` `/xrpc/app.bsky.feed.getQuotes`
- `GET` `/xrpc/app.bsky.feed.getRepostedBy`
- `GET` `/xrpc/app.bsky.feed.getSuggestedFeeds`
- `GET` `/xrpc/app.bsky.feed.getTimeline`
- `GET` `/xrpc/app.bsky.feed.searchPostsV2`
- `POST` `/xrpc/app.bsky.feed.sendInteractions`
- `GET` `/xrpc/app.bsky.graph.getActorStarterPacks`
- `GET` `/xrpc/app.bsky.graph.getBlocks`
- `GET` `/xrpc/app.bsky.graph.getFollowers`
- `GET` `/xrpc/app.bsky.graph.getFollows`
- `GET` `/xrpc/app.bsky.graph.getKnownFollowers`
- `GET` `/xrpc/app.bsky.graph.getList`
- `GET` `/xrpc/app.bsky.graph.getListBlocks`
… and 145 more


</details>

**Missing** (7)

- No repo reads: com.atproto.repo getRecord, listRecords, describeRepo, uploadBlob
- No com.atproto.server getSession or deleteSession
- No app.bsky.feed getTimeline, getPostThread, getFeed, getLikes
- No app.bsky.graph getFollows, getFollowers, mutes, blocks
- No app.bsky.notification listNotifications or getUnreadCount
- No app.bsky.actor updateProfile or preference endpoints
- No com.atproto.moderation createReport; no app.bsky.chat conversations

**Deviations** (4)

- searchPosts returns seeded synthetic results, not an index over created records
- createSession mints tokens for any identifier/password pair; no credential check
- refreshSession invalidates the old accessJwt too; real AT Protocol leaves it valid to exp
- cids cycle a fixed pool of 8 real CIDv1 strings rather than hashing record content

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/xrpc/com.atproto.server.createSession` — body, stateful, errors
- `POST` `/xrpc/com.atproto.server.refreshSession` — auth, stateful
- `POST` `/xrpc/com.atproto.repo.createRecord` — body, auth, stateful, errors
- `POST` `/xrpc/com.atproto.repo.deleteRecord` — body, auth, stateful
- `GET` `/xrpc/com.atproto.identity.resolveHandle` — query, stateful, errors
- `GET` `/xrpc/app.bsky.actor.getProfile` — query, stateful, errors
- `GET` `/xrpc/app.bsky.feed.searchPosts` — query, stateful, clock

</details>

### braintree-style

**Covered** — 15 routes · GraphQL schema

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/merchants/{merchantId}/transactions/advanced_search` |
| POST | `/merchants/{merchantId}/transactions` |
| GET | `/merchants/{merchantId}/transactions/{id}` |
| POST | `/merchants/{merchantId}/transactions/{id}/settle` |
| POST | `/merchants/{merchantId}/transactions/{id}/void` |
| POST | `/merchants/{merchantId}/transactions/{id}/refund` |
| POST | `/merchants/{merchantId}/payment_methods` |
| POST | `/merchants/{merchantId}/client_token` |
| POST | `/merchants/{merchantId}/plans` |
| GET | `/merchants/{merchantId}/plans` |
| GET | `/merchants/{merchantId}/plans/{id}` |
| POST | `/merchants/{merchantId}/subscriptions` |
| GET | `/merchants/{merchantId}/subscriptions/{id}` |
| POST | `/merchants/{merchantId}/subscriptions/{id}/cancel` |
| POST | `/webhooks` |

</details>

**Missing** (8)

- No REST customer endpoints: create, get, search, update, delete (/customers)
- No payment method fetch or delete: GET/DELETE /payment_methods/{token}
- No addresses or credit_card_verifications endpoints
- No subscription update, retry, or search; no plan delete
- No disputes endpoints: search, open, accept, add evidence
- No merchant accounts, settlements, or documents endpoints
- GraphQL subset: no paymentMethod, clientToken, PayPal, or dispute operations
- No Braintree Auth OAuth endpoints (token exchange, merchant onboarding)

**Deviations** (7)

- timings compressed: transactions settle at +3s, subscriptions bill a cycle every 2s
- webhook registration exposed at POST /webhooks; real Braintree is Control Panel only
- webhook deliveries are JSON + bt-* headers, not the real form-encoded bt_* POST
- POST /graphql is served without the Bearer/Basic auth check the REST surface enforces
- simulate_authorization_expiry sim-only flag: auths expire in 1s vs 7 simulated days
- REST creates answer 200; real Braintree answers 201 Created
- Client tokens are opaque strings, not the real base64 JSON encoding

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/merchants/{merchantId}/transactions/advanced_search` — body, stateful, filter, webhooks, clock
- `POST` `/merchants/{merchantId}/transactions` — body, stateful, webhooks, clock
- `GET` `/merchants/{merchantId}/transactions/{id}` — params, stateful, webhooks, clock
- `POST` `/merchants/{merchantId}/transactions/{id}/settle` — body, params, stateful, webhooks, clock
- `POST` `/merchants/{merchantId}/transactions/{id}/void` — params, stateful, webhooks, clock
- `POST` `/merchants/{merchantId}/transactions/{id}/refund` — body, params, stateful, webhooks, clock
- `POST` `/merchants/{merchantId}/payment_methods` — body, stateful
- `POST` `/merchants/{merchantId}/client_token` — stateful
- `POST` `/merchants/{merchantId}/plans` — body, stateful, clock
- `GET` `/merchants/{merchantId}/plans` — stateful
- `GET` `/merchants/{merchantId}/plans/{id}` — params, stateful
- `POST` `/merchants/{merchantId}/subscriptions` — body, stateful, clock
- `GET` `/merchants/{merchantId}/subscriptions/{id}` — params, stateful, webhooks, clock
- `POST` `/merchants/{merchantId}/subscriptions/{id}/cancel` — params, stateful, webhooks, clock
- `POST` `/webhooks` — body, stateful, webhooks, errors, clock

</details>

### braze-style

**Covered** — 12 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/messages/send` |
| POST | `/messages/schedule/create` |
| POST | `/users/track` |
| POST | `/users/alias/new` |
| POST | `/users/identify` |
| POST | `/users/delete` |
| POST | `/users/export/ids` |
| POST | `/campaigns/trigger/send` |
| GET | `/segments/list` |
| GET | `/messages/scheduled` |
| POST | `/webhooks` |
| GET | `/webhooks` |

</details>

**Missing** (8)

- No canvas endpoints: /canvas/trigger/send, /canvas/list, /canvas/data_series
- No campaign analytics: /campaigns/list, /campaigns/data_series, /campaigns/details
- No /messages/schedule/update or delete; no /campaigns/trigger/schedule/create
- No /users/export by segment; no /events/list or /purchases/product_list
- No email endpoints: /email/status, /email/hard_bounces, /email/spam, /email/unsubscribes
- No subscription groups: /subscription/status/set, /subscription/user/status, /get
- No content blocks: /content_blocks list, info, create, update
- No preference centers: /preference_center/v1 list and per-user URL endpoints

**Deviations** (6)

- POST /webhooks registration is a local extension; real Braze has no webhook REST API
- message.sent webhook payloads use a synthetic shape; Braze has no documented scheme
- scheduled sends flip to sent on first read past the time; message.sent fires once then
- key store models expiry for app-group keys; real Braze keys do not expire
- /users/track echoes *_processed counts the real API does not return
- Segments list pages by a cursor; the real endpoint pages by 100s of page param

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/messages/send` — body, auth, stateful, webhooks, errors, clock
- `POST` `/messages/schedule/create` — body, auth, stateful, errors, clock
- `POST` `/users/track` — body, auth, stateful, errors, clock
- `POST` `/users/alias/new` — body, auth, stateful, errors, clock
- `POST` `/users/identify` — body, auth, stateful, errors, clock
- `POST` `/users/delete` — body, auth, stateful, errors, clock
- `POST` `/users/export/ids` — body, auth, stateful, filter, errors, clock
- `POST` `/campaigns/trigger/send` — body, auth, stateful, webhooks, errors, clock
- `GET` `/segments/list` — query, auth, stateful, paginate, errors, clock
- `GET` `/messages/scheduled` — query, auth, stateful, filter, webhooks, errors, clock
- `POST` `/webhooks` — body, auth, stateful, clock
- `GET` `/webhooks` — auth, stateful, clock

</details>

### chainlink-style

**Covered** — 21 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/feeds` |
| GET | `/feeds/{feedID}` |
| GET | `/feeds/{feedID}/latestRoundData` |
| GET | `/feeds/{feedID}/rounds` |
| GET | `/feeds/{feedID}/rounds/{roundId}` |
| POST | `/v2/functions/createSecrets` |
| POST | `/v2/functions/encryptSecrets` |
| POST | `/v2/functions/createRequest` |
| GET | `/v2/functions/request/{requestID}` |
| GET | `/v2/functions/secrets/{secretID}` |
| POST | `/v2/automation/registerUpkeep` |
| GET | `/v2/automation/upkeeps` |
| GET | `/v2/automation/{id}` |
| POST | `/v2/automation/{id}/fund` |
| POST | `/v2/automation/{id}/cancel` |
| POST | `/v2/automation/{id}/withdraw` |
| GET | `/v2/automation/{id}/check` |
| POST | `/v2/automation/{id}/perform` |
| GET | `/v2/automation/{id}/performs` |
| GET | `/v2/ccip/messages` |
| GET | `/v2/ccip/lane/{src}/{dst}` |

</details>

**Missing** (6)

- No Functions subscription management: create, fund, update, cancel subscription
- No Functions requests listing or DON listing endpoints
- No Automation update, pause, or resume endpoints for upkeeps
- No CCIP message detail, executions, token-pool, or send endpoints
- No Data Streams product: stream auth, WebSocket report feeds, report upload
- No feed timeseries/chart history endpoint beyond /rounds paging

**Deviations** (7)

- feed rounds aggregate per 60s heartbeat vs real deviation/3600s; answers drift ±0.25%
- DON secrets use a deterministic HMAC envelope, not real randomized ECIES encryption
- Functions requests: queued 0-1s, running 1-3s, fulfilled at +3s (derive-on-read)
- createRequest accepts simulate_fail to inject failures; real sandbox has no trigger
- keeper performs are derived on read per elapsed cadence tick; real network performs on-chain
- invalid_cursor error code is lowercase while every other code is SCREAMING_SNAKE
- CCIP lane status is active with ramp addresses for any src/dst pair, including nonexistent chains

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/feeds` — query, stateful, paginate, clock
- `GET` `/feeds/{feedID}` — params, stateful, clock
- `GET` `/feeds/{feedID}/latestRoundData` — params, stateful, clock
- `GET` `/feeds/{feedID}/rounds` — query, params, stateful, paginate, clock
- `GET` `/feeds/{feedID}/rounds/{roundId}` — params, stateful, clock
- `POST` `/v2/functions/createSecrets` — body, stateful, clock
- `POST` `/v2/functions/encryptSecrets` — body, stateful, clock
- `POST` `/v2/functions/createRequest` — body, stateful, clock
- `GET` `/v2/functions/request/{requestID}` — params, stateful, clock
- `GET` `/v2/functions/secrets/{secretID}` — params, stateful, clock
- `POST` `/v2/automation/registerUpkeep` — body, stateful, clock
- `GET` `/v2/automation/upkeeps` — query, stateful, paginate, clock
- `GET` `/v2/automation/{id}` — params, stateful, clock
- `POST` `/v2/automation/{id}/fund` — body, params, stateful, clock
- `POST` `/v2/automation/{id}/cancel` — params, stateful, clock
- `POST` `/v2/automation/{id}/withdraw` — body, params, stateful, clock
- `GET` `/v2/automation/{id}/check` — params, stateful, clock
- `POST` `/v2/automation/{id}/perform` — params, stateful, clock
- `GET` `/v2/automation/{id}/performs` — query, params, stateful, paginate, clock
- `GET` `/v2/ccip/messages` — query, stateful, paginate, clock
- `GET` `/v2/ccip/lane/{src}/{dst}` — params, stateful, clock

</details>

### cloudflare-style

**Covered** — 35 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/zones` |
| POST | `/zones` |
| GET | `/zones/{zone_id}` |
| DELETE | `/zones/{zone_id}` |
| GET | `/zones/{zone_id}/dns_records` |
| POST | `/zones/{zone_id}/dns_records` |
| GET | `/zones/{zone_id}/dns_records/{dns_record_id}` |
| PUT | `/zones/{zone_id}/dns_records/{dns_record_id}` |
| PATCH | `/zones/{zone_id}/dns_records/{dns_record_id}` |
| DELETE | `/zones/{zone_id}/dns_records/{dns_record_id}` |
| GET | `/zones/{zone_id}/firewall/rules` |
| POST | `/zones/{zone_id}/firewall/rules` |
| GET | `/zones/{zone_id}/firewall/rules/{rule_id}` |
| PUT | `/zones/{zone_id}/firewall/rules/{rule_id}` |
| PATCH | `/zones/{zone_id}/firewall/rules/{rule_id}` |
| DELETE | `/zones/{zone_id}/firewall/rules/{rule_id}` |
| GET | `/zones/{zone_id}/page_rules` |
| POST | `/zones/{zone_id}/page_rules` |
| GET | `/zones/{zone_id}/page_rules/{rule_id}` |
| PUT | `/zones/{zone_id}/page_rules/{rule_id}` |
| PATCH | `/zones/{zone_id}/page_rules/{rule_id}` |
| DELETE | `/zones/{zone_id}/page_rules/{rule_id}` |
| POST | `/zones/{zone_id}/purge_cache` |
| GET | `/accounts/{account_id}/workers/scripts` |
| PUT | `/accounts/{account_id}/workers/scripts/{script_name}` |
| GET | `/accounts/{account_id}/workers/scripts/{script_name}` |
| DELETE | `/accounts/{account_id}/workers/scripts/{script_name}` |
| GET | `/accounts/{account_id}/workers/scripts/{script_name}/deployments` |
| GET | `/accounts/{account_id}/r2/buckets` |
| POST | `/accounts/{account_id}/r2/buckets` |
| DELETE | `/accounts/{account_id}/r2/buckets/{bucket_name}` |
| GET | `/accounts/{account_id}/d1/database` |
| POST | `/accounts/{account_id}/d1/database` |
| DELETE | `/accounts/{account_id}/d1/database/{database_id}` |
| POST | `/accounts/{account_id}/d1/database/{database_id}/query` |

</details>

**Provider surface** — derived from spec cloudflare api-schemas (paths /client/v4 prefix stripped) @ 4.0.0: 3334 real routes · 29 covered · 0% · 3304 not implemented

<details><summary>not implemented (3304)</summary>

- `GET` `/accounts`
- `POST` `/accounts`
- `POST` `/accounts/move`
- `GET` `/accounts/{accountId}/v1/images`
- `POST` `/accounts/{accountId}/v1/images`
- `DELETE` `/accounts/{accountId}/v1/images/{imageId}`
- `GET` `/accounts/{accountId}/v1/images/{imageId}`
- `PATCH` `/accounts/{accountId}/v1/images/{imageId}`
- `PUT` `/accounts/{accountId}/v1/images/{imageId}`
- `GET` `/accounts/{accountId}/v1/images/{imageId}/blob`
- `GET` `/accounts/{accountId}/v2/images`
- `POST` `/accounts/{accountId}/v2/images/direct_upload`
- `GET` `/accounts/{accountId}/zones/{zoneId}/v1/images/flows`
- `PUT` `/accounts/{accountId}/zones/{zoneId}/v1/images/flows`
- `GET` `/accounts/{account_identifier}/custom_pages`
- `GET` `/accounts/{account_identifier}/custom_pages/assets`
- `POST` `/accounts/{account_identifier}/custom_pages/assets`
- `DELETE` `/accounts/{account_identifier}/custom_pages/assets/{asset_name}`
- `GET` `/accounts/{account_identifier}/custom_pages/assets/{asset_name}`
- `PUT` `/accounts/{account_identifier}/custom_pages/assets/{asset_name}`
- `POST` `/accounts/{account_identifier}/custom_pages/preview_tokens`
- `GET` `/accounts/{account_identifier}/custom_pages/{identifier}`
- `PUT` `/accounts/{account_identifier}/custom_pages/{identifier}`
- `DELETE` `/accounts/{account_id}`
- `GET` `/accounts/{account_id}`
- `PUT` `/accounts/{account_id}`
- `GET` `/accounts/{account_id}/abuse-reports`
- `GET` `/accounts/{account_id}/abuse-reports/{report_id}/appeals/eligibility`
- `GET` `/accounts/{account_id}/abuse-reports/{report_id}/emails`
- `GET` `/accounts/{account_id}/abuse-reports/{report_id}/mitigations`
- `POST` `/accounts/{account_id}/abuse-reports/{report_id}/mitigations/appeal`
- `GET` `/accounts/{account_id}/abuse-reports/{report_param}`
- `POST` `/accounts/{account_id}/abuse-reports/{report_param}`
- `GET` `/accounts/{account_id}/access/ai-controls/mcp/portals`
- `POST` `/accounts/{account_id}/access/ai-controls/mcp/portals`
- `DELETE` `/accounts/{account_id}/access/ai-controls/mcp/portals/{id}`
- `GET` `/accounts/{account_id}/access/ai-controls/mcp/portals/{id}`
- `PUT` `/accounts/{account_id}/access/ai-controls/mcp/portals/{id}`
- `GET` `/accounts/{account_id}/access/ai-controls/mcp/portals/{portal_id}/servers/{server_id}/effective-redirect-uri`
- `GET` `/accounts/{account_id}/access/ai-controls/mcp/servers`
- `POST` `/accounts/{account_id}/access/ai-controls/mcp/servers`
- `DELETE` `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}`
- `GET` `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}`
- `PUT` `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}`
- `POST` `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}/sync`
- `GET` `/accounts/{account_id}/access/apps`
- `POST` `/accounts/{account_id}/access/apps`
- `GET` `/accounts/{account_id}/access/apps/ca`
- `DELETE` `/accounts/{account_id}/access/apps/{app_id}`
- `GET` `/accounts/{account_id}/access/apps/{app_id}`
… and 3254 more


</details>

**Missing** (8)

- No Workers KV: namespace or key-value endpoints (storage/kv/values)
- No Workers routes, custom domains, cron triggers, secrets, or tail endpoints
- No R2 object endpoints (listing, uploads, downloads) or S3 API surface
- No D1 get/update/import/export or time-travel endpoints
- No user, account, member, or role management endpoints (/user, /accounts)
- No zone settings, SSL/certificates, or GraphQL analytics endpoints
- No bulk DNS create/delete (dns_records/batch) or DNS import/export
- No rate limiting rules or WAF custom rulesets beyond zone firewall rules

**Deviations** (6)

- any non-empty bearer token accepted; real token permission scoping not validated
- paths served without the /client/v4 prefix — cloudflare-go's BaseURL replaces the whole base, raw REST clients must strip it
- zone status runs pending -> initializing -> active in ~4s; real waits on nameservers
- deployments expose a status field; real Deployment objects carry rollout percentages
- simulate_fail on zone create / worker deploy injects moved or failed; no real trigger
- D1 query runs a small SQL subset; DROP/ALTER and other statements return 400

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/zones` — query, stateful, paginate, filter, clock
- `POST` `/zones` — body, stateful, clock
- `GET` `/zones/{zone_id}` — params, stateful, clock
- `DELETE` `/zones/{zone_id}` — params, stateful, clock
- `GET` `/zones/{zone_id}/dns_records` — query, params, stateful, paginate, filter, clock
- `POST` `/zones/{zone_id}/dns_records` — body, params, stateful, clock
- `GET` `/zones/{zone_id}/dns_records/{dns_record_id}` — params, stateful, clock
- `PUT` `/zones/{zone_id}/dns_records/{dns_record_id}` — body, params, stateful, clock
- `PATCH` `/zones/{zone_id}/dns_records/{dns_record_id}` — body, params, stateful, clock
- `DELETE` `/zones/{zone_id}/dns_records/{dns_record_id}` — params, stateful
- `GET` `/zones/{zone_id}/firewall/rules` — query, params, stateful, paginate, clock
- `POST` `/zones/{zone_id}/firewall/rules` — body, params, stateful, clock
- `GET` `/zones/{zone_id}/firewall/rules/{rule_id}` — params, stateful, clock
- `PUT` `/zones/{zone_id}/firewall/rules/{rule_id}` — body, params, stateful, clock
- `PATCH` `/zones/{zone_id}/firewall/rules/{rule_id}` — body, params, stateful, clock
- `DELETE` `/zones/{zone_id}/firewall/rules/{rule_id}` — params, stateful
- `GET` `/zones/{zone_id}/page_rules` — query, params, stateful, paginate, filter, clock
- `POST` `/zones/{zone_id}/page_rules` — body, params, stateful, clock
- `GET` `/zones/{zone_id}/page_rules/{rule_id}` — params, stateful, clock
- `PUT` `/zones/{zone_id}/page_rules/{rule_id}` — body, params, stateful, clock
- `PATCH` `/zones/{zone_id}/page_rules/{rule_id}` — body, params, stateful, clock
- `DELETE` `/zones/{zone_id}/page_rules/{rule_id}` — params, stateful
- `POST` `/zones/{zone_id}/purge_cache` — body, params, stateful, clock
- `GET` `/accounts/{account_id}/workers/scripts` — query, params, stateful, paginate, clock
- `PUT` `/accounts/{account_id}/workers/scripts/{script_name}` — body, params, stateful, clock
- `GET` `/accounts/{account_id}/workers/scripts/{script_name}` — params, stateful, clock
- `DELETE` `/accounts/{account_id}/workers/scripts/{script_name}` — params, stateful
- `GET` `/accounts/{account_id}/workers/scripts/{script_name}/deployments` — params, stateful, clock
- `GET` `/accounts/{account_id}/r2/buckets` — query, params, stateful, paginate, clock
- `POST` `/accounts/{account_id}/r2/buckets` — body, params, stateful, clock
- `DELETE` `/accounts/{account_id}/r2/buckets/{bucket_name}` — params, stateful
- `GET` `/accounts/{account_id}/d1/database` — query, params, stateful, paginate, clock
- `POST` `/accounts/{account_id}/d1/database` — body, params, stateful, clock
- `DELETE` `/accounts/{account_id}/d1/database/{database_id}` — params, stateful
- `POST` `/accounts/{account_id}/d1/database/{database_id}/query` — body, params, stateful, filter

</details>

### cloudkit-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/database/1/{container}/{env}/public/users/current` |
| GET | `/database/1/{container}/{env}/public/zones/list` |
| GET | `/database/1/{container}/{env}/public/records/lookup` |
| GET | `/database/1/{container}/{env}/public/records/query` |
| POST | `/database/1/{container}/{env}/public/records/modify` |

</details>

**Missing** (6)

- No private or shared database surfaces (/database/1/.../private|shared)
- No assets: no /assets/upload endpoint or asset field handling
- No /users/discover (find users by email or address)
- No zone mutations (/zones/modify); zones cannot be created or deleted
- No subscriptions: /subscriptions/list, /subscriptions/modify (push)
- No web-user token auth; server-to-server key signatures only

**Deviations** (2)

- records/lookup and records/query are GET-with-body; real CloudKit specifies POST
- query comparators are a limited subset; FULL_TEXT, LIKE, and list variants missing

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/database/1/{container}/{env}/public/users/current` — query, auth, clock
- `GET` `/database/1/{container}/{env}/public/zones/list` — body, query, auth, stateful, paginate, filter, clock
- `GET` `/database/1/{container}/{env}/public/records/lookup` — body, query, auth, stateful, clock
- `GET` `/database/1/{container}/{env}/public/records/query` — body, query, auth, stateful, paginate, filter, clock
- `POST` `/database/1/{container}/{env}/public/records/modify` — body, query, auth, stateful, clock

</details>

### discord-style

**Covered** — 26 routes (+1 ws)

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth2/authorize` |
| POST | `/oauth2/token` |
| GET | `/oauth2/@me` |
| GET | `/users/@me/guilds` |
| GET | `/users/@me` |
| GET | `/guilds/{guild_id}` |
| GET | `/guilds/{guild_id}/channels` |
| POST | `/channels/{channel_id}/messages` |
| GET | `/channels/{channel_id}/messages` |
| GET | `/channels/{channel_id}/messages/{message_id}` |
| GET | `/v10/channels/{channel_id}/messages/{message_id}` |
| PUT | `/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` |
| POST | `/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` |
| POST | `/interactions` |
| GET | `/v10/oauth2/authorize` |
| POST | `/v10/oauth2/token` |
| GET | `/v10/oauth2/@me` |
| GET | `/v10/users/@me/guilds` |
| GET | `/v10/users/@me` |
| GET | `/v10/guilds/{guild_id}` |
| GET | `/v10/guilds/{guild_id}/channels` |
| POST | `/v10/channels/{channel_id}/messages` |
| GET | `/v10/channels/{channel_id}/messages` |
| PUT | `/v10/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` |
| POST | `/v10/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` |
| POST | `/v10/interactions` |
| WS | `/gateway` |

</details>

**Provider surface** — derived from spec discord-api-spec @ 10: 242 real routes · 9 covered · 3% · 228 not implemented

<details><summary>not implemented (228)</summary>

- `GET` `/applications/@me`
- `PATCH` `/applications/@me`
- `GET` `/applications/{application_id}`
- `PATCH` `/applications/{application_id}`
- `GET` `/applications/{application_id}/activity-instances/{instance_id}`
- `POST` `/applications/{application_id}/attachment`
- `GET` `/applications/{application_id}/commands`
- `POST` `/applications/{application_id}/commands`
- `PUT` `/applications/{application_id}/commands`
- `DELETE` `/applications/{application_id}/commands/{command_id}`
- `GET` `/applications/{application_id}/commands/{command_id}`
- `PATCH` `/applications/{application_id}/commands/{command_id}`
- `GET` `/applications/{application_id}/emojis`
- `POST` `/applications/{application_id}/emojis`
- `DELETE` `/applications/{application_id}/emojis/{emoji_id}`
- `GET` `/applications/{application_id}/emojis/{emoji_id}`
- `PATCH` `/applications/{application_id}/emojis/{emoji_id}`
- `GET` `/applications/{application_id}/entitlements`
- `POST` `/applications/{application_id}/entitlements`
- `DELETE` `/applications/{application_id}/entitlements/{entitlement_id}`
- `GET` `/applications/{application_id}/entitlements/{entitlement_id}`
- `POST` `/applications/{application_id}/entitlements/{entitlement_id}/consume`
- `GET` `/applications/{application_id}/guilds/{guild_id}/commands`
- `POST` `/applications/{application_id}/guilds/{guild_id}/commands`
- `PUT` `/applications/{application_id}/guilds/{guild_id}/commands`
- `GET` `/applications/{application_id}/guilds/{guild_id}/commands/permissions`
- `DELETE` `/applications/{application_id}/guilds/{guild_id}/commands/{command_id}`
- `GET` `/applications/{application_id}/guilds/{guild_id}/commands/{command_id}`
- `PATCH` `/applications/{application_id}/guilds/{guild_id}/commands/{command_id}`
- `GET` `/applications/{application_id}/guilds/{guild_id}/commands/{command_id}/permissions`
- `PUT` `/applications/{application_id}/guilds/{guild_id}/commands/{command_id}/permissions`
- `GET` `/applications/{application_id}/role-connections/metadata`
- `PUT` `/applications/{application_id}/role-connections/metadata`
- `DELETE` `/channels/{channel_id}`
- `GET` `/channels/{channel_id}`
- `PATCH` `/channels/{channel_id}`
- `POST` `/channels/{channel_id}/followers`
- `GET` `/channels/{channel_id}/invites`
- `POST` `/channels/{channel_id}/invites`
- `POST` `/channels/{channel_id}/messages/bulk-delete`
- `GET` `/channels/{channel_id}/messages/pins`
- `DELETE` `/channels/{channel_id}/messages/pins/{message_id}`
- `PUT` `/channels/{channel_id}/messages/pins/{message_id}`
- `DELETE` `/channels/{channel_id}/messages/{message_id}`
- `PATCH` `/channels/{channel_id}/messages/{message_id}`
- `POST` `/channels/{channel_id}/messages/{message_id}/crosspost`
- `DELETE` `/channels/{channel_id}/messages/{message_id}/reactions`
- `DELETE` `/channels/{channel_id}/messages/{message_id}/reactions/{emoji_name}`
- `GET` `/channels/{channel_id}/messages/{message_id}/reactions/{emoji_name}`
- `DELETE` `/channels/{channel_id}/messages/{message_id}/reactions/{emoji_name}/@me`
… and 178 more


</details>

**Missing** (8)

- No message edit or delete: PATCH/DELETE /channels/{id}/messages/{msg_id}
- No channel create/update/delete or channel webhooks endpoints
- No reaction listing or removal endpoints (GET/DELETE /reactions/{emoji})
- No application command registration (PUT /applications/{app_id}/commands)
- No guild member endpoints (/guilds/{id}/members)
- No DM channels (POST /users/@me/channels) or invite endpoints
- No OAuth token revoke (/oauth2/token/revoke) or /applications/@me
- No pins, typing, threads, or audit log endpoints

**Deviations** (5)

- gateway is a fixed script: HELLO, lenient IDENTIFY, READY, one synthetic MESSAGE_CREATE
- Reactions are 204 no-ops — no reaction state is stored or echoed on messages
- POST /interactions answers ping with type 1, everything else a type 5 deferred ack
- posted messages emit signed MESSAGE_CREATE webhooks; real Discord dispatches via gateway
- message listing pages via opaque after cursors + Link headers, not snowflake ids

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth2/authorize` — query, stateful, errors
- `POST` `/oauth2/token` — body, stateful, errors, clock
- `GET` `/oauth2/@me` — auth, stateful, clock
- `GET` `/users/@me/guilds` — auth, stateful, clock
- `GET` `/users/@me` — auth, stateful, clock
- `GET` `/guilds/{guild_id}` — params, auth, stateful, errors, clock
- `GET` `/guilds/{guild_id}/channels` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/channels/{channel_id}/messages` — body, params, auth, stateful, webhooks, clock
- `GET` `/channels/{channel_id}/messages` — query, params, auth, stateful, paginate, errors, clock
- `GET` `/channels/{channel_id}/messages/{message_id}` — params, auth, stateful, errors, clock
- `GET` `/v10/channels/{channel_id}/messages/{message_id}` — params, auth, stateful, errors, clock
- `PUT` `/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` — auth, stateful, clock
- `POST` `/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` — auth, stateful, clock
- `POST` `/interactions` — body, auth
- `GET` `/v10/oauth2/authorize` — query, stateful, errors
- `POST` `/v10/oauth2/token` — body, stateful, errors, clock
- `GET` `/v10/oauth2/@me` — auth, stateful, clock
- `GET` `/v10/users/@me/guilds` — auth, stateful, clock
- `GET` `/v10/users/@me` — auth, stateful, clock
- `GET` `/v10/guilds/{guild_id}` — params, auth, stateful, errors, clock
- `GET` `/v10/guilds/{guild_id}/channels` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/v10/channels/{channel_id}/messages` — body, params, auth, stateful, webhooks, clock
- `GET` `/v10/channels/{channel_id}/messages` — query, params, auth, stateful, paginate, errors, clock
- `PUT` `/v10/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` — auth, stateful, clock
- `POST` `/v10/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` — auth, stateful, clock
- `POST` `/v10/interactions` — body, auth

</details>

### drive-style

**Covered** — 13 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/o/oauth2/auth` |
| POST | `/o/oauth2/token` |
| POST | `/upload/drive/v3/files` |
| PUT | `/upload/drive/v3/files/{upload_id}` |
| DELETE | `/upload/drive/v3/files/{upload_id}` |
| GET | `/drive/v3/files` |
| POST | `/drive/v3/files` |
| GET | `/drive/v3/files/{id}` |
| PATCH | `/drive/v3/files/{id}` |
| DELETE | `/drive/v3/files/{id}` |
| GET | `/drive/v3/about` |
| GET | `/drive/v3/changes/startPageToken` |
| GET | `/drive/v3/changes` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 64 real routes · 8 covered · 12% · 56 not implemented

<details><summary>not implemented (56)</summary>

- `GET` `/drive/v3/apps`
- `GET` `/drive/v3/apps/{appId}`
- `POST` `/drive/v3/changes/watch`
- `POST` `/drive/v3/channels/stop`
- `GET` `/drive/v3/drives`
- `POST` `/drive/v3/drives`
- `DELETE` `/drive/v3/drives/{driveId}`
- `GET` `/drive/v3/drives/{driveId}`
- `PATCH` `/drive/v3/drives/{driveId}`
- `POST` `/drive/v3/drives/{driveId}/hide`
- `POST` `/drive/v3/drives/{driveId}/unhide`
- `GET` `/drive/v3/files/generateCseToken`
- `GET` `/drive/v3/files/generateIds`
- `DELETE` `/drive/v3/files/trash`
- `GET` `/drive/v3/files/{fileId}/accessproposals`
- `GET` `/drive/v3/files/{fileId}/accessproposals/{proposalId}`
- `POST` `/drive/v3/files/{fileId}/accessproposals/{proposalId}:resolve`
- `GET` `/drive/v3/files/{fileId}/approvals`
- `GET` `/drive/v3/files/{fileId}/approvals/{approvalId}`
- `POST` `/drive/v3/files/{fileId}/approvals/{approvalId}:approve`
- `POST` `/drive/v3/files/{fileId}/approvals/{approvalId}:cancel`
- `POST` `/drive/v3/files/{fileId}/approvals/{approvalId}:comment`
- `POST` `/drive/v3/files/{fileId}/approvals/{approvalId}:decline`
- `POST` `/drive/v3/files/{fileId}/approvals/{approvalId}:reassign`
- `POST` `/drive/v3/files/{fileId}/approvals:start`
- `GET` `/drive/v3/files/{fileId}/comments`
- `POST` `/drive/v3/files/{fileId}/comments`
- `DELETE` `/drive/v3/files/{fileId}/comments/{commentId}`
- `GET` `/drive/v3/files/{fileId}/comments/{commentId}`
- `PATCH` `/drive/v3/files/{fileId}/comments/{commentId}`
- `GET` `/drive/v3/files/{fileId}/comments/{commentId}/replies`
- `POST` `/drive/v3/files/{fileId}/comments/{commentId}/replies`
- `DELETE` `/drive/v3/files/{fileId}/comments/{commentId}/replies/{replyId}`
- `GET` `/drive/v3/files/{fileId}/comments/{commentId}/replies/{replyId}`
- `PATCH` `/drive/v3/files/{fileId}/comments/{commentId}/replies/{replyId}`
- `POST` `/drive/v3/files/{fileId}/copy`
- `POST` `/drive/v3/files/{fileId}/download`
- `GET` `/drive/v3/files/{fileId}/export`
- `GET` `/drive/v3/files/{fileId}/listLabels`
- `POST` `/drive/v3/files/{fileId}/modifyLabels`
- `GET` `/drive/v3/files/{fileId}/permissions`
- `POST` `/drive/v3/files/{fileId}/permissions`
- `DELETE` `/drive/v3/files/{fileId}/permissions/{permissionId}`
- `GET` `/drive/v3/files/{fileId}/permissions/{permissionId}`
- `PATCH` `/drive/v3/files/{fileId}/permissions/{permissionId}`
- `GET` `/drive/v3/files/{fileId}/revisions`
- `DELETE` `/drive/v3/files/{fileId}/revisions/{revisionId}`
- `GET` `/drive/v3/files/{fileId}/revisions/{revisionId}`
- `PATCH` `/drive/v3/files/{fileId}/revisions/{revisionId}`
- `POST` `/drive/v3/files/{fileId}/watch`
… and 6 more


</details>

**Missing** (7)

- No permissions/sharing endpoints on files (GET/POST/DELETE permissions)
- No comments or replies endpoints (/files/{id}/comments)
- No file copy (POST /files/{id}/copy) or export (GET /files/{id}/export)
- No revisions endpoints (/files/{id}/revisions)
- No shared drives endpoints (/drives); no supportsAllDrives handling
- No push notification channels (files.watch, changes.watch, channels/stop)
- No generateIds, apps list, or batch (multipart/mixed) request support

**Deviations** (5)

- uploads take JSON {name, content, parents}; real Drive uses multipart/related bodies
- list q is a limited field/op subset; queries outside it 400 rather than running
- orderBy honors only the first recognized key; real Drive applies every key
- metadata-only files.create defaults mimeType to the folder type when absent; real Drive defaults to a plain file
- ?alt=media on a content-less file returns 404; real Drive serves 200 with an empty body

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/o/oauth2/auth` — query, stateful, errors
- `POST` `/o/oauth2/token` — body, stateful, errors, clock
- `POST` `/upload/drive/v3/files` — body, query, stateful, clock
- `PUT` `/upload/drive/v3/files/{upload_id}` — query, params, stateful, clock
- `DELETE` `/upload/drive/v3/files/{upload_id}` — query, params, stateful, errors
- `GET` `/drive/v3/files` — query, stateful, paginate, filter, clock
- `POST` `/drive/v3/files` — body, stateful, clock
- `GET` `/drive/v3/files/{id}` — query, params, stateful, errors, clock
- `PATCH` `/drive/v3/files/{id}` — body, params, stateful, errors, clock
- `DELETE` `/drive/v3/files/{id}` — params, stateful, errors, clock
- `GET` `/drive/v3/about` — stateful, clock
- `GET` `/drive/v3/changes/startPageToken` — stateful, clock
- `GET` `/drive/v3/changes` — query, stateful, paginate, filter, clock

</details>

### dropbox-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/2/files/upload` |
| POST | `/2/files/download` |
| POST | `/2/files/list_folder` |
| POST | `/2/files/get_metadata` |
| POST | `/2/files/create_folder` |
| POST | `/2/files/delete` |
| POST | `/2/files/get_temporary_link` |
| POST | `/2/users/get_current_account` |

</details>

**Provider surface** — derived from spec dropbox-api-spec files.stone + users.stone (every route POST — API v2 is RPC-style, Stone declares no verb): 72 real routes · 8 covered · 11% · 64 not implemented

<details><summary>not implemented (64)</summary>

- `POST` `/2/files/alpha/get_metadata`
- `POST` `/2/files/alpha/upload`
- `POST` `/2/files/copy`
- `POST` `/2/files/copy_batch`
- `POST` `/2/files/copy_batch/check`
- `POST` `/2/files/copy_batch/check_v2`
- `POST` `/2/files/copy_batch_v2`
- `POST` `/2/files/copy_reference/get`
- `POST` `/2/files/copy_reference/save`
- `POST` `/2/files/copy_v2`
- `POST` `/2/files/create_folder_batch`
- `POST` `/2/files/create_folder_batch/check`
- `POST` `/2/files/create_folder_v2`
- `POST` `/2/files/delete_batch`
- `POST` `/2/files/delete_batch/check`
- `POST` `/2/files/delete_v2`
- `POST` `/2/files/download_zip`
- `POST` `/2/files/export`
- `POST` `/2/files/get_file_lock_batch`
- `POST` `/2/files/get_preview`
- `POST` `/2/files/get_temporary_upload_link`
- `POST` `/2/files/get_thumbnail`
- `POST` `/2/files/get_thumbnail_batch`
- `POST` `/2/files/get_thumbnail_v2`
- `POST` `/2/files/list_folder/continue`
- `POST` `/2/files/list_folder/get_latest_cursor`
- `POST` `/2/files/list_folder/longpoll`
- `POST` `/2/files/list_revisions`
- `POST` `/2/files/lock_file_batch`
- `POST` `/2/files/move`
- `POST` `/2/files/move_batch`
- `POST` `/2/files/move_batch/check`
- `POST` `/2/files/move_batch/check_v2`
- `POST` `/2/files/move_batch_v2`
- `POST` `/2/files/move_v2`
- `POST` `/2/files/paper/create`
- `POST` `/2/files/paper/update`
- `POST` `/2/files/permanently_delete`
- `POST` `/2/files/properties/add`
- `POST` `/2/files/properties/overwrite`
- `POST` `/2/files/properties/update`
- `POST` `/2/files/restore`
- `POST` `/2/files/save_url`
- `POST` `/2/files/save_url/check_job_status`
- `POST` `/2/files/search`
- `POST` `/2/files/search/continue_v2`
- `POST` `/2/files/search_v2`
- `POST` `/2/files/tags/add`
- `POST` `/2/files/tags/get`
- `POST` `/2/files/tags/remove`
… and 14 more


</details>

**Missing** (8)

- No move or copy endpoints (/2/files/move_v2, /2/files/copy_v2)
- No upload sessions for large files (/2/files/upload_session/*)
- No file search (/2/files/search_v2)
- No thumbnails or previews (get_thumbnail_b64, get_preview)
- No shared links or sharing folder endpoints (/2/sharing/*)
- No file history (list_revisions, restore, copy_reference)
- No users/get_space_usage or users/get_account batch
- No /2/files/list_folder/continue or list_folder/get_latest_cursor

**Deviations** (4)

- requests with no Authorization header are accepted; real Dropbox requires auth
- upload takes JSON {path, content}; real /2/files/upload posts raw bytes + Dropbox-API-Arg
- list_folder returns the entire path-prefix subtree in one response
- get_temporary_link mints a synthetic URL that does not serve the content

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/2/files/upload` — body, auth, stateful, errors, clock
- `POST` `/2/files/download` — body, auth, stateful, errors, clock
- `POST` `/2/files/list_folder` — body, auth, stateful, paginate, errors, clock
- `POST` `/2/files/get_metadata` — body, auth, stateful, errors, clock
- `POST` `/2/files/create_folder` — body, auth, stateful, errors, clock
- `POST` `/2/files/delete` — body, auth, stateful, errors, clock
- `POST` `/2/files/get_temporary_link` — body, auth, stateful, errors, clock
- `POST` `/2/users/get_current_account` — auth, stateful, clock

</details>

### dune-style

**Covered** — 6 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/v1/query/{query_id}/execute` |
| POST | `/api/v1/query/{query_id}/result` |
| GET | `/api/v1/auth/validate` |
| GET | `/api/v1/execution/{execution_id}/status` |
| GET | `/api/v1/execution/{execution_id}/results/csv` |
| GET | `/api/v1/execution/{execution_id}/results` |

</details>

**Missing** (5)

- No query management: GET/POST/PATCH/DELETE /api/v1/query endpoints
- No execution cancel (POST /api/v1/execution/{id}/cancel)
- No stateless execution endpoint (DuneStateless /stateless/executions)
- No CSV transfer to external storage (transfers endpoints)
- No table metadata endpoints (GET /api/v1/table/{namespace}/{table})

**Deviations** (4)

- executions follow a fixed clock: EXECUTING at +1s, COMPLETED at +3s after execute
- queries come from a static 3-entry catalog; no real SQL is executed
- simulate_fail body flag forces QUERY_STATE_FAILED; real API has no failure trigger
- Auth is a presence-only Bearer; real Dune uses the x-dune-api-key header

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/v1/query/{query_id}/execute` — body, params, auth, stateful, errors, clock
- `POST` `/api/v1/query/{query_id}/result` — body, params, auth, stateful, errors, clock
- `GET` `/api/v1/auth/validate` — auth
- `GET` `/api/v1/execution/{execution_id}/status` — params, auth, stateful, errors, clock
- `GET` `/api/v1/execution/{execution_id}/results/csv` — query, params, auth, stateful, errors, clock
- `GET` `/api/v1/execution/{execution_id}/results` — query, params, auth, stateful, errors, clock

</details>

### dynamodb-style

**Covered** — 1 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/` |

</details>

**Missing** (8)

- No secondary indexes: GSI/LSI creation and index-targeted queries
- No transactions: TransactGetItems, TransactWriteItems
- No PartiQL: ExecuteStatement, BatchExecuteStatement
- No TTL: DescribeTimeToLive, UpdateTimeToLive
- No backup or restore: CreateBackup, RestoreTableFromBackup
- No UpdateTable, TagResource/UntagResource/ListTags, or DescribeLimits
- No PITR or import/export: ExportTableToPointInTime, ImportTable
- No global tables (CreateGlobalTable, ListGlobalTables)

**Deviations** (5)

- expression subset: OR/NOT/parens/IN/size()/doc paths rejected as ValidationException
- tables are ACTIVE immediately and DeleteTable is synchronous; no CREATING/DELETING
- UnprocessedKeys/UnprocessedItems always empty; no throttling, ConsumedCapacity fixed at 1
- Query/Scan Limit caps returned post-filter items; real caps items evaluated
- UpdateItem REMOVE on a key attribute silently no-ops instead of erroring

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/` — body, query, stateful, paginate, errors, clock

</details>

### echo-style

**Covered** — 0 routes (+1 ws) · gRPC `stunt.example.Echo`

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| WS | `/ws/echo` |

</details>

### emailoctopus-style

**Covered** — 21 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/lists` |
| POST | `/lists` |
| GET | `/lists/{list_id}` |
| PUT | `/lists/{list_id}` |
| DELETE | `/lists/{list_id}` |
| POST | `/lists/{list_id}/fields` |
| PUT | `/lists/{list_id}/fields/{tag}` |
| DELETE | `/lists/{list_id}/fields/{tag}` |
| GET | `/lists/{list_id}/contacts` |
| POST | `/lists/{list_id}/contacts` |
| PUT | `/lists/{list_id}/contacts` |
| PUT | `/lists/{list_id}/contacts/batch` |
| GET | `/lists/{list_id}/contacts/{contact_id}` |
| PUT | `/lists/{list_id}/contacts/{contact_id}` |
| DELETE | `/lists/{list_id}/contacts/{contact_id}` |
| GET | `/campaigns` |
| GET | `/campaigns/{campaign_id}` |
| GET | `/campaigns/{campaign_id}/reports/summary` |
| GET | `/campaigns/{campaign_id}/reports/links` |
| GET | `/campaigns/{campaign_id}/reports` |
| POST | `/automations/{automation_id}/queue` |

</details>

**Missing** (2)

- No rate limiting: 429 too-many-requests responses and quotas not simulated
- No 403 access-denied, 415 unsupported-media-type, or 405 method problem responses

**Deviations** (3)

- contact ids are the MD5 of the lowercased email, which is the alias the API documents for contact_id; the docs do not state the shape of the id returned on create
- any non-empty bearer token is accepted; real keys are dashboard-issued API keys
- v2 has no webhooks; adapter emits unsigned lifecycle events as a local extension

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/lists` — query, stateful, paginate, filter
- `POST` `/lists` — body, stateful, filter, webhooks, clock
- `GET` `/lists/{list_id}` — params, stateful, filter
- `PUT` `/lists/{list_id}` — body, params, stateful, filter, webhooks, clock
- `DELETE` `/lists/{list_id}` — params, stateful, filter, webhooks, clock
- `POST` `/lists/{list_id}/fields` — body, params, stateful, webhooks, clock
- `PUT` `/lists/{list_id}/fields/{tag}` — body, params, stateful, filter, webhooks, clock
- `DELETE` `/lists/{list_id}/fields/{tag}` — params, stateful, filter, webhooks, clock
- `GET` `/lists/{list_id}/contacts` — query, params, stateful, paginate, filter
- `POST` `/lists/{list_id}/contacts` — body, params, stateful, filter, webhooks, clock
- `PUT` `/lists/{list_id}/contacts` — body, params, stateful, filter, webhooks, clock
- `PUT` `/lists/{list_id}/contacts/batch` — body, params, stateful, webhooks, clock
- `GET` `/lists/{list_id}/contacts/{contact_id}` — params, stateful
- `PUT` `/lists/{list_id}/contacts/{contact_id}` — body, params, stateful, webhooks, clock
- `DELETE` `/lists/{list_id}/contacts/{contact_id}` — params, stateful, webhooks, clock
- `GET` `/campaigns` — query, stateful, paginate, filter, clock
- `GET` `/campaigns/{campaign_id}` — params, stateful, clock
- `GET` `/campaigns/{campaign_id}/reports/summary` — params, stateful, clock
- `GET` `/campaigns/{campaign_id}/reports/links` — params, stateful, clock
- `GET` `/campaigns/{campaign_id}/reports` — query, params, stateful, paginate, clock
- `POST` `/automations/{automation_id}/queue` — body, params, stateful, webhooks, clock

</details>

### entra-id-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/common/oauth2/v2.0/authorize` |
| POST | `/common/oauth2/v2.0/token` |
| GET | `/common/discovery/v2.0/keys` |
| GET | `/v1.0/me` |
| GET | `/v1.0/users` |
| POST | `/v1.0/users` |
| GET | `/v1.0/users/{id}` |
| GET | `/v1.0/applications` |
| GET | `/v1.0/servicePrincipals` |

</details>

**Provider surface** — derived from spec msgraph-metadata v1.0 @ v1.0: 17531 real routes · 6 covered · 0% · 17525 not implemented

<details><summary>not implemented (17525)</summary>

- `GET` `/v1.0/admin`
- `PATCH` `/v1.0/admin`
- `DELETE` `/v1.0/admin/configurationManagement`
- `GET` `/v1.0/admin/configurationManagement`
- `PATCH` `/v1.0/admin/configurationManagement`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts`
- `POST` `/v1.0/admin/configurationManagement/configurationDrifts`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults`
- `POST` `/v1.0/admin/configurationManagement/configurationMonitoringResults`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors`
- `POST` `/v1.0/admin/configurationManagement/configurationMonitors`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs`
- `POST` `/v1.0/admin/configurationManagement/configurationSnapshotJobs`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots`
- `POST` `/v1.0/admin/configurationManagement/configurationSnapshots`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `DELETE` `/v1.0/admin/edge`
- `GET` `/v1.0/admin/edge`
- `PATCH` `/v1.0/admin/edge`
- `DELETE` `/v1.0/admin/edge/internetExplorerMode`
- `GET` `/v1.0/admin/edge/internetExplorerMode`
- `PATCH` `/v1.0/admin/edge/internetExplorerMode`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists`
- `POST` `/v1.0/admin/edge/internetExplorerMode/siteLists`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists/$count`
- `DELETE` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
- `PATCH` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
… and 17475 more


</details>

**Missing** (8)

- No $filter, $search, $orderby, $select, or $expand on Graph queries
- No user PATCH or DELETE (/v1.0/users/{id})
- No application or servicePrincipal create, update, or delete operations
- No groups, members, or memberOf endpoints (/v1.0/groups)
- No directory roles, role assignments, or organization endpoints
- No B2B invitations (POST /invitations) or guest users
- No client-credentials or device-code token grant support
- No signInLogs, audit logs, or user activities

**Deviations** (3)

- Authorize auto-approves with an instant 302; no consent screen
- nextLink cursor param is $skipToken (camelCase); real Graph emits $skiptoken
- users create ignores mailNickname; mail defaults to the UPN

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/common/oauth2/v2.0/authorize` — query, stateful, errors
- `POST` `/common/oauth2/v2.0/token` — body, stateful, errors, clock
- `GET` `/common/discovery/v2.0/keys` — —
- `GET` `/v1.0/me` — auth, stateful, clock
- `GET` `/v1.0/users` — query, auth, stateful, paginate, errors, clock
- `POST` `/v1.0/users` — body, auth, stateful, clock
- `GET` `/v1.0/users/{id}` — params, auth, stateful, errors, clock
- `GET` `/v1.0/applications` — query, auth, stateful, paginate, errors, clock
- `GET` `/v1.0/servicePrincipals` — query, auth, stateful, paginate, errors, clock

</details>

### erc4337-style

**Covered** — 2 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/` |
| POST | `/paymaster/sign` |

</details>

**Missing** (5)

- No eth_chainId, eth_blockNumber, or eth_getBlockByNumber passthrough
- No ERC-7677 paymaster RPC (pm_* methods); only local /paymaster/sign
- No EntryPoint v0.6 support; v0.7 entrypoint only
- No debug_bundler_* ops: sendBundleNow, clearState, dropUserOperation
- No WebSocket transport or newHeads subscriptions

**Deviations** (6)

- gas estimates are deterministic fixed values; real bundlers differ per implementation
- inclusion runs on a fixed clock: mempool 0-1s, bundled 1-3s, included at >=3s
- eth_sendUserOperation accepts {simulate_fail:true} as a third params element
- mock paymaster POST /paymaster/sign mints synthetic sponsorship signatures
- userOp keeps the v0.6 paymasterAndData field though the adapter is EntryPoint-v0.7-only
- Error envelopes use generic -32602 rather than AA-prefixed codes (-32500...)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/` — body, stateful, clock
- `POST` `/paymaster/sign` — body, errors

</details>

### escrow-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/2017-09-01/customer/me` |
| GET | `/2017-09-01/transaction` |
| POST | `/2017-09-01/transaction` |
| GET | `/2017-09-01/transaction/reference/{reference}` |
| GET | `/2017-09-01/transaction/{id}` |
| PATCH | `/2017-09-01/transaction/{id}` |
| POST | `/2017-09-01/customer/me/webhook` |
| GET | `/2017-09-01/customer/me/webhook` |
| POST | `/sim/transaction/{id}/fund` |

</details>

**Missing** (3)

- No list filters on GET /2017-09-01/transaction (status, date, email)
- No reject or return-item actions (agree/accept/ship/receive/cancel exist)
- No fee calculation endpoint (/2017-09-01/transaction/fees)

**Deviations** (4)

- POST /sim/transaction/{id}/fund is a simulator-only affordance for hosted-page funding
- List returns {transactions:[...]}; real Escrow.com returns a bare array
- An unparseable schedule amount stores 0.00 instead of a 400 field error
- ship/receive/cancel are not gated on agreement or secured funds

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/2017-09-01/customer/me` — auth
- `GET` `/2017-09-01/transaction` — query, auth, stateful, paginate
- `POST` `/2017-09-01/transaction` — body, auth, stateful, webhooks, errors, clock
- `GET` `/2017-09-01/transaction/reference/{reference}` — params, auth, stateful, errors
- `GET` `/2017-09-01/transaction/{id}` — params, auth, stateful, errors
- `PATCH` `/2017-09-01/transaction/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/2017-09-01/customer/me/webhook` — body, auth, stateful, errors
- `GET` `/2017-09-01/customer/me/webhook` — auth, stateful
- `POST` `/sim/transaction/{id}/fund` — params, auth, stateful, webhooks, errors

</details>

### eth-jsonrpc-style

**Covered** — 1 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/` |

</details>

**Missing** (5)

- No EVM execution — eth_getCode always 0x, contracts never run
- No eth_getStorageAt, eth_getTransactionByBlock*, or uncle methods
- No debug/trace namespaces (debug_traceTransaction, trace_transaction)
- No eth_maxPriorityFeePerGas or eth_blobBaseFee methods
- No WebSocket subscriptions (eth_subscribe); HTTP POST / only

**Deviations** (4)

- eth_estimateGas fixed at 0x5208 (21000); eth_gasPrice fixed at 1 Gwei
- Tx hashes derive from a pseudo-keccak, not real keccak256
- Mining delay fixed at 3s; blockNumber advances one block per sent tx
- eth_sendRawTransaction accepts simulator-only {simulate_fail: true} for a revert

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/` — body, stateful, clock

</details>

### etherscan-style

**Covered** — 1 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/api` |

</details>

**Missing** (3)

- No getLogs action (txlistinternal/tokentx are served, hard-coded empty)
- No logs, proxy, or gastracker modules (gasoracle, eth_call passthrough)
- No getminedblocks, getblocknobytime, or nodecount actions

**Deviations** (2)

- Auth accepts any non-empty apikey; only a missing key yields the error envelope
- txlistinternal/tokentx/tokenbalance return hard-coded empty results

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/api` — query, stateful, filter

</details>

### fattureincloud-style

**Covered** — 42 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/user/companies` |
| GET | `/c/{company_id}/company/info` |
| PUT | `/c/{company_id}/company/info` |
| GET | `/c/{company_id}/received_documents` |
| POST | `/c/{company_id}/received_documents` |
| GET | `/c/{company_id}/received_documents/info` |
| GET | `/c/{company_id}/received_documents/{id}` |
| PUT | `/c/{company_id}/received_documents/{id}` |
| DELETE | `/c/{company_id}/received_documents/{id}` |
| GET | `/c/{company_id}/issued_documents` |
| POST | `/c/{company_id}/issued_documents` |
| GET | `/c/{company_id}/issued_documents/info` |
| GET | `/c/{company_id}/issued_documents/{id}` |
| PUT | `/c/{company_id}/issued_documents/{id}` |
| DELETE | `/c/{company_id}/issued_documents/{id}` |
| GET | `/c/{company_id}/suppliers` |
| POST | `/c/{company_id}/suppliers` |
| GET | `/c/{company_id}/suppliers/{id}` |
| PUT | `/c/{company_id}/suppliers/{id}` |
| DELETE | `/c/{company_id}/suppliers/{id}` |
| GET | `/c/{company_id}/clients` |
| POST | `/c/{company_id}/clients` |
| GET | `/c/{company_id}/clients/{id}` |
| PUT | `/c/{company_id}/clients/{id}` |
| DELETE | `/c/{company_id}/clients/{id}` |
| GET | `/c/{company_id}/products` |
| POST | `/c/{company_id}/products` |
| GET | `/c/{company_id}/products/{id}` |
| PUT | `/c/{company_id}/products/{id}` |
| DELETE | `/c/{company_id}/products/{id}` |
| GET | `/c/{company_id}/taxes` |
| POST | `/c/{company_id}/taxes` |
| GET | `/c/{company_id}/taxes/{id}` |
| PUT | `/c/{company_id}/taxes/{id}` |
| DELETE | `/c/{company_id}/taxes/{id}` |
| GET | `/c/{company_id}/cashbook/{year}/{month}` |
| POST | `/c/{company_id}/archive` |
| GET | `/c/{company_id}/subscriptions` |
| POST | `/c/{company_id}/subscriptions` |
| GET | `/c/{company_id}/subscriptions/{id}` |
| PUT | `/c/{company_id}/subscriptions/{id}` |
| DELETE | `/c/{company_id}/subscriptions/{id}` |

</details>

**Provider surface** — derived from spec openapi-fattureincloud @ 2.1.8: 123 real routes · 31 covered · 25% · 92 not implemented

<details><summary>not implemented (92)</summary>

- `GET` `/c/{company_id}/archive`
- `POST` `/c/{company_id}/archive/attachment`
- `DELETE` `/c/{company_id}/archive/{document_id}`
- `GET` `/c/{company_id}/archive/{document_id}`
- `PUT` `/c/{company_id}/archive/{document_id}`
- `GET` `/c/{company_id}/bin/issued_documents`
- `DELETE` `/c/{company_id}/bin/issued_documents/{document_id}`
- `GET` `/c/{company_id}/bin/issued_documents/{document_id}`
- `POST` `/c/{company_id}/bin/issued_documents/{document_id}/recover`
- `GET` `/c/{company_id}/bin/received_documents`
- `DELETE` `/c/{company_id}/bin/received_documents/{document_id}`
- `GET` `/c/{company_id}/bin/received_documents/{document_id}`
- `POST` `/c/{company_id}/bin/received_documents/{document_id}/recover`
- `GET` `/c/{company_id}/cashbook`
- `POST` `/c/{company_id}/cashbook`
- `DELETE` `/c/{company_id}/cashbook/{document_id}`
- `PUT` `/c/{company_id}/cashbook/{document_id}`
- `GET` `/c/{company_id}/company/plan_usage`
- `GET` `/c/{company_id}/emails`
- `GET` `/c/{company_id}/entities/clients`
- `POST` `/c/{company_id}/entities/clients`
- `GET` `/c/{company_id}/entities/clients/info`
- `DELETE` `/c/{company_id}/entities/clients/{client_id}`
- `GET` `/c/{company_id}/entities/clients/{client_id}`
- `PUT` `/c/{company_id}/entities/clients/{client_id}`
- `GET` `/c/{company_id}/entities/suppliers`
- `POST` `/c/{company_id}/entities/suppliers`
- `DELETE` `/c/{company_id}/entities/suppliers/{supplier_id}`
- `GET` `/c/{company_id}/entities/suppliers/{supplier_id}`
- `PUT` `/c/{company_id}/entities/suppliers/{supplier_id}`
- `GET` `/c/{company_id}/info/archive_categories`
- `GET` `/c/{company_id}/info/cost_centers`
- `GET` `/c/{company_id}/info/payment_accounts`
- `GET` `/c/{company_id}/info/payment_methods`
- `GET` `/c/{company_id}/info/product_categories`
- `GET` `/c/{company_id}/info/received_document_categories`
- `GET` `/c/{company_id}/info/revenue_centers`
- `GET` `/c/{company_id}/info/vat_types`
- `POST` `/c/{company_id}/issued_documents/attachment`
- `GET` `/c/{company_id}/issued_documents/join`
- `POST` `/c/{company_id}/issued_documents/totals`
- `GET` `/c/{company_id}/issued_documents/transform`
- `DELETE` `/c/{company_id}/issued_documents/{document_id}/attachment`
- `GET` `/c/{company_id}/issued_documents/{document_id}/e_invoice/error_reason`
- `POST` `/c/{company_id}/issued_documents/{document_id}/e_invoice/send`
- `GET` `/c/{company_id}/issued_documents/{document_id}/e_invoice/xml`
- `GET` `/c/{company_id}/issued_documents/{document_id}/e_invoice/xml_verify`
- `GET` `/c/{company_id}/issued_documents/{document_id}/email`
- `POST` `/c/{company_id}/issued_documents/{document_id}/email`
- `POST` `/c/{company_id}/issued_documents/{document_id}/totals`
… and 42 more


</details>

**Missing** (3)

- OAuth2 token dance not implemented (no authorize or token endpoints)
- No e-invoice send/retrieve side effects or email dispatch
- No receipts, settings, or document attachment endpoints

**Deviations** (6)

- Any non-empty bearer accepted; missing/malformed header is a genuine 401
- POST /entities/{c}/archive takes JSON; the real endpoint is multipart
- Webhook HMAC uses fixed secret fic-stunt-webhook-signing-secret
- DELETE returns bare {}; real API wraps delete responses in {data: ...}
- Webhook deliveries use a platform envelope, not CloudEvents (ce-* headers, JWT bearer)
- Update events are generalized <category>.update; real API uses per-document-kind types

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/user/companies` — stateful
- `GET` `/c/{company_id}/company/info` — params, stateful
- `PUT` `/c/{company_id}/company/info` — body, params, stateful
- `GET` `/c/{company_id}/received_documents` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/received_documents` — body, params, stateful, webhooks
- `GET` `/c/{company_id}/received_documents/info` — params, stateful
- `GET` `/c/{company_id}/received_documents/{id}` — params, stateful
- `PUT` `/c/{company_id}/received_documents/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/received_documents/{id}` — params, stateful
- `GET` `/c/{company_id}/issued_documents` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/issued_documents` — body, params, stateful, webhooks
- `GET` `/c/{company_id}/issued_documents/info` — params, stateful
- `GET` `/c/{company_id}/issued_documents/{id}` — params, stateful
- `PUT` `/c/{company_id}/issued_documents/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/issued_documents/{id}` — params, stateful
- `GET` `/c/{company_id}/suppliers` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/suppliers` — body, params, stateful, webhooks
- `GET` `/c/{company_id}/suppliers/{id}` — params, stateful
- `PUT` `/c/{company_id}/suppliers/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/suppliers/{id}` — params, stateful
- `GET` `/c/{company_id}/clients` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/clients` — body, params, stateful, webhooks
- `GET` `/c/{company_id}/clients/{id}` — params, stateful
- `PUT` `/c/{company_id}/clients/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/clients/{id}` — params, stateful
- `GET` `/c/{company_id}/products` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/products` — body, params, stateful, webhooks
- `GET` `/c/{company_id}/products/{id}` — params, stateful
- `PUT` `/c/{company_id}/products/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/products/{id}` — params, stateful
- `GET` `/c/{company_id}/taxes` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/taxes` — body, params, stateful, webhooks, clock
- `GET` `/c/{company_id}/taxes/{id}` — params, stateful
- `PUT` `/c/{company_id}/taxes/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/taxes/{id}` — params, stateful
- `GET` `/c/{company_id}/cashbook/{year}/{month}` — params, stateful
- `POST` `/c/{company_id}/archive` — body, params, stateful
- `GET` `/c/{company_id}/subscriptions` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/subscriptions` — body, params, stateful
- `GET` `/c/{company_id}/subscriptions/{id}` — params, stateful
- `PUT` `/c/{company_id}/subscriptions/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/subscriptions/{id}` — params, stateful

</details>

### firebase-style

**Covered** — 22 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/accounts:signInWithPassword` |
| POST | `/v1/accounts:signUp` |
| POST | `/v1/accounts:signInWithIdp` |
| POST | `/v1/accounts:getAccountInfo` |
| POST | `/v1/accounts:lookup` |
| POST | `/identitytoolkit/v3/relyingparty/{action}` |
| POST | `/v1/token` |
| POST | `/v1/projects/{project}/databases/(default)/documents:runQuery` |
| GET | `/v1/projects/{project}/databases/(default)/documents/{collection}` |
| POST | `/v1/projects/{project}/databases/(default)/documents/{collection}` |
| GET | `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` |
| PATCH | `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` |
| DELETE | `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` |
| GET | `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}` |
| POST | `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}` |
| GET | `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` |
| PATCH | `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` |
| DELETE | `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` |
| POST | `/v1/projects/{project}/messages:send` |
| GET | `/v1/projects/{project}/messages` |
| POST | `/v1/projects/{project}/topics/{topic}:subscribe` |
| POST | `/v1/projects/{project}/topics/{topic}:unsubscribe` |

</details>

**Missing** (4)

- No Realtime Database, Cloud Storage, or App Check surfaces
- No password reset (sendOobCode), account update/delete, or phone auth
- No Firestore index management, listCollectionIds, batchGet, or listen
- runQuery lacks composite/unary filters, offset, and startAt/endAt cursors

**Deviations** (8)

- Firestore subcollections supported one level deep only
- runQuery covers a structuredQuery subset: from/where/orderBy/limit, 8 filter ops
- Auth checks credential presence only; Bearer or key value never validated
- FCM topic :subscribe/:unsubscribe stand in for the Instance ID API
- GET .../messages lists sent messages — simulator extension, no real endpoint
- securetoken /v1/token errors use the Identity Toolkit envelope; real securetoken answers OAuth-style {error: invalid_grant}
- securetoken access_token mirrors id_token; real Firebase mints distinct tokens
- signUp includes registered:true and an empty displayName (real API emits those on sign-in only)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/accounts:signInWithPassword` — body, query, auth, stateful, clock
- `POST` `/v1/accounts:signUp` — body, query, auth, stateful, clock
- `POST` `/v1/accounts:signInWithIdp` — body, query, auth, stateful, clock
- `POST` `/v1/accounts:getAccountInfo` — body, query, auth, stateful, clock
- `POST` `/v1/accounts:lookup` — body, query, auth, stateful, clock
- `POST` `/identitytoolkit/v3/relyingparty/{action}` — body, query, params, auth, stateful, clock
- `POST` `/v1/token` — body, query, auth, stateful, clock
- `POST` `/v1/projects/{project}/databases/(default)/documents:runQuery` — body, query, params, auth, stateful, filter, clock
- `GET` `/v1/projects/{project}/databases/(default)/documents/{collection}` — body, query, params, auth, stateful, paginate, clock
- `POST` `/v1/projects/{project}/databases/(default)/documents/{collection}` — body, query, params, auth, stateful, clock
- `GET` `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` — body, query, params, auth, stateful, clock
- `PATCH` `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` — body, query, params, auth, stateful, clock
- `DELETE` `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` — body, query, params, auth, stateful
- `GET` `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}` — body, query, params, auth, stateful, paginate, clock
- `POST` `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}` — body, query, params, auth, stateful, clock
- `GET` `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` — body, query, params, auth, stateful, clock
- `PATCH` `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` — body, query, params, auth, stateful, clock
- `DELETE` `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` — body, query, params, auth, stateful
- `POST` `/v1/projects/{project}/messages:send` — body, query, params, auth, stateful
- `GET` `/v1/projects/{project}/messages` — body, query, params, auth, stateful, paginate
- `POST` `/v1/projects/{project}/topics/{topic}:subscribe` — body, query, params, auth, stateful
- `POST` `/v1/projects/{project}/topics/{topic}:unsubscribe` — body, query, params, auth, stateful

</details>

### ga4-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1beta/accounts` |
| GET | `/v1beta/properties` |
| GET | `/v1beta/properties/{property}/dataStreams` |
| GET | `/v1admin/accounts` |
| GET | `/v1admin/properties` |
| GET | `/v1admin/properties/{property}/dataStreams` |
| POST | `/v1beta/properties/{resource}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 66 real routes · 11 covered · 16% · 55 not implemented

<details><summary>not implemented (55)</summary>

- `GET` `/v1beta/properties/{propertiesId}/audienceExports`
- `POST` `/v1beta/properties/{propertiesId}/audienceExports`
- `GET` `/v1beta/properties/{propertiesId}/audienceExports/{audienceExportsId}`
- `POST` `/v1beta/properties/{propertiesId}/audienceExports/{audienceExportsId}:query`
- `GET` `/v1beta/properties/{propertiesId}/metadata`
- `GET` `/v1beta/accountSummaries`
- `DELETE` `/v1beta/accounts/{accountsId}`
- `GET` `/v1beta/accounts/{accountsId}`
- `PATCH` `/v1beta/accounts/{accountsId}`
- `GET` `/v1beta/accounts/{accountsId}/dataSharingSettings`
- `POST` `/v1beta/accounts/{accountsId}:runAccessReport`
- `POST` `/v1beta/accounts/{accountsId}:searchChangeHistoryEvents`
- `POST` `/v1beta/accounts:provisionAccountTicket`
- `POST` `/v1beta/properties`
- `DELETE` `/v1beta/properties/{propertiesId}`
- `GET` `/v1beta/properties/{propertiesId}`
- `PATCH` `/v1beta/properties/{propertiesId}`
- `GET` `/v1beta/properties/{propertiesId}/conversionEvents`
- `POST` `/v1beta/properties/{propertiesId}/conversionEvents`
- `DELETE` `/v1beta/properties/{propertiesId}/conversionEvents/{conversionEventsId}`
- `GET` `/v1beta/properties/{propertiesId}/conversionEvents/{conversionEventsId}`
- `PATCH` `/v1beta/properties/{propertiesId}/conversionEvents/{conversionEventsId}`
- `GET` `/v1beta/properties/{propertiesId}/customDimensions`
- `POST` `/v1beta/properties/{propertiesId}/customDimensions`
- `GET` `/v1beta/properties/{propertiesId}/customDimensions/{customDimensionsId}`
- `PATCH` `/v1beta/properties/{propertiesId}/customDimensions/{customDimensionsId}`
- `POST` `/v1beta/properties/{propertiesId}/customDimensions/{customDimensionsId}:archive`
- `GET` `/v1beta/properties/{propertiesId}/customMetrics`
- `POST` `/v1beta/properties/{propertiesId}/customMetrics`
- `GET` `/v1beta/properties/{propertiesId}/customMetrics/{customMetricsId}`
- `PATCH` `/v1beta/properties/{propertiesId}/customMetrics/{customMetricsId}`
- `POST` `/v1beta/properties/{propertiesId}/customMetrics/{customMetricsId}:archive`
- `GET` `/v1beta/properties/{propertiesId}/dataRetentionSettings`
- `PATCH` `/v1beta/properties/{propertiesId}/dataRetentionSettings`
- `POST` `/v1beta/properties/{propertiesId}/dataStreams`
- `DELETE` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}`
- `GET` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}`
- `PATCH` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}`
- `GET` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}/measurementProtocolSecrets`
- `POST` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}/measurementProtocolSecrets`
- `DELETE` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}/measurementProtocolSecrets/{measurementProtocolSecretsId}`
- `GET` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}/measurementProtocolSecrets/{measurementProtocolSecretsId}`
- `PATCH` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}/measurementProtocolSecrets/{measurementProtocolSecretsId}`
- `GET` `/v1beta/properties/{propertiesId}/firebaseLinks`
- `POST` `/v1beta/properties/{propertiesId}/firebaseLinks`
- `DELETE` `/v1beta/properties/{propertiesId}/firebaseLinks/{firebaseLinksId}`
- `GET` `/v1beta/properties/{propertiesId}/googleAdsLinks`
- `POST` `/v1beta/properties/{propertiesId}/googleAdsLinks`
- `DELETE` `/v1beta/properties/{propertiesId}/googleAdsLinks/{googleAdsLinksId}`
- `PATCH` `/v1beta/properties/{propertiesId}/googleAdsLinks/{googleAdsLinksId}`
… and 5 more


</details>

**Missing** (4)

- No pivots, cohortSpec, metricAggregations, or keepEmptyRows in runReport
- No runPivotReport, batchRunReports, getMetadata, or checkCompatibility
- No Admin write ops: account/property/dataStream create, patch, delete
- No googleAdsLinks, firebaseLinks, audiences, or conversionEvents

**Deviations** (3)

- Dimensions: date/country/deviceCategory only; metrics: sessions/activeUsers/screenPageViews
- properties.list honors only the filter=parent:<account> form
- Admin API served at both /v1admin (GA) and /v1beta (the shipped Go client's version); shapes shared

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1beta/accounts` — query, auth, stateful, paginate, errors, clock
- `GET` `/v1beta/properties` — query, auth, stateful, paginate, errors, clock
- `GET` `/v1beta/properties/{property}/dataStreams` — query, params, auth, stateful, paginate, errors, clock
- `GET` `/v1admin/accounts` — query, auth, stateful, paginate, errors, clock
- `GET` `/v1admin/properties` — query, auth, stateful, paginate, errors, clock
- `GET` `/v1admin/properties/{property}/dataStreams` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/v1beta/properties/{resource}` — body, params, auth, stateful, filter, errors, clock

</details>

### gcalendar-style

**Covered** — 10 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/calendar/v3/users/me/calendarList` |
| GET | `/calendar/v3/calendars/primary` |
| POST | `/calendar/v3/calendars/{calendarId}/events/quickAdd` |
| POST | `/calendar/v3/calendars/{calendarId}/events/import` |
| GET | `/calendar/v3/calendars/{calendarId}/events` |
| POST | `/calendar/v3/calendars/{calendarId}/events` |
| GET | `/calendar/v3/calendars/{calendarId}/events/{eventId}/instances` |
| GET | `/calendar/v3/calendars/{calendarId}/events/{eventId}` |
| PATCH | `/calendar/v3/calendars/{calendarId}/events/{eventId}` |
| DELETE | `/calendar/v3/calendars/{calendarId}/events/{eventId}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 38 real routes · 9 covered · 23% · 29 not implemented

<details><summary>not implemented (29)</summary>

- `POST` `/calendar/v3/calendars`
- `DELETE` `/calendar/v3/calendars/{calendarId}`
- `GET` `/calendar/v3/calendars/{calendarId}`
- `PATCH` `/calendar/v3/calendars/{calendarId}`
- `PUT` `/calendar/v3/calendars/{calendarId}`
- `GET` `/calendar/v3/calendars/{calendarId}/acl`
- `POST` `/calendar/v3/calendars/{calendarId}/acl`
- `POST` `/calendar/v3/calendars/{calendarId}/acl/watch`
- `DELETE` `/calendar/v3/calendars/{calendarId}/acl/{ruleId}`
- `GET` `/calendar/v3/calendars/{calendarId}/acl/{ruleId}`
- `PATCH` `/calendar/v3/calendars/{calendarId}/acl/{ruleId}`
- `PUT` `/calendar/v3/calendars/{calendarId}/acl/{ruleId}`
- `POST` `/calendar/v3/calendars/{calendarId}/clear`
- `POST` `/calendar/v3/calendars/{calendarId}/events/watch`
- `PUT` `/calendar/v3/calendars/{calendarId}/events/{eventId}`
- `POST` `/calendar/v3/calendars/{calendarId}/events/{eventId}/move`
- `POST` `/calendar/v3/calendars/{calendarId}/transferOwnership`
- `POST` `/calendar/v3/channels/stop`
- `GET` `/calendar/v3/colors`
- `POST` `/calendar/v3/freeBusy`
- `POST` `/calendar/v3/users/me/calendarList`
- `POST` `/calendar/v3/users/me/calendarList/watch`
- `DELETE` `/calendar/v3/users/me/calendarList/{calendarId}`
- `GET` `/calendar/v3/users/me/calendarList/{calendarId}`
- `PATCH` `/calendar/v3/users/me/calendarList/{calendarId}`
- `PUT` `/calendar/v3/users/me/calendarList/{calendarId}`
- `GET` `/calendar/v3/users/me/settings`
- `POST` `/calendar/v3/users/me/settings/watch`
- `GET` `/calendar/v3/users/me/settings/{setting}`

</details>

**Missing** (4)

- No RRULE MONTHLY/YEARLY frequencies or BY* parts (BYDAY, BYSETPOS)
- No calendars CRUD or calendarList/ACL write endpoints
- No events watch, move, or freebusy.query endpoints
- No colors or users.settings endpoints

**Deviations** (2)

- Event create without start/end defaults them (now+30m, +90m); real API requires both
- quickAdd uses the text verbatim as the summary with a now+30m slot; real Calendar parses natural-language dates

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/calendar/v3/users/me/calendarList` — query, auth, stateful, paginate, clock
- `GET` `/calendar/v3/calendars/primary` — auth, stateful, clock
- `POST` `/calendar/v3/calendars/{calendarId}/events/quickAdd` — query, params, auth, stateful, clock
- `POST` `/calendar/v3/calendars/{calendarId}/events/import` — body, params, auth, stateful, clock
- `GET` `/calendar/v3/calendars/{calendarId}/events` — query, params, auth, stateful, paginate, filter, clock
- `POST` `/calendar/v3/calendars/{calendarId}/events` — body, params, auth, stateful, clock
- `GET` `/calendar/v3/calendars/{calendarId}/events/{eventId}/instances` — query, params, auth, stateful, paginate, filter, clock
- `GET` `/calendar/v3/calendars/{calendarId}/events/{eventId}` — params, auth, stateful, clock
- `PATCH` `/calendar/v3/calendars/{calendarId}/events/{eventId}` — body, params, auth, stateful, clock
- `DELETE` `/calendar/v3/calendars/{calendarId}/events/{eventId}` — params, auth, stateful, clock

</details>

### gdocs-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/documents` |
| GET | `/v1/documents/{documentId}/revisions` |
| POST | `/v1/documents/{documentId}:batchUpdate` |
| POST | `/v1/documents/{documentId}/batchUpdate` |
| GET | `/v1/documents/{documentId}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 3 real routes · 3 covered · 100% · 0 not implemented

**Missing** (3)

- Tables, headers/footers, suggestions, and writeControl not modeled
- Most batchUpdate request types absent: replaceAllText, replaceImage, named ranges
- No createTable or other table requests (insertTableRow, updateTableCellStyle)

**Deviations** (5)

- batchUpdate replies map 1:1 to requests; real API may return fewer
- batchUpdate also served at the legacy slash form (documents/{id}/batchUpdate)
- GET revisions endpoint is extra-API; the real Docs API v1 has none
- Inserted text adopts the style of the run it lands in
- Inserting newline continues bullet/named style into the new paragraph

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/documents` — body, auth, stateful, clock
- `GET` `/v1/documents/{documentId}/revisions` — params, auth, stateful, clock
- `POST` `/v1/documents/{documentId}:batchUpdate` — body, params, auth, stateful, clock
- `POST` `/v1/documents/{documentId}/batchUpdate` — body, params, auth, stateful, clock
- `GET` `/v1/documents/{documentId}` — params, auth, stateful, clock

</details>

### github-style

**Covered** — 26 routes · GraphQL schema

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/app` |
| GET | `/app/installations` |
| POST | `/app/installations/{installation_id}/access_tokens` |
| GET | `/installation` |
| GET | `/repos/{owner}/{repo}` |
| GET | `/repos/{owner}/{repo}/issues` |
| POST | `/repos/{owner}/{repo}/issues` |
| GET | `/repos/{owner}/{repo}/issues/{issue_number}` |
| PATCH | `/repos/{owner}/{repo}/issues/{issue_number}` |
| GET | `/repos/{owner}/{repo}/issues/{issue_number}/comments` |
| POST | `/repos/{owner}/{repo}/issues/{issue_number}/comments` |
| POST | `/repos/{owner}/{repo}/issues/{issue_number}/labels/{name}` |
| DELETE | `/repos/{owner}/{repo}/issues/{issue_number}/labels/{name}` |
| GET | `/repos/{owner}/{repo}/issues/{issue_number}/events` |
| GET | `/repos/{owner}/{repo}/pulls` |
| POST | `/repos/{owner}/{repo}/pulls` |
| GET | `/repos/{owner}/{repo}/pulls/{pull_number}` |
| PATCH | `/repos/{owner}/{repo}/pulls/{pull_number}` |
| PUT | `/repos/{owner}/{repo}/pulls/{pull_number}/merge` |
| GET | `/repos/{owner}/{repo}/pulls/{pull_number}/reviews` |
| POST | `/repos/{owner}/{repo}/pulls/{pull_number}/reviews` |
| POST | `/repos/{owner}/{repo}/dispatches` |
| GET | `/repos/{owner}/{repo}/actions/runs` |
| GET | `/repos/{owner}/{repo}/actions/runs/{run_id}` |
| POST | `/repos/{owner}/{repo}/hooks` |
| POST | `/webhooks/receive` |

</details>

**Provider surface** — derived from sdk octokit @ 5.0.5 (floor): 998 real routes · 23 covered · 2% · 971 not implemented

<details><summary>not implemented (971)</summary>

- `GET` `/advisories`
- `GET` `/advisories/{ghsa_id}`
- `POST` `/app-manifests/{code}/conversions`
- `GET` `/app/hook/config`
- `PATCH` `/app/hook/config`
- `GET` `/app/hook/deliveries`
- `GET` `/app/hook/deliveries/{delivery_id}`
- `POST` `/app/hook/deliveries/{delivery_id}/attempts`
- `GET` `/app/installation-requests`
- `DELETE` `/app/installations/{installation_id}`
- `GET` `/app/installations/{installation_id}`
- `DELETE` `/app/installations/{installation_id}/suspended`
- `PUT` `/app/installations/{installation_id}/suspended`
- `DELETE` `/applications/{client_id}/grant`
- `DELETE` `/applications/{client_id}/token`
- `PATCH` `/applications/{client_id}/token`
- `POST` `/applications/{client_id}/token`
- `POST` `/applications/{client_id}/token/scoped`
- `GET` `/apps/{app_slug}`
- `GET` `/codes_of_conduct`
- `GET` `/codes_of_conduct/{key}`
- `POST` `/credentials/revoke`
- `GET` `/emojis`
- `GET` `/enterprises/{enterprise}/code-security/configurations`
- `POST` `/enterprises/{enterprise}/code-security/configurations`
- `GET` `/enterprises/{enterprise}/code-security/configurations/defaults`
- `DELETE` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}`
- `GET` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}`
- `PATCH` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}`
- `POST` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}/attach`
- `PUT` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}/defaults`
- `GET` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}/repositories`
- `GET` `/enterprises/{enterprise}/dependabot/alerts`
- `GET` `/enterprises/{enterprise}/teams`
- `POST` `/enterprises/{enterprise}/teams`
- `GET` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships`
- `POST` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships/add`
- `POST` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships/remove`
- `DELETE` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships/{username}`
- `GET` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships/{username}`
- `PUT` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships/{username}`
- `GET` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations`
- `POST` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations/add`
- `POST` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations/remove`
- `DELETE` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations/{org}`
- `GET` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations/{org}`
- `PUT` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations/{org}`
- `DELETE` `/enterprises/{enterprise}/teams/{team_slug}`
- `GET` `/enterprises/{enterprise}/teams/{team_slug}`
- `PATCH` `/enterprises/{enterprise}/teams/{team_slug}`
… and 921 more


</details>

**Missing** (7)

- No X-Hub-Signature (SHA-1) or X-GitHub-Delivery UUID webhook headers
- No users, orgs, teams, or search endpoints
- No git data, contents, branches, or releases endpoints
- No PR review comments, files, or requested_reviewers endpoints
- No actions workflows, jobs, artifacts, or logs endpoints
- No webhook list/patch/delete or deliveries endpoints
- No GraphQL nodes or mutations beyond viewer, repository, issues, pulls

**Deviations** (4)

- POST /graphql served without the REST Bearer/PAT check (transport lacks auth hook)
- App JWT RS256 signature not verified; the credential store is the check
- Webhook body is a stunt {type, payload} envelope, not GitHub's bare event body
- Runs advance on fixed clock (queued+1s, in_progress+3s); dispatch takes simulate_fail

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/app` — auth, stateful, clock
- `GET` `/app/installations` — query, auth, stateful, paginate, clock
- `POST` `/app/installations/{installation_id}/access_tokens` — params, auth, stateful, clock
- `GET` `/installation` — auth, stateful, clock
- `GET` `/repos/{owner}/{repo}` — params, auth, stateful, errors, clock
- `GET` `/repos/{owner}/{repo}/issues` — query, params, auth, stateful, paginate, filter, clock
- `POST` `/repos/{owner}/{repo}/issues` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/issues/{issue_number}` — params, auth, stateful, errors, clock
- `PATCH` `/repos/{owner}/{repo}/issues/{issue_number}` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/issues/{issue_number}/comments` — query, params, auth, stateful, paginate, filter, errors, clock
- `POST` `/repos/{owner}/{repo}/issues/{issue_number}/comments` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/repos/{owner}/{repo}/issues/{issue_number}/labels/{name}` — params, auth, stateful, webhooks, errors, clock
- `DELETE` `/repos/{owner}/{repo}/issues/{issue_number}/labels/{name}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/issues/{issue_number}/events` — query, params, auth, stateful, paginate, filter, errors, clock
- `GET` `/repos/{owner}/{repo}/pulls` — query, params, auth, stateful, paginate, filter, clock
- `POST` `/repos/{owner}/{repo}/pulls` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/pulls/{pull_number}` — params, auth, stateful, errors, clock
- `PATCH` `/repos/{owner}/{repo}/pulls/{pull_number}` — body, params, auth, stateful, webhooks, errors, clock
- `PUT` `/repos/{owner}/{repo}/pulls/{pull_number}/merge` — params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/pulls/{pull_number}/reviews` — query, params, auth, stateful, paginate, filter, errors, clock
- `POST` `/repos/{owner}/{repo}/pulls/{pull_number}/reviews` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/repos/{owner}/{repo}/dispatches` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/actions/runs` — query, params, auth, stateful, paginate, filter, webhooks, clock
- `GET` `/repos/{owner}/{repo}/actions/runs/{run_id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/repos/{owner}/{repo}/hooks` — body, params, auth, stateful, errors, clock
- `POST` `/webhooks/receive` — stateful

</details>

### gmail-style

**Covered** — 16 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/gmail/v1/users/{userId}/labels` |
| POST | `/gmail/v1/users/{userId}/labels` |
| DELETE | `/gmail/v1/users/{userId}/labels/{id}` |
| POST | `/gmail/v1/users/{userId}/messages/send` |
| GET | `/gmail/v1/users/{userId}/messages` |
| POST | `/gmail/v1/users/{userId}/messages` |
| POST | `/gmail/v1/users/{userId}/messages/batchModify` |
| POST | `/gmail/v1/users/{userId}/messages/{messageId}/trash` |
| POST | `/gmail/v1/users/{userId}/messages/{messageId}/modify` |
| GET | `/gmail/v1/users/{userId}/messages/{messageId}/attachments/{attachmentId}` |
| GET | `/gmail/v1/users/{userId}/messages/{messageId}` |
| DELETE | `/gmail/v1/users/{userId}/messages/{messageId}` |
| GET | `/gmail/v1/users/{userId}/drafts` |
| POST | `/gmail/v1/users/{userId}/drafts` |
| DELETE | `/gmail/v1/users/{userId}/drafts/{id}` |
| GET | `/gmail/v1/users/{userId}/threads/{threadId}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 79 real routes · 16 covered · 20% · 63 not implemented

<details><summary>not implemented (63)</summary>

- `POST` `/gmail/v1/users/{userId}/drafts/send`
- `GET` `/gmail/v1/users/{userId}/drafts/{id}`
- `PUT` `/gmail/v1/users/{userId}/drafts/{id}`
- `GET` `/gmail/v1/users/{userId}/history`
- `GET` `/gmail/v1/users/{userId}/labels/{id}`
- `PATCH` `/gmail/v1/users/{userId}/labels/{id}`
- `PUT` `/gmail/v1/users/{userId}/labels/{id}`
- `POST` `/gmail/v1/users/{userId}/messages/batchDelete`
- `POST` `/gmail/v1/users/{userId}/messages/import`
- `POST` `/gmail/v1/users/{userId}/messages/{id}/untrash`
- `GET` `/gmail/v1/users/{userId}/profile`
- `GET` `/gmail/v1/users/{userId}/settings/autoForwarding`
- `PUT` `/gmail/v1/users/{userId}/settings/autoForwarding`
- `GET` `/gmail/v1/users/{userId}/settings/cse/identities`
- `POST` `/gmail/v1/users/{userId}/settings/cse/identities`
- `DELETE` `/gmail/v1/users/{userId}/settings/cse/identities/{cseEmailAddress}`
- `GET` `/gmail/v1/users/{userId}/settings/cse/identities/{cseEmailAddress}`
- `PATCH` `/gmail/v1/users/{userId}/settings/cse/identities/{emailAddress}`
- `GET` `/gmail/v1/users/{userId}/settings/cse/keypairs`
- `POST` `/gmail/v1/users/{userId}/settings/cse/keypairs`
- `GET` `/gmail/v1/users/{userId}/settings/cse/keypairs/{keyPairId}`
- `POST` `/gmail/v1/users/{userId}/settings/cse/keypairs/{keyPairId}:disable`
- `POST` `/gmail/v1/users/{userId}/settings/cse/keypairs/{keyPairId}:enable`
- `POST` `/gmail/v1/users/{userId}/settings/cse/keypairs/{keyPairId}:obliterate`
- `GET` `/gmail/v1/users/{userId}/settings/delegates`
- `POST` `/gmail/v1/users/{userId}/settings/delegates`
- `DELETE` `/gmail/v1/users/{userId}/settings/delegates/{delegateEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/delegates/{delegateEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/filters`
- `POST` `/gmail/v1/users/{userId}/settings/filters`
- `DELETE` `/gmail/v1/users/{userId}/settings/filters/{id}`
- `GET` `/gmail/v1/users/{userId}/settings/filters/{id}`
- `GET` `/gmail/v1/users/{userId}/settings/forwardingAddresses`
- `POST` `/gmail/v1/users/{userId}/settings/forwardingAddresses`
- `DELETE` `/gmail/v1/users/{userId}/settings/forwardingAddresses/{forwardingEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/forwardingAddresses/{forwardingEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/imap`
- `PUT` `/gmail/v1/users/{userId}/settings/imap`
- `GET` `/gmail/v1/users/{userId}/settings/language`
- `PUT` `/gmail/v1/users/{userId}/settings/language`
- `GET` `/gmail/v1/users/{userId}/settings/pop`
- `PUT` `/gmail/v1/users/{userId}/settings/pop`
- `GET` `/gmail/v1/users/{userId}/settings/sendAs`
- `POST` `/gmail/v1/users/{userId}/settings/sendAs`
- `DELETE` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}`
- `PATCH` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}`
- `PUT` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}/smimeInfo`
- `POST` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}/smimeInfo`
… and 13 more


</details>

**Missing** (6)

- No Gmail search operators (from:, to:, after:, has:attachment) in q
- No threads.list, history.list, or watch/stop push endpoints
- No drafts send/update/get or threads modify/trash endpoints
- No messages.import, untrash, or batchDelete endpoints
- No labels get/patch or users.getProfile endpoints
- No settings surface: filters, sendAs, forwardingAddresses, vacation

**Deviations** (3)

- q is substring match on snippet + Subject header only
- Omitted/0 maxResults returns everything; real API defaults to 100
- Label create is idempotent on existing name; real Gmail returns 409

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/gmail/v1/users/{userId}/labels` — auth, stateful
- `POST` `/gmail/v1/users/{userId}/labels` — body, auth, stateful
- `DELETE` `/gmail/v1/users/{userId}/labels/{id}` — params, auth, stateful
- `POST` `/gmail/v1/users/{userId}/messages/send` — body, auth, stateful
- `GET` `/gmail/v1/users/{userId}/messages` — query, params, auth, stateful, paginate
- `POST` `/gmail/v1/users/{userId}/messages` — body, auth, stateful
- `POST` `/gmail/v1/users/{userId}/messages/batchModify` — body, auth, stateful
- `POST` `/gmail/v1/users/{userId}/messages/{messageId}/trash` — params, auth, stateful
- `POST` `/gmail/v1/users/{userId}/messages/{messageId}/modify` — body, params, auth, stateful
- `GET` `/gmail/v1/users/{userId}/messages/{messageId}/attachments/{attachmentId}` — params, auth, stateful
- `GET` `/gmail/v1/users/{userId}/messages/{messageId}` — query, params, auth, stateful
- `DELETE` `/gmail/v1/users/{userId}/messages/{messageId}` — params, auth, stateful
- `GET` `/gmail/v1/users/{userId}/drafts` — query, auth, stateful, paginate
- `POST` `/gmail/v1/users/{userId}/drafts` — body, auth, stateful
- `DELETE` `/gmail/v1/users/{userId}/drafts/{id}` — params, auth, stateful
- `GET` `/gmail/v1/users/{userId}/threads/{threadId}` — params, auth, stateful

</details>

### google-admin-style

**Covered** — 13 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/admin/directory/v1/users` |
| POST | `/admin/directory/v1/users` |
| GET | `/admin/directory/v1/users/{userKey}` |
| PUT | `/admin/directory/v1/users/{userKey}` |
| DELETE | `/admin/directory/v1/users/{userKey}` |
| GET | `/admin/directory/v1/users/{userKey}/tokens` |
| GET | `/admin/directory/v1/groups` |
| POST | `/admin/directory/v1/groups` |
| GET | `/admin/directory/v1/groups/{groupKey}` |
| DELETE | `/admin/directory/v1/groups/{groupKey}` |
| GET | `/admin/directory/v1/groups/{groupKey}/members` |
| POST | `/admin/directory/v1/groups/{groupKey}/members` |
| DELETE | `/admin/directory/v1/groups/{groupKey}/members/{memberKey}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 128 real routes · 13 covered · 10% · 115 not implemented

<details><summary>not implemented (115)</summary>

- `GET` `/admin/directory/v1/customer/{customerId}/devices/chromeos`
- `POST` `/admin/directory/v1/customer/{customerId}/devices/chromeos/moveDevicesToOu`
- `GET` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}`
- `PATCH` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}`
- `PUT` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}`
- `GET` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}/commands/{commandId}`
- `POST` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}:issueCommand`
- `POST` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{resourceId}/action`
- `POST` `/admin/directory/v1/customer/{customerId}/devices/chromeos:batchChangeStatus`
- `GET` `/admin/directory/v1/customer/{customerId}/devices/chromeos:countChromeOsDevices`
- `GET` `/admin/directory/v1/customer/{customerId}/devices/mobile`
- `DELETE` `/admin/directory/v1/customer/{customerId}/devices/mobile/{resourceId}`
- `GET` `/admin/directory/v1/customer/{customerId}/devices/mobile/{resourceId}`
- `POST` `/admin/directory/v1/customer/{customerId}/devices/mobile/{resourceId}/action`
- `GET` `/admin/directory/v1/customer/{customerId}/orgunits`
- `POST` `/admin/directory/v1/customer/{customerId}/orgunits`
- `DELETE` `/admin/directory/v1/customer/{customerId}/orgunits/{orgunitsId}`
- `GET` `/admin/directory/v1/customer/{customerId}/orgunits/{orgunitsId}`
- `PATCH` `/admin/directory/v1/customer/{customerId}/orgunits/{orgunitsId}`
- `PUT` `/admin/directory/v1/customer/{customerId}/orgunits/{orgunitsId}`
- `GET` `/admin/directory/v1/customer/{customerId}/schemas`
- `POST` `/admin/directory/v1/customer/{customerId}/schemas`
- `DELETE` `/admin/directory/v1/customer/{customerId}/schemas/{schemaKey}`
- `GET` `/admin/directory/v1/customer/{customerId}/schemas/{schemaKey}`
- `PATCH` `/admin/directory/v1/customer/{customerId}/schemas/{schemaKey}`
- `PUT` `/admin/directory/v1/customer/{customerId}/schemas/{schemaKey}`
- `GET` `/admin/directory/v1/customer/{customer}/domainaliases`
- `POST` `/admin/directory/v1/customer/{customer}/domainaliases`
- `DELETE` `/admin/directory/v1/customer/{customer}/domainaliases/{domainAliasName}`
- `GET` `/admin/directory/v1/customer/{customer}/domainaliases/{domainAliasName}`
- `GET` `/admin/directory/v1/customer/{customer}/domains`
- `POST` `/admin/directory/v1/customer/{customer}/domains`
- `DELETE` `/admin/directory/v1/customer/{customer}/domains/{domainName}`
- `GET` `/admin/directory/v1/customer/{customer}/domains/{domainName}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/buildings`
- `POST` `/admin/directory/v1/customer/{customer}/resources/buildings`
- `DELETE` `/admin/directory/v1/customer/{customer}/resources/buildings/{buildingId}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/buildings/{buildingId}`
- `PATCH` `/admin/directory/v1/customer/{customer}/resources/buildings/{buildingId}`
- `PUT` `/admin/directory/v1/customer/{customer}/resources/buildings/{buildingId}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/calendars`
- `POST` `/admin/directory/v1/customer/{customer}/resources/calendars`
- `DELETE` `/admin/directory/v1/customer/{customer}/resources/calendars/{calendarResourceId}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/calendars/{calendarResourceId}`
- `PATCH` `/admin/directory/v1/customer/{customer}/resources/calendars/{calendarResourceId}`
- `PUT` `/admin/directory/v1/customer/{customer}/resources/calendars/{calendarResourceId}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/features`
- `POST` `/admin/directory/v1/customer/{customer}/resources/features`
- `DELETE` `/admin/directory/v1/customer/{customer}/resources/features/{featureKey}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/features/{featureKey}`
… and 65 more


</details>

**Missing** (4)

- No orgunits, roles, roleAssignments, or schemas resources
- No asps, verificationCodes, mobileDevices, or chromeosDevices
- No user/group aliases, user photos, domains, or customers endpoints
- No users.patch/groups.patch, members.get, or members.update endpoints

**Deviations** (4)

- Users query supports bare terms plus email:/name:/orgUnitPath=/isSuspended= only
- Groups query silently ignores unrecognized query forms
- Static convenience tokens (ya29.mock-admin-token, conformance-token) seeded far-future
- users.list ignores customer/domain exactly-one-of enforcement; real Directory requires one

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/admin/directory/v1/users` — query, auth, stateful, paginate, filter, errors, clock
- `POST` `/admin/directory/v1/users` — body, auth, stateful, errors, clock
- `GET` `/admin/directory/v1/users/{userKey}` — params, auth, stateful, errors, clock
- `PUT` `/admin/directory/v1/users/{userKey}` — body, params, auth, stateful, errors, clock
- `DELETE` `/admin/directory/v1/users/{userKey}` — params, auth, stateful, errors, clock
- `GET` `/admin/directory/v1/users/{userKey}/tokens` — query, params, auth, stateful, paginate, errors, clock
- `GET` `/admin/directory/v1/groups` — query, auth, stateful, paginate, filter, errors, clock
- `POST` `/admin/directory/v1/groups` — body, auth, stateful, errors, clock
- `GET` `/admin/directory/v1/groups/{groupKey}` — params, auth, stateful, errors, clock
- `DELETE` `/admin/directory/v1/groups/{groupKey}` — params, auth, stateful, errors, clock
- `GET` `/admin/directory/v1/groups/{groupKey}/members` — query, params, auth, stateful, paginate, filter, errors, clock
- `POST` `/admin/directory/v1/groups/{groupKey}/members` — body, params, auth, stateful, errors, clock
- `DELETE` `/admin/directory/v1/groups/{groupKey}/members/{memberKey}` — params, auth, stateful, errors, clock

</details>

### google-cloudtasks-style

**Covered** — 16 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v2/projects/{project}/locations` |
| GET | `/v2/projects/{project}/locations/{location}` |
| GET | `/v2/projects/{project}/locations/{location}/cmekConfig` |
| PATCH | `/v2/projects/{project}/locations/{location}/cmekConfig` |
| POST | `/v2/projects/{project}/locations/{location}/queues` |
| GET | `/v2/projects/{project}/locations/{location}/queues` |
| GET | `/v2/projects/{project}/locations/{location}/queues/{queue}` |
| PATCH | `/v2/projects/{project}/locations/{location}/queues/{queue}` |
| DELETE | `/v2/projects/{project}/locations/{location}/queues/{queue}` |
| POST | `/v2/projects/{project}/locations/{location}/queues/{queue_verb}` |
| POST | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks` |
| GET | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks` |
| POST | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks:buffer` |
| POST | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task_verb}` |
| GET | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task}` |
| DELETE | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task}` |

</details>

**Missing** (7)

- No background dispatch loop — tasks are never auto-delivered at scheduleTime; only tasks.run drives attempts
- No gRPC transport (REST only); google-cloud-* client libraries default to gRPC
- oauthToken/oidcToken are stored verbatim — no token minting at dispatch time
- stackdriverLoggingConfig is stored but no logs are written
- IAM policies are stored but not enforced — testIamPermissions always grants
- No App Engine queue.yaml/xml semantics (DISABLED state, queue-file overrides)
- CMEK config is metadata-only; nothing is encrypted

**Deviations** (7)

- Any OAuth2 bearer token is accepted; real Google validates tokens and IAM permissions
- tasks.run models the worker instead of calling it — success completes and deletes the task; the failing-worker profile simulates a 500 with retryConfig backoff
- queues.list filter supports only name/state with =, !=, and : containment (subset of the real filter grammar)
- tasks.list returns creation order; the real service defines no order
- Generated task IDs are counter-based 19-digit decimals, not random
- Purge is synchronous; real purge can take up to 60s to complete
- Deleted-task tombstones hold names exactly 24h (real retention is up to 24h, 9 days for queue.yaml queues)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v2/projects/{project}/locations` — query, params, paginate
- `GET` `/v2/projects/{project}/locations/{location}` — params
- `GET` `/v2/projects/{project}/locations/{location}/cmekConfig` — params, stateful
- `PATCH` `/v2/projects/{project}/locations/{location}/cmekConfig` — body, params, stateful
- `POST` `/v2/projects/{project}/locations/{location}/queues` — body, query, params, stateful
- `GET` `/v2/projects/{project}/locations/{location}/queues` — query, params, stateful, paginate
- `GET` `/v2/projects/{project}/locations/{location}/queues/{queue}` — params, stateful
- `PATCH` `/v2/projects/{project}/locations/{location}/queues/{queue}` — body, query, params, stateful
- `DELETE` `/v2/projects/{project}/locations/{location}/queues/{queue}` — params, stateful
- `POST` `/v2/projects/{project}/locations/{location}/queues/{queue_verb}` — body, params, stateful, clock
- `POST` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks` — body, query, params, stateful, clock
- `GET` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks` — query, params, stateful, paginate
- `POST` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks:buffer` — body, params, stateful, clock
- `POST` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task_verb}` — body, query, params, stateful, clock
- `GET` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task}` — query, params, stateful
- `DELETE` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task}` — params, stateful, clock

</details>

### google-iam-style

**Covered** — 10 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/oauth2/v4/token` |
| GET | `/oauth2/v3/certs` |
| GET | `/v1/projects/{project}/serviceAccounts` |
| POST | `/v1/projects/{project}/serviceAccounts` |
| GET | `/v1/projects/{project}/serviceAccounts/{sa}` |
| DELETE | `/v1/projects/{project}/serviceAccounts/{sa}` |
| GET | `/v1/projects/{project}/serviceAccounts/{sa}/keys` |
| POST | `/v1/projects/{project}/serviceAccounts/{sa_verb}` |
| POST | `/v1/roles:queryGrantableRoles` |
| POST | `/v1/projects/{project}/roles:queryGrantableRoles` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 136 real routes · 14 covered · 10% · 122 not implemented

<details><summary>not implemented (122)</summary>

- `POST` `/v1/iamPolicies:lintPolicy`
- `POST` `/v1/iamPolicies:queryAuditableServices`
- `GET` `/v1/locations/{locationsId}/workforcePools`
- `POST` `/v1/locations/{locationsId}/workforcePools`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}`
- `PATCH` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/operations/{operationsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}`
- `PATCH` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys/{keysId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys/{keysId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys/{keysId}/operations/{operationsId}`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys/{keysId}:undelete`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/operations/{operationsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}`
- `PATCH` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}/tokens`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}/tokens`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}/tokens/{tokensId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}/tokens/{tokensId}`
- `PATCH` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}/tokens/{tokensId}`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}:getIamPolicy`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}:setIamPolicy`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}:testIamPermissions`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}:undelete`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}:undelete`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/subjects/{subjectsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/subjects/{subjectsId}/operations/{operationsId}`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/subjects/{subjectsId}:undelete`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}:getIamPolicy`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}:setIamPolicy`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}:testIamPermissions`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}:undelete`
- `GET` `/v1/organizations/{organizationsId}/roles`
- `POST` `/v1/organizations/{organizationsId}/roles`
- `DELETE` `/v1/organizations/{organizationsId}/roles/{rolesId}`
- `GET` `/v1/organizations/{organizationsId}/roles/{rolesId}`
- `PATCH` `/v1/organizations/{organizationsId}/roles/{rolesId}`
- `POST` `/v1/organizations/{organizationsId}/roles/{rolesId}:undelete`
- `POST` `/v1/permissions:queryTestablePermissions`
- `GET` `/v1/projects/{projectsId}/locations/{locationsId}/oauthClients`
… and 72 more


</details>

**Missing** (4)

- No serviceAccountKeys create/delete, signJwt, or signBlob methods
- No serviceAccount patch, disable/enable, undelete, or getIamPolicy
- No generateIdToken method
- No roles list, get, create, or custom-role CRUD endpoints

**Deviations** (2)

- JWKS serves one fixed synthetic RSA-2048 key (kid mock-google-key-1)
- roles:queryGrantableRoles also served project-scoped (extra form; the real path is project-less)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/oauth2/v4/token` — body, stateful, errors, clock
- `GET` `/oauth2/v3/certs` — —
- `GET` `/v1/projects/{project}/serviceAccounts` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/v1/projects/{project}/serviceAccounts` — body, params, auth, stateful, errors, clock
- `GET` `/v1/projects/{project}/serviceAccounts/{sa}` — params, auth, stateful, errors, clock
- `DELETE` `/v1/projects/{project}/serviceAccounts/{sa}` — params, auth, stateful, errors, clock
- `GET` `/v1/projects/{project}/serviceAccounts/{sa}/keys` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/v1/projects/{project}/serviceAccounts/{sa_verb}` — body, params, auth, stateful, errors, clock
- `POST` `/v1/roles:queryGrantableRoles` — body, auth, stateful, errors, clock
- `POST` `/v1/projects/{project}/roles:queryGrantableRoles` — body, auth, stateful, errors, clock

</details>

### google-style

**Covered** — 4 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/o/oauth2/auth` |
| POST | `/o/oauth2/token` |
| GET | `/oauth2/v3/certs` |
| GET | `/oauth2/v3/userinfo` |

</details>

**Missing** (2)

- No revoke or tokeninfo endpoints
- No device-code grant (/device.code) or OIDC discovery document

**Deviations** (2)

- Authorize auto-approves with an instant 302; no consent screen
- id_tokens signed by a fixed synthetic RSA key (kid mock-google-key-1)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/o/oauth2/auth` — query, stateful, errors
- `POST` `/o/oauth2/token` — body, stateful, errors, clock
- `GET` `/oauth2/v3/certs` — —
- `GET` `/oauth2/v3/userinfo` — auth, stateful, clock

</details>

### gsearchconsole-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/webmasters/v3/sites` |
| GET | `/webmasters/v3/sites/{siteUrl}` |
| PUT | `/webmasters/v3/sites/{siteUrl}` |
| DELETE | `/webmasters/v3/sites/{siteUrl}` |
| POST | `/webmasters/v3/sites/{siteUrl}/searchAnalytics/query` |
| GET | `/webmasters/v3/sites/{siteUrl}/sitemaps` |
| GET | `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` |
| PUT | `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` |
| DELETE | `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` |
| POST | `/v1/urlInspection/index:inspect` |
| POST | `/webmasters/v3/sites/{siteUrl}/inspect` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 11 real routes · 10 covered · 90% · 1 not implemented

<details><summary>not implemented (1)</summary>

- `POST` `/v1/urlTestingTools/mobileFriendlyTest:run`

</details>

**Missing** (2)

- 16-month window not modeled; ranges derive at most 90 days / ~1800 cells
- No country dimension in search analytics

**Deviations** (4)

- Regex filters (includingRegex/excludingRegex) degrade to equals/notEquals
- Site verification completes ~2s after sites.add via derive-on-read clock
- Inspection verdicts keyed to magic path tokens (noindex, soft404, servererror)
- URL-prefix sites/sitemaps addressed by single-segment paths (decoded routing)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/webmasters/v3/sites` — query, auth, stateful, paginate, clock
- `GET` `/webmasters/v3/sites/{siteUrl}` — params, auth, stateful, clock
- `PUT` `/webmasters/v3/sites/{siteUrl}` — params, auth, stateful, clock
- `DELETE` `/webmasters/v3/sites/{siteUrl}` — params, auth, stateful, clock
- `POST` `/webmasters/v3/sites/{siteUrl}/searchAnalytics/query` — body, params, auth, stateful, filter, clock
- `GET` `/webmasters/v3/sites/{siteUrl}/sitemaps` — query, params, auth, stateful, paginate, clock
- `GET` `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` — params, auth, stateful, clock
- `PUT` `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` — params, auth, stateful, clock
- `DELETE` `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` — params, auth, stateful, clock
- `POST` `/v1/urlInspection/index:inspect` — body, auth, stateful, clock
- `POST` `/webmasters/v3/sites/{siteUrl}/inspect` — body, params, auth, stateful, clock

</details>

### gsheets-style

**Covered** — 10 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v4/spreadsheets` |
| GET | `/v4/spreadsheets/{spreadsheetId}/values:batchGet` |
| POST | `/v4/spreadsheets/{spreadsheetId}/values:batchGet` |
| POST | `/v4/spreadsheets/{spreadsheetId}/values:batchUpdate` |
| POST | `/v4/spreadsheets/{spreadsheetId}/sheets` |
| POST | `/v4/spreadsheets/{ss_id_or_verb}` |
| GET | `/v4/spreadsheets/{spreadsheetId}` |
| GET | `/v4/spreadsheets/{spreadsheetId}/values/{range}` |
| PUT | `/v4/spreadsheets/{spreadsheetId}/values/{range}` |
| POST | `/v4/spreadsheets/{spreadsheetId}/values/{range_verb}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 17 real routes · 10 covered · 58% · 7 not implemented

<details><summary>not implemented (7)</summary>

- `GET` `/v4/spreadsheets/{spreadsheetId}/developerMetadata/{metadataId}`
- `POST` `/v4/spreadsheets/{spreadsheetId}/developerMetadata:search`
- `POST` `/v4/spreadsheets/{spreadsheetId}/sheets/{sheetId}:copyTo`
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchClear`
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchClearByDataFilter`
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchGetByDataFilter`
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchUpdateByDataFilter`

</details>

**Missing** (4)

- No row-only A1 ranges (1:5) or quoted sheet titles
- No copyTo, named ranges, developer metadata, or byDataFilter endpoints
- batchUpdate limited to 4 request types; no insertDimension, mergeCells, sortRange
- No valueRenderOption or dateTimeRenderOption on values reads

**Deviations** (3)

- Repeated ranges query params collapse to the first value (engine query params are single-valued)
- Cell values always come back as strings; numeric cells stringify as floats (42 -> "42.0"), no USER_ENTERED/RAW typing
- Spreadsheet get ignores fields= and returns the full object

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v4/spreadsheets` — body, auth, stateful
- `GET` `/v4/spreadsheets/{spreadsheetId}/values:batchGet` — body, query, params, auth, stateful
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchGet` — body, query, params, auth, stateful
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchUpdate` — body, params, auth, stateful
- `POST` `/v4/spreadsheets/{spreadsheetId}/sheets` — body, params, auth, stateful
- `POST` `/v4/spreadsheets/{ss_id_or_verb}` — body, params, auth, stateful
- `GET` `/v4/spreadsheets/{spreadsheetId}` — query, params, auth, stateful
- `GET` `/v4/spreadsheets/{spreadsheetId}/values/{range}` — query, params, auth, stateful
- `PUT` `/v4/spreadsheets/{spreadsheetId}/values/{range}` — body, params, auth, stateful
- `POST` `/v4/spreadsheets/{spreadsheetId}/values/{range_verb}` — body, params, auth, stateful

</details>

### gtasks-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/tasks/v1/users/@me/lists` |
| POST | `/tasks/v1/users/@me/lists` |
| GET | `/tasks/v1/lists` |
| POST | `/tasks/v1/lists` |
| POST | `/tasks/v1/lists/{tasklistId}/tasks/{taskId}/move` |
| GET | `/tasks/v1/lists/{tasklistId}/tasks` |
| POST | `/tasks/v1/lists/{tasklistId}/tasks` |
| GET | `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` |
| PUT | `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` |
| PATCH | `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` |
| DELETE | `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 14 real routes · 9 covered · 64% · 5 not implemented

<details><summary>not implemented (5)</summary>

- `POST` `/tasks/v1/lists/{tasklist}/clear`
- `DELETE` `/tasks/v1/users/@me/lists/{tasklist}`
- `GET` `/tasks/v1/users/@me/lists/{tasklist}`
- `PATCH` `/tasks/v1/users/@me/lists/{tasklist}`
- `PUT` `/tasks/v1/users/@me/lists/{tasklist}`

</details>

**Missing** (3)

- No task-list get, patch, or delete endpoints
- No tasks.clear endpoint
- showDeleted/showHidden/showAssigned list params unmodeled

**Deviations** (2)

- Responses omit the kind field (tasks#task, tasks#taskList); SDKs decode fine without it
- tasks.insert ignores a client-sent status/completed (always needsAction); due is stored verbatim

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/tasks/v1/users/@me/lists` — query, auth, stateful, paginate, clock
- `POST` `/tasks/v1/users/@me/lists` — body, auth, stateful, clock
- `GET` `/tasks/v1/lists` — query, auth, stateful, paginate, clock
- `POST` `/tasks/v1/lists` — body, auth, stateful, clock
- `POST` `/tasks/v1/lists/{tasklistId}/tasks/{taskId}/move` — body, query, params, auth, stateful, clock
- `GET` `/tasks/v1/lists/{tasklistId}/tasks` — query, params, auth, stateful, paginate, filter, clock
- `POST` `/tasks/v1/lists/{tasklistId}/tasks` — body, params, auth, stateful, clock
- `GET` `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` — params, auth, stateful, clock
- `PUT` `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` — body, params, auth, stateful, clock
- `PATCH` `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` — body, params, auth, stateful, clock
- `DELETE` `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` — params, auth, stateful

</details>

### helius-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/` |
| POST | `/v0/transactions` |
| GET | `/v0/addresses/{address}/transactions` |
| GET | `/v0/addresses/{address}/balances` |
| GET | `/v0/addresses/{address}/nfts` |
| POST | `/v0/names` |
| POST | `/v0/webhooks` |
| GET | `/v0/webhooks` |
| GET | `/v0/webhooks/{webhookId}` |
| PUT | `/v0/webhooks/{webhookId}` |
| DELETE | `/v0/webhooks/{webhookId}` |

</details>

**Missing** (3)

- RPC covers 6 methods; no getAccountInfo, getSlot, getSignaturesForAddress
- No DAS API (getAsset, searchAssets) or /v0/tokens metadata endpoints
- No getPriorityFeeEstimate, requestAirdrop, or WebSocket subscriptions

**Deviations** (6)

- Webhook payloads carry one transaction each; real Helius batches an array
- Confirmation milestones fixed by clock: processed 1-2s, confirmed 2-3s, final 3s+
- sendTransaction config takes simulate_fail/simulate_type/simulate_address
- Enhanced transactions limit capped at 100 (real API max 1000)
- A crossed before/until cursor pair silently ignores the until signature
- The confirmation webhook fires only when a read lands inside the 2-3s confirmed window

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/` — body, query, auth, stateful, webhooks, clock
- `POST` `/v0/transactions` — body, query, auth, errors, clock
- `GET` `/v0/addresses/{address}/transactions` — query, params, auth, stateful, filter, webhooks, clock
- `GET` `/v0/addresses/{address}/balances` — query, params, auth
- `GET` `/v0/addresses/{address}/nfts` — query, params, auth
- `POST` `/v0/names` — body, query, auth
- `POST` `/v0/webhooks` — body, query, auth, stateful, clock
- `GET` `/v0/webhooks` — query, auth, stateful
- `GET` `/v0/webhooks/{webhookId}` — query, params, auth, stateful, errors
- `PUT` `/v0/webhooks/{webhookId}` — body, query, params, auth, stateful, errors
- `DELETE` `/v0/webhooks/{webhookId}` — query, params, auth, stateful, errors

</details>

### hn-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v0/topstories.json` |
| GET | `/v0/newstories.json` |
| GET | `/v0/beststories.json` |
| GET | `/v0/askstories.json` |
| GET | `/v0/showstories.json` |
| GET | `/v0/jobstories.json` |
| POST | `/login` |
| GET | `/logout` |
| POST | `/submit` |
| GET | `/v0/item/{id}` |
| GET | `/v0/user/{id}` |

</details>

**Missing** (3)

- No GET /v0/maxitem.json or GET /v0/updates.json endpoints
- No poll or pollopt item types; no deleted or dead item flags
- No realtime updates (Firebase SSE watch) on item or list reads

**Deviations** (4)

- Write flow /login + /submit from a reference client; official Firebase API is read-only
- Challenge injection after N submits (anti-abuse) mirrors mock_hn, configurable via KV
- Firebase REST query params (print=pretty, orderBy, limitToFirst) are accepted and ignored
- The .json suffix is optional on item reads; real Firebase requires it

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v0/topstories.json` — stateful
- `GET` `/v0/newstories.json` — stateful
- `GET` `/v0/beststories.json` — stateful
- `GET` `/v0/askstories.json` — stateful
- `GET` `/v0/showstories.json` — stateful
- `GET` `/v0/jobstories.json` — stateful
- `POST` `/login` — body, stateful, errors
- `GET` `/logout` — —
- `POST` `/submit` — body, auth, stateful
- `GET` `/v0/item/{id}` — params, stateful
- `GET` `/v0/user/{id}` — params, stateful

</details>

### hubspot-style

**Covered** — 33 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/crm/v3/objects/contacts` |
| POST | `/crm/v3/objects/contacts` |
| GET | `/crm/v3/objects/contacts/{id}` |
| PATCH | `/crm/v3/objects/contacts/{id}` |
| DELETE | `/crm/v3/objects/contacts/{id}` |
| POST | `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/batch/create` |
| POST | `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/batch/archive` |
| PUT | `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/{toObjectId}/{associationType}` |
| GET | `/crm/v3/objects/contacts/{id}/associations/{toObjectType}` |
| GET | `/crm/v3/objects/companies` |
| POST | `/crm/v3/objects/companies` |
| GET | `/crm/v3/objects/companies/{id}` |
| PATCH | `/crm/v3/objects/companies/{id}` |
| DELETE | `/crm/v3/objects/companies/{id}` |
| GET | `/crm/v3/objects/deals` |
| POST | `/crm/v3/objects/deals` |
| GET | `/crm/v3/objects/deals/{id}` |
| PATCH | `/crm/v3/objects/deals/{id}` |
| DELETE | `/crm/v3/objects/deals/{id}` |
| GET | `/crm/v3/objects/tickets` |
| POST | `/crm/v3/objects/tickets` |
| GET | `/crm/v3/objects/tickets/{id}` |
| PATCH | `/crm/v3/objects/tickets/{id}` |
| DELETE | `/crm/v3/objects/tickets/{id}` |
| POST | `/crm/v3/objects/{objectType}/search` |
| POST | `/crm/v3/objects/{objectType}/batch/create` |
| POST | `/crm/v3/objects/{objectType}/batch/read` |
| POST | `/crm/v3/objects/{objectType}/batch/update` |
| POST | `/crm/v3/objects/{objectType}/batch/archive` |
| POST | `/crm/v3/objects/{objectType}/{id}/restore` |
| POST | `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/batch/create` |
| POST | `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/batch/archive` |
| DELETE | `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/{toObjectId}/{associationType}` |

</details>

**Provider surface** — derived from sdk hubspot-node @ 14.0.1 (floor): 564 real routes · 25 covered · 4% · 526 not implemented

<details><summary>not implemented (526)</summary>

- `POST` `/automation/v4/actions/callbacks/complete`
- `POST` `/automation/v4/actions/callbacks/{callbackId}/complete`
- `GET` `/automation/v4/actions/{appId}`
- `POST` `/automation/v4/actions/{appId}`
- `GET` `/business-units/v3/business-units/user/{userId}`
- `GET` `/cms/audit-logs/v3`
- `GET` `/cms/pages/v3/landing-pages/cursor`
- `GET` `/cms/pages/v3/landing-pages/cursor/query`
- `GET` `/cms/pages/v3/landing-pages/folders/cursor`
- `GET` `/cms/pages/v3/landing-pages/folders/cursor/query`
- `GET` `/cms/pages/v3/site-pages/cursor`
- `GET` `/cms/pages/v3/site-pages/cursor/query`
- `GET` `/cms/site-search/v3/search`
- `GET` `/cms/url-redirects/v3`
- `POST` `/cms/url-redirects/v3`
- `GET` `/cms/v3/audit-logs/`
- `GET` `/cms/v3/blogs/authors`
- `POST` `/cms/v3/blogs/authors`
- `POST` `/cms/v3/blogs/authors/batch/archive`
- `POST` `/cms/v3/blogs/authors/batch/create`
- `POST` `/cms/v3/blogs/authors/batch/read`
- `POST` `/cms/v3/blogs/authors/batch/update`
- `POST` `/cms/v3/blogs/authors/multi-language/attach-to-lang-group`
- `POST` `/cms/v3/blogs/authors/multi-language/create-language-variation`
- `POST` `/cms/v3/blogs/authors/multi-language/detach-from-lang-group`
- `PUT` `/cms/v3/blogs/authors/multi-language/set-new-lang-primary`
- `POST` `/cms/v3/blogs/authors/multi-language/update-languages`
- `DELETE` `/cms/v3/blogs/authors/{objectId}`
- `GET` `/cms/v3/blogs/authors/{objectId}`
- `PATCH` `/cms/v3/blogs/authors/{objectId}`
- `GET` `/cms/v3/blogs/posts`
- `POST` `/cms/v3/blogs/posts`
- `POST` `/cms/v3/blogs/posts/batch/archive`
- `POST` `/cms/v3/blogs/posts/batch/create`
- `POST` `/cms/v3/blogs/posts/batch/read`
- `POST` `/cms/v3/blogs/posts/batch/update`
- `POST` `/cms/v3/blogs/posts/clone`
- `POST` `/cms/v3/blogs/posts/multi-language/attach-to-lang-group`
- `POST` `/cms/v3/blogs/posts/multi-language/create-language-variation`
- `POST` `/cms/v3/blogs/posts/multi-language/detach-from-lang-group`
- `PUT` `/cms/v3/blogs/posts/multi-language/set-new-lang-primary`
- `POST` `/cms/v3/blogs/posts/multi-language/update-languages`
- `POST` `/cms/v3/blogs/posts/schedule`
- `DELETE` `/cms/v3/blogs/posts/{objectId}`
- `GET` `/cms/v3/blogs/posts/{objectId}`
- `PATCH` `/cms/v3/blogs/posts/{objectId}`
- `GET` `/cms/v3/blogs/posts/{objectId}/draft`
- `PATCH` `/cms/v3/blogs/posts/{objectId}/draft`
- `POST` `/cms/v3/blogs/posts/{objectId}/draft/push-live`
- `POST` `/cms/v3/blogs/posts/{objectId}/draft/reset`
… and 476 more


</details>

**Missing** (4)

- No webhook subscriptions or signed deliveries (X-HubSpot-Signature-v3 documented only)
- No owners, line_items, products, quotes, or custom object types
- No engagements (calls, emails, meetings, notes, tasks) endpoints
- No properties, pipelines, or import/export endpoints

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/crm/v3/objects/contacts` — query, auth, stateful, filter, clock
- `POST` `/crm/v3/objects/contacts` — query, auth, stateful, clock
- `GET` `/crm/v3/objects/contacts/{id}` — query, params, auth, stateful, clock
- `PATCH` `/crm/v3/objects/contacts/{id}` — query, params, auth, stateful, clock
- `DELETE` `/crm/v3/objects/contacts/{id}` — query, params, auth, stateful, clock
- `POST` `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/batch/create` — query, params, auth, stateful, clock
- `POST` `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/batch/archive` — query, params, auth, stateful, clock
- `PUT` `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/{toObjectId}/{associationType}` — query, params, auth, stateful, clock
- `GET` `/crm/v3/objects/contacts/{id}/associations/{toObjectType}` — query, params, auth, stateful, clock
- `GET` `/crm/v3/objects/companies` — query, auth, stateful, filter, clock
- `POST` `/crm/v3/objects/companies` — query, auth, stateful, clock
- `GET` `/crm/v3/objects/companies/{id}` — query, params, auth, stateful, clock
- `PATCH` `/crm/v3/objects/companies/{id}` — query, params, auth, stateful, clock
- `DELETE` `/crm/v3/objects/companies/{id}` — query, params, auth, stateful, clock
- `GET` `/crm/v3/objects/deals` — query, auth, stateful, filter, clock
- `POST` `/crm/v3/objects/deals` — query, auth, stateful, clock
- `GET` `/crm/v3/objects/deals/{id}` — query, params, auth, stateful, clock
- `PATCH` `/crm/v3/objects/deals/{id}` — query, params, auth, stateful, clock
- `DELETE` `/crm/v3/objects/deals/{id}` — query, params, auth, stateful, clock
- `GET` `/crm/v3/objects/tickets` — query, auth, stateful, filter, clock
- `POST` `/crm/v3/objects/tickets` — query, auth, stateful, clock
- `GET` `/crm/v3/objects/tickets/{id}` — query, params, auth, stateful, clock
- `PATCH` `/crm/v3/objects/tickets/{id}` — query, params, auth, stateful, clock
- `DELETE` `/crm/v3/objects/tickets/{id}` — query, params, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/search` — query, auth, stateful, filter, clock
- `POST` `/crm/v3/objects/{objectType}/batch/create` — query, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/batch/read` — query, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/batch/update` — query, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/batch/archive` — query, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/{id}/restore` — query, params, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/batch/create` — query, params, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/batch/archive` — query, params, auth, stateful, clock
- `DELETE` `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/{toObjectId}/{associationType}` — query, params, auth, stateful, clock

</details>

### instagram-style

**Covered** — 10 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth/authorize` |
| POST | `/oauth/access_token` |
| GET | `/v21.0/me` |
| GET | `/v21.0/refresh_access_token` |
| GET | `/v21.0/{container_id}` |
| GET | `/v21.0/{media_id}/comments` |
| GET | `/v21.0/{media_id}/insights` |
| POST | `/v21.0/{ig_user_id}/media_publish` |
| POST | `/v21.0/{ig_user_id}/media` |
| GET | `/v21.0/{ig_user_id}/media` |

</details>

**Missing** (4)

- No account-level insights (GET /{ig_user_id}/insights), per-media only
- No stories publishing (media_type=STORIES) or story insights
- No hashtag search (ig_hashtag_search, top_media, recent_media)
- No comment replies, delete, hide, or moderation endpoints

**Deviations** (5)

- Container processing fixed at ~3s IN_PROGRESS before FINISHED or ERROR
- simulate_fail=true create flag forces container ERROR; real API has no such switch
- Cursors are forward-only plain offsets; no before cursor or paging.previous
- An unknown insights metric returns 200 with empty data; real Graph answers error code 100
- media_publish does not check container ownership across users

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth/authorize` — query, stateful, errors
- `POST` `/oauth/access_token` — body, stateful, errors, clock
- `GET` `/v21.0/me` — auth, stateful, clock
- `GET` `/v21.0/refresh_access_token` — query, stateful, errors, clock
- `GET` `/v21.0/{container_id}` — query, params, auth, stateful, errors, clock
- `GET` `/v21.0/{media_id}/comments` — query, params, auth, stateful, errors, clock
- `GET` `/v21.0/{media_id}/insights` — query, params, auth, stateful, filter, errors, clock
- `POST` `/v21.0/{ig_user_id}/media_publish` — query, params, auth, stateful, errors, clock
- `POST` `/v21.0/{ig_user_id}/media` — body, params, auth, stateful, errors, clock
- `GET` `/v21.0/{ig_user_id}/media` — query, params, auth, stateful, paginate, filter, errors, clock

</details>

### jira-style

**Covered** — 32 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/rest/api/3/myself` |
| GET | `/rest/api/3/serverInfo` |
| GET | `/rest/api/3/project` |
| GET | `/rest/api/3/project/search` |
| GET | `/rest/api/3/project/{key}` |
| POST | `/rest/api/3/search/jql` |
| GET | `/rest/api/3/search` |
| POST | `/rest/api/3/issue` |
| GET | `/rest/api/3/issue/{key}` |
| PUT | `/rest/api/3/issue/{key}` |
| DELETE | `/rest/api/3/issue/{key}` |
| GET | `/rest/api/3/issue/{key}/transitions` |
| POST | `/rest/api/3/issue/{key}/transitions` |
| POST | `/rest/api/2/issue` |
| GET | `/rest/api/2/issue/{key}` |
| PUT | `/rest/api/2/issue/{key}` |
| DELETE | `/rest/api/2/issue/{key}` |
| GET | `/rest/api/2/issue/{key}/transitions` |
| POST | `/rest/api/2/issue/{key}/transitions` |
| GET | `/rest/api/2/issue/{key}/comment` |
| GET | `/rest/api/2/issue/{key}/comment/{id}` |
| POST | `/rest/api/2/issue/{key}/comment` |
| PUT | `/rest/api/2/issue/{key}/comment/{id}` |
| DELETE | `/rest/api/2/issue/{key}/comment/{id}` |
| GET | `/rest/api/3/issue/{key}/comment` |
| GET | `/rest/api/3/issue/{key}/comment/{id}` |
| POST | `/rest/api/3/issue/{key}/comment` |
| PUT | `/rest/api/3/issue/{key}/comment/{id}` |
| DELETE | `/rest/api/3/issue/{key}/comment/{id}` |
| POST | `/rest/api/3/webhook` |
| GET | `/rest/api/3/webhook` |
| DELETE | `/rest/api/3/webhook` |

</details>

**Provider surface** — derived from sdk jira-js @ 6.1.0 (floor): 634 real routes · 22 covered · 3% · 611 not implemented

<details><summary>not implemented (611)</summary>

- `POST` `/rest/agile/1.0/backlog/issue`
- `POST` `/rest/agile/1.0/backlog/{boardId}/issue`
- `GET` `/rest/agile/1.0/board`
- `POST` `/rest/agile/1.0/board`
- `GET` `/rest/agile/1.0/board/filter/{filterId}`
- `DELETE` `/rest/agile/1.0/board/{boardId}`
- `GET` `/rest/agile/1.0/board/{boardId}`
- `GET` `/rest/agile/1.0/board/{boardId}/configuration`
- `GET` `/rest/agile/1.0/board/{boardId}/epic`
- `GET` `/rest/agile/1.0/board/{boardId}/features`
- `PUT` `/rest/agile/1.0/board/{boardId}/features`
- `POST` `/rest/agile/1.0/board/{boardId}/issue`
- `GET` `/rest/agile/1.0/board/{boardId}/project`
- `GET` `/rest/agile/1.0/board/{boardId}/project/full`
- `GET` `/rest/agile/1.0/board/{boardId}/properties`
- `DELETE` `/rest/agile/1.0/board/{boardId}/properties/{propertyKey}`
- `GET` `/rest/agile/1.0/board/{boardId}/properties/{propertyKey}`
- `PUT` `/rest/agile/1.0/board/{boardId}/properties/{propertyKey}`
- `GET` `/rest/agile/1.0/board/{boardId}/quickfilter`
- `GET` `/rest/agile/1.0/board/{boardId}/quickfilter/{quickFilterId}`
- `GET` `/rest/agile/1.0/board/{boardId}/reports`
- `GET` `/rest/agile/1.0/board/{boardId}/sprint`
- `GET` `/rest/agile/1.0/board/{boardId}/version`
- `POST` `/rest/agile/1.0/epic/none/issue`
- `GET` `/rest/agile/1.0/epic/{epicIdOrKey}`
- `POST` `/rest/agile/1.0/epic/{epicIdOrKey}`
- `POST` `/rest/agile/1.0/epic/{epicIdOrKey}/issue`
- `PUT` `/rest/agile/1.0/epic/{epicIdOrKey}/rank`
- `PUT` `/rest/agile/1.0/issue/rank`
- `GET` `/rest/agile/1.0/issue/{issueIdOrKey}`
- `GET` `/rest/agile/1.0/issue/{issueIdOrKey}/estimation`
- `PUT` `/rest/agile/1.0/issue/{issueIdOrKey}/estimation`
- `POST` `/rest/agile/1.0/sprint`
- `DELETE` `/rest/agile/1.0/sprint/{sprintId}`
- `GET` `/rest/agile/1.0/sprint/{sprintId}`
- `POST` `/rest/agile/1.0/sprint/{sprintId}`
- `PUT` `/rest/agile/1.0/sprint/{sprintId}`
- `POST` `/rest/agile/1.0/sprint/{sprintId}/issue`
- `GET` `/rest/agile/1.0/sprint/{sprintId}/properties`
- `DELETE` `/rest/agile/1.0/sprint/{sprintId}/properties/{propertyKey}`
- `GET` `/rest/agile/1.0/sprint/{sprintId}/properties/{propertyKey}`
- `PUT` `/rest/agile/1.0/sprint/{sprintId}/properties/{propertyKey}`
- `POST` `/rest/agile/1.0/sprint/{sprintId}/swap`
- `POST` `/rest/api/2/issue/{issueIdOrKey}/worklog`
- `PUT` `/rest/api/2/issue/{issueIdOrKey}/worklog/{id}`
- `GET` `/rest/api/3/announcementBanner`
- `PUT` `/rest/api/3/announcementBanner`
- `POST` `/rest/api/3/app/field/value`
- `GET` `/rest/api/3/app/field/{fieldIdOrKey}/context/configuration`
- `PUT` `/rest/api/3/app/field/{fieldIdOrKey}/context/configuration`
… and 561 more


</details>

**Missing** (5)

- No attachments, worklogs, watchers, or issue link endpoints
- No project create/update, versions, or components endpoints
- No agile boards, sprints, or backlog endpoints
- No users search, avatars, or notification endpoints
- No workflow or field configuration management endpoints

**Deviations** (6)

- Comment bodies are plain strings, not Atlassian Document Format objects
- Enhanced-search nextPageToken is a plain decimal offset, not an opaque token
- JQL subset: parenthesised grouping unsupported; unknown fields 400
- JQL dates compare as ISO-8601 strings, not parsed datetimes
- Single fixed simplified workflow for all projects; real workflows are configurable
- GET /rest/api/3/webhook (list registrations) marked simulator-only

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/rest/api/3/myself` — auth
- `GET` `/rest/api/3/serverInfo` — auth
- `GET` `/rest/api/3/project` — auth, stateful
- `GET` `/rest/api/3/project/search` — auth, stateful
- `GET` `/rest/api/3/project/{key}` — params, auth, stateful, errors
- `POST` `/rest/api/3/search/jql` — body, auth, stateful, filter, errors
- `GET` `/rest/api/3/search` — query, auth, stateful, filter, errors
- `POST` `/rest/api/3/issue` — body, auth, stateful, webhooks, errors, clock
- `GET` `/rest/api/3/issue/{key}` — params, auth, stateful, errors
- `PUT` `/rest/api/3/issue/{key}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/rest/api/3/issue/{key}` — params, auth, stateful, errors
- `GET` `/rest/api/3/issue/{key}/transitions` — params, auth, stateful, errors
- `POST` `/rest/api/3/issue/{key}/transitions` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/rest/api/2/issue` — body, auth, stateful, webhooks, errors, clock
- `GET` `/rest/api/2/issue/{key}` — params, auth, stateful, errors
- `PUT` `/rest/api/2/issue/{key}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/rest/api/2/issue/{key}` — params, auth, stateful, errors
- `GET` `/rest/api/2/issue/{key}/transitions` — params, auth, stateful, errors
- `POST` `/rest/api/2/issue/{key}/transitions` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/rest/api/2/issue/{key}/comment` — query, params, auth, stateful, errors
- `GET` `/rest/api/2/issue/{key}/comment/{id}` — params, auth, stateful, errors
- `POST` `/rest/api/2/issue/{key}/comment` — body, params, auth, stateful, webhooks, errors, clock
- `PUT` `/rest/api/2/issue/{key}/comment/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/rest/api/2/issue/{key}/comment/{id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/rest/api/3/issue/{key}/comment` — query, params, auth, stateful, errors
- `GET` `/rest/api/3/issue/{key}/comment/{id}` — params, auth, stateful, errors
- `POST` `/rest/api/3/issue/{key}/comment` — body, params, auth, stateful, webhooks, errors, clock
- `PUT` `/rest/api/3/issue/{key}/comment/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/rest/api/3/issue/{key}/comment/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/rest/api/3/webhook` — body, auth, stateful
- `GET` `/rest/api/3/webhook` — query, auth, stateful
- `DELETE` `/rest/api/3/webhook` — body, auth, stateful

</details>

### jumio-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/netverify/v2/scans` |
| GET | `/netverify/v2/scans/{scan_reference}` |
| DELETE | `/netverify/v2/scans/{scan_reference}` |
| GET | `/netverify/v2/scans/{scan_reference}/data` |
| POST | `/netverify/v2/webhooks` |

</details>

**Missing** (3)

- No document or selfie image upload/retrieval endpoints
- No hosted redirect verification flow; API scan creation only
- No Document Verification, Data Verification, or Transaction Screening APIs

**Deviations** (6)

- Scan lifecycle on a fixed clock: PENDING ~3s then DONE or FAILED at +3s
- simulate_fail and simulate_reject_reason create fields are stunt-only hooks
- Webhook HMAC secret is the public constant stunt_jumio_mock_signing_key
- POST /netverify/v2/webhooks is a local stand-in receiver, not a Jumio endpoint
- Bearer-presence gate; real Jumio uses HTTP Basic against a server-token store
- Scan references are decimal groups, not UUIDs; extracted PII is fixed synthetic

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/netverify/v2/scans` — body, auth, stateful, errors, clock
- `GET` `/netverify/v2/scans/{scan_reference}` — params, auth, stateful, webhooks, errors, clock
- `DELETE` `/netverify/v2/scans/{scan_reference}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/netverify/v2/scans/{scan_reference}/data` — params, auth, stateful, webhooks, errors, clock
- `POST` `/netverify/v2/webhooks` — auth, stateful, clock

</details>

### linkedin-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth/v2/authorization` |
| POST | `/oauth/v2/accessToken` |
| GET | `/v2/userinfo` |
| POST | `/v2/ugcPosts` |
| GET | `/rest/comments` |
| POST | `/rest/comments` |
| GET | `/rest/posts/{urn}` |
| GET | `/rest/memberCreatorPostAnalytics` |

</details>

**Missing** (4)

- No ugcPosts delete or edit (DELETE /v2/ugcPosts/{id})
- No organizations or company page API (GET /v2/organizations)
- No reactions or likes endpoints (socialActions likes)
- No video upload flow or multi-image carousel posts

**Deviations** (3)

- Rate-limit injection on POST /v2/ugcPosts publish is a simulator test hook
- An unknown analytics queryType silently falls back to the base total; real LinkedIn 400s
- Refresh tokens never expire; only access tokens carry the 60-day expiry

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth/v2/authorization` — query, stateful, errors
- `POST` `/oauth/v2/accessToken` — body, stateful, errors, clock
- `GET` `/v2/userinfo` — auth, stateful, clock
- `POST` `/v2/ugcPosts` — body, auth, stateful, errors, clock
- `GET` `/rest/comments` — query, auth, stateful, paginate, errors, clock
- `POST` `/rest/comments` — body, auth, stateful, errors, clock
- `GET` `/rest/posts/{urn}` — params, auth, stateful, errors, clock
- `GET` `/rest/memberCreatorPostAnalytics` — query, auth, stateful, errors, clock

</details>

### llm-style

**Covered** — 3 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/chat/completions` |
| GET | `/v1/models` |
| POST | `/v1/messages` |

</details>

**Provider surface** — derived from sdk openai-node @ 7.5.0 (floor): 246 real routes · 2 covered · 0% · 238 not implemented

<details><summary>not implemented (238)</summary>

- `GET` `/v1/assistants`
- `POST` `/v1/assistants`
- `DELETE` `/v1/assistants/{assistantID}`
- `GET` `/v1/assistants/{assistantID}`
- `POST` `/v1/assistants/{assistantID}`
- `POST` `/v1/audio/speech`
- `POST` `/v1/audio/transcriptions`
- `POST` `/v1/audio/translations`
- `GET` `/v1/batches`
- `POST` `/v1/batches`
- `GET` `/v1/batches/{batchID}`
- `POST` `/v1/batches/{batchID}/cancel`
- `GET` `/v1/chat/completions`
- `DELETE` `/v1/chat/completions/{completionID}`
- `GET` `/v1/chat/completions/{completionID}`
- `POST` `/v1/chat/completions/{completionID}`
- `POST` `/v1/chatkit/sessions`
- `POST` `/v1/chatkit/sessions/{sessionID}/cancel`
- `GET` `/v1/chatkit/threads`
- `DELETE` `/v1/chatkit/threads/{threadID}`
- `GET` `/v1/chatkit/threads/{threadID}`
- `POST` `/v1/completions`
- `GET` `/v1/containers`
- `POST` `/v1/containers`
- `DELETE` `/v1/containers/{containerID}`
- `GET` `/v1/containers/{containerID}`
- `POST` `/v1/containers/{containerID}/files`
- `DELETE` `/v1/containers/{container_id}/files/{fileID}`
- `GET` `/v1/containers/{container_id}/files/{fileID}`
- `GET` `/v1/containers/{container_id}/files/{fileID}/content`
- `POST` `/v1/content_provenance_checks`
- `POST` `/v1/conversations`
- `DELETE` `/v1/conversations/{conversationID}`
- `GET` `/v1/conversations/{conversationID}`
- `POST` `/v1/conversations/{conversationID}`
- `POST` `/v1/conversations/{conversationID}/items`
- `DELETE` `/v1/conversations/{conversation_id}/items/{itemID}`
- `GET` `/v1/conversations/{conversation_id}/items/{itemID}`
- `POST` `/v1/embeddings`
- `GET` `/v1/evals`
- `POST` `/v1/evals`
- `DELETE` `/v1/evals/{evalID}`
- `GET` `/v1/evals/{evalID}`
- `POST` `/v1/evals/{evalID}`
- `POST` `/v1/evals/{evalID}/runs`
- `DELETE` `/v1/evals/{eval_id}/runs/{runID}`
- `GET` `/v1/evals/{eval_id}/runs/{runID}`
- `POST` `/v1/evals/{eval_id}/runs/{runID}`
- `GET` `/v1/evals/{eval_id}/runs/{run_id}/output_items/{outputItemID}`
- `GET` `/v1/files`
… and 188 more


</details>

**Missing** (4)

- No embeddings (POST /v1/embeddings) or legacy completions endpoints
- No Anthropic SSE streaming (stream:true only handled for OpenAI)
- No tool use, function calling, or JSON mode
- No image or multimodal content blocks

**Deviations** (3)

- Responses deterministic: echo of the last user message; no model or randomness
- Reply derived solely from the last user message; earlier history ignored
- stream:true (OpenAI) returns one SSE chunk plus [DONE], not token-by-token

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/chat/completions` — body, auth, stateful, clock
- `GET` `/v1/models` — query, auth, stateful, paginate, errors, clock
- `POST` `/v1/messages` — body, auth, stateful, clock

</details>

### marketo-style

**Covered** — 21 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/identity/oauth/token` |
| POST | `/rest/v1/leads.json` |
| GET | `/rest/v1/leads` |
| POST | `/rest/v1/leads` |
| GET | `/rest/v1/leads/describe` |
| GET | `/rest/v1/leads/{id}` |
| GET | `/rest/v1/leads/{id}.json` |
| POST | `/rest/v1/campaigns/{id}/trigger` |
| GET | `/rest/v1/campaigns` |
| GET | `/rest/v1/programs` |
| GET | `/rest/v1/folders` |
| GET | `/rest/v1/activities/pagingtoken` |
| GET | `/rest/v1/activities` |
| POST | `/bulk/v1/leads/export/create` |
| POST | `/bulk/v1/leads/export/create.json` |
| GET | `/bulk/v1/leads/export/{exportId}/status` |
| GET | `/bulk/v1/leads/export/{exportId}/status.json` |
| GET | `/bulk/v1/leads/export/{exportId}/file` |
| GET | `/bulk/v1/leads/export/{exportId}/file.json` |
| POST | `/bulk/v1/leads/export/{exportId}/cancel` |
| POST | `/bulk/v1/leads/export/{exportId}/cancel.json` |

</details>

**Missing** (5)

- No bulk lead import (enqueue, batch status, failures, warnings)
- No bulk activity extract (POST /bulk/v1/activities/export/*)
- No custom objects API (/rest/v1/customobjects)
- No asset APIs (emails, forms, landing pages, files) under /rest/asset/v1
- No lead delete (POST /rest/v1/leads/delete.json) or campaign schedule

**Deviations** (3)

- Export job timing fixed: Processing after ~1s, Completed after ~3s
- Signed completion webhook (X-Stunt-Signature, fixed secret) is a simulator extension
- Daily quota 602 modeled but threshold set to 100k so tests are unaffected

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/identity/oauth/token` — query, stateful, errors, clock
- `POST` `/rest/v1/leads.json` — body, query, auth, stateful, clock
- `GET` `/rest/v1/leads` — query, auth, stateful, paginate, filter, clock
- `POST` `/rest/v1/leads` — body, query, auth, stateful, clock
- `GET` `/rest/v1/leads/describe` — query, auth, stateful, clock
- `GET` `/rest/v1/leads/{id}` — query, params, auth, stateful, errors, clock
- `GET` `/rest/v1/leads/{id}.json` — query, params, auth, stateful, errors, clock
- `POST` `/rest/v1/campaigns/{id}/trigger` — body, query, params, auth, stateful, errors, clock
- `GET` `/rest/v1/campaigns` — query, auth, stateful, paginate, clock
- `GET` `/rest/v1/programs` — query, auth, stateful, paginate, clock
- `GET` `/rest/v1/folders` — query, auth, stateful, paginate, clock
- `GET` `/rest/v1/activities/pagingtoken` — query, auth, stateful, clock
- `GET` `/rest/v1/activities` — query, auth, stateful, paginate, clock
- `POST` `/bulk/v1/leads/export/create` — body, query, auth, stateful, clock
- `POST` `/bulk/v1/leads/export/create.json` — body, query, auth, stateful, clock
- `GET` `/bulk/v1/leads/export/{exportId}/status` — query, params, auth, stateful, webhooks, errors, clock
- `GET` `/bulk/v1/leads/export/{exportId}/status.json` — query, params, auth, stateful, webhooks, errors, clock
- `GET` `/bulk/v1/leads/export/{exportId}/file` — query, params, auth, stateful, webhooks, errors, clock
- `GET` `/bulk/v1/leads/export/{exportId}/file.json` — query, params, auth, stateful, webhooks, errors, clock
- `POST` `/bulk/v1/leads/export/{exportId}/cancel` — query, params, auth, stateful, webhooks, errors, clock
- `POST` `/bulk/v1/leads/export/{exportId}/cancel.json` — query, params, auth, stateful, webhooks, errors, clock

</details>

### microsoft-graph-style

**Covered** — 55 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1.0/me` |
| POST | `/v1.0/subscriptions` |
| GET | `/v1.0/subscriptions` |
| GET | `/v1.0/subscriptions/{id}` |
| DELETE | `/v1.0/subscriptions/{id}` |
| GET | `/v1.0/users` |
| GET | `/v1.0/users/{id}` |
| GET | `/v1.0/me/mailFolders` |
| GET | `/v1.0/me/mailFolders/{id}/messages` |
| GET | `/v1.0/me/messages` |
| POST | `/v1.0/me/messages` |
| POST | `/v1.0/me/messages/{id}/send` |
| GET | `/v1.0/me/messages/{id}` |
| PATCH | `/v1.0/me/messages/{id}` |
| DELETE | `/v1.0/me/messages/{id}` |
| POST | `/v1.0/me/sendMail` |
| GET | `/v1.0/me/calendarView` |
| GET | `/v1.0/me/calendar/calendarView` |
| GET | `/v1.0/me/events` |
| POST | `/v1.0/me/events` |
| POST | `/v1.0/me/events/{id}/accept` |
| POST | `/v1.0/me/events/{id}/decline` |
| POST | `/v1.0/me/events/{id}/tentativelyAccept` |
| GET | `/v1.0/me/events/{id}` |
| DELETE | `/v1.0/me/events/{id}` |
| PATCH | `/v1.0/me/events/{id}` |
| GET | `/v1.0/me/drive` |
| GET | `/v1.0/me/drive/root/children` |
| POST | `/v1.0/me/drive/root/children` |
| GET | `/v1.0/me/drive/items/{id}/children` |
| POST | `/v1.0/me/drive/items/{id}/children` |
| GET | `/v1.0/me/drive/items/{id}/content` |
| POST | `/v1.0/me/drive/items/{id}/restore` |
| GET | `/v1.0/me/drive/items/{id}` |
| DELETE | `/v1.0/me/drive/items/{id}` |
| PUT | `/v1.0/me/drive/root:/{item}/content` |
| PUT | `/v1.0/me/drive/items/{parent}/{item}/content` |
| POST | `/v1.0/me/drive/root:/{item}/createUploadSession` |
| POST | `/v1.0/me/drive/items/{parent}/{item}/createUploadSession` |
| PUT | `/v1.0/_upload/{session}` |
| GET | `/v1.0/me/drive/root:/{item}` |
| GET | `/v1.0/groups/{id}/sites` |
| GET | `/v1.0/me/chats` |
| POST | `/v1.0/me/chats` |
| DELETE | `/v1.0/chats/{id}` |
| GET | `/v1.0/chats/{id}/messages` |
| POST | `/v1.0/chats/{id}/messages` |
| DELETE | `/v1.0/chats/{id}/messages/{messageId}` |
| GET | `/v1.0/me/drive/items/{id}/workbook/worksheets` |
| POST | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/add` |
| GET | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows` |
| POST | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows` |
| PATCH | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/{index}` |
| DELETE | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/{index}` |
| GET | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/range` |

</details>

**Provider surface** — derived from spec msgraph-metadata v1.0 @ v1.0: 17531 real routes · 34 covered · 0% · 17497 not implemented

<details><summary>not implemented (17497)</summary>

- `GET` `/v1.0/admin`
- `PATCH` `/v1.0/admin`
- `DELETE` `/v1.0/admin/configurationManagement`
- `GET` `/v1.0/admin/configurationManagement`
- `PATCH` `/v1.0/admin/configurationManagement`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts`
- `POST` `/v1.0/admin/configurationManagement/configurationDrifts`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults`
- `POST` `/v1.0/admin/configurationManagement/configurationMonitoringResults`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors`
- `POST` `/v1.0/admin/configurationManagement/configurationMonitors`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs`
- `POST` `/v1.0/admin/configurationManagement/configurationSnapshotJobs`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots`
- `POST` `/v1.0/admin/configurationManagement/configurationSnapshots`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `DELETE` `/v1.0/admin/edge`
- `GET` `/v1.0/admin/edge`
- `PATCH` `/v1.0/admin/edge`
- `DELETE` `/v1.0/admin/edge/internetExplorerMode`
- `GET` `/v1.0/admin/edge/internetExplorerMode`
- `PATCH` `/v1.0/admin/edge/internetExplorerMode`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists`
- `POST` `/v1.0/admin/edge/internetExplorerMode/siteLists`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists/$count`
- `DELETE` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
- `PATCH` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
… and 17447 more


</details>

**Missing** (8)

- No Excel workbook sessions (createSession, refreshSession, closeSession)
- No mail reply/forward, attachments, or message move/copy endpoints
- No calendar or mail folder create/update/delete, no event instances
- No drive item copy, move, rename, permissions, or sharing invites
- No drive search, delta, recent, or sharedWithMe endpoints
- No teams or channels endpoints (chats and chat messages only)
- No Excel worksheet or table create/update/delete, no workbook calculate
- No todo, planner, contacts, presence, or /search surfaces

**Deviations** (6)

- Webhook validationToken handshake not enforced; subscription accepted immediately
- Upload session ids are deterministic counters, not unguessable tokens
- OData $filter limited to the equality pattern (field eq value)
- Static seeded mock-bearer-token bypasses the entra-id token flow
- @odata.nextLink/@odata.context point at graph.microsoft.com, not the serving host (prod-faithful; a local SDK harness must rebase)
- Resumable upload session URLs are absolute http:// — the JS SDK's OneDriveLargeFileUploadTask urlJoins them into a broken path

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1.0/me` — auth, stateful, clock
- `POST` `/v1.0/subscriptions` — body, auth, stateful, webhooks, clock
- `GET` `/v1.0/subscriptions` — auth, stateful, clock
- `GET` `/v1.0/subscriptions/{id}` — params, auth, stateful, clock
- `DELETE` `/v1.0/subscriptions/{id}` — params, auth, stateful, clock
- `GET` `/v1.0/users` — query, auth, stateful, paginate, clock
- `GET` `/v1.0/users/{id}` — params, auth, stateful, clock
- `GET` `/v1.0/me/mailFolders` — query, auth, stateful, paginate, clock
- `GET` `/v1.0/me/mailFolders/{id}/messages` — query, params, auth, stateful, paginate, clock
- `GET` `/v1.0/me/messages` — query, auth, stateful, paginate, clock
- `POST` `/v1.0/me/messages` — body, auth, stateful, webhooks, clock
- `POST` `/v1.0/me/messages/{id}/send` — params, auth, stateful, webhooks, clock
- `GET` `/v1.0/me/messages/{id}` — params, auth, stateful, clock
- `PATCH` `/v1.0/me/messages/{id}` — body, params, auth, stateful, webhooks, clock
- `DELETE` `/v1.0/me/messages/{id}` — params, auth, stateful, clock
- `POST` `/v1.0/me/sendMail` — body, auth, stateful, webhooks, clock
- `GET` `/v1.0/me/calendarView` — query, auth, stateful, paginate, clock
- `GET` `/v1.0/me/calendar/calendarView` — query, auth, stateful, paginate, clock
- `GET` `/v1.0/me/events` — query, auth, stateful, paginate, clock
- `POST` `/v1.0/me/events` — body, auth, stateful, webhooks, clock
- `POST` `/v1.0/me/events/{id}/accept` — params, auth, stateful, webhooks, clock
- `POST` `/v1.0/me/events/{id}/decline` — params, auth, stateful, webhooks, clock
- `POST` `/v1.0/me/events/{id}/tentativelyAccept` — params, auth, stateful, webhooks, clock
- `GET` `/v1.0/me/events/{id}` — params, auth, stateful, clock
- `DELETE` `/v1.0/me/events/{id}` — params, auth, stateful, webhooks, clock
- `PATCH` `/v1.0/me/events/{id}` — body, params, auth, stateful, webhooks, clock
- `GET` `/v1.0/me/drive` — auth, stateful, clock
- `GET` `/v1.0/me/drive/root/children` — query, auth, stateful, paginate, clock
- `POST` `/v1.0/me/drive/root/children` — body, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}/children` — query, params, auth, stateful, paginate, clock
- `POST` `/v1.0/me/drive/items/{id}/children` — body, params, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}/content` — params, auth, stateful, clock
- `POST` `/v1.0/me/drive/items/{id}/restore` — params, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}` — params, auth, stateful, clock
- `DELETE` `/v1.0/me/drive/items/{id}` — params, auth, stateful, clock
- `PUT` `/v1.0/me/drive/root:/{item}/content` — query, params, auth, stateful, clock
- `PUT` `/v1.0/me/drive/items/{parent}/{item}/content` — query, params, auth, stateful, clock
- `POST` `/v1.0/me/drive/root:/{item}/createUploadSession` — body, params, auth, stateful, clock
- `POST` `/v1.0/me/drive/items/{parent}/{item}/createUploadSession` — body, params, auth, stateful, clock
- `PUT` `/v1.0/_upload/{session}` — params, stateful, clock
- `GET` `/v1.0/me/drive/root:/{item}` — query, params, auth, stateful, clock
- `GET` `/v1.0/groups/{id}/sites` — query, params, auth, stateful, paginate, clock
- `GET` `/v1.0/me/chats` — query, auth, stateful, paginate, clock
- `POST` `/v1.0/me/chats` — body, auth, stateful, clock
- `DELETE` `/v1.0/chats/{id}` — params, auth, stateful, clock
- `GET` `/v1.0/chats/{id}/messages` — query, params, auth, stateful, paginate, clock
- `POST` `/v1.0/chats/{id}/messages` — body, params, auth, stateful, webhooks, clock
- `DELETE` `/v1.0/chats/{id}/messages/{messageId}` — params, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}/workbook/worksheets` — query, params, auth, stateful, paginate, clock
- `POST` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/add` — body, params, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows` — query, params, auth, stateful, paginate, clock
- `POST` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows` — body, params, auth, stateful, clock
- `PATCH` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/{index}` — body, params, auth, stateful, clock
- `DELETE` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/{index}` — params, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/range` — params, auth, stateful, clock

</details>

### netsuite-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/services/rest/query/v1/suiteql` |
| POST | `/services/rest/v1/suiteql` |
| GET | `/services/rest/record/v1/metadata-catalog` |
| GET | `/services/rest/record/v1/{recordType}` |
| POST | `/services/rest/record/v1/{recordType}` |
| GET | `/services/rest/record/v1/{recordType}/{id}` |
| PATCH | `/services/rest/record/v1/{recordType}/{id}` |
| DELETE | `/services/rest/record/v1/{recordType}/{id}` |
| POST | `/services/rest/record/v1/{recordType}/{id}/!transform/{target}` |

</details>

**Missing** (4)

- No creditMemo, purchaseOrder, vendorBill, journalEntry, or cashSale records
- No sublist child resources (e.g. salesOrder/{id}/item/{line})
- No per-record-type metadata catalog (metadata-catalog/{recordType})
- No file cabinet, blob upload, or REST analytics endpoints

**Deviations** (3)

- TBA/NLAuth/Bearer only structurally checked; OAuth 1.0a HMAC not validated
- SuiteQL matches only the FROM table; WHERE and ORDER BY clauses are ignored
- Duplicate-externalId create returns the stored record without updating it

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/services/rest/query/v1/suiteql` — query, auth, stateful, filter
- `POST` `/services/rest/v1/suiteql` — query, auth, stateful, filter
- `GET` `/services/rest/record/v1/metadata-catalog` — auth
- `GET` `/services/rest/record/v1/{recordType}` — query, auth, stateful, filter
- `POST` `/services/rest/record/v1/{recordType}` — auth, stateful
- `GET` `/services/rest/record/v1/{recordType}/{id}` — params, auth, stateful
- `PATCH` `/services/rest/record/v1/{recordType}/{id}` — params, auth, stateful
- `DELETE` `/services/rest/record/v1/{recordType}/{id}` — params, auth, stateful
- `POST` `/services/rest/record/v1/{recordType}/{id}/!transform/{target}` — params, auth, stateful, clock

</details>

### oneinch-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v6.0/1/approve/spender` |
| GET | `/v6.0/1/approve/calldata` |
| GET | `/v6.0/1/tokens` |
| GET | `/v6.0/1/quote` |
| GET | `/v6.0/1/swap` |

</details>

**Missing** (3)

- No Fusion+ order flow (order quotes, submission, status, events)
- No Limit Order Protocol endpoints (create, list, history)
- No raw transaction broadcast, status check, or chains list endpoints

**Deviations** (4)

- Quotes deterministic from src/dst/amount; same input yields same toAmount and split
- Quote field is toAmount; real v6.0 returns dstAmount
- Same-token quotes return amount x pseudo-rate; real API rejects
- slippage is optional and ignored on swap; real v6.0 requires it

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v6.0/1/approve/spender` — —
- `GET` `/v6.0/1/approve/calldata` — query, errors
- `GET` `/v6.0/1/tokens` — —
- `GET` `/v6.0/1/quote` — query, errors
- `GET` `/v6.0/1/swap` — query, errors

</details>

### onfido-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v3.6/applicants` |
| POST | `/v3.6/documents` |
| POST | `/v3.6/live_photos` |
| POST | `/v3.6/checks` |
| GET | `/v3.6/applicants/{applicant_id}` |
| GET | `/v3.6/checks/{check_id}` |
| POST | `/v3.6/webhooks` |

</details>

**Provider surface** — derived from spec onfido-openapi-spec @ v3.6: 84 real routes · 7 covered · 8% · 73 not implemented

<details><summary>not implemented (73)</summary>

- `GET` `/v3.6/addresses/pick`
- `GET` `/v3.6/advanced_electronic_signature/documents`
- `GET` `/v3.6/applicants`
- `DELETE` `/v3.6/applicants/{applicant_id}`
- `PUT` `/v3.6/applicants/{applicant_id}`
- `GET` `/v3.6/applicants/{applicant_id}/consents`
- `POST` `/v3.6/applicants/{applicant_id}/restore`
- `DELETE` `/v3.6/biometric_tokens/{user_id}`
- `GET` `/v3.6/biometric_tokens/{user_id}`
- `PUT` `/v3.6/biometric_tokens/{user_id}/{token_uuid}`
- `GET` `/v3.6/checks`
- `GET` `/v3.6/checks/{check_id}/download`
- `POST` `/v3.6/checks/{check_id}/resume`
- `GET` `/v3.6/documents`
- `GET` `/v3.6/documents/{document_id}`
- `GET` `/v3.6/documents/{document_id}/download`
- `GET` `/v3.6/documents/{document_id}/nfc_face`
- `GET` `/v3.6/documents/{document_id}/video/download`
- `POST` `/v3.6/extractions`
- `GET` `/v3.6/id_photos`
- `POST` `/v3.6/id_photos`
- `GET` `/v3.6/id_photos/{id_photo_id}`
- `GET` `/v3.6/id_photos/{id_photo_id}/download`
- `GET` `/v3.6/live_photos`
- `GET` `/v3.6/live_photos/{live_photo_id}`
- `GET` `/v3.6/live_photos/{live_photo_id}/download`
- `GET` `/v3.6/live_videos`
- `GET` `/v3.6/live_videos/{live_video_id}`
- `GET` `/v3.6/live_videos/{live_video_id}/download`
- `GET` `/v3.6/live_videos/{live_video_id}/frame`
- `GET` `/v3.6/motion_captures`
- `GET` `/v3.6/motion_captures/{motion_capture_id}`
- `GET` `/v3.6/motion_captures/{motion_capture_id}/download`
- `GET` `/v3.6/motion_captures/{motion_capture_id}/frame`
- `DELETE` `/v3.6/passkeys/{username}`
- `GET` `/v3.6/passkeys/{username}`
- `PUT` `/v3.6/passkeys/{username}/{passkey_id}`
- `GET` `/v3.6/ping`
- `GET` `/v3.6/qualified_electronic_signature/documents`
- `GET` `/v3.6/repeat_attempts/{report_id}`
- `GET` `/v3.6/reports`
- `GET` `/v3.6/reports/{report_id}`
- `POST` `/v3.6/reports/{report_id}/cancel`
- `POST` `/v3.6/reports/{report_id}/resume`
- `POST` `/v3.6/results_feedback`
- `POST` `/v3.6/sdk_token`
- `GET` `/v3.6/signing_documents`
- `POST` `/v3.6/signing_documents`
- `GET` `/v3.6/signing_documents/{signing_document_id}`
- `GET` `/v3.6/signing_documents/{signing_document_id}/download`
… and 23 more


</details>

**Missing** (5)

- No SDK token generation (POST /v3.6/sdk_token)
- No applicant list, update, delete, or resume endpoints
- No reports sub-resource (GET /v3.6/reports/{id}); results inline only
- No motion capture or video uploads; no document/live photo list or delete
- No webhook registration or listing (local receiver only)

**Deviations** (6)

- Check lifecycle fixed: in_progress ~3s then complete; awaiting_applicant skipped
- simulate_fail yields result consider; real sandbox uses special sandbox documents
- Webhook HMAC secret is the public constant stunt_onfido_mock_signing_key
- POST /v3.6/webhooks is a local stand-in receiver, not an Onfido endpoint
- Synthetic sequential ids (app-000001...) where real Onfido uses UUIDs
- The awaiting_applicant phase is skipped; documents assumed on file

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v3.6/applicants` — body, auth, stateful, errors, clock
- `POST` `/v3.6/documents` — body, auth, stateful, errors, clock
- `POST` `/v3.6/live_photos` — body, auth, stateful, errors, clock
- `POST` `/v3.6/checks` — body, auth, stateful, errors, clock
- `GET` `/v3.6/applicants/{applicant_id}` — params, auth, stateful, errors
- `GET` `/v3.6/checks/{check_id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v3.6/webhooks` — auth, stateful, clock

</details>

### opensea-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/api/v2/assets` |
| GET | `/api/v2/assets/{chain}/{address}/{identifier}` |
| GET | `/api/v2/collections/{slug}` |
| GET | `/api/v2/events` |
| GET | `/api/v2/orders/{chain}/{protocol}/listings` |
| GET | `/api/v2/orders/{chain}/{protocol}/offers` |
| POST | `/api/v2/offers` |

</details>

**Provider surface** — derived from spec OpenSea ReadMe registry spec (semi-official) @ 2.0.0: 139 real routes · 3 covered · 2% · 136 not implemented

<details><summary>not implemented (136)</summary>

- `GET` `/api/v2/account/{address}/collections`
- `GET` `/api/v2/account/{address}/favorites`
- `GET` `/api/v2/account/{address}/listings`
- `GET` `/api/v2/account/{address}/offers`
- `GET` `/api/v2/account/{address}/offers_received`
- `GET` `/api/v2/account/{address}/perpetual_watchlist`
- `GET` `/api/v2/account/{address}/pnl`
- `GET` `/api/v2/account/{address}/pnl/closed-positions`
- `GET` `/api/v2/account/{address}/pnl/token-transfers`
- `GET` `/api/v2/account/{address}/portfolio`
- `GET` `/api/v2/account/{address}/portfolio/history`
- `GET` `/api/v2/account/{address}/token-activity`
- `GET` `/api/v2/account/{address}/token_watchlist`
- `GET` `/api/v2/account/{address}/tokens`
- `DELETE` `/api/v2/accounts/agent`
- `PUT` `/api/v2/accounts/agent`
- `DELETE` `/api/v2/accounts/agent-relationships`
- `GET` `/api/v2/accounts/agent-relationships`
- `POST` `/api/v2/accounts/agent-relationships`
- `POST` `/api/v2/accounts/agent-relationships/confirm`
- `GET` `/api/v2/accounts/resolve/{identifier}`
- `POST` `/api/v2/accounts/wallets/siwx`
- `DELETE` `/api/v2/accounts/wallets/{wallet}`
- `DELETE` `/api/v2/accounts/wallets/{wallet}/private`
- `PUT` `/api/v2/accounts/wallets/{wallet}/private`
- `GET` `/api/v2/accounts/{address_or_username}`
- `GET` `/api/v2/accounts/{address_or_username}/agent-relationships`
- `DELETE` `/api/v2/accounts/{address_or_username}/follow`
- `POST` `/api/v2/accounts/{address_or_username}/follow`
- `GET` `/api/v2/accounts/{address_or_username}/followers`
- `GET` `/api/v2/accounts/{address_or_username}/following`
- `GET` `/api/v2/accounts/{address_or_username}/relationship`
- `DELETE` `/api/v2/accounts/{address_or_username}/watch`
- `POST` `/api/v2/accounts/{address_or_username}/watch`
- `POST` `/api/v2/assets/transfer`
- `POST` `/api/v2/auth/keys`
- `GET` `/api/v2/chain/{chain}/account/{address}/nfts`
- `GET` `/api/v2/chain/{chain}/contract/{address}`
- `GET` `/api/v2/chain/{chain}/contract/{address}/nfts`
- `GET` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}`
- `GET` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}/analytics`
- `GET` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}/collection`
- `GET` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}/owners`
- `POST` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}/refresh`
- `POST` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}/validate-metadata`
- `GET` `/api/v2/chain/{chain}/payment_token/{address}`
- `GET` `/api/v2/chain/{chain}/token/{address}`
- `GET` `/api/v2/chain/{chain}/token/{address}/activity`
- `GET` `/api/v2/chain/{chain}/token/{address}/activity/stats`
- `GET` `/api/v2/chain/{chain}/token/{address}/holders`
… and 86 more


</details>

**Missing** (4)

- No collections list endpoint (GET /api/v2/collections), only get-by-slug
- No listing creation or order cancellation (offer creation only)
- No account lookup (GET /api/v2/accounts/{address})
- No NFT transfer history endpoint (chain/{chain}/transfers)

**Deviations** (4)

- X-API-KEY accepted as any non-empty value; no real key validation
- Asset routes serve the deprecated v2 surface; real v2 replaced them with collection-scoped nfts endpoints
- Identical offers re-create and store duplicate orders (no order_hash dedupe)
- Create-offer body and response are simulator-specific, not the documented criteria-offer shapes

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/api/v2/assets` — query, auth, stateful, paginate, errors
- `GET` `/api/v2/assets/{chain}/{address}/{identifier}` — params, auth, stateful, errors
- `GET` `/api/v2/collections/{slug}` — params, auth, stateful, errors
- `GET` `/api/v2/events` — query, auth, stateful, paginate, errors
- `GET` `/api/v2/orders/{chain}/{protocol}/listings` — query, params, auth, stateful, paginate, errors
- `GET` `/api/v2/orders/{chain}/{protocol}/offers` — query, params, auth, stateful, paginate, errors
- `POST` `/api/v2/offers` — body, auth, stateful

</details>

### paypal-style

**Covered** — 17 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/oauth2/token` |
| POST | `/v2/checkout/orders` |
| GET | `/v2/checkout/orders/{id}` |
| POST | `/v2/checkout/orders/{id}/approve` |
| POST | `/v2/checkout/orders/{id}/capture` |
| POST | `/v2/checkout/orders/{id}/authorize` |
| GET | `/v2/payments/authorizations/{id}` |
| POST | `/v2/payments/authorizations/{id}/reauthorize` |
| POST | `/v2/payments/authorizations/{id}/void` |
| POST | `/v2/payments/authorizations/{id}/capture` |
| GET | `/v2/payments/captures/{id}` |
| POST | `/v2/payments/captures/{capture_id}/refund` |
| GET | `/v2/payments/refunds/{id}` |
| POST | `/v1/notifications/webhooks` |
| GET | `/v1/notifications/webhooks` |
| DELETE | `/v1/notifications/webhooks/{id}` |
| POST | `/v1/notifications/verify-webhook-signature` |

</details>

**Provider surface** — derived from spec paypal-rest-api-specifications checkout_orders_v2 + payments_payment_v2 @ 2.32, 2.12: 17 real routes · 11 covered · 64% · 6 not implemented

<details><summary>not implemented (6)</summary>

- `POST` `/v2/checkout/orders/order-update-callback`
- `PATCH` `/v2/checkout/orders/{id}`
- `POST` `/v2/checkout/orders/{id}/confirm-payment-source`
- `POST` `/v2/checkout/orders/{id}/track`
- `PATCH` `/v2/checkout/orders/{id}/trackers/{tracker_id}`
- `POST` `/v2/payments/find-eligible-methods`

</details>

**Missing** (6)

- No PATCH order update (PATCH /v2/checkout/orders/{id})
- No payouts API (POST /v1/payments/payouts)
- No disputes API (/v1/customer/disputes)
- No subscriptions, billing plans, or catalog products APIs
- No webhook event-types list or simulate-event endpoints
- No order patch endpoint (PATCH /v2/checkout/orders/{id})

**Deviations** (8)

- Payer approval endpoint /approve is simulator-only; real flow is browser rel=approve
- simulate_fail flags on approve and refund are stunt-only test hooks
- Webhook deliveries unsigned; real PayPal uses a certificate-based signature scheme
- verify-webhook-signature returns SUCCESS for any known webhook_id, no real check
- Refund derives terminal state on read after fixed ~3s (PENDING to COMPLETED/FAILED)
- Token endpoint validates only the Basic scheme — any credentials mint, grant_type ignored
- Captures always complete immediately; no PENDING/ON_HOLD capture states
- Idempotency replay re-renders the order's current state, not the cached original response

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/oauth2/token` — body, stateful, clock
- `POST` `/v2/checkout/orders` — body, stateful, clock
- `GET` `/v2/checkout/orders/{id}` — params, stateful, clock
- `POST` `/v2/checkout/orders/{id}/approve` — body, params, stateful, webhooks, clock
- `POST` `/v2/checkout/orders/{id}/capture` — params, stateful, webhooks, clock
- `POST` `/v2/checkout/orders/{id}/authorize` — params, stateful, webhooks, clock
- `GET` `/v2/payments/authorizations/{id}` — params, stateful, clock
- `POST` `/v2/payments/authorizations/{id}/reauthorize` — params, stateful, clock
- `POST` `/v2/payments/authorizations/{id}/void` — params, stateful, webhooks, clock
- `POST` `/v2/payments/authorizations/{id}/capture` — body, params, stateful, webhooks, clock
- `GET` `/v2/payments/captures/{id}` — params, stateful, filter, webhooks, clock
- `POST` `/v2/payments/captures/{capture_id}/refund` — body, params, stateful, filter, clock
- `GET` `/v2/payments/refunds/{id}` — params, stateful, webhooks, clock
- `POST` `/v1/notifications/webhooks` — body, stateful, clock
- `GET` `/v1/notifications/webhooks` — stateful, clock
- `DELETE` `/v1/notifications/webhooks/{id}` — params, stateful, clock
- `POST` `/v1/notifications/verify-webhook-signature` — body, stateful, clock

</details>

### persona-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/inquiry/v1/inquiries` |
| GET | `/api/inquiry/v1/inquiries/{inquiry_id}` |
| POST | `/api/inquiry/v1/inquiries/{inquiry_id}/resume` |
| GET | `/api/inquiry/v1/inquiries/{inquiry_id}/verifications` |
| POST | `/api/inquiry/v1/webhooks` |

</details>

**Provider surface** — derived from spec Persona API reference @ 1.0.0: 213 real routes · 4 covered · 1% · 209 not implemented

<details><summary>not implemented (209)</summary>

- `GET` `/api/inquiry/v1/account-types/{account-type-id}`
- `GET` `/api/inquiry/v1/accounts`
- `POST` `/api/inquiry/v1/accounts`
- `POST` `/api/inquiry/v1/accounts/search`
- `DELETE` `/api/inquiry/v1/accounts/{account-id}`
- `GET` `/api/inquiry/v1/accounts/{account-id}`
- `PATCH` `/api/inquiry/v1/accounts/{account-id}`
- `POST` `/api/inquiry/v1/accounts/{account-id}/add-relation`
- `POST` `/api/inquiry/v1/accounts/{account-id}/add-tag`
- `POST` `/api/inquiry/v1/accounts/{account-id}/consolidate`
- `GET` `/api/inquiry/v1/accounts/{account-id}/relations`
- `POST` `/api/inquiry/v1/accounts/{account-id}/remove-relation`
- `POST` `/api/inquiry/v1/accounts/{account-id}/remove-tag`
- `POST` `/api/inquiry/v1/accounts/{account-id}/run-action`
- `POST` `/api/inquiry/v1/accounts/{account-id}/set-tags`
- `GET` `/api/inquiry/v1/api-keys`
- `POST` `/api/inquiry/v1/api-keys`
- `GET` `/api/inquiry/v1/api-keys/{api-key-id}`
- `PATCH` `/api/inquiry/v1/api-keys/{api-key-id}`
- `POST` `/api/inquiry/v1/api-keys/{api-key-id}/clone`
- `POST` `/api/inquiry/v1/api-keys/{api-key-id}/expire`
- `GET` `/api/inquiry/v1/api-logs`
- `GET` `/api/inquiry/v1/api-logs/{api-log-id}`
- `GET` `/api/inquiry/v1/case-templates/{case-template-id}`
- `GET` `/api/inquiry/v1/cases`
- `POST` `/api/inquiry/v1/cases`
- `POST` `/api/inquiry/v1/cases/search`
- `DELETE` `/api/inquiry/v1/cases/{case-id}`
- `GET` `/api/inquiry/v1/cases/{case-id}`
- `PATCH` `/api/inquiry/v1/cases/{case-id}`
- `POST` `/api/inquiry/v1/cases/{case-id}/add-objects`
- `POST` `/api/inquiry/v1/cases/{case-id}/add-tag`
- `POST` `/api/inquiry/v1/cases/{case-id}/assign`
- `POST` `/api/inquiry/v1/cases/{case-id}/remove-objects`
- `POST` `/api/inquiry/v1/cases/{case-id}/remove-tag`
- `POST` `/api/inquiry/v1/cases/{case-id}/set-status`
- `POST` `/api/inquiry/v1/cases/{case-id}/set-tags`
- `GET` `/api/inquiry/v1/connect/connections`
- `POST` `/api/inquiry/v1/connect/connections`
- `GET` `/api/inquiry/v1/connect/connections/{connection-id}`
- `POST` `/api/inquiry/v1/connect/connections/{connection-id}/deactivate`
- `POST` `/api/inquiry/v1/connect/connections/{connection-id}/reactivate`
- `GET` `/api/inquiry/v1/connect/share-tokens`
- `POST` `/api/inquiry/v1/connect/share-tokens`
- `GET` `/api/inquiry/v1/connect/share-tokens/{share-token-id}`
- `POST` `/api/inquiry/v1/connect/share-tokens/{share-token-id}/expire`
- `POST` `/api/inquiry/v1/connect/share-tokens/{share-token-id}/redeem`
- `GET` `/api/inquiry/v1/devices`
- `GET` `/api/inquiry/v1/devices/{device-id}`
- `GET` `/api/inquiry/v1/document/generics/{document-id}`
… and 159 more


</details>

**Missing** (5)

- No inquiries list endpoint (GET /api/inquiry/v1/inquiries)
- No inquiry templates or reports endpoints
- No document or selfie upload endpoints (verifications auto-seeded)
- No Transactions API (bank account linking and verification)
- No inquiry cancel, expire, redact, or mark-under-review actions

**Deviations** (6)

- Fixed clock lifecycle: created (0-1s), pending (1-3s), completed or declined (+3s)
- simulate_fail create flag yields declined instead of completed (stunt-only)
- Webhook HMAC secret is the public constant stunt_persona_mock_signing_key
- POST /api/inquiry/v1/webhooks is a local stand-in receiver with 5-minute replay window
- JSON:API attributes are snake_case; real Persona serializes kebab-case
- Create takes a flat body; real API expects the JSON:API data/attributes wrapper

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/inquiry/v1/inquiries` — body, auth, stateful, errors, clock
- `GET` `/api/inquiry/v1/inquiries/{inquiry_id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/api/inquiry/v1/inquiries/{inquiry_id}/resume` — params, auth, stateful, errors, clock
- `GET` `/api/inquiry/v1/inquiries/{inquiry_id}/verifications` — params, auth, stateful, errors
- `POST` `/api/inquiry/v1/webhooks` — auth, stateful, clock

</details>

### photos-style

**Covered** — 12 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/o/oauth2/auth` |
| POST | `/o/oauth2/token` |
| POST | `/v1/uploads` |
| POST | `/v1/mediaItems:batchCreate` |
| POST | `/v1/mediaItems:search` |
| GET | `/v1/mediaItems` |
| GET | `/v1/mediaItems/{id}` |
| GET | `/v1/media-dl/{id}` |
| GET | `/v1/albums` |
| POST | `/v1/albums` |
| GET | `/v1/albums/{id}` |
| DELETE | `/v1/albums/{id}` |

</details>

**Missing** (5)

- No album item management (addItems, removeItems, batchRemoveMediaItems)
- No album title update (PATCH /v1/albums/{id})
- No album enrichments (text, map) via addEnrichment
- No shared albums (list, join, leave, unshare)
- No favorites marking or favorite filtering in search

**Deviations** (5)

- Bare-id media download returns derivative bytes; =d/=dv return original upload
- search honors mediaTypeFilter and dateFilter only (no contentFilter or album filters)
- Naming both PHOTO and VIDEO in mediaTypeFilter silently keeps only the last; real API 400s
- albumId in batchCreate is not validated; mediaItemsCount stays 0 and description is dropped
- Deleting an album leaves its items findable via search {albumId}

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/o/oauth2/auth` — query, stateful, errors
- `POST` `/o/oauth2/token` — body, stateful, errors, clock
- `POST` `/v1/uploads` — auth, stateful, clock
- `POST` `/v1/mediaItems:batchCreate` — body, auth, stateful, clock
- `POST` `/v1/mediaItems:search` — body, auth, stateful, filter, clock
- `GET` `/v1/mediaItems` — query, auth, stateful, clock
- `GET` `/v1/mediaItems/{id}` — params, auth, stateful, errors, clock
- `GET` `/v1/media-dl/{id}` — params, stateful, errors
- `GET` `/v1/albums` — query, auth, stateful, clock
- `POST` `/v1/albums` — body, auth, stateful, clock
- `GET` `/v1/albums/{id}` — params, auth, stateful, errors, clock
- `DELETE` `/v1/albums/{id}` — params, auth, stateful, errors, clock

</details>

### pinata-style

**Covered** — 6 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/pinning/pinFileToIPFS` |
| POST | `/pinning/pinJSONToIPFS` |
| DELETE | `/pinning/unpin/{cid}` |
| GET | `/data/pinList` |
| GET | `/data/testAuthentication` |
| GET | `/data/pinByHash` |

</details>

**Missing** (4)

- No pin-by-CID endpoint (POST /pinning/addHashToPinQueue)
- No pin-jobs listing (GET /pinning/pinJobs)
- No metadata update or pin-policy change (POST /pinning/hashMetadata)
- No pinned-data-usage endpoint (GET /data/userPinnedDataTotal)

**Deviations** (3)

- Credentials are presence-checked only; any non-empty key pair or Bearer JWT passes
- Every stored pin is status pinned — unpinned/pending/failed not modeled (no job queue)
- JSON pin CIDs derive from stunt canonical serialization, not byte-identical to real Pinata

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/pinning/pinFileToIPFS` — stateful, clock
- `POST` `/pinning/pinJSONToIPFS` — body, stateful, clock
- `DELETE` `/pinning/unpin/{cid}` — params, stateful
- `GET` `/data/pinList` — query, stateful, filter
- `GET` `/data/testAuthentication` — —
- `GET` `/data/pinByHash` — query, stateful

</details>

### plaid-style

**Covered** — 13 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/link/token/create` |
| POST | `/item/public_token/exchange` |
| POST | `/accounts/balance/get` |
| POST | `/accounts/get` |
| POST | `/transactions/sync` |
| POST | `/identity/get` |
| POST | `/item/get` |
| POST | `/item/remove` |
| POST | `/institutions/get` |
| POST | `/institutions/get_by_id` |
| POST | `/sandbox/public_token/create` |
| POST | `/sandbox/item/reset_login` |
| POST | `/sandbox/item/fire_webhook` |

</details>

**Provider surface** — derived from sdk plaid-node @ 32.0.0 (floor): 294 real routes · 13 covered · 4% · 281 not implemented

<details><summary>not implemented (281)</summary>

- `POST` `/application/get`
- `POST` `/asset_report/audit_copy/create`
- `POST` `/asset_report/audit_copy/get`
- `POST` `/asset_report/audit_copy/remove`
- `POST` `/asset_report/create`
- `POST` `/asset_report/filter`
- `POST` `/asset_report/get`
- `POST` `/asset_report/pdf/get`
- `POST` `/asset_report/refresh`
- `POST` `/asset_report/remove`
- `POST` `/auth/get`
- `POST` `/bank_transfer/balance/get`
- `POST` `/bank_transfer/cancel`
- `POST` `/bank_transfer/create`
- `POST` `/bank_transfer/event/list`
- `POST` `/bank_transfer/event/sync`
- `POST` `/bank_transfer/get`
- `POST` `/bank_transfer/list`
- `POST` `/bank_transfer/migrate_account`
- `POST` `/bank_transfer/sweep/get`
- `POST` `/bank_transfer/sweep/list`
- `POST` `/beacon/account_risk/v1/evaluate`
- `POST` `/beacon/duplicate/get`
- `POST` `/beacon/report/create`
- `POST` `/beacon/report/get`
- `POST` `/beacon/report/list`
- `POST` `/beacon/report_syndication/get`
- `POST` `/beacon/report_syndication/list`
- `POST` `/beacon/user/account_insights/get`
- `POST` `/beacon/user/create`
- `POST` `/beacon/user/get`
- `POST` `/beacon/user/history/list`
- `POST` `/beacon/user/review`
- `POST` `/beacon/user/update`
- `POST` `/beta/credit/v1/bank_employment/get`
- `POST` `/beta/transactions/rules/v1/create`
- `POST` `/beta/transactions/rules/v1/list`
- `POST` `/beta/transactions/rules/v1/remove`
- `POST` `/beta/transactions/user_insights/v1/get`
- `POST` `/beta/transactions/v1/enhance`
- `POST` `/cashflow_report/get`
- `POST` `/cashflow_report/refresh`
- `POST` `/categories/get`
- `POST` `/consent/events/get`
- `POST` `/consumer_report/pdf/get`
- `POST` `/cra/check_report/base_report/get`
- `POST` `/cra/check_report/cashflow_insights/get`
- `POST` `/cra/check_report/create`
- `POST` `/cra/check_report/income_insights/get`
- `POST` `/cra/check_report/network_insights/get`
… and 231 more


</details>

**Missing** (5)

- No /auth/get (account and routing numbers)
- No legacy POST /transactions/get endpoint
- No /institutions/search endpoint
- No /item/webhook/update or /item/token/invalidate
- No liabilities, assets, investments, or income products

**Deviations** (3)

- X-Plaid-Signature JWT-style webhook signature is documented but never enforced
- fire_webhook SYNC_UPDATES_AVAILABLE doubles as transaction mutation (one posted, one removed)
- client_id/secret credentials are presence-checked only, never validated

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/link/token/create` — body, auth, stateful, clock
- `POST` `/item/public_token/exchange` — body, auth, stateful, errors
- `POST` `/accounts/balance/get` — body, auth, stateful, filter, errors
- `POST` `/accounts/get` — body, auth, stateful, filter, errors
- `POST` `/transactions/sync` — body, auth, stateful, filter, webhooks, errors
- `POST` `/identity/get` — body, auth, stateful, filter, errors
- `POST` `/item/get` — body, auth, stateful, errors
- `POST` `/item/remove` — body, auth, stateful, errors
- `POST` `/institutions/get` — body, auth, stateful, filter
- `POST` `/institutions/get_by_id` — body, auth, stateful, errors
- `POST` `/sandbox/public_token/create` — body, auth, stateful, errors, clock
- `POST` `/sandbox/item/reset_login` — body, auth, stateful, webhooks, errors
- `POST` `/sandbox/item/fire_webhook` — body, auth, stateful, filter, webhooks, errors

</details>

### powerplatform-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v2/environments` |
| GET | `/v2/environments/{env}/connectors` |
| GET | `/v2/environments/{env}/api/data/v9.2/accounts` |
| POST | `/v2/environments/{env}/api/data/v9.2/accounts` |
| GET | `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` |
| PATCH | `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` |
| DELETE | `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` |
| GET | `/v2/environments/{env}/flows` |
| POST | `/v2/environments/{env}/flows` |

</details>

**Missing** (4)

- No environment lifecycle operations (create, update, delete)
- Only the accounts table is served — no contacts, leads, or other tables
- No flow update, delete, or run operations
- No $expand, $apply, or $search query options

**Deviations** (6)

- No default page size: whole list returns unless $top is set; real Dataverse pages at 5000
- Client-supplied accountid accepted on create; auto ids are acc-<n>, not GUIDs
- Environments with no stored flows list a fallback seeded seeded-flow-001 entry
- api-version is ignored (version baked into the /v2 path); real Power Platform requires ?api-version=
- $skipToken is camelCase; real Dataverse entity paging uses $skiptoken
- POST accounts echoes the created record; real Dataverse returns 201 empty with OData-EntityId

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v2/environments` — query, auth, paginate, errors
- `GET` `/v2/environments/{env}/connectors` — query, params, auth, paginate, errors
- `GET` `/v2/environments/{env}/api/data/v9.2/accounts` — query, params, auth, stateful, paginate, filter, errors
- `POST` `/v2/environments/{env}/api/data/v9.2/accounts` — body, params, auth, stateful
- `GET` `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` — params, auth, stateful, errors
- `PATCH` `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` — body, params, auth, stateful, errors
- `DELETE` `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` — params, auth, stateful, errors
- `GET` `/v2/environments/{env}/flows` — query, params, auth, stateful, paginate, errors
- `POST` `/v2/environments/{env}/flows` — body, params, auth, stateful

</details>

### printful-style

**Covered** — 13 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v2/store/products` |
| POST | `/v2/store/products` |
| GET | `/v2/store/products/{product_id}` |
| POST | `/orders` |
| GET | `/orders/{order_id}` |
| GET | `/v2/store/orders` |
| POST | `/v2/store/orders` |
| POST | `/v2/store/orders/{order_id}` |
| POST | `/v2/shipping/rates` |
| GET | `/webhooks` |
| POST | `/webhooks` |
| PUT | `/webhooks` |
| DELETE | `/webhooks` |

</details>

**Provider surface** — derived from spec Printful OpenAPI @ 1.0: 55 real routes · 5 covered · 9% · 50 not implemented

<details><summary>not implemented (50)</summary>

- `GET` `/approval-sheets`
- `POST` `/approval-sheets`
- `POST` `/approval-sheets/changes`
- `GET` `/categories`
- `GET` `/categories/{id}`
- `GET` `/countries`
- `POST` `/files`
- `POST` `/files/thread-colors`
- `GET` `/files/{id}`
- `POST` `/mockup-generator/create-task/{id}`
- `GET` `/mockup-generator/printfiles/{id}`
- `GET` `/mockup-generator/task`
- `GET` `/mockup-generator/templates/{id}`
- `GET` `/oauth/scopes`
- `GET` `/orders`
- `POST` `/orders/estimate-costs`
- `DELETE` `/orders/{id}`
- `PUT` `/orders/{id}`
- `POST` `/orders/{id}/confirm`
- `GET` `/product-templates`
- `DELETE` `/product-templates/{id}`
- `GET` `/product-templates/{id}`
- `GET` `/products`
- `GET` `/products/variant/{id}`
- `GET` `/products/{id}`
- `GET` `/products/{id}/sizes`
- `GET` `/reports/statistics`
- `POST` `/shipping/rates`
- `POST` `/store/packing-slip`
- `GET` `/store/products`
- `POST` `/store/products`
- `DELETE` `/store/products/{id}`
- `GET` `/store/products/{id}`
- `PUT` `/store/products/{id}`
- `POST` `/store/products/{id}/variants`
- `DELETE` `/store/variants/{id}`
- `GET` `/store/variants/{id}`
- `PUT` `/store/variants/{id}`
- `GET` `/stores`
- `GET` `/stores/{id}`
- `GET` `/sync/products`
- `DELETE` `/sync/products/{id}`
- `GET` `/sync/products/{id}`
- `DELETE` `/sync/variant/{id}`
- `GET` `/sync/variant/{id}`
- `PUT` `/sync/variant/{id}`
- `GET` `/tax/countries`
- `POST` `/tax/rates`
- `GET` `/warehouse/products`
- `GET` `/warehouse/products/{id}`

</details>

**Missing** (5)

- No package_shipped, package_returned, product_synced, or order_hold events
- No product update or delete (PUT/DELETE /v2/store/products/{product_id})
- No order confirm or cancel (POST /orders/{id}/confirm, DELETE /orders/{id})
- No catalog endpoints (catalog variants, print files, mockup generator)
- No reference endpoints (countries, taxes, store info)

**Deviations** (3)

- Webhook set without a secret signs with built-in mock secret stunt_mock_pful_webhook_secret
- v2 responses are bare data/resources; real Printful wraps every response in {code, result}
- Timestamps are sequence-derived synthetic values, never wall-clock

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v2/store/products` — query, auth, stateful, paginate, errors
- `POST` `/v2/store/products` — body, auth, stateful
- `GET` `/v2/store/products/{product_id}` — params, auth, stateful, errors
- `POST` `/orders` — body, auth, stateful, webhooks, clock
- `GET` `/orders/{order_id}` — params, auth, stateful, errors
- `GET` `/v2/store/orders` — query, auth, stateful, paginate, filter, errors
- `POST` `/v2/store/orders` — body, auth, stateful, webhooks, clock
- `POST` `/v2/store/orders/{order_id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v2/shipping/rates` — body, auth
- `GET` `/webhooks` — auth, stateful
- `POST` `/webhooks` — body, auth, stateful, errors
- `PUT` `/webhooks` — body, auth, stateful, errors
- `DELETE` `/webhooks` — auth, stateful

</details>

### printify-style

**Covered** — 16 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1/catalog/blueprints.json` |
| GET | `/v1/catalog/blueprints/{blueprint_id}/variants.json` |
| GET | `/v1/shops/{shop_id}/products.json` |
| POST | `/v1/shops/{shop_id}/products.json` |
| GET | `/v1/shops/{shop_id}/products/{product_id}` |
| PUT | `/v1/shops/{shop_id}/products/{product_id}` |
| DELETE | `/v1/shops/{shop_id}/products/{product_id}` |
| POST | `/v1/shops/{shop_id}/orders.json` |
| GET | `/v1/shops/{shop_id}/orders/{order_id}` |
| GET | `/v1/orders.json` |
| POST | `/v1/orders.json` |
| POST | `/v1/orders/{order_id}/send.json` |
| GET | `/v1/shops/{shop_id}/webhooks.json` |
| POST | `/v1/shops/{shop_id}/webhooks.json` |
| GET | `/v1/shops/{shop_id}/webhooks/{webhook_id}` |
| DELETE | `/v1/shops/{shop_id}/webhooks/{webhook_id}` |

</details>

**Provider surface** — derived from spec Printify OpenAPI @ 1.0.0: 40 real routes · 11 covered · 27% · 29 not implemented

<details><summary>not implemented (29)</summary>

- `GET` `/v1/catalog/blueprints/{blueprint_id}.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/shipping.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/shipping/economy.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/shipping/express.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/shipping/priority.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/shipping/standard.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/{print_provider_id}/variants.json`
- `GET` `/v1/catalog/print_providers.json`
- `GET` `/v1/catalog/print_providers/{print_provider_id}.json`
- `GET` `/v1/shops.json`
- `DELETE` `/v1/shops/{shop_id}/connection.json`
- `GET` `/v1/shops/{shop_id}/orders.json`
- `POST` `/v1/shops/{shop_id}/orders/express.json`
- `POST` `/v1/shops/{shop_id}/orders/shipping.json`
- `POST` `/v1/shops/{shop_id}/orders/{order_id}/cancel.json`
- `POST` `/v1/shops/{shop_id}/orders/{order_id}/send_to_production.json`
- `GET` `/v1/shops/{shop_id}/products/{product_id}/gpsr.json`
- `POST` `/v1/shops/{shop_id}/products/{product_id}/publish.json`
- `POST` `/v1/shops/{shop_id}/products/{product_id}/publishing_failed.json`
- `POST` `/v1/shops/{shop_id}/products/{product_id}/publishing_succeeded.json`
- `POST` `/v1/shops/{shop_id}/products/{product_id}/unpublish.json`
- `PUT` `/v1/shops/{shop_id}/webhooks/{webhook_id}.json`
- `POST` `/v1/shops/{shop_id}/webhooks/{webhook_id}/simulate`
- `GET` `/v1/uploads.json`
- `POST` `/v1/uploads/images.json`
- `GET` `/v1/uploads/{image_id}.json`
- `POST` `/v1/uploads/{image_id}/archive.json`
- `GET` `/v2/catalog/blueprints/{blueprint_id}/print_providers/{print_provider_id}/shipping.json`

</details>

**Missing** (5)

- No shops endpoints (GET /v1/shops.json); shop_id is a path placeholder
- No image uploads (POST /v1/uploads/images.json)
- No order update route (PUT /v1/shops/{shop_id}/orders/{order_id}.json)
- No product publish/unpublish (publish.json, unpublish.json)
- No shipping calculation or shipping-methods endpoints

**Deviations** (4)

- Webhook without a secret signs with built-in mock secret stunt_mock_potify_webhook_secret
- List envelopes are a stunt invention with hardcoded current_page/per_page/last_page; real Printify returns bare arrays
- total_price is a synthetic whole number (qty x 20); real prices are per-variant cent strings
- The order list is global across shops; real Printify lists orders shop-scoped

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1/catalog/blueprints.json` — query, auth, paginate, errors
- `GET` `/v1/catalog/blueprints/{blueprint_id}/variants.json` — query, params, auth, paginate, errors
- `GET` `/v1/shops/{shop_id}/products.json` — query, params, auth, stateful, paginate, errors
- `POST` `/v1/shops/{shop_id}/products.json` — body, params, auth, stateful, webhooks, clock
- `GET` `/v1/shops/{shop_id}/products/{product_id}` — params, auth, stateful, errors
- `PUT` `/v1/shops/{shop_id}/products/{product_id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/shops/{shop_id}/products/{product_id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/shops/{shop_id}/orders.json` — body, params, auth, stateful, webhooks, clock
- `GET` `/v1/shops/{shop_id}/orders/{order_id}` — params, auth, stateful, errors
- `GET` `/v1/orders.json` — query, auth, stateful, paginate, errors
- `POST` `/v1/orders.json` — body, params, auth, stateful, webhooks, clock
- `POST` `/v1/orders/{order_id}/send.json` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/shops/{shop_id}/webhooks.json` — params, auth, stateful
- `POST` `/v1/shops/{shop_id}/webhooks.json` — body, params, auth, stateful, errors, clock
- `GET` `/v1/shops/{shop_id}/webhooks/{webhook_id}` — params, auth, stateful, errors
- `DELETE` `/v1/shops/{shop_id}/webhooks/{webhook_id}` — params, auth, stateful, errors

</details>

### producthunt-style

**Covered** — 0 routes · GraphQL schema

**Missing** (3)

- Only postCreate mutation — no vote, comment, or post-update mutations
- No users or topics queries (user, users, topic)
- No comments or collections surfaces

**Deviations** (2)

- GraphQL served at /v2/api/graphql.json; real Product Hunt path is /v2/api/graphql
- GraphQL endpoint is open — no OAuth developer-token check (transport has no auth hook)

### psd2-style

**Covered** — 19 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/oauth/token` |
| POST | `/v1/consents` |
| GET | `/v1/consents/{consentId}` |
| DELETE | `/v1/consents/{consentId}` |
| POST | `/v1/consents/{consentId}/authorisations` |
| GET | `/v1/consents/{consentId}/authorisations/{authorisationId}` |
| PUT | `/v1/consents/{consentId}/authorisations/{authorisationId}` |
| POST | `/v1/consents/{consentId}/authorisations/{authorisationId}` |
| GET | `/v1/accounts` |
| GET | `/v1/accounts/{resourceId}/balances` |
| GET | `/v1/accounts/{resourceId}/transactions` |
| POST | `/v1/payments/{product}` |
| GET | `/v1/payments/{product}/{paymentId}/status` |
| POST | `/v1/payments/{product}/{paymentId}/authorisations` |
| GET | `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` |
| PUT | `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` |
| POST | `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` |
| GET | `/v1/payments/{product}/{paymentId}` |
| DELETE | `/v1/payments/{product}/{paymentId}` |

</details>

**Missing** (6)

- No Confirmation of Funds (POST /v1/funds-confirmations)
- No card accounts (GET /v1/card-accounts and card transactions)
- No periodic or bulk payments (standing orders)
- No transaction detail (GET /v1/accounts/{id}/transactions/{resourceId})
- No GET /v1/consents/{id}/status sub-resource
- No payment cancellation-authorisations SCA sub-resource

**Deviations** (7)

- SCA finalisation is derive-on-read after a fixed 1s challenge window
- Payment status derives on read: ACTC at 1s, ACSC at 3s — fixed, not bank async
- simulate_fail: true in POST /payments forces RJCT (simulator-only trigger)
- Signed transition webhooks are a simulator extension; NextGenPSD2 defines none
- scaRedirect _links URL is synthetic — no real bank SCA login page behind it
- DELETE consent returns 200 + body; real NextGenPSD2 returns 204 No Content
- PARAMETER_MISSING-<FIELD> error codes are simulator conventions, not the official code list

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/oauth/token` — body, stateful, clock
- `POST` `/v1/consents` — body, stateful, clock
- `GET` `/v1/consents/{consentId}` — params, stateful, clock
- `DELETE` `/v1/consents/{consentId}` — params, stateful, clock
- `POST` `/v1/consents/{consentId}/authorisations` — params, stateful, clock
- `GET` `/v1/consents/{consentId}/authorisations/{authorisationId}` — params, stateful, webhooks, clock
- `PUT` `/v1/consents/{consentId}/authorisations/{authorisationId}` — body, params, stateful, clock
- `POST` `/v1/consents/{consentId}/authorisations/{authorisationId}` — body, params, stateful, clock
- `GET` `/v1/accounts` — query, stateful, paginate, webhooks, clock
- `GET` `/v1/accounts/{resourceId}/balances` — params, stateful, webhooks, clock
- `GET` `/v1/accounts/{resourceId}/transactions` — query, params, stateful, filter, webhooks, clock
- `POST` `/v1/payments/{product}` — body, params, stateful, webhooks, clock
- `GET` `/v1/payments/{product}/{paymentId}/status` — params, stateful, webhooks, clock
- `POST` `/v1/payments/{product}/{paymentId}/authorisations` — params, stateful, clock
- `GET` `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` — params, stateful, webhooks, clock
- `PUT` `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` — body, params, stateful, clock
- `POST` `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` — body, params, stateful, clock
- `GET` `/v1/payments/{product}/{paymentId}` — params, stateful, webhooks, clock
- `DELETE` `/v1/payments/{product}/{paymentId}` — params, stateful, webhooks, clock

</details>

### qbo-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth/v2/authorize` |
| POST | `/oauth/v2/tokens/bearer` |
| GET | `/v3/company/{realmId}/query` |
| POST | `/v3/company/{realmId}/query` |
| GET | `/v3/company/{realmId}/customer` |
| POST | `/v3/company/{realmId}/customer` |
| GET | `/v3/company/{realmId}/customer/{id}` |
| DELETE | `/v3/company/{realmId}/customer/{id}` |
| POST | `/v3/company/{realmId}/invoice` |
| GET | `/v3/company/{realmId}/invoice/{id}` |
| DELETE | `/v3/company/{realmId}/invoice/{id}` |

</details>

**Missing** (6)

- Only Customer and Invoice — no Payment, Estimate, Item, Vendor, etc.
- No QSQL aggregates (COUNT, SUM, MAX, MIN, AVG)
- No batch endpoint (POST /v3/company/{realmId}/batch)
- No CDC endpoint (GET /v3/company/{realmId}/cdc)
- No reports endpoints (Profit and Loss, Balance Sheet, Trial Balance)
- No Intuit webhooks (QBO event notifications)

**Deviations** (4)

- Malformed FROM tokens fall back to substring entity matching instead of erroring
- Full (non-sparse) update merges like sparse; real QBO replaces and clears omitted fields
- SyncToken optimistic concurrency is not enforced — stale tokens still update
- Data is not realm-partitioned: one realm's token reads another realm's records

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth/v2/authorize` — query, stateful, errors
- `POST` `/oauth/v2/tokens/bearer` — body, stateful, errors, clock
- `GET` `/v3/company/{realmId}/query` — body, query, params, auth, stateful, filter, clock
- `POST` `/v3/company/{realmId}/query` — body, query, params, auth, stateful, filter, clock
- `GET` `/v3/company/{realmId}/customer` — query, params, auth, stateful, filter, clock
- `POST` `/v3/company/{realmId}/customer` — body, params, auth, stateful, clock
- `GET` `/v3/company/{realmId}/customer/{id}` — params, auth, stateful, clock
- `DELETE` `/v3/company/{realmId}/customer/{id}` — params, auth, stateful, clock
- `POST` `/v3/company/{realmId}/invoice` — body, query, params, auth, stateful, clock
- `GET` `/v3/company/{realmId}/invoice/{id}` — params, auth, stateful, clock
- `DELETE` `/v3/company/{realmId}/invoice/{id}` — params, auth, stateful, clock

</details>

### reddit-style

**Covered** — 2 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/v1/access_token` |
| POST | `/api/submit` |

</details>

**Missing** (5)

- No listing endpoints (subreddit hot/new/top, thread comment pages)
- No votes or comments (/api/vote, /api/comment)
- No identity endpoint (GET /api/v1/me)
- No token revocation (POST /api/v1/revoke_token)
- No subreddit, search, or inbox/messages endpoints

**Deviations** (3)

- User-Agent gate simplified: any UA containing / and ( passes, else 429
- The authorization_code grant never validates code or redirect_uri — any or missing code mints tokens
- Post ids are plain sequence strings, not Reddit base36

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/v1/access_token` — body, auth, stateful, errors, clock
- `POST` `/api/submit` — body, auth, stateful, errors, clock

</details>

### resend-style

**Covered** — 6 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/emails` |
| GET | `/emails` |
| GET | `/emails/{id}` |
| POST | `/webhooks` |
| GET | `/webhooks` |
| DELETE | `/webhooks/{id}` |

</details>

**Provider surface** — derived from sdk resend-node @ 6.22.0 (floor): 20 real routes · 2 covered · 10% · 18 not implemented

<details><summary>not implemented (18)</summary>

- `POST` `/api-keys`
- `POST` `/automations`
- `POST` `/broadcasts`
- `POST` `/contact-properties`
- `POST` `/contacts`
- `POST` `/contacts/imports`
- `POST` `/domains`
- `POST` `/domains/claim`
- `POST` `/emails/batch`
- `POST` `/events`
- `POST` `/events/send`
- `POST` `/segments`
- `POST` `/suppressions`
- `POST` `/suppressions/batch/add`
- `POST` `/suppressions/batch/remove`
- `POST` `/templates`
- `GET` `/topics`
- `POST` `/topics`

</details>

**Missing** (6)

- No domains surface (create, list, verify, delete)
- No API keys management (/api-keys)
- No batch send (POST /emails/batch)
- No scheduled sends (schedule, cancel schedule)
- No audiences or contacts
- No broadcasts or tags

**Deviations** (3)

- Delivery derives on read: sent at +1s, delivered at +3s — fixed, not async
- simulate_fail: true in POST /emails forces bounced terminal (simulator extension)
- Webhook events fire exactly once on the first deriving read, not on real delivery

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/emails` — body, auth, stateful, clock
- `GET` `/emails` — query, auth, stateful, paginate, webhooks, errors, clock
- `GET` `/emails/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/webhooks` — body, auth, stateful, clock
- `GET` `/webhooks` — auth, stateful
- `DELETE` `/webhooks/{id}` — params, auth, stateful, errors

</details>

### revenuecat-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/receipts` |
| POST | `/v1/webhooks` |
| GET | `/v1/webhooks` |
| POST | `/v1/subscribers/{app_user_id}/subscriptions/{product_id}/revoke` |
| GET | `/v1/subscribers/{app_user_id}` |
| POST | `/v1/subscribers/{app_user_id}` |
| DELETE | `/v1/subscribers/{app_user_id}` |

</details>

**Provider surface** — derived from spec RevenueCat API v1 reference @ 1.0: 15 real routes · 4 covered · 26% · 11 not implemented

<details><summary>not implemented (11)</summary>

- `POST` `/v1/subscribers/{app_user_id}/attributes`
- `POST` `/v1/subscribers/{app_user_id}/attribution`
- `POST` `/v1/subscribers/{app_user_id}/entitlements/{entitlement_identifier}/promotional`
- `POST` `/v1/subscribers/{app_user_id}/entitlements/{entitlement_identifier}/revoke_promotionals`
- `GET` `/v1/subscribers/{app_user_id}/offerings`
- `DELETE` `/v1/subscribers/{app_user_id}/offerings/override`
- `POST` `/v1/subscribers/{app_user_id}/offerings/{offering_uuid}/override`
- `POST` `/v1/subscribers/{app_user_id}/subscriptions/{product_identifier}/defer`
- `POST` `/v1/subscribers/{app_user_id}/subscriptions/{store_transaction_identifier}/cancel`
- `POST` `/v1/subscribers/{app_user_id}/subscriptions/{store_transaction_identifier}/extend`
- `POST` `/v1/subscribers/{app_user_id}/transactions/{store_transaction_identifier}/refund`

</details>

**Missing** (5)

- No attribution endpoint (POST /v1/subscribers/{id}/attribution)
- No offers API (promotional offer creation)
- No v2 webhooks — only unsigned v1 events
- Only ios and android platforms — no amazon, stripe, or web billing
- No v2 REST surface (customers, subscriptions, entitlements)

**Deviations** (5)

- fetch_token prefixed with invalid is the deterministic bad-receipt 400 path
- Subscription expiry is derive-on-read; first read past it fires EXPIRATION
- POST /v1/subscribers accepts _expires_at seeding to drive EXPIRATION in tests
- pk_ public keys are simulator convention; real RC public keys are appl_/goog_-prefixed
- REST webhook registration does not exist in real RC v1 (dashboard-configured)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/receipts` — body, auth, stateful, webhooks, errors, clock
- `POST` `/v1/webhooks` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/webhooks` — auth, stateful, clock
- `POST` `/v1/subscribers/{app_user_id}/subscriptions/{product_id}/revoke` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/subscribers/{app_user_id}` — params, auth, stateful, webhooks, clock
- `POST` `/v1/subscribers/{app_user_id}` — body, params, auth, stateful, webhooks, clock
- `DELETE` `/v1/subscribers/{app_user_id}` — params, auth, stateful, errors, clock

</details>

### salesforce-style

**Covered** — 29 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/services/oauth2/token` |
| GET | `/services/data/v60.0/sobjects` |
| GET | `/services/data/v60.0/sobjects/Account` |
| GET | `/services/data/v60.0/sobjects/Contact` |
| GET | `/services/data/v60.0/sobjects/Opportunity` |
| GET | `/services/data/v60.0/sobjects/Lead` |
| GET | `/services/data/v60.0/sobjects/User` |
| POST | `/services/data/v60.0/sobjects/Account` |
| GET | `/services/data/v60.0/sobjects/Account/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Account/{id}` |
| DELETE | `/services/data/v60.0/sobjects/Account/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Account/{extIdField}/{extIdValue}` |
| POST | `/services/data/v60.0/sobjects/Contact` |
| GET | `/services/data/v60.0/sobjects/Contact/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Contact/{id}` |
| DELETE | `/services/data/v60.0/sobjects/Contact/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Contact/{extIdField}/{extIdValue}` |
| POST | `/services/data/v60.0/sobjects/Opportunity` |
| GET | `/services/data/v60.0/sobjects/Opportunity/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Opportunity/{id}` |
| DELETE | `/services/data/v60.0/sobjects/Opportunity/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Opportunity/{extIdField}/{extIdValue}` |
| GET | `/services/data/v60.0/query` |
| GET | `/services/data/v60.0/queryAll` |
| GET | `/services/data/v60.0/query/{queryLocator}` |
| POST | `/services/data/v60.0/composite` |
| POST | `/services/data/v60.0/composite/sobjects` |
| PATCH | `/services/data/v60.0/composite/sobjects` |
| DELETE | `/services/data/v60.0/composite/sobjects` |

</details>

**Missing** (7)

- No Lead or User CRUD routes
- No query or queryAll sub-requests in composite batches
- No SOSL search (GET /search)
- No composite tree upsert (POST /composite/tree)
- No batch endpoint (GET /composite/batch/sobjects)
- No Bulk API 2.0 (jobs/ingest, jobs/query)
- No GET updated/deleted incremental-refresh endpoints

**Deviations** (4)

- instance_url echoes the caller host over http:// (real: the org https:// instance)
- Governor limits (100 SOQL/txn, 10k DML rows) documented but not enforced
- SOQL WHERE subset: no parenthesized grouping; date literals compared lexically
- Password grant accepted for convenience; real SF requires web-server or JWT flow

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/services/oauth2/token` — body, stateful, errors, clock
- `GET` `/services/data/v60.0/sobjects` — auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Account` — auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Contact` — auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Opportunity` — auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Lead` — auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/User` — auth, stateful, clock
- `POST` `/services/data/v60.0/sobjects/Account` — body, auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Account/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Account/{id}` — body, params, auth, stateful, clock
- `DELETE` `/services/data/v60.0/sobjects/Account/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Account/{extIdField}/{extIdValue}` — body, params, auth, stateful, clock
- `POST` `/services/data/v60.0/sobjects/Contact` — body, auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Contact/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Contact/{id}` — body, params, auth, stateful, clock
- `DELETE` `/services/data/v60.0/sobjects/Contact/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Contact/{extIdField}/{extIdValue}` — body, params, auth, stateful, clock
- `POST` `/services/data/v60.0/sobjects/Opportunity` — body, auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Opportunity/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Opportunity/{id}` — body, params, auth, stateful, clock
- `DELETE` `/services/data/v60.0/sobjects/Opportunity/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Opportunity/{extIdField}/{extIdValue}` — body, params, auth, stateful, clock
- `GET` `/services/data/v60.0/query` — query, auth, stateful, clock
- `GET` `/services/data/v60.0/queryAll` — query, auth, stateful, clock
- `GET` `/services/data/v60.0/query/{queryLocator}` — params, auth, stateful, clock
- `POST` `/services/data/v60.0/composite` — body, auth, stateful, clock
- `POST` `/services/data/v60.0/composite/sobjects` — body, auth, stateful, clock
- `PATCH` `/services/data/v60.0/composite/sobjects` — body, auth, stateful, clock
- `DELETE` `/services/data/v60.0/composite/sobjects` — query, auth, stateful, clock

</details>

### sendgrid-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v3/mail/send` |
| GET | `/v3/messages` |
| POST | `/v3/user/webhooks/event/settings` |
| GET | `/v3/user/webhooks/event/settings` |
| POST | `/v3/user/webhooks/event/test` |

</details>

**Provider surface** — derived from spec sendgrid-oai tsg_mail_v3 + tsg_email_activity_v3 + tsg_webhooks_v3 @ 1.0.0, 1.0.0, 1.0.0: 26 real routes · 4 covered · 15% · 22 not implemented

<details><summary>not implemented (22)</summary>

- `POST` `/v3/mail/batch`
- `GET` `/v3/mail/batch/{batch_id}`
- `POST` `/v3/messages/download`
- `GET` `/v3/messages/download/{download_uuid}`
- `GET` `/v3/messages/{msg_id}`
- `GET` `/v3/user/webhooks/event/settings/all`
- `GET` `/v3/user/webhooks/event/settings/signed/{id}`
- `PATCH` `/v3/user/webhooks/event/settings/signed/{id}`
- `DELETE` `/v3/user/webhooks/event/settings/{id}`
- `GET` `/v3/user/webhooks/event/settings/{id}`
- `PATCH` `/v3/user/webhooks/event/settings/{id}`
- `GET` `/v3/user/webhooks/parse/settings`
- `POST` `/v3/user/webhooks/parse/settings`
- `DELETE` `/v3/user/webhooks/parse/settings/{hostname}`
- `GET` `/v3/user/webhooks/parse/settings/{hostname}`
- `PATCH` `/v3/user/webhooks/parse/settings/{hostname}`
- `GET` `/v3/user/webhooks/parse/stats`
- `GET` `/v3/user/webhooks/security/policies`
- `POST` `/v3/user/webhooks/security/policies`
- `DELETE` `/v3/user/webhooks/security/policies/{id}`
- `GET` `/v3/user/webhooks/security/policies/{id}`
- `PATCH` `/v3/user/webhooks/security/policies/{id}`

</details>

**Missing** (7)

- No single-message fetch (GET /v3/messages/{msg_id})
- No GET of event-webhook settings (POST-only)
- No suppression lists (bounces, blocks, invalid emails, spam reports)
- No scheduled-send management (/v3/scheduled_sends)
- No API keys management (/v3/api_keys)
- No sender authentication or domains setup
- No templates surface (/v3/templates)

**Deviations** (6)

- Webhook ECDSA signature is raw r||s (64 bytes), not Twilio ASN.1 DER encoding
- simulate_fail: true in send body forces dropped terminal (simulator extension)
- delivered derives at fixed +3s on first list read, not real async delivery
- Email Activity query subset: =, !=, CONTAINS terms AND-ed over six fields
- Each delivery wraps one event in the transport envelope; real SendGrid batches a JSON array of events
- asm, sandbox_mode, and batch_id are accepted but not modeled

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v3/mail/send` — body, auth, stateful, webhooks, clock
- `GET` `/v3/messages` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `POST` `/v3/user/webhooks/event/settings` — body, auth, stateful, errors, clock
- `GET` `/v3/user/webhooks/event/settings` — auth, stateful, clock
- `POST` `/v3/user/webhooks/event/test` — auth, stateful, webhooks, errors, clock

</details>

### servicenow-style

**Covered** — 44 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/api/now/table/incident` |
| POST | `/api/now/table/incident` |
| GET | `/api/now/table/incident/{sys_id}` |
| PUT | `/api/now/table/incident/{sys_id}` |
| PATCH | `/api/now/table/incident/{sys_id}` |
| DELETE | `/api/now/table/incident/{sys_id}` |
| GET | `/api/now/table/task` |
| POST | `/api/now/table/task` |
| GET | `/api/now/table/task/{sys_id}` |
| PUT | `/api/now/table/task/{sys_id}` |
| PATCH | `/api/now/table/task/{sys_id}` |
| DELETE | `/api/now/table/task/{sys_id}` |
| GET | `/api/now/table/change_request` |
| POST | `/api/now/table/change_request` |
| GET | `/api/now/table/change_request/{sys_id}` |
| PUT | `/api/now/table/change_request/{sys_id}` |
| PATCH | `/api/now/table/change_request/{sys_id}` |
| DELETE | `/api/now/table/change_request/{sys_id}` |
| GET | `/api/now/table/cmdb_ci` |
| POST | `/api/now/table/cmdb_ci` |
| GET | `/api/now/table/cmdb_ci/{sys_id}` |
| PUT | `/api/now/table/cmdb_ci/{sys_id}` |
| PATCH | `/api/now/table/cmdb_ci/{sys_id}` |
| DELETE | `/api/now/table/cmdb_ci/{sys_id}` |
| GET | `/api/now/table/sys_user` |
| POST | `/api/now/table/sys_user` |
| GET | `/api/now/table/sys_user/{sys_id}` |
| PUT | `/api/now/table/sys_user/{sys_id}` |
| PATCH | `/api/now/table/sys_user/{sys_id}` |
| DELETE | `/api/now/table/sys_user/{sys_id}` |
| GET | `/api/now/table/sys_user_group` |
| POST | `/api/now/table/sys_user_group` |
| GET | `/api/now/table/sys_user_group/{sys_id}` |
| PUT | `/api/now/table/sys_user_group/{sys_id}` |
| PATCH | `/api/now/table/sys_user_group/{sys_id}` |
| DELETE | `/api/now/table/sys_user_group/{sys_id}` |
| GET | `/api/now/table/sc_req_item` |
| POST | `/api/now/table/sc_req_item` |
| GET | `/api/now/table/sc_req_item/{sys_id}` |
| PUT | `/api/now/table/sc_req_item/{sys_id}` |
| PATCH | `/api/now/table/sc_req_item/{sys_id}` |
| DELETE | `/api/now/table/sc_req_item/{sys_id}` |
| GET | `/api/now/table/sys_metadata` |
| POST | `/api/now/import/u_my_table` |

</details>

**Missing** (5)

- Only a fixed table set (incident, task, change_request, cmdb_ci, ...) — no custom tables
- No attachment API (/api/now/attachment)
- No aggregate statistics API (/api/now/stats/{table})
- No service catalog API (/api/sn_sc/servicecatalog)
- No batch API (/api/now/v1/batch)

**Deviations** (1)

- sysparm_query supports an operator subset; NOT LIKE and similar 400-rejected

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/api/now/table/incident` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/incident` — body, auth, stateful, clock
- `GET` `/api/now/table/incident/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/incident/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/incident/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/incident/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/task` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/task` — body, auth, stateful, clock
- `GET` `/api/now/table/task/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/task/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/task/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/task/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/change_request` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/change_request` — body, auth, stateful, clock
- `GET` `/api/now/table/change_request/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/change_request/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/change_request/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/change_request/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/cmdb_ci` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/cmdb_ci` — body, auth, stateful, clock
- `GET` `/api/now/table/cmdb_ci/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/cmdb_ci/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/cmdb_ci/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/cmdb_ci/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/sys_user` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/sys_user` — body, auth, stateful, clock
- `GET` `/api/now/table/sys_user/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/sys_user/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/sys_user/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/sys_user/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/sys_user_group` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/sys_user_group` — body, auth, stateful, clock
- `GET` `/api/now/table/sys_user_group/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/sys_user_group/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/sys_user_group/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/sys_user_group/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/sc_req_item` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/sc_req_item` — body, auth, stateful, clock
- `GET` `/api/now/table/sc_req_item/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/sc_req_item/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/sc_req_item/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/sc_req_item/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/sys_metadata` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/import/u_my_table` — body, auth, stateful, clock

</details>

### shopify-style

**Covered** — 21 routes · GraphQL schema

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/admin/oauth/authorize` |
| POST | `/admin/oauth/access_token` |
| GET | `/admin/api/2024-10/products.json` |
| POST | `/admin/api/2024-10/products.json` |
| GET | `/admin/api/2024-10/products/{product_id}` |
| PUT | `/admin/api/2024-10/products/{product_id}` |
| DELETE | `/admin/api/2024-10/products/{product_id}` |
| GET | `/admin/api/2024-10/orders.json` |
| POST | `/admin/api/2024-10/orders.json` |
| GET | `/admin/api/2024-10/orders/{order_id}` |
| POST | `/admin/api/2024-10/orders/{order_id}/cancel.json` |
| POST | `/admin/api/2024-10/orders/{order_id}/close.json` |
| POST | `/admin/api/2024-10/orders/{order_id}/fulfillments.json` |
| POST | `/admin/api/2024-10/orders/{order_id}/transactions.json` |
| GET | `/admin/api/2024-10/customers.json` |
| POST | `/admin/api/2024-10/customers.json` |
| PUT | `/admin/api/2024-10/customers/{customer_id}` |
| DELETE | `/admin/api/2024-10/customers/{customer_id}` |
| GET | `/admin/api/2024-10/webhooks.json` |
| POST | `/admin/api/2024-10/webhooks.json` |
| DELETE | `/admin/api/2024-10/webhooks/{webhook_id}` |

</details>

**Missing** (7)

- No fulfillment-orders or fulfillment-events endpoints (fulfillments POST only)
- No transaction listing (GET /orders/{id}/transactions.json)
- No refunds endpoint (POST /orders/{id}/refunds.json)
- No Inventory API (inventory_items, inventory_levels)
- No product image or standalone variant CRUD routes
- GraphQL schema limited to shop, product, order, customer types
- No price rules, discount codes, gift cards, or draft orders

**Deviations** (4)

- GraphQL endpoint skips the X-Shopify-Access-Token check the REST surface enforces
- Webhook payloads ride stunt {type, payload} envelope, not raw Shopify event bodies
- OAuth authorize redirect omits the hmac query-param signature it documents
- GraphQL query arg subset: bare substring plus field:value equality tokens only

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/admin/oauth/authorize` — query, stateful, errors
- `POST` `/admin/oauth/access_token` — body, stateful, errors
- `GET` `/admin/api/2024-10/products.json` — query, auth, stateful, paginate, clock
- `POST` `/admin/api/2024-10/products.json` — body, auth, stateful, webhooks, clock
- `GET` `/admin/api/2024-10/products/{product_id}` — params, auth, stateful, errors, clock
- `PUT` `/admin/api/2024-10/products/{product_id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/admin/api/2024-10/products/{product_id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/admin/api/2024-10/orders.json` — query, auth, stateful, paginate, filter, clock
- `POST` `/admin/api/2024-10/orders.json` — body, auth, stateful, webhooks, errors, clock
- `GET` `/admin/api/2024-10/orders/{order_id}` — params, auth, stateful, errors, clock
- `POST` `/admin/api/2024-10/orders/{order_id}/cancel.json` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/admin/api/2024-10/orders/{order_id}/close.json` — params, auth, stateful, webhooks, errors, clock
- `POST` `/admin/api/2024-10/orders/{order_id}/fulfillments.json` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/admin/api/2024-10/orders/{order_id}/transactions.json` — body, params, auth, stateful, errors, clock
- `GET` `/admin/api/2024-10/customers.json` — query, auth, stateful, paginate, clock
- `POST` `/admin/api/2024-10/customers.json` — body, auth, stateful, webhooks, errors, clock
- `PUT` `/admin/api/2024-10/customers/{customer_id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/admin/api/2024-10/customers/{customer_id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/admin/api/2024-10/webhooks.json` — query, auth, stateful, paginate, clock
- `POST` `/admin/api/2024-10/webhooks.json` — body, auth, stateful, clock
- `DELETE` `/admin/api/2024-10/webhooks/{webhook_id}` — params, auth, stateful, errors, clock

</details>

### signin-with-apple-style

**Covered** — 3 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/auth/authorize` |
| POST | `/auth/token` |
| GET | `/auth/keys` |

</details>

**Missing** (3)

- No token revocation (POST /auth/revoke)
- No user endpoint (GET /auth/user for name/email)
- No server-to-server events (POST /api/v1/revoke)

**Deviations** (2)

- JWKS serves one fixed synthetic P-256 key (kid mock-siwa-key-1) — no rotation
- client_secret checks alg, signature, aud, exp only — iss/sub claims not enforced

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/auth/authorize` — query, stateful, errors
- `POST` `/auth/token` — body, stateful, errors, clock
- `GET` `/auth/keys` — —

</details>

### slack-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/auth.test` |
| POST | `/api/chat.postMessage` |
| POST | `/api/conversations.create` |
|  | `/api/conversations.list` |
|  | `/api/conversations.history` |
| POST | `/api/reactions.add` |
| POST | `/api/apps.events.url` |

</details>

**Provider surface** — derived from sdk slack-node @ 7.19.0 (floor): 272 real routes · 6 covered · 2% · 266 not implemented

<details><summary>not implemented (266)</summary>

- `POST` `/api/admin.analytics.getFile`
- `POST` `/api/admin.apps.activities.list`
- `POST` `/api/admin.apps.approve`
- `POST` `/api/admin.apps.approved.list`
- `POST` `/api/admin.apps.clearResolution`
- `POST` `/api/admin.apps.config.lookup`
- `POST` `/api/admin.apps.config.set`
- `POST` `/api/admin.apps.requests.cancel`
- `POST` `/api/admin.apps.requests.list`
- `POST` `/api/admin.apps.restrict`
- `POST` `/api/admin.apps.restricted.list`
- `POST` `/api/admin.apps.uninstall`
- `POST` `/api/admin.auth.policy.assignEntities`
- `POST` `/api/admin.auth.policy.getEntities`
- `POST` `/api/admin.auth.policy.removeEntities`
- `POST` `/api/admin.barriers.create`
- `POST` `/api/admin.barriers.delete`
- `POST` `/api/admin.barriers.list`
- `POST` `/api/admin.barriers.update`
- `POST` `/api/admin.conversations.archive`
- `POST` `/api/admin.conversations.bulkArchive`
- `POST` `/api/admin.conversations.bulkDelete`
- `POST` `/api/admin.conversations.bulkMove`
- `POST` `/api/admin.conversations.convertToPrivate`
- `POST` `/api/admin.conversations.convertToPublic`
- `POST` `/api/admin.conversations.create`
- `POST` `/api/admin.conversations.delete`
- `POST` `/api/admin.conversations.disconnectShared`
- `POST` `/api/admin.conversations.ekm.listOriginalConnectedChannelInfo`
- `POST` `/api/admin.conversations.getConversationPrefs`
- `POST` `/api/admin.conversations.getCustomRetention`
- `POST` `/api/admin.conversations.getTeams`
- `POST` `/api/admin.conversations.invite`
- `POST` `/api/admin.conversations.lookup`
- `POST` `/api/admin.conversations.removeCustomRetention`
- `POST` `/api/admin.conversations.rename`
- `POST` `/api/admin.conversations.restrictAccess.addGroup`
- `POST` `/api/admin.conversations.restrictAccess.listGroups`
- `POST` `/api/admin.conversations.restrictAccess.removeGroup`
- `POST` `/api/admin.conversations.search`
- `POST` `/api/admin.conversations.setConversationPrefs`
- `POST` `/api/admin.conversations.setCustomRetention`
- `POST` `/api/admin.conversations.setTeams`
- `POST` `/api/admin.conversations.unarchive`
- `POST` `/api/admin.emoji.add`
- `POST` `/api/admin.emoji.addAlias`
- `POST` `/api/admin.emoji.list`
- `POST` `/api/admin.emoji.remove`
- `POST` `/api/admin.emoji.rename`
- `POST` `/api/admin.functions.list`
… and 216 more


</details>

**Missing** (6)

- Only 7 Web API methods; no chat.update, chat.delete, or chat.scheduleMessage
- No conversations.members, join, leave, open, or rename; no users.list/users.info
- No reactions.remove or reactions.list
- No message threads: conversations.replies and chat.getPermalink absent
- No files (files.upload/info/list), search, views, or dialogs surfaces
- Only message, channel_created, reaction_added events; no app_mention or team_join

**Deviations** (2)

- apps.events.url config endpoint is simulator-only; real Slack sets it in the app dashboard
- Events deliveries wrap Slack event_callback payloads in an extra stunt envelope

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/auth.test` — auth, stateful, clock
- `POST` `/api/chat.postMessage` — body, auth, stateful, webhooks, clock
- `POST` `/api/conversations.create` — body, auth, stateful, webhooks, clock
- `` `/api/conversations.list` — body, query, auth, stateful, paginate, clock
- `` `/api/conversations.history` — body, query, auth, stateful, paginate, clock
- `POST` `/api/reactions.add` — body, auth, stateful, webhooks, clock
- `POST` `/api/apps.events.url` — body, auth, stateful, webhooks, clock

</details>

### smartbill-style

**Covered** — 18 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/invoice` |
| GET | `/invoice` |
| PUT | `/invoice/cancel` |
| PUT | `/invoice/restore` |
| GET | `/invoice/paymentstatus` |
| POST | `/estimate` |
| GET | `/estimate` |
| PUT | `/estimate/cancel` |
| POST | `/purchase` |
| GET | `/purchase` |
| POST | `/payment` |
| DELETE | `/payment/v2` |
| GET | `/stocks` |
| POST | `/document/send` |
| GET | `/tax` |
| GET | `/series` |
| POST | `/sim/company` |
| POST | `/sim/stocks/movement` |

</details>

**Missing** (3)

- No invoice/estimate/purchase list endpoints
- No PDF rendering, e-Factura (ANAF SPV) transmission, or email/SMS delivery
- No GET /invoice/paymentstatus (paidAmount/unpaidAmount/paid reporting)

**Deviations** (4)

- paymentId on POST /invoice/payment is a simulator extension for the delete flow
- /tax and /series require no cif (real SmartBill scopes both per company)
- cif falls back to ?cif= for POST bodies; the real API takes companyVatCode from the body only
- Overpaid invoices report paidAmount above total and a zero-total invoice can never read paid

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/invoice` — body, query, stateful, clock
- `GET` `/invoice` — query, stateful
- `PUT` `/invoice/cancel` — body, query, stateful
- `PUT` `/invoice/restore` — body, query, stateful
- `GET` `/invoice/paymentstatus` — query, stateful
- `POST` `/estimate` — body, query, stateful, clock
- `GET` `/estimate` — query, stateful
- `PUT` `/estimate/cancel` — body, query, stateful
- `POST` `/purchase` — body, query, stateful, clock
- `GET` `/purchase` — query, stateful
- `POST` `/payment` — body, query, stateful, clock
- `DELETE` `/payment/v2` — body, query, stateful
- `GET` `/stocks` — query, stateful
- `POST` `/document/send` — body, query, stateful, clock
- `GET` `/tax` — —
- `GET` `/series` — —
- `POST` `/sim/company` — body, stateful
- `POST` `/sim/stocks/movement` — body, query, stateful

</details>

### sqs-style

**Covered** — 2 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/` |
| POST | `/{queueName}` |

</details>

**Missing** (4)

- No ListQueues MaxResults/NextToken paging; no AttributeNames prefix wildcards (.*)
- No AddPermission/RemovePermission, Tag/Untag/ListQueueTags, or ListDeadLetterSourceQueues
- No presigned URL (query-parameter) auth; SigV4 Authorization header only
- FIFO queues allowed by name only; no MessageGroupId or deduplication semantics

**Deviations** (5)

- QueueUrl omits the 12-digit account id; http://<host>/<queueName> instead of the AWS path
- No long polling: WaitTimeSeconds is validated but never blocks; receive returns at once
- MD5OfMessageAttributes omitted (compound encoding not reproduced), only body MD5
- PurgeQueue is immediate, not async; the one-purge-per-60s rule is still enforced
- Message ids and receipt handles are synthetic deterministic strings, not real AWS ids

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/` — body, query, stateful, clock
- `POST` `/{queueName}` — body, query, params, stateful, clock

</details>

### square-style

**Covered** — 18 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/oauth2/token` |
| GET | `/v2/payments` |
| POST | `/v2/payments` |
| GET | `/v2/payments/{id}` |
| DELETE | `/v2/payments/{id}` |
| POST | `/v2/payments/{id}/complete` |
| POST | `/v2/payments/{id}/capture` |
| GET | `/v2/refunds` |
| POST | `/v2/refunds` |
| GET | `/v2/locations` |
| POST | `/v2/catalog/search` |
| POST | `/v2/orders` |
| POST | `/v2/orders/calculate` |
| GET | `/v2/orders/{id}` |
| PUT | `/v2/orders/{id}` |
| DELETE | `/v2/orders/{id}` |
| POST | `/v2/orders/{id}/pay` |
| POST | `/v2/orders/{id}/complete` |

</details>

**Provider surface** — derived from sdk square-node @ 45.1.0 (floor): 329 real routes · 13 covered · 3% · 316 not implemented

<details><summary>not implemented (316)</summary>

- `POST` `/v2/apple-pay/domains`
- `GET` `/v2/bank-accounts`
- `POST` `/v2/bank-accounts`
- `GET` `/v2/bank-accounts/by-v1-id/{v1_bank_account_id}`
- `GET` `/v2/bank-accounts/{bank_account_id}`
- `POST` `/v2/bank-accounts/{bank_account_id}/disable`
- `GET` `/v2/bookings`
- `POST` `/v2/bookings`
- `POST` `/v2/bookings/availability/search`
- `POST` `/v2/bookings/bulk-retrieve`
- `GET` `/v2/bookings/business-booking-profile`
- `GET` `/v2/bookings/custom-attribute-definitions`
- `POST` `/v2/bookings/custom-attribute-definitions`
- `DELETE` `/v2/bookings/custom-attribute-definitions/{key}`
- `GET` `/v2/bookings/custom-attribute-definitions/{key}`
- `PUT` `/v2/bookings/custom-attribute-definitions/{key}`
- `POST` `/v2/bookings/custom-attributes/bulk-delete`
- `POST` `/v2/bookings/custom-attributes/bulk-upsert`
- `GET` `/v2/bookings/location-booking-profiles`
- `GET` `/v2/bookings/location-booking-profiles/{location_id}`
- `GET` `/v2/bookings/team-member-booking-profiles`
- `POST` `/v2/bookings/team-member-booking-profiles/bulk-retrieve`
- `GET` `/v2/bookings/team-member-booking-profiles/{team_member_id}`
- `GET` `/v2/bookings/{booking_id}`
- `PUT` `/v2/bookings/{booking_id}`
- `POST` `/v2/bookings/{booking_id}/cancel`
- `GET` `/v2/bookings/{booking_id}/custom-attributes`
- `DELETE` `/v2/bookings/{booking_id}/custom-attributes/{key}`
- `GET` `/v2/bookings/{booking_id}/custom-attributes/{key}`
- `PUT` `/v2/bookings/{booking_id}/custom-attributes/{key}`
- `GET` `/v2/cards`
- `POST` `/v2/cards`
- `GET` `/v2/cards/{card_id}`
- `POST` `/v2/cards/{card_id}/disable`
- `GET` `/v2/cash-drawers/shifts`
- `GET` `/v2/cash-drawers/shifts/{shift_id}`
- `GET` `/v2/cash-drawers/shifts/{shift_id}/events`
- `POST` `/v2/catalog/batch-delete`
- `POST` `/v2/catalog/batch-retrieve`
- `POST` `/v2/catalog/batch-upsert`
- `POST` `/v2/catalog/images`
- `PUT` `/v2/catalog/images/{image_id}`
- `GET` `/v2/catalog/info`
- `GET` `/v2/catalog/list`
- `POST` `/v2/catalog/object`
- `DELETE` `/v2/catalog/object/{object_id}`
- `GET` `/v2/catalog/object/{object_id}`
- `POST` `/v2/catalog/search-catalog-items`
- `POST` `/v2/catalog/update-item-modifier-lists`
- `POST` `/v2/catalog/update-item-taxes`
… and 266 more


</details>

**Missing** (7)

- No Customers API at all (create/list/retrieve customers)
- Catalog is search-only; no upsert, batch-retrieve, list, or info endpoints
- No Invoices, Terminal, Loyalty, Gift Cards, Bookings, or Team APIs
- No POST /v2/payments/{id}/cancel for authorized payments
- No /oauth2/revoke or token access-check; only the exchange exists
- No webhook subscription endpoints; the delivery sink is stunt config
- No orders list (GET /v2/orders) or POST /v2/orders/search

**Deviations** (2)

- DELETE /v2/payments/{id} and DELETE /v2/orders/{id} are stunt extensions, not real Square
- Square-Version header is required (400 when absent); real Square defaults it

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/oauth2/token` — body, stateful, clock
- `GET` `/v2/payments` — query, stateful, paginate, filter, clock
- `POST` `/v2/payments` — body, stateful, webhooks, clock
- `GET` `/v2/payments/{id}` — params, stateful, clock
- `DELETE` `/v2/payments/{id}` — params, stateful, clock
- `POST` `/v2/payments/{id}/complete` — params, stateful, webhooks, clock
- `POST` `/v2/payments/{id}/capture` — params, stateful, webhooks, clock
- `GET` `/v2/refunds` — query, stateful, paginate, filter, clock
- `POST` `/v2/refunds` — body, stateful, webhooks, clock
- `GET` `/v2/locations` — query, stateful, paginate, clock
- `POST` `/v2/catalog/search` — body, stateful, clock
- `POST` `/v2/orders` — body, stateful, clock
- `POST` `/v2/orders/calculate` — body, stateful, clock
- `GET` `/v2/orders/{id}` — params, stateful, clock
- `PUT` `/v2/orders/{id}` — body, params, stateful, clock
- `DELETE` `/v2/orders/{id}` — params, stateful, clock
- `POST` `/v2/orders/{id}/pay` — body, params, stateful, webhooks, clock
- `POST` `/v2/orders/{id}/complete` — params, stateful, clock

</details>

### stripe-style

**Covered** — 158 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/tokens` |
| GET | `/v1/events` |
| GET | `/v1/events/{id}` |
| POST | `/v1/test_clocks` |
| GET | `/v1/test_clocks` |
| POST | `/v1/test_clocks/{id}/advance` |
| GET | `/v1/test_clocks/{id}` |
| DELETE | `/v1/test_clocks/{id}` |
| POST | `/v1/test_helpers/test_clocks` |
| GET | `/v1/test_helpers/test_clocks` |
| POST | `/v1/test_helpers/test_clocks/{id}/advance` |
| GET | `/v1/test_helpers/test_clocks/{id}` |
| DELETE | `/v1/test_helpers/test_clocks/{id}` |
| POST | `/v1/charges` |
| GET | `/v1/charges/{id}` |
| GET | `/v1/charges` |
| POST | `/v1/charges/{id}/capture` |
| POST | `/v1/charges/{id}/refund` |
| POST | `/v1/payment_intents` |
| POST | `/v1/payment_intents/{id}/confirm` |
| POST | `/v1/payment_intents/{id}/capture` |
| GET | `/v1/payment_intents/{id}` |
| GET | `/v1/payment_intents` |
| POST | `/v1/payment_methods` |
| POST | `/v1/payment_methods/{id}/attach` |
| POST | `/v1/payment_methods/{id}/detach` |
| GET | `/v1/payment_methods/{id}` |
| GET | `/v1/payment_methods` |
| POST | `/v1/refunds` |
| GET | `/v1/refunds/{id}` |
| GET | `/v1/refunds` |
| POST | `/v1/refunds/{id}/cancel` |
| POST | `/v1/customers` |
| GET | `/v1/customers/{id}` |
| GET | `/v1/customers` |
| POST | `/v1/customers/{id}` |
| DELETE | `/v1/customers/{id}` |
| POST | `/v1/products` |
| GET | `/v1/products` |
| GET | `/v1/products/{id}` |
| POST | `/v1/products/{id}` |
| DELETE | `/v1/products/{id}` |
| POST | `/v1/prices` |
| GET | `/v1/prices` |
| GET | `/v1/prices/{id}` |
| POST | `/v1/prices/{id}` |
| POST | `/v1/subscriptions` |
| GET | `/v1/subscriptions` |
| GET | `/v1/subscriptions/{id}` |
| POST | `/v1/subscriptions/{id}` |
| POST | `/v1/subscriptions/{id}/cancel` |
| GET | `/v1/subscription_items` |
| POST | `/v1/subscription_items` |
| POST | `/v1/subscription_items/{id}` |
| DELETE | `/v1/subscription_items/{id}` |
| POST | `/v1/subscription_items/{id}/usage_records` |
| GET | `/v1/subscription_items/{id}/usage_records` |
| POST | `/v1/invoices` |
| GET | `/v1/invoices` |
| GET | `/v1/invoices/upcoming` |
| GET | `/v1/invoices/{id}` |
| POST | `/v1/invoices/{id}` |
| DELETE | `/v1/invoices/{id}` |
| POST | `/v1/invoices/{id}/finalize` |
| POST | `/v1/invoices/{id}/pay` |
| POST | `/v1/invoices/{id}/send` |
| POST | `/v1/invoices/{id}/void` |
| POST | `/v1/invoices/{id}/mark_uncollectible` |
| GET | `/v1/invoices/{id}/lines` |
| POST | `/v1/invoice_items` |
| GET | `/v1/invoice_items` |
| GET | `/v1/invoice_items/{id}` |
| POST | `/v1/invoice_items/{id}` |
| DELETE | `/v1/invoice_items/{id}` |
| POST | `/v1/credit_notes` |
| GET | `/v1/credit_notes` |
| GET | `/v1/credit_notes/preview` |
| GET | `/v1/credit_notes/{id}` |
| POST | `/v1/credit_notes/{id}` |
| POST | `/v1/credit_notes/{id}/void` |
| POST | `/v1/coupons` |
| GET | `/v1/coupons` |
| GET | `/v1/coupons/{id}` |
| POST | `/v1/coupons/{id}` |
| DELETE | `/v1/coupons/{id}` |
| POST | `/v1/promotion_codes` |
| GET | `/v1/promotion_codes` |
| GET | `/v1/promotion_codes/{id}` |
| POST | `/v1/promotion_codes/{id}` |
| POST | `/v1/tax_rates` |
| GET | `/v1/tax_rates` |
| GET | `/v1/tax_rates/{id}` |
| POST | `/v1/tax_rates/{id}` |
| DELETE | `/v1/tax_rates/{id}` |
| GET | `/v1/balance` |
| GET | `/v1/balance_transactions` |
| GET | `/v1/balance_transactions/{id}` |
| GET | `/v1/disputes` |
| GET | `/v1/disputes/{id}` |
| POST | `/v1/disputes/{id}` |
| POST | `/v1/disputes/{id}/close` |
| GET | `/v1/application_fees` |
| GET | `/v1/application_fees/{id}` |
| GET | `/v1/application_fees/{id}/refunds` |
| POST | `/v1/application_fees/{id}/refunds` |
| POST | `/v1/application_fees/{id}/refund` |
| POST | `/v1/checkout/sessions` |
| GET | `/v1/checkout/sessions` |
| GET | `/v1/checkout/sessions/{id}/line_items` |
| POST | `/v1/checkout/sessions/{id}/expire` |
| GET | `/v1/checkout/sessions/{id}` |
| GET | `/c/pay/{id}` |
| POST | `/v1/setup_intents` |
| GET | `/v1/setup_intents` |
| POST | `/v1/setup_intents/{id}/confirm` |
| POST | `/v1/setup_intents/{id}/cancel` |
| GET | `/v1/setup_intents/{id}` |
| POST | `/v1/setup_intents/{id}` |
| POST | `/v1/webhook_endpoints` |
| GET | `/v1/webhook_endpoints` |
| GET | `/v1/webhook_endpoints/{id}` |
| POST | `/v1/webhook_endpoints/{id}` |
| DELETE | `/v1/webhook_endpoints/{id}` |
| POST | `/v1/files` |
| GET | `/v1/files` |
| GET | `/v1/files/{id}` |
| POST | `/v1/file_links` |
| GET | `/v1/file_links` |
| GET | `/v1/file_links/{id}` |
| POST | `/v1/file_links/{id}` |
| POST | `/v1/accounts` |
| GET | `/v1/accounts/{id}` |
| POST | `/v1/accounts/{id}` |
| GET | `/v1/accounts` |
| POST | `/v1/accounts/{id}/persons` |
| GET | `/v1/accounts/{id}/persons` |
| GET | `/v1/accounts/{id}/persons/{person_id}` |
| POST | `/v1/accounts/{id}/persons/{person_id}` |
| DELETE | `/v1/accounts/{id}/persons/{person_id}` |
| GET | `/v1/persons/{id}` |
| POST | `/v1/persons/{id}` |
| POST | `/v1/accounts/{id}/external_accounts` |
| GET | `/v1/accounts/{id}/external_accounts` |
| GET | `/v1/accounts/{id}/external_accounts/{ea_id}` |
| DELETE | `/v1/accounts/{id}/external_accounts/{ea_id}` |
| POST | `/v1/accounts/{id}/login_links` |
| POST | `/v1/account_links` |
| POST | `/v1/transfers` |
| GET | `/v1/transfers/{id}` |
| GET | `/v1/transfers` |
| POST | `/v1/transfers/{id}/reversals` |
| GET | `/v1/transfers/{id}/reversals` |
| GET | `/v1/transfers/{id}/reversals/{tr_id}` |
| POST | `/v1/payouts` |
| GET | `/v1/payouts` |
| GET | `/v1/payouts/{id}` |
| POST | `/v1/payouts/{id}` |
| POST | `/v1/payouts/{id}/cancel` |

</details>

**Provider surface** — derived from sdk stripe-node @ 22.6.2 (floor): 573 real routes · 138 covered · 24% · 435 not implemented

<details><summary>not implemented (435)</summary>

- `POST` `/oauth/deauthorize`
- `POST` `/oauth/token`
- `GET` `/v1/account`
- `POST` `/v1/account_sessions`
- `GET` `/v1/accounts/{accountId}/capabilities/{id}`
- `POST` `/v1/accounts/{accountId}/capabilities/{id}`
- `POST` `/v1/accounts/{accountId}/external_accounts/{id}`
- `DELETE` `/v1/accounts/{id}`
- `GET` `/v1/accounts/{id}/capabilities`
- `POST` `/v1/accounts/{id}/reject`
- `POST` `/v1/accounts/{id}/unreject`
- `GET` `/v1/apple_pay/domains`
- `POST` `/v1/apple_pay/domains`
- `DELETE` `/v1/apple_pay/domains/{id}`
- `GET` `/v1/apple_pay/domains/{id}`
- `GET` `/v1/application_fees/{feeId}/refunds/{id}`
- `POST` `/v1/application_fees/{feeId}/refunds/{id}`
- `GET` `/v1/apps/secrets`
- `POST` `/v1/apps/secrets`
- `POST` `/v1/apps/secrets/delete`
- `GET` `/v1/apps/secrets/find`
- `GET` `/v1/balance_settings`
- `POST` `/v1/balance_settings`
- `GET` `/v1/billing/alerts`
- `POST` `/v1/billing/alerts`
- `GET` `/v1/billing/alerts/{id}`
- `POST` `/v1/billing/alerts/{id}/activate`
- `POST` `/v1/billing/alerts/{id}/archive`
- `POST` `/v1/billing/alerts/{id}/deactivate`
- `GET` `/v1/billing/credit_balance_summary`
- `GET` `/v1/billing/credit_balance_transactions`
- `GET` `/v1/billing/credit_balance_transactions/{id}`
- `GET` `/v1/billing/credit_grants`
- `POST` `/v1/billing/credit_grants`
- `GET` `/v1/billing/credit_grants/{id}`
- `POST` `/v1/billing/credit_grants/{id}`
- `POST` `/v1/billing/credit_grants/{id}/expire`
- `POST` `/v1/billing/credit_grants/{id}/void`
- `GET` `/v1/billing/feedback_options`
- `POST` `/v1/billing/feedback_options`
- `GET` `/v1/billing/feedback_options/{id}`
- `POST` `/v1/billing/feedback_options/{id}`
- `POST` `/v1/billing/feedback_options/{id}/deactivate`
- `POST` `/v1/billing/meter_event_adjustments`
- `POST` `/v1/billing/meter_events`
- `GET` `/v1/billing/meters`
- `POST` `/v1/billing/meters`
- `GET` `/v1/billing/meters/{id}`
- `POST` `/v1/billing/meters/{id}`
- `POST` `/v1/billing/meters/{id}/deactivate`
… and 385 more


</details>

**Missing** (7)

- No POST /v1/payment_intents/{id}/cancel
- No Payment Links API (/v1/payment_links)
- No Stripe Tax calculation, settings, or registration endpoints
- No Quotes, Identity, Radar, or Issuing APIs
- No Terminal, Financial Connections, Reporting, or Sigma surfaces
- No /v1/billing/meters or meter event stream endpoints
- No ephemeral keys or Apple Pay domain endpoints

**Deviations** (5)

- Test clocks are one global time offset shared by all objects, not per-object clocks
- No proration lines on item changes; proration_behavior accepted but treated as none
- Checkout hosted page auto-completes 3DS/SCA cards instead of issuing a challenge
- Webhooks go to one sink; registered endpoints gate event types, not per-endpoint URLs
- Lifecycles compressed: refunds settle at +3s, payouts at +60s, disputes in 1 day

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/tokens` — body, auth, stateful, errors, clock
- `GET` `/v1/events` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/events/{id}` — params, auth, stateful, errors
- `POST` `/v1/test_clocks` — body, auth, stateful, errors, clock
- `GET` `/v1/test_clocks` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/test_clocks/{id}/advance` — body, params, auth, stateful, errors, clock
- `GET` `/v1/test_clocks/{id}` — params, auth, stateful, errors
- `DELETE` `/v1/test_clocks/{id}` — params, auth, stateful, errors
- `POST` `/v1/test_helpers/test_clocks` — body, auth, stateful, errors, clock
- `GET` `/v1/test_helpers/test_clocks` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/test_helpers/test_clocks/{id}/advance` — body, params, auth, stateful, errors, clock
- `GET` `/v1/test_helpers/test_clocks/{id}` — params, auth, stateful, errors
- `DELETE` `/v1/test_helpers/test_clocks/{id}` — params, auth, stateful, errors
- `POST` `/v1/charges` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/charges/{id}` — params, auth, stateful, errors
- `GET` `/v1/charges` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/charges/{id}/capture` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/charges/{id}/refund` — body, params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/payment_intents` — body, auth, stateful, webhooks, errors, clock
- `POST` `/v1/payment_intents/{id}/confirm` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/payment_intents/{id}/capture` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/payment_intents/{id}` — params, auth, stateful, errors
- `GET` `/v1/payment_intents` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/payment_methods` — body, auth, stateful
- `POST` `/v1/payment_methods/{id}/attach` — body, params, auth, stateful, errors
- `POST` `/v1/payment_methods/{id}/detach` — params, auth, stateful, errors
- `GET` `/v1/payment_methods/{id}` — params, auth, stateful, errors
- `GET` `/v1/payment_methods` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/refunds` — body, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/refunds/{id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/refunds` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `POST` `/v1/refunds/{id}/cancel` — params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/customers` — body, auth, stateful
- `GET` `/v1/customers/{id}` — params, auth, stateful, errors
- `GET` `/v1/customers` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/customers/{id}` — body, params, auth, stateful, errors
- `DELETE` `/v1/customers/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/products` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/products` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/products/{id}` — params, auth, stateful, errors
- `POST` `/v1/products/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/products/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/prices` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/prices` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/prices/{id}` — params, auth, stateful, errors
- `POST` `/v1/prices/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/subscriptions` — body, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/subscriptions` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `GET` `/v1/subscriptions/{id}` — params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/subscriptions/{id}` — body, params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/subscriptions/{id}/cancel` — body, params, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/subscription_items` — query, auth, stateful, paginate, errors
- `POST` `/v1/subscription_items` — body, auth, stateful, webhooks, errors, clock
- `POST` `/v1/subscription_items/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/subscription_items/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/subscription_items/{id}/usage_records` — body, params, auth, stateful, filter, errors, clock
- `GET` `/v1/subscription_items/{id}/usage_records` — query, params, auth, stateful, paginate, filter, errors
- `POST` `/v1/invoices` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/invoices` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/invoices/upcoming` — query, auth, stateful, filter, errors, clock
- `GET` `/v1/invoices/{id}` — params, auth, stateful, errors
- `POST` `/v1/invoices/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/invoices/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/invoices/{id}/finalize` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/invoices/{id}/pay` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/invoices/{id}/send` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/invoices/{id}/void` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/invoices/{id}/mark_uncollectible` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/invoices/{id}/lines` — query, params, auth, stateful, paginate, errors
- `POST` `/v1/invoice_items` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/invoice_items` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/invoice_items/{id}` — params, auth, stateful, errors
- `POST` `/v1/invoice_items/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/invoice_items/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/credit_notes` — body, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/credit_notes` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/credit_notes/preview` — body, query, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/credit_notes/{id}` — params, auth, stateful, errors
- `POST` `/v1/credit_notes/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/credit_notes/{id}/void` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/coupons` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/coupons` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/coupons/{id}` — params, auth, stateful, errors
- `POST` `/v1/coupons/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/coupons/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/promotion_codes` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/promotion_codes` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/promotion_codes/{id}` — params, auth, stateful, errors
- `POST` `/v1/promotion_codes/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/tax_rates` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/tax_rates` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/tax_rates/{id}` — params, auth, stateful, errors
- `POST` `/v1/tax_rates/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/tax_rates/{id}` — params, auth, stateful, errors
- `GET` `/v1/balance` — auth, stateful
- `GET` `/v1/balance_transactions` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/balance_transactions/{id}` — params, auth, stateful, errors
- `GET` `/v1/disputes` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `GET` `/v1/disputes/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/disputes/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/disputes/{id}/close` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/application_fees` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/application_fees/{id}` — params, auth, stateful, errors
- `GET` `/v1/application_fees/{id}/refunds` — params, auth, stateful, errors
- `POST` `/v1/application_fees/{id}/refunds` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/application_fees/{id}/refund` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/checkout/sessions` — body, auth, stateful, errors, clock
- `GET` `/v1/checkout/sessions` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `GET` `/v1/checkout/sessions/{id}/line_items` — query, params, auth, stateful, paginate, webhooks, errors, clock
- `POST` `/v1/checkout/sessions/{id}/expire` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/checkout/sessions/{id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/c/pay/{id}` — query, params, stateful, webhooks, errors, clock
- `POST` `/v1/setup_intents` — body, auth, stateful, webhooks, clock
- `GET` `/v1/setup_intents` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/setup_intents/{id}/confirm` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/setup_intents/{id}/cancel` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/setup_intents/{id}` — params, auth, stateful, errors
- `POST` `/v1/setup_intents/{id}` — body, params, auth, stateful, errors
- `POST` `/v1/webhook_endpoints` — body, auth, stateful, errors, clock
- `GET` `/v1/webhook_endpoints` — query, auth, stateful, paginate, errors
- `GET` `/v1/webhook_endpoints/{id}` — params, auth, stateful, errors
- `POST` `/v1/webhook_endpoints/{id}` — body, params, auth, stateful, errors
- `DELETE` `/v1/webhook_endpoints/{id}` — params, auth, stateful, errors
- `POST` `/v1/files` — auth, stateful, filter, errors, clock
- `GET` `/v1/files` — query, auth, stateful, paginate, filter, errors, clock
- `GET` `/v1/files/{id}` — params, auth, stateful, filter, errors, clock
- `POST` `/v1/file_links` — body, auth, stateful, errors, clock
- `GET` `/v1/file_links` — query, auth, stateful, paginate, filter, errors, clock
- `GET` `/v1/file_links/{id}` — params, auth, stateful, errors, clock
- `POST` `/v1/file_links/{id}` — body, params, auth, stateful, errors, clock
- `POST` `/v1/accounts` — body, auth, stateful, filter, webhooks, clock
- `GET` `/v1/accounts/{id}` — params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/accounts/{id}` — body, params, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/accounts` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `POST` `/v1/accounts/{id}/persons` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/accounts/{id}/persons` — query, params, auth, stateful, paginate, filter, errors
- `GET` `/v1/accounts/{id}/persons/{person_id}` — params, auth, stateful, errors
- `POST` `/v1/accounts/{id}/persons/{person_id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/accounts/{id}/persons/{person_id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/persons/{id}` — params, auth, stateful, errors
- `POST` `/v1/persons/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/accounts/{id}/external_accounts` — body, params, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/accounts/{id}/external_accounts` — query, params, auth, stateful, paginate, filter, errors
- `GET` `/v1/accounts/{id}/external_accounts/{ea_id}` — params, auth, stateful, errors
- `DELETE` `/v1/accounts/{id}/external_accounts/{ea_id}` — params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/accounts/{id}/login_links` — params, auth, stateful, errors, clock
- `POST` `/v1/account_links` — body, auth, stateful, errors
- `POST` `/v1/transfers` — body, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/transfers/{id}` — params, auth, stateful, filter, errors
- `GET` `/v1/transfers` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/transfers/{id}/reversals` — body, params, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/transfers/{id}/reversals` — query, params, auth, stateful, paginate, filter, errors
- `GET` `/v1/transfers/{id}/reversals/{tr_id}` — params, auth, stateful, errors
- `POST` `/v1/payouts` — body, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/payouts` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `GET` `/v1/payouts/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/payouts/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/payouts/{id}/cancel` — params, auth, stateful, webhooks, errors, clock

</details>

### tenderly-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/v1/account/{account}/project/{project}/simulate` |
| POST | `/api/v1/account/{account}/project/{project}/simulate-bundle` |
| GET | `/api/v1/account/{account}/project/{project}/simulations` |
| GET | `/api/v1/account/{account}/project/{project}/simulations/{id}` |
| GET | `/api/v1/networks` |

</details>

**Missing** (3)

- No contracts endpoints (import/verify/update contracts per project)
- No alerts or notification-rules API
- No transaction lookup/list endpoints (transactions by hash)

**Deviations** (4)

- gas_used is derived from input length, not real EVM execution; status defaults to true
- An explicit revert:true body flag forces the revert path; real API has no such switch
- Bearer auth where real Tenderly uses the X-Access-Key header
- Responses mix camelCase where Tenderly is snake_case and nests simulation.id

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/v1/account/{account}/project/{project}/simulate` — body, params, auth, stateful, clock
- `POST` `/api/v1/account/{account}/project/{project}/simulate-bundle` — body, params, auth, stateful, errors, clock
- `GET` `/api/v1/account/{account}/project/{project}/simulations` — params, auth, stateful, clock
- `GET` `/api/v1/account/{account}/project/{project}/simulations/{id}` — params, auth, stateful, errors, clock
- `GET` `/api/v1/networks` — query, auth, stateful, paginate, clock

</details>

### thegraph-style

**Covered** — 1 routes · GraphQL schema

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/subgraphs/id/{subgraphId}/graphql` |

</details>

**Missing** (3)

- No subgraph deployment/management surface; the two seeded ids are fixed
- No indexing-status queries beyond _meta (no /status endpoint)
- No GraphQL subscriptions over websockets; HTTP queries only

**Deviations** (2)

- One merged schema serves Uniswap and ENS entities; real Graph serves one per deployment
- _meta.block.number advances per query; the real head is block-height driven

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/subgraphs/id/{subgraphId}/graphql` — params, auth, stateful, clock

</details>

### threads-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth/authorize` |
| POST | `/oauth/access_token` |
| GET | `/v1.0/me` |
| GET | `/v1.0/{container_id}` |
| GET | `/v1.0/{id}/insights` |
| POST | `/v1.0/{id}/threads_publish` |
| POST | `/v1.0/{id}/threads` |
| GET | `/v1.0/{id}/threads` |

</details>

**Missing** (3)

- Only TEXT media containers; no image or video media types or uploads
- No reply or quote-post creation; inbox replies are synthetic
- No user-level insights; only 4 per-media metrics

**Deviations** (6)

- Container processing is a fixed ~3s clock-derived window; text needs no real poll
- simulate_fail=true on container create is a simulator-only failure switch
- Refresh-grant response omits the rotated refresh_token; only the code exchange returns one
- /me is a static profile shared by every token; the path user is never validated against the bearer
- The refresh response omits the rotated refresh_token, so each token refreshes only once
- Republishing a container mints duplicate media

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth/authorize` — query, stateful, errors
- `POST` `/oauth/access_token` — body, stateful, errors, clock
- `GET` `/v1.0/me` — auth, stateful, clock
- `GET` `/v1.0/{container_id}` — query, params, auth, stateful, errors, clock
- `GET` `/v1.0/{id}/insights` — query, params, auth, stateful, errors, clock
- `POST` `/v1.0/{id}/threads_publish` — query, params, auth, stateful, errors, clock
- `POST` `/v1.0/{id}/threads` — body, params, auth, stateful, errors, clock
- `GET` `/v1.0/{id}/threads` — params, auth, stateful, filter, clock

</details>

### twilio-style

**Covered** — 6 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/2010-04-01/Accounts/{account_sid}/Messages.json` |
| GET | `/2010-04-01/Accounts/{account_sid}/Messages.json` |
| GET | `/2010-04-01/Accounts/{account_sid}/Messages/{sid}` |
| POST | `/2010-04-01/Accounts/{account_sid}/Calls.json` |
| POST | `/v2/Services/{service_sid}/Verification` |
| POST | `/v2/Services/{service_sid}/VerificationCheck` |

</details>

**Provider surface** — derived from sdk twilio-node @ 6.1.0 (floor): 197 real routes · 4 covered · 2% · 193 not implemented

<details><summary>not implemented (193)</summary>

- `GET` `/2010-04-01/Accounts.json`
- `POST` `/2010-04-01/Accounts.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Addresses.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Addresses.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Addresses/{addressSid}/DependentPhoneNumbers.json`
- `DELETE` `/2010-04-01/Accounts/{accountSid}/Addresses/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Addresses/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Addresses/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Applications.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Applications.json`
- `DELETE` `/2010-04-01/Accounts/{accountSid}/Applications/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Applications/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Applications/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AuthorizedConnectApps.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AuthorizedConnectApps/{connectAppSid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/Local.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/MachineToMachine.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/Mobile.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/National.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/SharedCost.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/TollFree.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/Voip.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Balance.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Events.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Notifications.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Notifications/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Payments.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Payments/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Recordings.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Recordings.json`
- `DELETE` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Recordings/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Recordings/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Recordings/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Siprec.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Siprec/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Streams.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Streams/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Transcriptions.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Transcriptions/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/UserDefinedMessageSubscriptions.json`
- `DELETE` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/UserDefinedMessageSubscriptions/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/UserDefinedMessages.json`
- `DELETE` `/2010-04-01/Accounts/{accountSid}/Calls/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Conferences.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Conferences/{conferenceSid}/Participants.json`
… and 143 more


</details>

**Missing** (6)

- No message redact/cancel or scheduled-send endpoints
- Calls are create-only: no GET /Calls list, GET /Calls/{Sid}, or recordings
- No Messaging Services, Phone Numbers, or Addresses management
- No Verify services CRUD, verification listing, or attempts endpoints
- No Media resource for MMS attachments (list/content fetch)
- Call Url is never fetched; no TwiML execution is modeled

**Deviations** (4)

- Message status derives from the clock on read: sent at +1s, delivered at +3s after send
- Verify codes are deterministic: last 6 digits of the To number, not a random SMS code
- simulate_fail:true in the POST body is a simulator extension forcing undelivered (30007)
- PageSize omitted returns all messages in one page; real Twilio defaults to 50

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/2010-04-01/Accounts/{account_sid}/Messages.json` — body, params, auth, stateful, clock
- `GET` `/2010-04-01/Accounts/{account_sid}/Messages.json` — query, params, auth, stateful, paginate, filter, webhooks, errors, clock
- `GET` `/2010-04-01/Accounts/{account_sid}/Messages/{sid}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/2010-04-01/Accounts/{account_sid}/Calls.json` — body, params, auth, stateful
- `POST` `/v2/Services/{service_sid}/Verification` — body, params, auth, stateful
- `POST` `/v2/Services/{service_sid}/VerificationCheck` — body, params, auth, stateful, errors

</details>

### twitter-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/2/oauth2/token` |
| GET | `/2/users/me` |
| GET | `/2/users/by/username/{username}` |
| GET | `/2/users/{id}` |
| POST | `/2/tweets` |
| GET | `/2/tweets/{id}` |
| GET | `/2/tweets` |
| DELETE | `/2/tweets/{id}` |
| GET | `/2/users/{id}/timelines/reverse_chronological` |

</details>

**Provider surface** — derived from spec X API v2 openapi (published at the API origin) @ 2.167: 178 real routes · 8 covered · 4% · 170 not implemented

<details><summary>not implemented (170)</summary>

- `GET` `/2/account_activity/subscriptions/count`
- `GET` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all`
- `POST` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all`
- `GET` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all/list`
- `DELETE` `/2/account_activity/webhooks/{webhook_id}/subscriptions/{user_id}/all`
- `GET` `/2/activity/stream`
- `DELETE` `/2/activity/subscriptions`
- `GET` `/2/activity/subscriptions`
- `POST` `/2/activity/subscriptions`
- `DELETE` `/2/activity/subscriptions/{subscription_id}`
- `PUT` `/2/activity/subscriptions/{subscription_id}`
- `POST` `/2/articles/draft`
- `POST` `/2/articles/{article_id}/publish`
- `GET` `/2/broadcasts`
- `GET` `/2/broadcasts/scheduled`
- `POST` `/2/broadcasts/scheduled`
- `DELETE` `/2/broadcasts/scheduled/{id}`
- `GET` `/2/broadcasts/scheduled/{id}`
- `PUT` `/2/broadcasts/scheduled/{id}`
- `POST` `/2/broadcasts/scheduled/{id}/live`
- `GET` `/2/broadcasts/{id}`
- `GET` `/2/broadcasts/{id}/chat`
- `POST` `/2/broadcasts/{id}/chat`
- `POST` `/2/broadcasts/{id}/chat/mutes`
- `DELETE` `/2/broadcasts/{id}/chat/mutes/{user_id}`
- `DELETE` `/2/broadcasts/{id}/chat/{message_id}`
- `GET` `/2/chat/conversations`
- `POST` `/2/chat/conversations/group`
- `POST` `/2/chat/conversations/group/initialize`
- `GET` `/2/chat/conversations/{id}`
- `GET` `/2/chat/conversations/{id}/events`
- `POST` `/2/chat/conversations/{id}/keys`
- `POST` `/2/chat/conversations/{id}/members`
- `POST` `/2/chat/conversations/{id}/messages`
- `POST` `/2/chat/conversations/{id}/messages/delete`
- `POST` `/2/chat/conversations/{id}/read`
- `POST` `/2/chat/conversations/{id}/typing`
- `POST` `/2/chat/media/upload/initialize`
- `POST` `/2/chat/media/upload/{id}/append`
- `POST` `/2/chat/media/upload/{id}/finalize`
- `GET` `/2/chat/media/{id}/{media_hash_key}`
- `GET` `/2/communities/search`
- `GET` `/2/communities/{id}`
- `GET` `/2/compliance/jobs`
- `POST` `/2/compliance/jobs`
- `GET` `/2/compliance/jobs/{id}`
- `DELETE` `/2/connections`
- `GET` `/2/connections`
- `DELETE` `/2/connections/all`
- `DELETE` `/2/connections/{endpoint_id}`
… and 120 more


</details>

**Missing** (6)

- No tweet search (/2/tweets/search/recent or /all) endpoints
- No likes, reposts, bookmarks, or quote/reply tweet operations
- No follows, blocks, mutes, or follower-list endpoints
- No media upload, polls, or long-form (note) tweet support
- No spaces, lists, DMs, or compliance surfaces
- No filtered or sample stream endpoints

**Deviations** (5)

- Auth is mock and not enforced; any or no Authorization header is accepted everywhere
- POST /2/oauth2/token always succeeds, minting a fake token (no PKCE or client creds)
- GET /2/tweets list-all is a simulator extension; the real API has no such list endpoint
- Bare GET /2/tweets/{id} returns the full stored doc, not v2's id+text default
- since_id/until_id are not honored on the timeline

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/2/oauth2/token` — —
- `GET` `/2/users/me` — query, stateful
- `GET` `/2/users/by/username/{username}` — query, params, stateful, errors
- `GET` `/2/users/{id}` — query, params, stateful, errors
- `POST` `/2/tweets` — body, stateful, errors, clock
- `GET` `/2/tweets/{id}` — query, params, stateful, errors
- `GET` `/2/tweets` — query, stateful, paginate, errors
- `DELETE` `/2/tweets/{id}` — params, stateful, errors
- `GET` `/2/users/{id}/timelines/reverse_chronological` — query, stateful, paginate, filter, errors

</details>

### walletconnect-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/pairings` |
| POST | `/v1/sessions` |
| GET | `/v1/sessions` |
| POST | `/v1/sessions/{topic}/approve` |
| POST | `/v1/sessions/{topic}/request` |
| POST | `/v1/sessions/{topic}/extend` |
| DELETE | `/v1/sessions/{topic}` |

</details>

**Missing** (3)

- No WebSocket relay; the real IRN protocol is WSS JSON-RPC pub/sub, not HTTP REST
- No session update, ping, or event emission (chainChanged/accountsChanged)
- No pairing list, expire, or ping operations

**Deviations** (5)

- Pairing, session approve, and JSON-RPC requests are auto-approved (no wallet device)
- personal_sign and eth_sendTransaction return synthetic hashes; nothing is signed
- Any non-empty projectId passes the gate — no validation against a project registry
- Expiry fields are TTL constants, not absolute unix timestamps; extend persists nothing
- Unacknowledged sessions serve JSON-RPC requests immediately (no approval gate)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/pairings` — body, query, auth, stateful, errors
- `POST` `/v1/sessions` — body, query, auth, stateful, errors
- `GET` `/v1/sessions` — body, query, auth, stateful, paginate, errors
- `POST` `/v1/sessions/{topic}/approve` — body, query, params, auth, stateful, errors
- `POST` `/v1/sessions/{topic}/request` — body, query, params, auth, stateful, errors
- `POST` `/v1/sessions/{topic}/extend` — body, query, params, auth, stateful, errors
- `DELETE` `/v1/sessions/{topic}` — body, query, params, auth, stateful, errors

</details>

### whatsapp-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v21.0/{phone_number_id}/messages` |
| POST | `/v21.0/{phone_number_id}/register` |
| POST | `/v21.0/{phone_number_id}/media` |
| GET | `/v21.0/{media_id}/content` |
| GET | `/v21.0/{waba_id}/message_templates` |
| POST | `/v21.0/{waba_id}/message_templates` |
| GET | `/v21.0/{resource_id}` |
| POST | `/v21.0/{template_id}` |

</details>

**Missing** (5)

- Only text and template message types; no image, video, document, or interactive
- No mark-as-read (status=read) or message reaction sends
- No business profile, flows, or commerce surfaces
- No template delete or conversation analytics endpoints
- No inbound customer-message webhook simulation

**Deviations** (7)

- 24-hour customer service window not enforced; free-form sends never fail with 470
- delivered is clock-derived at a fixed +3s after send, not real carrier delivery
- simulate_fail:true on send is a simulator extension forcing terminal failed status
- Template review is client-driven: POST {template_id} flips PENDING to APPROVED/REJECTED
- mark-as-read is unmodeled: a status=read body falls into the send path
- register on an unknown phone id still answers success
- created_at is a fixed constant, not clock-derived

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v21.0/{phone_number_id}/messages` — body, params, auth, stateful, webhooks, clock
- `POST` `/v21.0/{phone_number_id}/register` — body, params, auth, stateful, clock
- `POST` `/v21.0/{phone_number_id}/media` — body, params, auth, stateful, clock
- `GET` `/v21.0/{media_id}/content` — params, auth, stateful, errors, clock
- `GET` `/v21.0/{waba_id}/message_templates` — query, params, auth, stateful, paginate, clock
- `POST` `/v21.0/{waba_id}/message_templates` — body, auth, stateful, clock
- `GET` `/v21.0/{resource_id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v21.0/{template_id}` — body, params, auth, stateful, errors, clock

</details>

### workday-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/wbs/v40.0/staffing/workers` |
| GET | `/wbs/v40.0/staffing/workers/{id}` |
| GET | `/wbs/v40.0/compensation/workers/{id}/compensation` |
| GET | `/wbs/v40.0/payroll/pay_components` |
| GET | `/wbs/v40.0/human_resources/positions` |
| GET | `/wbs/v40.0/financials/accounts` |
| GET | `/ccx/v1/{tenant}/RaaS/Custom_Report` |
| POST | `/ccx/v1/{tenant}/staffing/Create_Worker` |

</details>

**Missing** (4)

- SOAP interface not implemented (REST-equivalent endpoints only)
- No worker update, delete, or other writes; only Create_Worker exists
- RaaS serves only the seeded Custom_Report, not arbitrary named reports
- No absence, talent, recruiting, or benefits service domains

**Deviations** (3)

- Auth validates only Authorization header presence; any bearer/basic value passes
- Compensation is a static shelf keyed to seeded worker ids — runtime workers read empty, unknown ids 200
- RaaS custom reports return static rows that never reflect created workers

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/wbs/v40.0/staffing/workers` — query, auth, stateful
- `GET` `/wbs/v40.0/staffing/workers/{id}` — params, auth, stateful
- `GET` `/wbs/v40.0/compensation/workers/{id}/compensation` — params, auth
- `GET` `/wbs/v40.0/payroll/pay_components` — query, auth, stateful
- `GET` `/wbs/v40.0/human_resources/positions` — query, auth, stateful
- `GET` `/wbs/v40.0/financials/accounts` — query, auth, stateful
- `GET` `/ccx/v1/{tenant}/RaaS/Custom_Report` — auth
- `POST` `/ccx/v1/{tenant}/staffing/Create_Worker` — body, auth, stateful

</details>

### x-articles-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/2/oauth2/authorize` |
| POST | `/2/oauth2/token` |
| POST | `/2/articles/draft` |
| POST | `/2/articles/{id}/publish` |
| GET | `/2/articles/{id}` |
| POST | `/2/media/upload` |
| POST | `/2/tweets` |
| GET | `/2/tweets/{id}` |

</details>

**Provider surface** — derived from spec X API v2 openapi (published at the API origin) @ 2.167: 178 real routes · 5 covered · 2% · 173 not implemented

<details><summary>not implemented (173)</summary>

- `GET` `/2/account_activity/subscriptions/count`
- `GET` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all`
- `POST` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all`
- `GET` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all/list`
- `DELETE` `/2/account_activity/webhooks/{webhook_id}/subscriptions/{user_id}/all`
- `GET` `/2/activity/stream`
- `DELETE` `/2/activity/subscriptions`
- `GET` `/2/activity/subscriptions`
- `POST` `/2/activity/subscriptions`
- `DELETE` `/2/activity/subscriptions/{subscription_id}`
- `PUT` `/2/activity/subscriptions/{subscription_id}`
- `GET` `/2/broadcasts`
- `GET` `/2/broadcasts/scheduled`
- `POST` `/2/broadcasts/scheduled`
- `DELETE` `/2/broadcasts/scheduled/{id}`
- `GET` `/2/broadcasts/scheduled/{id}`
- `PUT` `/2/broadcasts/scheduled/{id}`
- `POST` `/2/broadcasts/scheduled/{id}/live`
- `GET` `/2/broadcasts/{id}`
- `GET` `/2/broadcasts/{id}/chat`
- `POST` `/2/broadcasts/{id}/chat`
- `POST` `/2/broadcasts/{id}/chat/mutes`
- `DELETE` `/2/broadcasts/{id}/chat/mutes/{user_id}`
- `DELETE` `/2/broadcasts/{id}/chat/{message_id}`
- `GET` `/2/chat/conversations`
- `POST` `/2/chat/conversations/group`
- `POST` `/2/chat/conversations/group/initialize`
- `GET` `/2/chat/conversations/{id}`
- `GET` `/2/chat/conversations/{id}/events`
- `POST` `/2/chat/conversations/{id}/keys`
- `POST` `/2/chat/conversations/{id}/members`
- `POST` `/2/chat/conversations/{id}/messages`
- `POST` `/2/chat/conversations/{id}/messages/delete`
- `POST` `/2/chat/conversations/{id}/read`
- `POST` `/2/chat/conversations/{id}/typing`
- `POST` `/2/chat/media/upload/initialize`
- `POST` `/2/chat/media/upload/{id}/append`
- `POST` `/2/chat/media/upload/{id}/finalize`
- `GET` `/2/chat/media/{id}/{media_hash_key}`
- `GET` `/2/communities/search`
- `GET` `/2/communities/{id}`
- `GET` `/2/compliance/jobs`
- `POST` `/2/compliance/jobs`
- `GET` `/2/compliance/jobs/{id}`
- `DELETE` `/2/connections`
- `GET` `/2/connections`
- `DELETE` `/2/connections/all`
- `DELETE` `/2/connections/{endpoint_id}`
- `POST` `/2/dm_conversations`
- `GET` `/2/dm_conversations/media/{dm_id}/{media_id}/{resource_id}`
… and 123 more


</details>

**Missing** (4)

- No article update, delete, or unpublish endpoints
- No article list or search; only single-article GET
- No chunked media upload (INIT/APPEND/FINALIZE) or processing status
- Tweet surface is create/get only; no delete, likes, or timeline

**Deviations** (4)

- PKCE is relaxed: code_verifier must be non-empty but the S256 hash match is not verified
- No v2 errors[] envelope — articles/media use flat {error: ...} shapes a reference client is built against
- PKCE S256 is presence-checked only; a wrong-but-present verifier passes
- Republishing mints a fresh post_id with no already-published guard

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/2/oauth2/authorize` — query, stateful, errors
- `POST` `/2/oauth2/token` — body, auth, stateful, errors
- `POST` `/2/articles/draft` — body, stateful, errors
- `POST` `/2/articles/{id}/publish` — params, stateful, errors
- `GET` `/2/articles/{id}` — params, stateful, errors
- `POST` `/2/media/upload` — stateful
- `POST` `/2/tweets` — body, stateful, errors
- `GET` `/2/tweets/{id}` — params, stateful, errors

</details>

### xero-style

**Covered** — 15 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/connections` |
| GET | `/api.xro/2.0/Contacts` |
| PUT | `/api.xro/2.0/Contacts` |
| GET | `/api.xro/2.0/Contacts/{id}` |
| PUT | `/api.xro/2.0/Contacts/{id}` |
| GET | `/api.xro/2.0/Invoices` |
| PUT | `/api.xro/2.0/Invoices` |
| GET | `/api.xro/2.0/Invoices/{id}` |
| DELETE | `/api.xro/2.0/Invoices/{id}` |
| POST | `/api.xro/2.0/Invoices/{id}/Payments` |
| GET | `/api.xro/2.0/Accounts` |
| GET | `/api.xro/2.0/BankTransactions` |
| GET | `/api.xro/2.0/Items` |
| GET | `/api.xro/2.0/TrackingCategories` |
| POST | `/webhooks` |

</details>

**Provider surface** — derived from spec Xero-OpenAPI xero_accounting @ 17.0.0: 235 real routes · 10 covered · 4% · 211 not implemented

<details><summary>not implemented (211)</summary>

- `PUT` `/api.xro/2.0/Accounts`
- `DELETE` `/api.xro/2.0/Accounts/{AccountID}`
- `GET` `/api.xro/2.0/Accounts/{AccountID}`
- `POST` `/api.xro/2.0/Accounts/{AccountID}`
- `GET` `/api.xro/2.0/Accounts/{AccountID}/Attachments`
- `GET` `/api.xro/2.0/Accounts/{AccountID}/Attachments/{AttachmentID}`
- `POST` `/api.xro/2.0/Accounts/{AccountID}/Attachments/{FileName}`
- `PUT` `/api.xro/2.0/Accounts/{AccountID}/Attachments/{FileName}`
- `POST` `/api.xro/2.0/BankTransactions`
- `PUT` `/api.xro/2.0/BankTransactions`
- `GET` `/api.xro/2.0/BankTransactions/{BankTransactionID}`
- `POST` `/api.xro/2.0/BankTransactions/{BankTransactionID}`
- `GET` `/api.xro/2.0/BankTransactions/{BankTransactionID}/Attachments`
- `GET` `/api.xro/2.0/BankTransactions/{BankTransactionID}/Attachments/{AttachmentID}`
- `POST` `/api.xro/2.0/BankTransactions/{BankTransactionID}/Attachments/{FileName}`
- `PUT` `/api.xro/2.0/BankTransactions/{BankTransactionID}/Attachments/{FileName}`
- `GET` `/api.xro/2.0/BankTransactions/{BankTransactionID}/History`
- `PUT` `/api.xro/2.0/BankTransactions/{BankTransactionID}/History`
- `GET` `/api.xro/2.0/BankTransfers`
- `POST` `/api.xro/2.0/BankTransfers`
- `PUT` `/api.xro/2.0/BankTransfers`
- `GET` `/api.xro/2.0/BankTransfers/{BankTransferID}`
- `POST` `/api.xro/2.0/BankTransfers/{BankTransferID}`
- `GET` `/api.xro/2.0/BankTransfers/{BankTransferID}/Attachments`
- `GET` `/api.xro/2.0/BankTransfers/{BankTransferID}/Attachments/{AttachmentID}`
- `POST` `/api.xro/2.0/BankTransfers/{BankTransferID}/Attachments/{FileName}`
- `PUT` `/api.xro/2.0/BankTransfers/{BankTransferID}/Attachments/{FileName}`
- `GET` `/api.xro/2.0/BankTransfers/{BankTransferID}/History`
- `PUT` `/api.xro/2.0/BankTransfers/{BankTransferID}/History`
- `GET` `/api.xro/2.0/BatchPayments`
- `POST` `/api.xro/2.0/BatchPayments`
- `PUT` `/api.xro/2.0/BatchPayments`
- `GET` `/api.xro/2.0/BatchPayments/{BatchPaymentID}`
- `POST` `/api.xro/2.0/BatchPayments/{BatchPaymentID}`
- `GET` `/api.xro/2.0/BatchPayments/{BatchPaymentID}/History`
- `PUT` `/api.xro/2.0/BatchPayments/{BatchPaymentID}/History`
- `GET` `/api.xro/2.0/BrandingThemes`
- `GET` `/api.xro/2.0/BrandingThemes/{BrandingThemeID}`
- `GET` `/api.xro/2.0/BrandingThemes/{BrandingThemeID}/PaymentServices`
- `POST` `/api.xro/2.0/BrandingThemes/{BrandingThemeID}/PaymentServices`
- `GET` `/api.xro/2.0/Budgets`
- `GET` `/api.xro/2.0/Budgets/{BudgetID}`
- `GET` `/api.xro/2.0/ContactGroups`
- `PUT` `/api.xro/2.0/ContactGroups`
- `GET` `/api.xro/2.0/ContactGroups/{ContactGroupID}`
- `POST` `/api.xro/2.0/ContactGroups/{ContactGroupID}`
- `DELETE` `/api.xro/2.0/ContactGroups/{ContactGroupID}/Contacts`
- `PUT` `/api.xro/2.0/ContactGroups/{ContactGroupID}/Contacts`
- `DELETE` `/api.xro/2.0/ContactGroups/{ContactGroupID}/Contacts/{ContactID}`
- `POST` `/api.xro/2.0/Contacts`
… and 161 more


</details>

**Missing** (6)

- No Credit Notes, Quotes, or standalone Payments endpoints
- No Journals, Bank Transfers, Employees, or Expense Claims
- No Organisations, Currencies, or TaxRates endpoints
- Accounts, Items, TrackingCategories, BankTransactions are read-only (GET only)
- No attachments or history/notes endpoints
- No invoice update, email, or repeating-invoice endpoints

**Deviations** (5)

- No tax-rate registry; line tax is the given TaxAmount, not computed from TaxType
- Responses carry a sim-only nextPage field; real Xero signals the last page by item count
- GET /connections wraps entries in {connections:[...]} with tenantName; real Xero returns a bare array without it
- Malformed page falls back to page 1; real Xero answers 400
- nextPage envelope field is a simulator extension; 401 ErrorNumber is the string TokenExpired, not numeric

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/connections` — query, stateful, paginate, clock
- `GET` `/api.xro/2.0/Contacts` — query, stateful, paginate, filter, clock
- `PUT` `/api.xro/2.0/Contacts` — body, stateful, clock
- `GET` `/api.xro/2.0/Contacts/{id}` — params, stateful, clock
- `PUT` `/api.xro/2.0/Contacts/{id}` — body, params, stateful, clock
- `GET` `/api.xro/2.0/Invoices` — query, stateful, paginate, filter, clock
- `PUT` `/api.xro/2.0/Invoices` — body, stateful, clock
- `GET` `/api.xro/2.0/Invoices/{id}` — params, stateful, clock
- `DELETE` `/api.xro/2.0/Invoices/{id}` — params, stateful, clock
- `POST` `/api.xro/2.0/Invoices/{id}/Payments` — body, params, stateful, clock
- `GET` `/api.xro/2.0/Accounts` — query, stateful, paginate, filter, clock
- `GET` `/api.xro/2.0/BankTransactions` — query, stateful, paginate, filter, clock
- `GET` `/api.xro/2.0/Items` — query, stateful, paginate, filter, clock
- `GET` `/api.xro/2.0/TrackingCategories` — query, stateful, paginate, filter, clock
- `POST` `/webhooks` — —

</details>

### youtube-style

**Covered** — 14 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/o/oauth2/auth` |
| POST | `/o/oauth2/token` |
| POST | `/upload/youtube/v3/videos` |
| PUT | `/upload/youtube/v3/videos/{upload_id}` |
| DELETE | `/upload/youtube/v3/videos/{upload_id}` |
| GET | `/youtube/v3/videos` |
| POST | `/youtube/v3/videos` |
| DELETE | `/youtube/v3/videos` |
| GET | `/youtube/v3/channels` |
| POST | `/youtube/v3/playlists` |
| GET | `/youtube/v3/playlists` |
| DELETE | `/youtube/v3/playlists` |
| POST | `/youtube/v3/playlistItems` |
| DELETE | `/youtube/v3/playlistItems` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.299.0: 83 real routes · 9 covered · 10% · 74 not implemented

<details><summary>not implemented (74)</summary>

- `POST` `/youtube/v3/abuseReports`
- `GET` `/youtube/v3/activities`
- `DELETE` `/youtube/v3/captions`
- `GET` `/youtube/v3/captions`
- `POST` `/youtube/v3/captions`
- `PUT` `/youtube/v3/captions`
- `GET` `/youtube/v3/captions/{id}`
- `POST` `/youtube/v3/channelBanners/insert`
- `DELETE` `/youtube/v3/channelSections`
- `GET` `/youtube/v3/channelSections`
- `POST` `/youtube/v3/channelSections`
- `PUT` `/youtube/v3/channelSections`
- `PUT` `/youtube/v3/channels`
- `GET` `/youtube/v3/commentThreads`
- `POST` `/youtube/v3/commentThreads`
- `DELETE` `/youtube/v3/comments`
- `GET` `/youtube/v3/comments`
- `POST` `/youtube/v3/comments`
- `PUT` `/youtube/v3/comments`
- `POST` `/youtube/v3/comments/markAsSpam`
- `POST` `/youtube/v3/comments/setModerationStatus`
- `GET` `/youtube/v3/i18nLanguages`
- `GET` `/youtube/v3/i18nRegions`
- `DELETE` `/youtube/v3/liveBroadcasts`
- `GET` `/youtube/v3/liveBroadcasts`
- `POST` `/youtube/v3/liveBroadcasts`
- `PUT` `/youtube/v3/liveBroadcasts`
- `POST` `/youtube/v3/liveBroadcasts/bind`
- `POST` `/youtube/v3/liveBroadcasts/cuepoint`
- `POST` `/youtube/v3/liveBroadcasts/transition`
- `DELETE` `/youtube/v3/liveChat/bans`
- `POST` `/youtube/v3/liveChat/bans`
- `DELETE` `/youtube/v3/liveChat/messages`
- `GET` `/youtube/v3/liveChat/messages`
- `POST` `/youtube/v3/liveChat/messages`
- `GET` `/youtube/v3/liveChat/messages/stream`
- `POST` `/youtube/v3/liveChat/messages/transition`
- `DELETE` `/youtube/v3/liveChat/moderators`
- `GET` `/youtube/v3/liveChat/moderators`
- `POST` `/youtube/v3/liveChat/moderators`
- `DELETE` `/youtube/v3/liveStreams`
- `GET` `/youtube/v3/liveStreams`
- `POST` `/youtube/v3/liveStreams`
- `PUT` `/youtube/v3/liveStreams`
- `GET` `/youtube/v3/members`
- `GET` `/youtube/v3/membershipsLevels`
- `DELETE` `/youtube/v3/playlistImages`
- `GET` `/youtube/v3/playlistImages`
- `POST` `/youtube/v3/playlistImages`
- `PUT` `/youtube/v3/playlistImages`
… and 24 more


</details>

**Missing** (7)

- No search endpoint (/youtube/v3/search)
- No comments or commentThreads endpoints
- No video update (PUT), rate, or reportAbuse endpoints
- Channels supports mine=true only; no list by id/forUsername or update
- No playlist update or playlistItems list endpoints
- No captions, thumbnails set, videoCategories, or i18n endpoints
- No subscriptions, activities, or live streaming surfaces

**Deviations** (2)

- GET /youtube/v3/videos without id lists all user videos; real API requires id or chart
- maxResults omitted returns everything; real API defaults to 5 per page

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/o/oauth2/auth` — query, stateful, errors
- `POST` `/o/oauth2/token` — body, stateful, errors, clock
- `POST` `/upload/youtube/v3/videos` — body, query, auth, stateful, clock
- `PUT` `/upload/youtube/v3/videos/{upload_id}` — query, params, stateful, clock
- `DELETE` `/upload/youtube/v3/videos/{upload_id}` — query, params, stateful, errors
- `GET` `/youtube/v3/videos` — query, auth, stateful, paginate, filter, errors, clock
- `POST` `/youtube/v3/videos` — body, query, auth, stateful, clock
- `DELETE` `/youtube/v3/videos` — query, auth, stateful, errors, clock
- `GET` `/youtube/v3/channels` — auth, stateful, clock
- `POST` `/youtube/v3/playlists` — body, auth, stateful, clock
- `GET` `/youtube/v3/playlists` — query, auth, stateful, paginate, filter, errors, clock
- `DELETE` `/youtube/v3/playlists` — query, auth, stateful, errors, clock
- `POST` `/youtube/v3/playlistItems` — body, auth, stateful, errors, clock
- `DELETE` `/youtube/v3/playlistItems` — query, auth, stateful, errors, clock

</details>

### zendesk-style

**Covered** — 37 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/api/v2/tickets.json` |
| POST | `/api/v2/tickets.json` |
| POST | `/api/v2/tickets/{id}/comments.json` |
| GET | `/api/v2/tickets/{id}/comments.json` |
| POST | `/api/v2/tickets/{id}/tags.json` |
| GET | `/api/v2/tickets/{id}.json` |
| PUT | `/api/v2/tickets/{id}.json` |
| DELETE | `/api/v2/tickets/{id}.json` |
| GET | `/api/v2/users.json` |
| GET | `/api/v2/organizations.json` |
| GET | `/api/v2/groups.json` |
| GET | `/api/v2/requests.json` |
| GET | `/api/v2/views.json` |
| GET | `/api/v2/triggers.json` |
| GET | `/api/v2/webhooks.json` |
| POST | `/api/v2/webhooks.json` |
| DELETE | `/api/v2/webhooks/{id}.json` |
| GET | `/api/v2/suspended_tickets.json` |
| GET | `/api/v2/tickets` |
| POST | `/api/v2/tickets` |
| POST | `/api/v2/tickets/{id}/comments` |
| GET | `/api/v2/tickets/{id}/comments` |
| POST | `/api/v2/tickets/{id}/tags` |
| GET | `/api/v2/tickets/{id}` |
| PUT | `/api/v2/tickets/{id}` |
| DELETE | `/api/v2/tickets/{id}` |
| GET | `/api/v2/users` |
| GET | `/api/v2/organizations` |
| GET | `/api/v2/groups` |
| GET | `/api/v2/search.json` |
| GET | `/api/v2/requests` |
| GET | `/api/v2/views` |
| GET | `/api/v2/triggers` |
| GET | `/api/v2/webhooks` |
| POST | `/api/v2/webhooks` |
| DELETE | `/api/v2/webhooks/{id}` |
| GET | `/api/v2/suspended_tickets` |

</details>

**Missing** (8)

- No ticket metrics, audits, fields, or forms endpoints
- No ticket create_many/update_many or import endpoints
- No macros, SLA policies, or satisfaction ratings endpoints
- No incremental exports (incremental/tickets, incremental/users)
- No attachments/uploads API
- Users, orgs, groups, views, triggers list-only; no create/update/delete
- No request create/update endpoints (GET /api/v2/requests is list-only)
- No webhook update (PUT/PATCH) or /webhooks/{id}/test endpoint

**Deviations** (5)

- Search is substring-only over ticket subject/description; empty query returns all tickets
- GET /api/v2/suspended_tickets always returns an empty list
- Webhook deliveries use the {type, payload} envelope, not Zendesk placeholder bodies
- Webhook signing_secret is caller-supplied (omitted falls back to a public mock secret)
- per_page <= 0 disables cursor paging: all records returned, links.next null

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/api/v2/tickets.json` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/v2/tickets.json` — body, auth, stateful, webhooks, clock
- `POST` `/api/v2/tickets/{id}/comments.json` — body, params, auth, stateful, webhooks, clock
- `GET` `/api/v2/tickets/{id}/comments.json` — query, params, auth, stateful, paginate, clock
- `POST` `/api/v2/tickets/{id}/tags.json` — body, params, auth, stateful, clock
- `GET` `/api/v2/tickets/{id}.json` — params, auth, stateful, clock
- `PUT` `/api/v2/tickets/{id}.json` — body, params, auth, stateful, webhooks, clock
- `DELETE` `/api/v2/tickets/{id}.json` — params, auth, stateful, clock
- `GET` `/api/v2/users.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/organizations.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/groups.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/requests.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/views.json` — query, auth, stateful, paginate, clock
- `GET` `/api/v2/triggers.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/webhooks.json` — query, auth, stateful, paginate, clock
- `POST` `/api/v2/webhooks.json` — body, auth, stateful, clock
- `DELETE` `/api/v2/webhooks/{id}.json` — params, auth, stateful, clock
- `GET` `/api/v2/suspended_tickets.json` — query, auth, stateful, paginate, clock
- `GET` `/api/v2/tickets` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/v2/tickets` — body, auth, stateful, webhooks, clock
- `POST` `/api/v2/tickets/{id}/comments` — body, params, auth, stateful, webhooks, clock
- `GET` `/api/v2/tickets/{id}/comments` — query, params, auth, stateful, paginate, clock
- `POST` `/api/v2/tickets/{id}/tags` — body, params, auth, stateful, clock
- `GET` `/api/v2/tickets/{id}` — params, auth, stateful, clock
- `PUT` `/api/v2/tickets/{id}` — body, params, auth, stateful, webhooks, clock
- `DELETE` `/api/v2/tickets/{id}` — params, auth, stateful, clock
- `GET` `/api/v2/users` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/organizations` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/groups` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/search.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/requests` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/views` — query, auth, stateful, paginate, clock
- `GET` `/api/v2/triggers` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/webhooks` — query, auth, stateful, paginate, clock
- `POST` `/api/v2/webhooks` — body, auth, stateful, clock
- `DELETE` `/api/v2/webhooks/{id}` — params, auth, stateful, clock
- `GET` `/api/v2/suspended_tickets` — query, auth, stateful, paginate, clock

</details>

### zuora-style

**Covered** — 20 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1/accounts` |
| POST | `/v1/accounts` |
| GET | `/v1/accounts/{accountKey}` |
| POST | `/v1/subscriptions` |
| POST | `/v1/subscriptions/{subscriptionKey}/cancel` |
| PUT | `/v1/subscriptions/{subscriptionKey}` |
| GET | `/v1/subscriptions/{subscriptionKey}` |
| POST | `/v1/usage` |
| GET | `/v1/usage` |
| GET | `/v1/invoices/{invoiceId}` |
| GET | `/v1/payments` |
| POST | `/v1/payments` |
| POST | `/v1/payments/{paymentId}/unapply` |
| GET | `/v1/payments/{paymentId}` |
| POST | `/v1/payment-methods/credit-cards` |
| POST | `/v1/transactions/billing/preview` |
| POST | `/v1/action/query` |
| POST | `/v1/webhooks` |
| GET | `/v1/webhooks` |
| DELETE | `/v1/webhooks/{id}` |

</details>

**Missing** (8)

- No Orders API (POST /v1/orders, /v1/orders/preview)
- No product catalog endpoints (/v1/catalog/products, rate plans)
- No credit or debit memo endpoints (/v1/creditmemos, /v1/debitmemos)
- No refunds endpoints (POST /v1/refunds, GET /v1/refunds/{id})
- No bill runs or payment runs (/v1/bill-runs, /v1/payment_runs)
- No subscription list by account (GET /v1/subscriptions/account/{key})
- No invoice list endpoint (GET /v1/transactions/invoices)
- No other /v1/action endpoints (queryMore, create, update, delete)

**Deviations** (5)

- ZOQL is pattern-matched: only SELECT fields FROM Object [WHERE Id = value] is supported
- Synthetic calendar anchored at 2024-01-01; term and due dates track real time
- Webhook reg via /v1/webhooks (real: Notifications UI only); deliveries JSON not form-encoded
- List filter[] applies a single condition per request; multiple filters cannot be ANDed
- Subscriptions become Active immediately on create; no Pending Activation state

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1/accounts` — body, query, auth, stateful, paginate, filter, clock
- `POST` `/v1/accounts` — body, auth, stateful, webhooks, clock
- `GET` `/v1/accounts/{accountKey}` — body, params, auth, stateful, clock
- `POST` `/v1/subscriptions` — body, auth, stateful, webhooks, clock
- `POST` `/v1/subscriptions/{subscriptionKey}/cancel` — body, params, auth, stateful, webhooks, clock
- `PUT` `/v1/subscriptions/{subscriptionKey}` — body, params, auth, stateful, webhooks, clock
- `GET` `/v1/subscriptions/{subscriptionKey}` — body, params, auth, stateful, webhooks, clock
- `POST` `/v1/usage` — body, auth, stateful, clock
- `GET` `/v1/usage` — body, query, auth, stateful, paginate, filter, clock
- `GET` `/v1/invoices/{invoiceId}` — body, params, auth, stateful, clock
- `GET` `/v1/payments` — body, query, auth, stateful, paginate, filter, clock
- `POST` `/v1/payments` — body, auth, stateful, webhooks, clock
- `POST` `/v1/payments/{paymentId}/unapply` — body, params, auth, stateful, webhooks, clock
- `GET` `/v1/payments/{paymentId}` — body, params, auth, stateful, clock
- `POST` `/v1/payment-methods/credit-cards` — body, auth, stateful, clock
- `POST` `/v1/transactions/billing/preview` — body, auth, stateful, clock
- `POST` `/v1/action/query` — body, auth, stateful, webhooks, clock
- `POST` `/v1/webhooks` — body, auth, stateful, clock
- `GET` `/v1/webhooks` — body, auth, stateful, clock
- `DELETE` `/v1/webhooks/{id}` — body, params, auth, stateful, clock

</details>

---

Maintenance: add deviations to `conformance/matrix.yaml`; new `Record(...)`
calls and `// =====` sections appear here automatically on regeneration; SDK
version bumps flow from `go.mod`/`package.json` with no edit here. A new
adapter without a sidecar entry fails generation, so it cannot ship
uncurated.