CONFORMANCE.md

<!-- GENERATED by conformance/cmd/genmatrix — do not edit by hand.
     Regenerate with `just conformance-matrix`; CI regenerates and fails on drift.
     SDK versions are read live from conformance/go.mod and
     conformance/node/package.json, so they cannot go stale here. -->

# SDK conformance matrix

Every reference adapter, and how it is verified. The conformance suites drive
**real official SDKs** — their serialization, their request signing, their
client-side validation — against booted stunt adapters, not hand-rolled HTTP
calls.

Verification tiers:

- **SDK** — an official provider SDK is driven against the adapter in CI (Go
  suites run against the engine; Node suites boot the real `stunt` binary
  and go through the CLI end to end).
- **VM** — handler-level Go tests (`adapters/<name>_test.go`) execute the
  adapter's Starlark handlers directly.
- **boot** — clears `stunt adapter lint`, the all-scripts-parse guard and
  the all-adapters-boot guard on every CI run; no SDK suite drives it yet.
- Every adapter additionally documents its behavior in depth in its README.

**99 adapters** — 2 SDK+VM, 34 SDK-only, 60 VM-only, 3 boot-tier.

**45 adapters carry derived provider-surface coverage**: their real-API route totals come from the route tables embedded in the pinned official SDKs (Google Discovery docs inside `google-api-go-client`; generated tables inside the Node clients) or from official specs vendored under `conformance/surfaces/` (refreshed by `just surfaces-fetch`) — mechanical and network-free at generation time. For those rows the derived not-implemented list supplements the curated Missing column; adapters without one have no trustworthy machine-readable surface and stay fully curated.

Behavior columns come in two kinds: **verified** (an official SDK was driven against the adapter and the check passed — the Behaviors counts in the matrix above) and **derived** (static analysis of the handler scripts — every adapter's *Derived behavior tags* block below says what the code does, not that a client confirmed it).

| Adapter | API | Routes | Verification | Official SDK(s) | Behaviors | Missing | Deviations |
|---|---|---|---|---|---|---|---|
| [adyen-style](adapters/adyen-style/) | Adyen Checkout + Notification API `v68` | 14 | VM | — | — | [4](#adyen-style) | [8](#adyen-style) |
| [anaplan-style](adapters/anaplan-style/) | Anaplan API `2.0` | 18 | VM | — | — | [4](#anaplan-style) | [5](#anaplan-style) |
| [apple-apns-style](adapters/apple-apns-style/) | Apple Push Notification service (APNs) `v2` | 2 | VM | — | — | [4](#apple-apns-style) | [3](#apple-apns-style) |
| [apple-appstoreconnect-style](adapters/apple-appstoreconnect-style/) | App Store Connect API `v3` | 15 | VM | — | — | [7](#apple-appstoreconnect-style) | [7](#apple-appstoreconnect-style) |
| [apple-music-style](adapters/apple-music-style/) | Apple Music API `1.0` | 18 | VM | — | — | [5](#apple-music-style) | [5](#apple-music-style) |
| [apple-searchads-style](adapters/apple-searchads-style/) | Apple Search Ads API `v4` | 12 | VM | — | — | [4](#apple-searchads-style) | [5](#apple-searchads-style) |
| [apps-script-style](adapters/apps-script-style/) | Google Apps Script API `v1` | 11 | SDK | google-api-go-client @ v0.293.0 | 6 | [2](#apps-script-style) | [3](#apps-script-style) |
| [auth0-style](adapters/auth0-style/) | Auth0 Authentication & Management API `v2` | 17 | VM | — | — | [3](#auth0-style) | [4](#auth0-style) |
| [avalara-style](adapters/avalara-style/) | Avalara AvaTax REST API `2` | 8 | VM | — | — | [5](#avalara-style) | [3](#avalara-style) |
| [aws-cognito-style](adapters/aws-cognito-style/) | Amazon Cognito Identity Provider API `2016-04-18` | 7 | VM | — | — | [6](#aws-cognito-style) | [3](#aws-cognito-style) |
| [aws-iam-sts-style](adapters/aws-iam-sts-style/) | AWS STS + IAM API `2011-06-15` | 2 | SDK | aws-sdk-go-v2 @ v1.43.7 | 2 | [3](#aws-iam-sts-style) | [3](#aws-iam-sts-style) |
| [aws-s3-style](adapters/aws-s3-style/) | Amazon S3 API `2006-03-01` | 8 | SDK | aws-sdk-go-v2 @ v1.43.7 | 6 | [5](#aws-s3-style) | [5](#aws-s3-style) |
| [azure-devops-style](adapters/azure-devops-style/) | Azure DevOps REST API `7.1` | 17 | VM | — | — | [8](#azure-devops-style) | [6](#azure-devops-style) |
| [azure-servicebus-style](adapters/azure-servicebus-style/) | Azure Service Bus + Storage `2024-01-01` | 18 | VM | — | — | [6](#azure-servicebus-style) | [3](#azure-servicebus-style) |
| [azure-storage-style](adapters/azure-storage-style/) | Azure Storage Blob REST API `2024-08-04` | 9 | VM | — | — | [6](#azure-storage-style) | [3](#azure-storage-style) |
| [blog-style](adapters/blog-style/) | GraphQL demo `1.0` | 0 +GQL | boot | — | — | — | — |
| [bluesky-style](adapters/bluesky-style/) | Bluesky AT Protocol `com.atproto (2024-Q4)` | 7 | SDK | atproto @ 0.20.41 (floor) | 8 | [7](#bluesky-style) | [4](#bluesky-style) |
| [braintree-style](adapters/braintree-style/) | Braintree GraphQL + REST API `2024-09-01` | 15 +GQL | VM | — | — | [8](#braintree-style) | [7](#braintree-style) |
| [braze-style](adapters/braze-style/) | Braze REST API `2.0` | 12 | VM | — | — | [8](#braze-style) | [6](#braze-style) |
| [chainlink-style](adapters/chainlink-style/) | Chainlink Data Feeds + Functions + Automation `1.0` | 21 | VM | — | — | [6](#chainlink-style) | [7](#chainlink-style) |
| [cloudflare-style](adapters/cloudflare-style/) | Cloudflare API `4` | 35 | SDK | cloudflare-go @ v0.117.0 | 7 | [8](#cloudflare-style) | [6](#cloudflare-style) |
| [cloudkit-style](adapters/cloudkit-style/) | CloudKit Web Services API `1` | 5 | VM | — | — | [6](#cloudkit-style) | [2](#cloudkit-style) |
| [discord-style](adapters/discord-style/) | Discord API `v10` | 26 (+1 ws) | SDK | discord-node @ 2.6.3 (floor) | 5 | [8](#discord-style) | [5](#discord-style) |
| [drive-style](adapters/drive-style/) | Google Drive API `v3` | 13 | SDK | google-api-go-client @ v0.293.0 | 8 | [7](#drive-style) | [5](#drive-style) |
| [dropbox-style](adapters/dropbox-style/) | Dropbox API `2` | 8 | VM | — | — | [8](#dropbox-style) | [4](#dropbox-style) |
| [dune-style](adapters/dune-style/) | Dune Analytics API `v1` | 6 | VM | — | — | [5](#dune-style) | [4](#dune-style) |
| [dynamodb-style](adapters/dynamodb-style/) | Amazon DynamoDB API `2012-08-10` | 1 | SDK + VM | aws-sdk-go-v2 @ v1.43.7 | 8 | [8](#dynamodb-style) | [5](#dynamodb-style) |
| [echo-style](adapters/echo-style/) | gRPC echo demo `1.0` | 0 (+1 ws) | boot | — | — | — | — |
| [emailoctopus-style](adapters/emailoctopus-style/) | EmailOctopus API `2.0.0` | 21 | VM | — | — | [2](#emailoctopus-style) | [3](#emailoctopus-style) |
| [entra-id-style](adapters/entra-id-style/) | Microsoft Graph / Entra ID `v1.0` | 9 | SDK | microsoft-graph-client @ 3.0.7 (floor) | 8 | [8](#entra-id-style) | [3](#entra-id-style) |
| [erc4337-style](adapters/erc4337-style/) | ERC-4337 Bundler RPC `0.7` | 2 | VM | — | — | [5](#erc4337-style) | [6](#erc4337-style) |
| [escrow-style](adapters/escrow-style/) | Escrow.com API `2017-09-01` | 9 | VM | — | — | [3](#escrow-style) | [4](#escrow-style) |
| [eth-jsonrpc-style](adapters/eth-jsonrpc-style/) | Ethereum JSON-RPC `1.0` | 1 | SDK | go-ethereum @ v1.17.5 | 5 | [5](#eth-jsonrpc-style) | [4](#eth-jsonrpc-style) |
| [etherscan-style](adapters/etherscan-style/) | Etherscan API `1.0` | 1 | VM | — | — | [3](#etherscan-style) | [2](#etherscan-style) |
| [fattureincloud-style](adapters/fattureincloud-style/) | Fatture in Cloud API v2 `2.0.29` | 42 | VM | — | — | [3](#fattureincloud-style) | [6](#fattureincloud-style) |
| [firebase-style](adapters/firebase-style/) | Firebase Auth + Firestore + Cloud Messaging API `v1` | 22 | VM | — | — | [4](#firebase-style) | [8](#firebase-style) |
| [ga4-style](adapters/ga4-style/) | Google Analytics Data API + Admin API `v1beta` | 7 | SDK | google-api-go-client @ v0.293.0 | 7 | [4](#ga4-style) | [3](#ga4-style) |
| [gcalendar-style](adapters/gcalendar-style/) | Google Calendar API `v3` | 10 | SDK | google-api-go-client @ v0.293.0 | 8 | [4](#gcalendar-style) | [2](#gcalendar-style) |
| [gdocs-style](adapters/gdocs-style/) | Google Docs API `v1` | 5 | SDK | google-api-go-client @ v0.293.0 | 5 | [3](#gdocs-style) | [5](#gdocs-style) |
| [github-style](adapters/github-style/) | GitHub REST + GraphQL API `2022-11-28` | 26 +GQL | SDK | go-github/v89 @ v89.0.0<br>octokit @ 5.0.5 (floor) | 6 | [7](#github-style) | [4](#github-style) |
| [gmail-style](adapters/gmail-style/) | Gmail API `v1` | 16 | SDK | google-api-go-client @ v0.293.0 | 9 | [6](#gmail-style) | [3](#gmail-style) |
| [google-admin-style](adapters/google-admin-style/) | Google Admin SDK Directory API `directory_v1` | 13 | SDK | google-api-go-client @ v0.293.0 | 8 | [4](#google-admin-style) | [4](#google-admin-style) |
| [google-cloudtasks-style](adapters/google-cloudtasks-style/) | Google Cloud Tasks API `v2` | 16 | VM | — | — | [7](#google-cloudtasks-style) | [7](#google-cloudtasks-style) |
| [google-iam-style](adapters/google-iam-style/) | Google Cloud IAM API + Service Accounts `v1` | 10 | SDK | google-api-go-client @ v0.293.0 | 7 | [4](#google-iam-style) | [2](#google-iam-style) |
| [google-style](adapters/google-style/) | Google OAuth2 API `v2` | 4 | SDK | x/oauth2 @ v0.36.0<br>google-api-go-client/idtoken @ v0.293.0 | 7 | [2](#google-style) | [2](#google-style) |
| [gsearchconsole-style](adapters/gsearchconsole-style/) | Google Search Console API `v1` | 11 | SDK | google-api-go-client @ v0.293.0 | 7 | [2](#gsearchconsole-style) | [4](#gsearchconsole-style) |
| [gsheets-style](adapters/gsheets-style/) | Google Sheets API `v4` | 10 | SDK | google-api-go-client @ v0.293.0 | 8 | [4](#gsheets-style) | [3](#gsheets-style) |
| [gtasks-style](adapters/gtasks-style/) | Google Tasks API `v1` | 11 | SDK | google-api-go-client @ v0.293.0 | 8 | [3](#gtasks-style) | [2](#gtasks-style) |
| [helius-style](adapters/helius-style/) | Helius Solana RPC + Enhanced API `v0` | 11 | VM | — | — | [3](#helius-style) | [6](#helius-style) |
| [hn-style](adapters/hn-style/) | Hacker News Firebase API `v0` | 11 | VM | — | — | [3](#hn-style) | [4](#hn-style) |
| [hubspot-style](adapters/hubspot-style/) | HubSpot CRM API `v3` | 33 | SDK | hubspot-node @ 14.0.1 (floor) | 5 | [4](#hubspot-style) | — |
| [instagram-style](adapters/instagram-style/) | Instagram Graph API `v21.0` | 10 | VM | — | — | [4](#instagram-style) | [5](#instagram-style) |
| [jira-style](adapters/jira-style/) | Jira Cloud REST API `3` | 32 | SDK | jira-js @ 6.1.0 (floor) | 7 | [5](#jira-style) | [6](#jira-style) |
| [jumio-style](adapters/jumio-style/) | Jumio API `v1` | 5 | VM | — | — | [3](#jumio-style) | [6](#jumio-style) |
| [linkedin-style](adapters/linkedin-style/) | LinkedIn API `v2` | 8 | VM | — | — | [4](#linkedin-style) | [3](#linkedin-style) |
| [llm-style](adapters/llm-style/) | OpenAI API + Anthropic API `OpenAI v1 / Anthropic v1` | 3 | SDK | openai-node @ 7.5.0 (floor) | 2 | [4](#llm-style) | [3](#llm-style) |
| [marketo-style](adapters/marketo-style/) | Marketo Engage REST API `1.0` | 21 | VM | — | — | [5](#marketo-style) | [3](#marketo-style) |
| [microsoft-graph-style](adapters/microsoft-graph-style/) | Microsoft Graph API `v1.0` | 55 | SDK | microsoft-graph-client @ 3.0.7 (floor) | 10 | [8](#microsoft-graph-style) | [6](#microsoft-graph-style) |
| [netsuite-style](adapters/netsuite-style/) | NetSuite SuiteTalk REST API `1.0` | 9 | VM | — | — | [4](#netsuite-style) | [3](#netsuite-style) |
| [oneinch-style](adapters/oneinch-style/) | 1inch Aggregation Protocol API `v6.0` | 5 | VM | — | — | [3](#oneinch-style) | [4](#oneinch-style) |
| [onfido-style](adapters/onfido-style/) | Onfido API `v3.6` | 7 | VM | — | — | [5](#onfido-style) | [6](#onfido-style) |
| [opensea-style](adapters/opensea-style/) | OpenSea API `2.0.0` | 7 | VM | — | — | [4](#opensea-style) | [4](#opensea-style) |
| [paypal-style](adapters/paypal-style/) | PayPal Orders API `v2` | 17 | VM | — | — | [6](#paypal-style) | [8](#paypal-style) |
| [persona-style](adapters/persona-style/) | Persona Inquiry API `2023-01-05` | 5 | VM | — | — | [5](#persona-style) | [6](#persona-style) |
| [photos-style](adapters/photos-style/) | Google Photos Library API `v1` | 12 | VM | — | — | [5](#photos-style) | [5](#photos-style) |
| [pinata-style](adapters/pinata-style/) | Pinata API `1.0` | 6 | VM | — | — | [4](#pinata-style) | [3](#pinata-style) |
| [plaid-style](adapters/plaid-style/) | Plaid API `2020-09-14` | 13 | SDK | plaid-node @ 32.0.0 (floor) | 4 | [5](#plaid-style) | [3](#plaid-style) |
| [powerplatform-style](adapters/powerplatform-style/) | Microsoft Power Platform API `2` | 9 | VM | — | — | [4](#powerplatform-style) | [6](#powerplatform-style) |
| [printful-style](adapters/printful-style/) | Printful API `v2` | 13 | VM | — | — | [5](#printful-style) | [3](#printful-style) |
| [printify-style](adapters/printify-style/) | Printify API `v1` | 16 | VM | — | — | [5](#printify-style) | [4](#printify-style) |
| [producthunt-style](adapters/producthunt-style/) | Product Hunt GraphQL API `2` | 0 +GQL | boot | — | — | [3](#producthunt-style) | [2](#producthunt-style) |
| [psd2-style](adapters/psd2-style/) | Open Banking / PSD2 (Berlin Group NextGenPSD2) `1.3.6` | 19 | VM | — | — | [6](#psd2-style) | [7](#psd2-style) |
| [qbo-style](adapters/qbo-style/) | QuickBooks Online API `v3` | 11 | VM | — | — | [6](#qbo-style) | [4](#qbo-style) |
| [reddit-style](adapters/reddit-style/) | Reddit API `1.0` | 2 | VM | — | — | [5](#reddit-style) | [3](#reddit-style) |
| [resend-style](adapters/resend-style/) | Resend API `1.0.0` | 6 | SDK | resend-node @ 6.22.0 (floor) | 4 | [6](#resend-style) | [3](#resend-style) |
| [revenuecat-style](adapters/revenuecat-style/) | RevenueCat API `v1` | 7 | VM | — | — | [5](#revenuecat-style) | [5](#revenuecat-style) |
| [salesforce-style](adapters/salesforce-style/) | Salesforce REST API `v60.0` | 29 | SDK | jsforce @ 3.10.22 (floor) | 6 | [7](#salesforce-style) | [4](#salesforce-style) |
| [sendgrid-style](adapters/sendgrid-style/) | Twilio SendGrid v3 API `v3` | 5 | VM | — | — | [7](#sendgrid-style) | [6](#sendgrid-style) |
| [servicenow-style](adapters/servicenow-style/) | ServiceNow Table API `2` | 44 | VM | — | — | [5](#servicenow-style) | [1](#servicenow-style) |
| [shopify-style](adapters/shopify-style/) | Shopify Admin REST + GraphQL API `2024-10` | 21 +GQL | SDK | go-shopify/v4 @ v4.7.0 | 5 | [7](#shopify-style) | [4](#shopify-style) |
| [signin-with-apple-style](adapters/signin-with-apple-style/) | Sign in with Apple `v2` | 3 | VM | — | — | [3](#signin-with-apple-style) | [2](#signin-with-apple-style) |
| [slack-style](adapters/slack-style/) | Slack Web API `1.0` | 7 | SDK | slack-node @ 7.19.0 (floor) | 4 | [6](#slack-style) | [2](#slack-style) |
| [smartbill-style](adapters/smartbill-style/) | SmartBill Cloud API `1.0` | 18 | VM | — | — | [3](#smartbill-style) | [4](#smartbill-style) |
| [sqs-style](adapters/sqs-style/) | Amazon SQS API `2012-11-05` | 2 | SDK + VM | aws-sdk-go-v2 @ v1.43.7 | 6 | [4](#sqs-style) | [5](#sqs-style) |
| [square-style](adapters/square-style/) | Square API `2024-08-21` | 18 | SDK | square-node @ 45.1.0 (floor) | 4 | [7](#square-style) | [2](#square-style) |
| [stripe-style](adapters/stripe-style/) | Stripe API `2025-01-27.acacia` | 158 | SDK | stripe-go/v86 @ v86.3.0<br>stripe-node @ 22.5.0 (floor) | 9 | [7](#stripe-style) | [5](#stripe-style) |
| [tenderly-style](adapters/tenderly-style/) | Tenderly Simulation API `v1` | 5 | VM | — | — | [3](#tenderly-style) | [4](#tenderly-style) |
| [thegraph-style](adapters/thegraph-style/) | The Graph (GraphQL over subgraphs) `1.0` | 1 +GQL | VM | — | — | [3](#thegraph-style) | [2](#thegraph-style) |
| [threads-style](adapters/threads-style/) | Threads API (Meta) `v1.0` | 8 | VM | — | — | [3](#threads-style) | [6](#threads-style) |
| [twilio-style](adapters/twilio-style/) | Twilio API `2010-04-01` | 6 | SDK | twilio-go @ v1.30.9<br>twilio-node @ 6.1.0 (floor) | 8 | [6](#twilio-style) | [4](#twilio-style) |
| [twitter-style](adapters/twitter-style/) | Twitter/X API `v2` | 9 | VM | — | — | [6](#twitter-style) | [5](#twitter-style) |
| [walletconnect-style](adapters/walletconnect-style/) | WalletConnect (Relay Protocol v2) `2.0` | 7 | VM | — | — | [3](#walletconnect-style) | [5](#walletconnect-style) |
| [whatsapp-style](adapters/whatsapp-style/) | WhatsApp Business Cloud API (Meta) `v21.0` | 8 | VM | — | — | [5](#whatsapp-style) | [7](#whatsapp-style) |
| [workday-style](adapters/workday-style/) | Workday REST API `v40.0` | 8 | VM | — | — | [4](#workday-style) | [3](#workday-style) |
| [x-articles-style](adapters/x-articles-style/) | X (Twitter) Articles API `v2` | 8 | VM | — | — | [4](#x-articles-style) | [4](#x-articles-style) |
| [xero-style](adapters/xero-style/) | Xero Accounting API `2.0` | 15 | VM | — | — | [6](#xero-style) | [5](#xero-style) |
| [youtube-style](adapters/youtube-style/) | YouTube Data API `v3` | 14 | SDK | google-api-go-client @ v0.293.0 | 8 | [7](#youtube-style) | [2](#youtube-style) |
| [zendesk-style](adapters/zendesk-style/) | Zendesk REST API `2` | 37 | SDK | node-zendesk @ 6.0.1 (floor) | 6 | [8](#zendesk-style) | [5](#zendesk-style) |
| [zuora-style](adapters/zuora-style/) | Zuora REST API `v1` | 20 | VM | — | — | [8](#zuora-style) | [5](#zuora-style) |

## Verified behaviors

What each suite actually asserts, as written in the test sources
(`Record(...)` literals in `conformance/*_test.go`; `// =====`
sections in `conformance/node/tests/*.test.ts`).

### atproto @ 0.20.41 (floor)

**bluesky-style**

- login rides createSession and adopts did/handle/tokens
- agent.post creates an app.bsky.feed.post record
- searchPosts finds the created post by its text
- getProfile resolves the session actor with counts
- resolveHandle is a public read (no session)
- unauthenticated record writes surface as XRPC 401s
- deletePost removes the record from search
- refreshSession rotates the token pair via the SDK

### aws-sdk-go-v2 @ v1.43.7

**aws-iam-sts-style**

- GetCallerIdentity with real SigV4 signature
- AssumeRole -> credentials

**aws-s3-style**

- CreateBucket
- PutObject (binary body)
- GetObject byte-exact round-trip (incl. non-UTF-8)
- HeadObject metadata
- ListObjectsV2 paginator follows continuation (4 over MaxKeys=2)
- DeleteObject

**dynamodb-style**

- CreateTable via real SigV4
- typed item Put/Get round-trip (S/N/BOOL/SS)
- UpdateItem SET/ADD with exact decimal arithmetic
- ConditionExpression → ConditionalCheckFailedException
- Query numeric sort-key ordering (1,2,10)
- Query BETWEEN + ScanIndexForward=false
- Scan with FilterExpression
- typed ResourceNotFoundException surface

**sqs-style**

- CreateQueue/GetQueueUrl via real SigV4
- SendMessage/ReceiveMessage with ms-precision system attributes
- visibility timeout: in-flight hidden, expiry redelivers
- DeleteMessage consumes the redelivered message
- SendMessageBatch correlated results
- missing-queue typed error surface

### cloudflare-go @ v0.117.0

**cloudflare-style**

- Zones list returns the seeded zone
- Zones list filters by name
- CreateZone + ZoneDetails round-trip
- Duplicate CreateZone -> error code 1061
- DNS records create + list + update round-trip
- Firewall rules batch create + list with filter expression
- DNS record delete + zone delete then details fails

### discord-node @ 2.6.3 (floor)

**discord-style**

- users/@me resolves the bot user
- guilds resolve with channels
- message post lands in the channel history
- single-message fetch round-trips
- add-reaction is the real PUT and returns 204

### go-ethereum @ v1.17.5

**eth-jsonrpc-style**

- ethclient.ChainID + BlockNumber
- BalanceAt decodes seeded hex-quantity wei
- CodeAt returns empty (no EVM execution)
- HeaderByNumber returns the genesis header
- PendingNonceAt for an untouched account

### go-github/v89 @ v89.0.0

**github-style**

- Issues.Create x5 (number assignment)
- Issues.ListByRepo walks Link headers across pages
- Issues.CreateComment
- Issues.ListComments round-trip
- Issues.Edit state transition

### go-shopify/v4 @ v4.7.0

**shopify-style**

- Webhook.Create (orders/create)
- Order.Create x4 (numeric ids)
- Order.Create with embedded customer (numeric id round-trip)
- Order.ListWithPagination walks page_info cursors
- webhooks verify through the SDK's VerifyWebhookRequest HMAC validator

### google-api-go-client @ v0.293.0

**apps-script-style**

- Projects.Create + Projects.Get round-trip
- Projects content update + get round-trip
- Scripts.Run returns a done Operation with the function result
- Scripts.Run passes parameters into the simulation
- Deployments.Create + Deployments.List round-trip
- Unknown project content Get -> googleapi 404

**drive-style**

- Files.List returns the seeded folder
- Files.Create + Files.List round-trip
- Files.Get returns the created metadata (int64 size decodes)
- Files.Update renames the file
- Files.List q= filters by mimeType and parents
- Files.List PageSize + PageToken walk pages
- Files.Delete then Get -> googleapi 404
- Changes.List replays mutations from startPageToken

**ga4-style**

- Admin Accounts.List returns the seeded account
- Admin Properties.List filters by parent account
- Admin DataStreams.List returns the property streams
- Data runReport returns headers, rows, and rowCount
- Data runReport limit pages rows deterministically
- Data runRealtimeReport returns rows
- Unknown dimension runReport -> googleapi 400

**gcalendar-style**

- Calendars.Get resolves the primary calendar
- CalendarList.List returns the seeded primary entry
- Events.Insert + Events.Get round-trip the event body
- Events.List Q matches summary/description text
- Events.List MaxResults + PageToken walk pages
- Events.Patch updates fields and bumps sequence + etag
- Events.Instances expands an RRULE into per-occurrence events
- Events.Delete then Get -> googleapi 404

**gdocs-style**

- Documents.Create returns documentId + title
- Documents.Get returns the structural body model
- batchUpdate insertText applies and replies 1:1
- batchUpdate applies ordered requests at indexes
- Unknown document Get -> googleapi 404

**gmail-style**

- Labels.List returns seeded system labels
- Labels.Create + Labels.List round-trip
- Messages.Send raw rfc822 -> id + threadId
- Messages.Get parses the sent raw message into payload headers
- Messages.List includes sent messages
- Messages.List MaxResults + PageToken walk pages
- Messages.Modify AddLabelIds applies
- Messages.Get Format=metadata returns headers without body
- Messages.Delete then Get -> googleapi 404

**google-admin-style**

- Users.List Customer=my_customer returns the seeded directory
- Users.Insert + Users.Get round-trip by numeric id and email
- Users.List Domain narrows to a single email domain
- Users.List Query isSuspended=true returns only suspended users
- Users.Update renames the primary email; old key stops resolving
- Users.Delete then Get -> decoded googleapi 404
- Groups.Insert + Members.Insert + Members.List round-trip
- Groups.List UserKey returns only the groups holding that member

**google-iam-style**

- jwt-bearer exchange mints the SDK's access token
- ServiceAccounts.List returns the seeded account
- ServiceAccounts.Create + Get round-trip
- ServiceAccounts.Keys.List returns managed keys
- Roles.QueryGrantableRoles returns grantable roles
- ServiceAccounts.Delete then Get -> googleapi 404
- Garbage bearer -> googleapi 401

**gsearchconsole-style**

- Sites.List returns the seeded properties
- Sites.Get returns the property with permissionLevel
- Sites.Add starts unverified and lists immediately
- Searchanalytics.Query returns keyed metric rows
- Sitemaps.Submit + List round-trip
- UrlInspection.Index.Inspect returns an index-status verdict
- Unknown site Get -> googleapi 404

**gsheets-style**

- Spreadsheets.Create + Get round-trip
- Values.Update + Values.Get round-trip an A1 range
- Values.Get MajorDimension=COLUMNS transposes the grid
- Values.Append writes after the last populated row
- Values.BatchUpdate writes multiple ranges in one call
- Values.BatchGet reads a range over GET query params
- Spreadsheets.BatchUpdate addSheet adds a tab Values can write to
- Get on an unknown spreadsheet -> googleapi 404

**gtasks-style**

- Tasklists.List returns the seeded default list
- Tasklists.Insert + Tasklists.List round-trip
- Tasks.Insert + Tasks.Get round-trip fields
- Tasks.Patch status=completed derives the completed stamp
- Tasks.List ShowCompleted=false hides completed tasks
- Tasks.Move Parent/Previous re-parents and repositions
- Tasks.List MaxResults + PageToken walk pages
- Tasks.Delete then Tasks.Get -> googleapi 404

**youtube-style**

- OAuth2 authorize + exchange mint the access token the SDK presents
- Videos.Insert metadata-only + Videos.List id= round-trip with part projection
- Videos.List without id lists every user video
- Videos.List MaxResults + PageToken walk pages
- Channels.List mine=true returns the authenticated user's channel
- Playlists.Insert + Playlists.List mine=true round-trip
- PlaylistItems.Insert adds the video, Delete removes it
- Videos.Delete -> 204; re-delete surfaces a googleapi 404

### google-api-go-client/idtoken @ v0.293.0

**google-style**

- idtoken.Validate verifies the adapter's RS256 id_token via its JWKS
- tampered id_token rejected by idtoken.Validate
- adapter serves a real JWKS

### hubspot-node @ 14.0.1 (floor)

**hubspot-style**

- basicApi.create assigns an id and echoes properties
- basicApi.getById round-trips
- basicApi.update patches a property
- searchApi.doSearch finds the record by name
- archive hides the record from reads

### jira-js @ 6.1.0 (floor)

**jira-style**

- myself + project resolve
- create assigns a TEST-n key
- get round-trips; edit persists
- JQL search finds it
- add comment + list
- transition moves the status
- delete removes it

### jsforce @ 3.10.22 (floor)

**salesforce-style**

- SDK-driven login: with clientId+clientSecret configured, jsforce's conn.login rides the OAuth2 password grant itself, and adopts the adapter's echoed instance_url as its API base
- sobject create assigns an id
- retrieve round-trips the fields
- update patches and persists
- SOQL through the SDK's query parser
- destroy removes the record

### microsoft-graph-client @ 3.0.7 (floor)

**entra-id-style**

- authorize redirects with code + state
- token exchange mints a JWKS-verifiable RS256 bearer
- authProvider feeds the SDK; /v1.0/me resolves the token's user
- users create + get round-trip (by id and by UPN)
- users list pages via $top + $skipToken + PageIterator
- applications + servicePrincipals reads
- refresh grant rotates the token the SDK presents
- error decoding: 404 and 401 surface as GraphError

**microsoft-graph-style**

- /me resolves the signed-in profile
- users directory pages via $top and the @odata.nextLink cursor
- $filter and $select are applied server-side
- draft lifecycle: create, PATCH, send, land in Sent Items
- sendMail posts straight to Sent Items (no draft)
- subscription lifecycle with clientState-echoed notifications
- calendar: create, calendarView window, accept records the response
- teams chat: create chat, send message, list, delete
- drive: quota, simple upload round-trip, path resolution
- error envelope: unknown user 404, unknown token 401

### node-zendesk @ 6.0.1 (floor)

**zendesk-style**

- create assigns a numeric id
- show round-trips; status update persists
- comment created at ticket-create time is readable
- list includes the ticket
- substring search finds it by subject
- delete removes it

### octokit @ 5.0.5 (floor)

**github-style**

- issue CRUD + paginate over Link headers

### openai-node @ 7.5.0 (floor)

**llm-style**

- models.list returns the catalog
- chat.completions.create returns a typed echo response

### plaid-node @ 32.0.0 (floor)

**plaid-style**

- link/token/create mints a session
- sandbox public_token -> exchange -> item with accounts
- accounts/balance/get over the SDK's typed response
- transactions/sync cursor round-trip

### resend-node @ 6.22.0 (floor)

**resend-style**

- emails.send mints a re_* id
- emails.get round-trips the message
- emails.list includes it
- delivery state derives on read (sent -> delivered)

### slack-node @ 7.19.0 (floor)

**slack-style**

- auth.test validates the seeded bearer token
- conversations.create + list round-trip
- chat.postMessage lands in conversations.history
- reactions.add on the posted message

### square-node @ 45.1.0 (floor)

**square-style**

- oAuth.obtainToken mints the bearer the adapter validates
- payments.create + payments.get round-trip
- orders.create prices line items and mints an order id
- orders.get round-trips the priced order

### stripe-go/v86 @ v86.3.0

**stripe-style**

- customer.New (form+bracket body)
- customer.Get round-trip
- paymentintent create+confirm -> succeeded
- charge.New (typed amount round-trip)
- SDK iterator walks has_more pages (4+ over limit=2)
- webhook.ConstructEvent verifies HMAC + parses data.object

### stripe-node @ 22.5.0 (floor)

**stripe-style**

- Typed create/get (form+bracket encoded by the SDK)
- autoPagingEach walks has_more pages
- Webhook registration, delivery verified by the SDK's own constructEvent

### twilio-go @ v1.30.9

**twilio-style**

- CreateMessage (SM sid assigned)
- FetchMessage poll reaches terminal state
- +15005550001 magic number -> failed
- ListMessage To filter honored
- status callbacks verify against Twilio's HMAC-SHA1 formula

### twilio-node @ 6.1.0 (floor)

**twilio-style**

- Create + SDK fetches drive the lifecycle
- Callbacks verified by twilio-node's own validateRequest
- The magic invalid number -> failed

### x/oauth2 @ v0.36.0

**google-style**

- authorize redirect mints a single-use code
- authorization-code exchange -> tokens + id_token
- refresh grant rotates the access token
- userinfo honors the refreshed token


### vm (handler-level Go suites)

What the engine-level suites in `adapters/<name>_style_test.go` assert — the
adapter's real handlers execute against the real engine; no SDK is involved.
Named by their `// =====` section markers.

**adyen-style**

- a missing X-API-Key is a 401 security envelope
- an unseeded API key is rejected identically
- the seeded test key authorises; header spelling does not matter
- the gate spans the whole surface, not just /payments
- a plain card authorises instantly with a 16-digit 881 pspReference
- the refused test card (...0002) answers Refused with refusalReason, still 200
- simulate_fail refuses an instant payment outright
- Idempotency-Key replays the same pspReference; a fresh call mints a new one
- GET ?reference= returns the payment object; unknown references are 422 010
- the unfiltered list is cursor-paginated; a garbage cursor is a 400
- a 3DS card returns IdentifyShopper with a threeDS2 action and no pspReference yet
- submitting the fingerprint authorises and mints the pspReference
- paymentData tokens are single-use
- challenge cards (...0081) add a ChallengeShopper round with a fresh token
- simulate_fail refuses at completion with threeDSError
- a missing paymentData or missing fingerprint is a 422 validation error
- an idempotent replay re-renders the payment's CURRENT state, not the original response (deviation, asserted as-is)
- the catalogue is scheme/ideal/paypal/applepay/googlepay, storedPaymentMethods empty
- merchantAccount is required
- any merchantAccount string is accepted — no account registry (deviation, asserted as-is)
- creating a link assigns PL-N, defaults expiresAt to +24h, starts active
- a zero amount or missing reference is a 422
- an unknown link id is a 404 with errorCode 191
- authorising a payment on the link's reference completes the link on read
- a past expiresAt flips the link to expired on read, and terminal statuses persist
- capture chains a CAP-prefixed pspReference and returns status received
- a partial capture keeps the remainder capturable; over-capture is 422 702
- refunds draw down the captured balance; over-refund is 422 705
- refund before capture is 704, currency mismatch 708, zero amount 703
- cancel is only for uncaptured payments; reversal is terminal from captured
- a cancelled payment rejects every later modification
- an unknown pspReference is a 422 010
- webhook registration masks the hmacKey in every view
- an authorisation delivers the standard envelope signed with the hook's own key
- a capture chains originalReference and signs with the mock key via the events filter
- a refused payment notifies AUTHORISATION with success "false"
- only the first matching hook receives an event (deviation, asserted as-is)
- deleting a hook silences it; the next matching hook takes over
- the merchant-side receiver answers [accepted] and tolerates redelivery

**anaplan-style**

- missing or unrecognized credentials draw the 401 failure envelope
- the workspace list is seeded with Anaplan paging metadata
- paging walks the opaque offset cursor and rejects a bad token
- models are workspace-scoped and a single model round-trips or 404s
- catalog lists serve the seeded per-model action catalog
- a full-body upload replaces file content byte-exact on POST and PUT
- chunked uploads append in order and reject gaps and malformed ranges
- invalid identifiers and unknown files get 400/404 envelopes
- an import task walks CREATED → NOT_STARTED → IN_PROGRESS → COMPLETE
- completion applies the import once and the export renders the model data
- simulate_fail completes with every row failed
- an import over an empty upload reports no contents
- unknown import, export, and task ids get 404 failure envelopes
- catalog ids resolve only within their model
- task status is scoped to its workspace and model

**apple-apns-style**

- the provider token gate distinguishes missing invalid and expired tokens
- a push to the known device returns 200 with a canonical uuid apns-id
- unknown device tokens are 400 baddevicetoken
- empty aps payloads are 400 payloadempty
- sent notifications are retrievable per device

**apple-appstoreconnect-style**

- a rejected credential answers Apple's 401 errors array, not a bare status
- the JOSE header must declare ES256 and carry a kid
- structural validity is not enough: the exact JWT string must be registered
- the seeded app reads back through list and single-get, with 404 NOT_FOUND for unknown ids
- create assigns numeric ids, persists into the list, and dedupes bundleId
- bracketed filter[...], leading-dash sort, and fields[apps] projections apply before paging
- PATCH /v1/apps/{id} renames and refuses bundleId collisions
- limit/cursor paging surfaces meta.paging and a links.next cursor
- limit defaults to 50 and clamps at the documented maximum 200
- a malformed cursor is total: 200 with data null (Apple answers 400 — deviation)
- versionString is required and duplicate versionStrings collide per app
- the app's first version adopts its unattached build
- PATCH works only in the editable states (PREPARE_FOR_SUBMISSION, REJECTED)
- submission drives WAITING_FOR_REVIEW → IN_REVIEW → READY_FOR_SALE on the clock
- simulate_fail rejects, and a REJECTED version stays editable and resubmittable
- a fresh app's build reads PROCESSING and the processingState filter agrees
- the 3s window settles VALID and GET /v1/builds/{id} agrees
- a simulate_fail app settles its build INVALID
- users seed once and answer the bracketed role/username filters and sort
- salesReports echoes the bracketed report filters with DAILY/SALES defaults

**apple-music-style**

- a missing bearer answers 401 in Apple's error envelope
- malformed schemes, segments, algs and signatures are all 401
- the registered deterministic developer token reads the catalog
- the developer token dies when its registry entry expires
- search without a term is a 400 invalid_parameter
- results group by requested type in meta order with next links
- the term matches names, artists and album text case-insensitively
- unknown search and chart types are 400 invalid_parameter
- charts order the seed by release date within each requested type
- include=tracks embeds track resources; without it only an href
- storefront codes are validated and normalized (US -> us)
- unknown ids answer Apple's 404 error body
- a known album and artist fetch with storefront-derived hrefs
- pages walk by offset and the last partial page has no next
- limits clamp to the endpoint default and max
- library lists page with meta.total
- /v1/me checks the developer JWT before the Music-User-Token
- adding resources to the library is idempotent and validates ids
- played bumps playCount and stamps lastPlayedDate at play time
- recently-added lists newest first across mixed resource types
- fields[type] projects library attributes
- delete addresses the catalog id or the library id, then 404s
- an unrated resource reads 0; love/dislike/clear round-trip
- invalid values and unknown targets keep the documented shapes

**apple-searchads-style**

- a missing, malformed or unknown bearer is a 401 in the Search Ads envelope
- the seeded static test token passes the gate
- a client_credentials exchange mints a bearer valid for exactly one hour
- malformed grants and client secrets are oauth-shaped 400s
- campaign create assigns a numeric id and fills the v4 defaults
- create without a name is a 400
- the campaign reads back by numeric id; unknown ids are 404s
- update merges fields, maps status onto servingStatus, and bumps only modificationTime
- an invalid status is a 400 that writes nothing
- ad groups create under a campaign; unknown campaigns are 404s
- find lists the seed with default pagination and clock-derived stamps
- conditions filter with EQUALS, CONTAINS and amount ranges
- values within one condition are OR'd; multi-value NOT_EQUALS excludes all
- orderBy sorts and pagination slices with totalResults before the slice
- first touch seeds three keywords scoped to the campaign
- keyword find speaks the same selector (conditions, orderBy, pagination)
- create takes a single keyword or a batch body
- single update merges partial fields and validates them
- bulk update takes id-addressed rows; an unknown id 404s the batch
- delete removes the keyword and find no longer sees it
- startTime, endTime and groupBy are validated
- one row per campaign with deterministic metrics and summed grandTotals
- the report selector filters rows and grandTotals follow

**auth0-style**

- discovery and JWKS are self-consistent for the host
- authorize issues a code; the grant mints a real RS256 token pair
- userinfo resolves the token to the seeded user; login_hint picks another
- spent and mismatched-redirect codes answer invalid_grant
- authorization codes expire after five minutes
- zero-based pages cover every user exactly once with true totals
- control characters in claims round-trip as escaped JSON
- a control-char audience survives the adapter's own token check
- patching onto another user's email is a 409 Conflict envelope
- fresh and self-owned email patches both succeed
- bad clients, redirect_uris, response types, and login hints get OAuth error redirects
- a missing redirect_uri is a 400, not a redirect
- the refresh grant returns fresh tokens without rotation
- revoke is idempotent and actually kills the token
- the access token dies at its 1-hour exp on both APIs
- the refresh token outlives it, then dies at 30 days
- client_credentials mints a bare JWS that drives the Management API
- the M2M token cannot call userinfo; a bad secret is invalid_client
- list returns the seeded users without leaking password internals
- q search and zero-based paging narrow the list
- create/get/patch round-trip the user and its metadata
- validation errors and delete leave the documented envelopes
- role create/list round-trip with conflict and name validation
- assignment is additive, idempotent, and validated
- signup creates an unverified user the Management API can see
- duplicate, weak, and unknown-client signups are rejected

**avalara-style**

- every v2 endpoint demands a credential: a bare call is a 401 AuthenticationRequired envelope
- any Bearer or any HTTP Basic credential opens the gate
- a non-Basic/Non-Bearer scheme does not count as a credential
- the effective rate keys off the address state (CA 0.095) with a State/County/City/Special breakdown
- the summary aggregates the taxable base per jurisdiction
- per-line tax rounds to cents: two lines aggregate, line 2 keeps its own tax
- SDK decimal strings ("100.00") price identically to JSON numbers
- the shipFrom/shipTo form keys off shipTo (NY 0.0875)
- unknown or missing addresses fall back to the synthetic 0.0825 default
- create prices the document, mints id/code/companyId and applies AvaTax defaults
- an omitted date defaults to the clock's today, and advances with it
- read round-trips by id; unknown ids are 404 NotFound
- the list supports OData $filter and $orderBy with @recordsetCount
- $top/$skip pages through an @odata.nextLink that round-trips
- void flips status to Cancelled and the record reads back cancelled
- re-void is idempotent
- the companies catalog lists DEFAULT and STORE1 with default locations
- nexus $filter literals are typed: id eq 1001 matches ints, hasNexus eq true matches bools
- the taxcode catalog is filterable by taxCode

**aws-cognito-style**

- a reset code older than one hour answers ExpiredCodeException
- a NEW_PASSWORD_REQUIRED session works until AuthSessionValidity lapses
- past the session window the challenge answer is NotAuthorizedException
- refresh tokens are reusable without rotation; access tokens rotate
- the refresh token dies at its 30-day expiry with invalid_grant
- two authorize flows bind the same seeded demo-user
- authorize never mints new users into the collection

**azure-devops-style**

- a missing, unknown, or non-PAT credential gets the UnauthorizedRequestException 401 envelope
- both PAT wire forms — Basic base64(PAT:) and Bearer — authenticate
- the projects list returns the two seeded projects in the Azure DevOps shape
- $top/$skip walk pages each project exactly once via continuationToken, and a bad token 400s
- creating on the typed route applies the patch document and defaults area/iteration
- the fully-qualified $type route normalizes to the bare type
- read-back returns the integer id; an unknown id is the WIT 404 envelope
- a patch bumps rev, applies field ops, and refreshes audit fields
- relations are added at - and removed by numeric index only
- malformed patches answer the PatchOperationFailed / Argument envelopes
- ids= returns the asked work items and fields= projects to those columns
- WIQL ANDs string and numeric predicates and matches CONTAINS
- ORDER BY sorts by the field and $top caps the result
- OR and non-WorkItems FROM targets answer the 400 envelope
- the repos list is scoped to the project
- a push stores content that items serves at the branch and at a pinned commit
- the commits list walks newest-first along the parent chain and filters by refName
- git faults: unknown repo, missing path, unknown path, malformed versionDescriptor
- pipelines list and get round-trip, and unknown ids answer 404
- a queued run derives inProgress then completed from the clock, once each
- simulate_fail drives the completed result to failed
- a registered subscription receives the service-hook envelope when a work item is created
- iterations list the two sprints and page under $top

**azure-servicebus-style**

- a correctly signed SAS token sends the message
- a tampered signature is 401 InvalidSignature
- an expired se is 401 ExpiredToken
- structurally broken tokens map to MalformedToken or InvalidSignature
- Entra Bearer tokens are accepted alongside SAS
- the storage-queue endpoint accepts the same SAS verifier
- a tampered storage-queue signature is 401 InvalidSignature

**azure-storage-style**

- container create passes auth with clock-driven Last-Modified and ETag
- blob upload passes auth with byte-exact content
- blob download round-trips bytes with the stored ETag
- ListContainers includes the container with query params signed
- a tampered signature gets the 403 AuthenticationFailed XML envelope
- an account outside the key table fails closed with 403

**braintree-style**

- ping answers true and introspection names the query root
- unknown fields and operations fail validation before execution
- createCustomer assigns an id and the customer query reads it back
- a charge is born SUBMITTED_FOR_SETTLEMENT; an authorization is AUTHORIZED
- resolver failures surface as errors[] with a null field, not an HTTP status
- searchTransactions speaks the criteria vocabulary with enum normalization
- the charge settles at +3s, derived on read
- REST handlers require credentials; Bearer or Basic both unlock
- client tokens and vaulted payment methods come back in Braintree shapes
- the transaction lifecycle derives on the clock
- guard failures carry the real Braintree error codes
- refunds default to the unrefunded balance and cap at it
- an uncaptured authorization expires past its window
- an Idempotency-Key replays the original create
- advanced_search maps the search-criteria vocabulary onto typed filters
- registration stores the hook and delivers a signed check
- settled transactions fire one signed notification per new state, filtered by kind
- subscriptions bill per cycle, expire at the last, and cancel only while Active
- inbound verification splits 200/400

**braze-style**

- a missing credential is the 401 message envelope
- an unknown app-group key is rejected
- x-authorization carries the raw app-group key
- track ingests attributes, events, and purchases
- re-tracking the same external_id updates one profile
- export aggregates custom events and purchases, dedups ids
- fields_to_export projects the profile
- per-record errors keep partial success
- _update_existing_only never creates
- fatal envelopes: the 75-id cap and undecodable JSON
- alias/new creates an alias-only profile track can target
- identify re-keys an alias-only profile when the external_id is new
- identify merges an alias-only profile into an existing one
- send fatals: message, variant, and recipient rules
- send succeeds with a 32-hex dispatch id and emits message.sent
- campaigns/trigger/send validates the campaign id
- schedule/create mints a UUID-shaped schedule id
- end_time is required
- upcoming broadcasts list both schedules
- the send transition derives on read, exactly once
- segments list seeds and pages by cursor
- one identifier type per delete
- delete removes the profile and its dependent records

**chainlink-style**

- the five default feeds seed on first read and narrow by network
- the feed summary and latestRoundData agree at the same instant
- rounds roll one per virtual minute with phase-1 string roundIds
- round history pages newest-first and getRoundData resolves ids
- unknown feeds and rounds answer the documented 404 envelopes
- v2 endpoints reject missing and wrong bearers
- encryptSecrets is a deterministic version-0 canonical envelope
- createSecrets bumps the slot version and never leaks plaintext
- a request walks queued -> running -> fulfilled on the virtual clock
- the fulfill event packs chainId << 64 | gasUsed
- simulate_fail lands the real fulfillment-code vocabulary
- registration validates the registry shape and funds in juels
- the keepers network performs on cadence until the LINK runs out
- check gates eligibility and a manual perform charges the premium
- cadence performs interleave chronologically with manual ones
- cancel freezes the upkeep and withdraw pays out exactly once
- the upkeep list derives state for every entry and 404s unknown ids
- ccip messages require the bearer token
- lane status echoes the requested pair with its ramp addresses
- the seeded test token dies after its ten-year virtual window

**cloudkit-style**

- the s2s signature gate rejects unsigned tampered stale and foreign-key requests
- users current returns the s2s owner identity
- zones list seeds defaults filters by prefix and pages
- records lookup returns the seeded shape with inline NOT_FOUND
- records query filters sorts and pages on a numeric resultsLimit
- records modify creates updates and deletes round-trip

**dropbox-style**

- upload takes the JSON {path, content} convenience body (documented deviation)
- the real RPC upload (Dropbox-API-Arg header + raw octet-stream body) lands identically
- re-uploading an existing path answers the real mode:"add" conflict
- mode overwrite replaces in place; autorename forks a suffixed path
- list_folder returns the whole path-prefix subtree, not one level
- the root listing spans everything; unknown and file paths carry distinct 409 tags
- paging slices the filtered subtree by body cursor, ignoring query strings
- download streams raw bytes by path and by id, with metadata alongside
- folders and unknown paths decline under the 409 path envelope
- get_temporary_link pairs the file's metadata with the synthetic link
- a presented bearer must be registered: unknown and expired tokens get distinct 401 tags
- an absent Authorization header stays open (documented deviation)
- create_folder mints folder metadata and conflicts case-insensitively
- get_current_account returns the synthetic /2/users snapshot
- deleting a folder removes its entire subtree from every read path
- trash tombstones audit the exact cascade batch
- delete is permanent: a re-created path is a brand-new entry

**dune-style**

- the api-key gate rejects missing, empty and non-bearer authorization
- an execution walks PENDING -> EXECUTING -> COMPLETED as the clock advances
- a missing required parameter is the 400 envelope and both SDK parameter shapes resolve
- simulate_fail terminates QUERY_STATE_FAILED and results carry the failure envelope
- the inline-result route completes synchronously
- results pages honor limit/offset with a followable next_uri
- the CSV variant streams text/csv for the same page

**dynamodb-style**

- an unsigned request is 403; a real SigV4 signature passes
- tampered signatures, wrong secrets, and clock skew are all 403
- CreateTable returns ACTIVE; duplicate and bad-schema creates throw the real exceptions
- Describe/List/Delete round out the lifecycle with table paging
- typed values round-trip verbatim through PutItem/GetItem
- projection, misses, and malformed keys take the documented paths
- SET upserts, ADD does exact-decimal math, REMOVE drops with UPDATED_OLD
- non-numeric ADD and bogus ReturnValues are ValidationExceptions
- numeric sort keys order numerically (10 after 9)
- BETWEEN, >=, descending, and begins_with shape the key range
- Limit + ExclusiveStartKey pages queries; bad conditions are rejected
- Scan returns the whole table and filters by expression
- Select COUNT, pagination, and error paths round out Scan
- attribute_not_exists guards writes; failed checks return the old item
- conditional deletes enforce the condition; consumed capacity echoes
- batch writes and gets round-trip with empty Unprocessed maps
- oversized, unknown-table, and invalid batches are rejected atomically
- unsupported constructs fail with named ValidationExceptions
- a leading "." answers ValidationException instead of wedging the tokenizer
- "|" in key values cannot collide two composite keys
- set members dedupe by string and numeric value
- "-0" and "0" name the same stored item

**emailoctopus-style**

- a missing API key is 401 problem+json
- a blank name is 422 with the field error
- list create/get round-trip
- an unknown list is 404 on contact routes too
- contacts create into the list
- limit/starting_after paging pages contacts without repeats
- get by contact id round-trips the email
- delete removes the contact; reads 404 after

**erc4337-style**

- supportedEntryPoints, chainId, and the JSON-RPC envelope
- estimateUserOperationGas validates the full v0.7 field set
- sendUserOperation answers a deterministic hash and defaults the entry point
- the op walks mempool -> bundled -> included on the virtual clock
- simulate_fail reverts on inclusion with the AA95 reason
- the paymaster signs the op into paymasterAndData
- missing or invalid userOps are 400s

**escrow-style**

- missing, Bearer, and malformed Authorization are 401s with the challenge header
- the documented credentials unlock the customer record
- the gate covers the transaction and webhook surfaces alike
- create assigns the first numeric id, stamps creation_date, and defaults currency
- the initiating party is auto-agreed; the counterparty is not
- items carry the 2017-09-01 defaults and schedule amounts as decimal strings
- the default escrow fee is 3.25% charged to the buyer
- get by id returns the same shape — amounts survive the store round trip
- unknown ids are 404s keyed on the id field
- party validation answers the nested Escrow field errors
- amounts parse from decimal strings identically to numbers
- multi-entry schedules sum into the default fee
- a caller-supplied fee split is honored, in the schedule's dollar units
- an unparseable amount stores 0.00 rather than 400ing (deviation, asserted as-is)
- a non-JSON body is a 400 body error, not a 500
- the default page returns every transaction in creation order
- per_page slices; page walks the remainder; past the end is empty
- junk pagination params fall back to the defaults (page 1, per_page 10)
- a reference resolves to its transaction
- an unknown reference is a 404 keyed on the reference field
- agree needs a party's email and rejects strangers
- funding waits for every party's agreement
- the counterparty's agreement unlocks funding; every schedule entry secures
- accept flips every item and stamps close_date off the virtual clock
- PATCH actions and funding on unknown ids are 404s
- ship marks the item shipped, receive marks it received
- cancel flags every item and the transaction itself, without closing it
- unknown or missing actions are 400s on the action field
- registration assigns integer ids and echoes the URL
- the list carries every registered webhook
- a missing or blank url is the can't-be-blank field error

**etherscan-style**

- the apikey query parameter gates every module call
- unknown modules and actions answer the NOTOK envelope over HTTP 200
- balance reads the seeded ledger; unknown addresses default to "0"
- txlist scopes by address then applies block filters, sort and paging
- contract verification: ABI, source, and the unverified fallback
- stats and token holders keep every number a decimal string

**fattureincloud-style**

- auth failures answer the flat OAuth envelope; any non-empty bearer passes
- an unknown company id is the nested NOT_FOUND 404
- document create wraps the v2 defaults, an int id, and decimal-string amounts
- modify merges, delete clears, and the after-states keep the v2 envelope
- the Laravel pagination envelope is exact and clamps page and per_page
- type, date, and q filters narrow received documents inclusively
- the metodata endpoint lists the sorted categories in use
- subscriptions round-trip the real data.sink shape; a missing sink is a validation 400
- deliveries are HMAC-signed, real-typed, and respect the types filter
- F24 taxes stamp the virtual clock and flip status through the lifecycle

**firebase-style**

- signUp mints the Identity Toolkit token set with a padded localId
- duplicate and email-less signUps are Firebase-coded 400s
- password sign-in round-trips the user; bad credentials answer the real codes
- signInWithIdp provisions a verified Google user
- the v3 relyingparty dispatcher mirrors verifyPassword and 404s unknown actions
- endpoints accept Bearer or key and reject anonymous requests 401
- getAccountInfo resolves each idToken to the user it was minted for
- unknown and empty idTokens are 401 INVALID_ID_TOKEN
- the idToken dies at 1h while its refresh token survives
- v3 refreshToken rotates the token pair for the bound user
- unknown and missing refresh tokens are 400 INVALID_REFRESH_TOKEN
- POST /v1/token exchanges a refresh token in the securetoken shape
- the grant rejects wrong grant types and unknown tokens
- create wraps fields in Firestore typed values under a full resource name
- get reads the document back; unknown ids are 404 NOT_FOUND
- PATCH merges fields, bumps updateTime, and upserts unknown ids
- explicit documentIds are scoped per project+collection and 409 on reuse
- delete returns an empty 200 and leaves 404s behind (its own project only)
- list pages with pageSize/pageToken and rejects a malformed token
- subcollections nest under their parent document path
- runQuery filters, sorts, and limits over typed fields
- IN and ARRAY_CONTAINS resolve over array values
- queries are project-scoped and malformed bodies are 400 INVALID_ARGUMENT
- a token send is stored with its recipient and answers with its resource name
- a send must carry exactly one target
- topic and condition sends fan out to the subscribed tokens
- unsubscribing shrinks the fanout and a bare subscribe is a 400
- the stored message list is project-scoped

**helius-style**

- the api-key query gate rejects both surfaces
- the JSON-RPC reads answer deterministic values; an unknown method is a -32601 envelope
- sendTransaction walks null → processed → confirmed → finalized, firing the enhanced webhook exactly once at first confirmation
- simulate_fail lands an on-chain InstructionError while confirmation still proceeds
- the enhanced history seeds once per address, newest first, in the Helius parsed shape
- type/source filters and before/until/limit paging narrow the history
- a sent transaction joins its address's history; other addresses do not see it
- the parse-transactions contract holds and the balances/nfts/names lookups are deterministic
- webhook registration round-trips the Helius config shape with 404s for unknown ids
- deliveries are unsigned, carry authHeader as Authorization, honor transactionTypes and fire exactly once

**hn-style**

- item reads resolve the .json route capture into the full Firebase story shape
- comments link up via parent and kids, omit story-only fields, and count their subtree in descendants
- unknown items and users answer 200 with the literal null, not a 404
- story lists are bare integer arrays: top and best rank by score, new is newest-first
- ask and show partition the story set by title prefix; jobs stay type-only and off the story lists
- Firebase REST query params (print=pretty, orderBy, limitToFirst) are accepted and ignored
- user reads resolve .json ids into created/karma/about/submitted with by/submitted agreeing
- users without a bio omit about, matching the sparse Firebase shape
- reads are public: no credential is required and a stray bearer gates nothing
- maxitem and updates are not modeled: the read surface is the six lists plus item and user

**instagram-style**

- authorize without redirect_uri, state or client_id is invalid_request
- authorize redirects back with a fresh code and the state echoed
- a redirect_uri that already carries a query is joined with &
- the exchange demands grant_type=authorization_code
- an unknown code is 400 invalid_grant
- a good exchange mints a token bound to a fresh IG user
- the code is single-use: a replay is invalid_grant
- client mismatches are 400 invalid_client
- a mismatched attempt must not burn the code
- a second flow mints a distinct user
- a missing bearer is 401 in the Graph error envelope
- wrong schemes and unknown bearers answer the same 190
- every API route enforces the same gate
- a bearer dies at its clock-derived 60-day expiry
- me returns the OAuth-bound profile
- media_count starts at 0 and tracks published media
- a second user's profile counts only its own media
- a container without image_url or video_url is a code-100 400
- create assigns a c_* container id
- a fresh container polls IN_PROGRESS and publish is gated
- the status derives FINISHED after the ~3s window
- publishing a FINISHED container assigns an m_* media id
- simulate_fail ends in ERROR and never publishes
- unknown container ids answer the catch-all 404
- a video container publishes VIDEO media carrying the video url
- the media edge lists newest first (reverse chronological)
- ?fields= projects each row and drops unknown fields
- limit pages through after cursors with a next that keeps the query
- a malformed after cursor is a code-100 400
- the list is scoped to the path user
- all four manifest metrics return in canonical order
- values are deterministic across reads
- ?metric= filters to the requested names
- an unknown metric name empties the data set (deviation, as-is)
- insights for an unknown media id are the catch-all 404
- comments authorize via the access_token query param
- the bearer header authorizes the identical read
- a bad query token is the 190 envelope
- since hides comments at-or-before the cutoff
- comments on an unknown media id are a code-100 OAuthException 404
- refresh demands a token (query param or bearer)
- an unknown token is rejected with 190
- refresh mints a fresh 60-day token; the old one keeps working
- the refreshed token outlives the original's expiry

**jumio-style**

- a missing, bare or wrong-scheme token is a 401 in the Jumio error envelope
- a scan create answers PENDING with a synthetic decimal scan reference
- sequential creates advance the reference sequence
- a create without merchantScanReference is a 400
- PENDING holds through the processing window then flips to DONE
- a FAILED scan carries a real reject reason and its description
- unknown scans are 404 on every parameterized route
- extracted data is None while the scan is PENDING
- DONE exposes the synthetic document extraction
- FAILED scans answer data with a 409 repeating the reason
- delete removes the scan and later reads are 404s
- deleting after the terminal window still advances the lifecycle
- a correctly MACed webhook body is accepted
- a tampered body, wrong MAC or missing header is a 401
- the terminal transition emits exactly one signed scan.completed
- failed scans emit scan.failed carrying the rejection reason
- a delete-driven terminal transition also emits, then nothing more

**linkedin-style**

- authorize without redirect_uri, state or client_id is invalid_request
- authorize redirects back with a fresh code and the state echoed
- a redirect_uri that already carries a query is joined with &
- the exchange demands grant_type=authorization_code
- an unknown code is 400 invalid_grant
- a good exchange mints a 60-day token pair for a fresh member
- the code is single-use: a replay is invalid_grant
- client mismatches are 400 invalid_client
- a mismatched attempt must not burn the code
- a second flow mints a distinct member
- the refresh grant demands client creds
- an unknown refresh token is invalid_grant
- refresh rotates the pair and keeps the member
- the presented refresh token is single-use
- rotation chains: the new refresh token refreshes again
- a missing bearer is 401 in the service error envelope
- wrong schemes and unknown bearers answer the same 401
- every API route enforces the same gate
- a bearer dies at its clock-derived 60-day expiry
- userinfo returns the OAuth member profile
- publishing as anyone but the token's member is a 403
- a good publish mints a ugcPost urn echoed in x-linkedin-id
- the post resolves to a share urn carrying its own author
- resolving an unknown urn is a 404
- unconfigured, publishing is unthrottled
- arming fail_after injects 429 REQUEST_LIMIT_EXCEEDED
- the limit is per member
- a throttled attempt creates no post
- q must be author
- reply resolves urn:li:person:me to the authenticated member
- commenting as anyone but the caller is a 403
- replying to an unknown object is a 404
- ingest lists only the token member's comments
- member B's comment resolved me and lists only under B
- createdOn is clock-stamped and monotonic
- count pages with a next link that round-trips the query
- without count the whole list returns unpaged
- a malformed start cursor is a 400
- an unknown entity is a 404
- each queryType totals base+3/5/7/11 split across two daily buckets
- entity accepts both the parenthesized and bare urn forms
- start past the data returns an empty page
- an unknown queryType falls back to the base total (deviation, as-is)

**marketo-style**

- only client_credentials mints a token
- an invalid token gets the 403 success=false envelope
- create assigns ids through the input array
- get by id round-trips the fields
- createOrUpdate dedupes by email in place
- batchSize/nextPageToken paging walks leads without overlap

**netsuite-style**

- a request without Authorization is 401 INVALID_LOGIN in the o: envelope
- TBA without oauth_signature is rejected: the signature's presence is the gate
- TBA, NLAuth and Bearer all pass the structural gate
- every route family sits behind the gate
- create answers 204 No Content with the record's URL in Location
- internal ids are numeric strings minted past the seed range
- the created record reads back verbatim under its id
- POST with a seen externalId is an upsert: the existing record's Location, no duplicate
- DELETE answers 204 and the record is gone afterwards
- unknown ids and unknown record types are distinct 404 codes
- a transaction record without entity is 400 USER_ERROR naming the field
- entity references resolve by id or refName against stored customers
- a dangling entity reference is 400 INVALID_KEY_OR_REF
- customerPayment demands both customer and payment
- a body that is not a JSON object is 400 INVALID_REQUEST
- PATCH merges the sent fields into the stored record and answers 204
- numeric patches round-trip through the collection as floats
- an id in the PATCH body cannot move the record
- PATCH on an unknown record id or type is a 404
- a malformed PATCH body is 400 INVALID_REQUEST
- the list envelope is items/count/hasMore/links with a self link
- limit windows the page and hasMore adds a next link with the following offset
- following the next link returns the tail and clears hasMore
- an offset past the end is an empty page, not an error
- q filters and orderBy sorts before paging
- an unparseable q is 400 INVALID_SEARCH_PARAMETER, not silent unfiltered rows
- the metadata catalog lists the record types the parameterized routes serve
- SuiteQL returns the FROM table's live rows in the query envelope
- created records are visible to SuiteQL
- SQL LIMIT/OFFSET window the page and mint a next link
- limit/offset query params page when the SQL has no clauses
- unknown tables, FROM-less and missing statements are 400 INVALID_REQUEST
- the /services/rest/v1/suiteql alias runs the same handler
- a salesOrder bills into an invoice dated today, due in 30 days
- the invoice settles into a customerPayment and flips its source to Paid in Full
- the clock drives trandate
- request-body fields override the mapped defaults
- impossible chains, unknown sources and dangling overrides use NetSuite's real codes

**oneinch-style**

- a quote returns token pairs, a decimal toAmount and a 100-point split
- quotes are deterministic and address matching is case-insensitive
- the toAmount scales linearly with the input amount
- a same-token quote scales the amount by the pseudo-rate (as-is)
- missing params and unknown tokens are 400 error envelopes
- a swap returns router-addressed calldata with gas and gasPrice
- the swap toAmount matches the quote for the same input
- slippage is optional and ignored (as-is)
- missing params and unknown tokens are 400s
- the spender is the router contract address
- approve calldata targets the token with the max allowance
- a missing or unknown token is a 400
- the token list is an address-keyed map of six tokens
- every token in the list is quotable as a source

**onfido-style**

- a missing or non-Token Authorization header is 401 authorization_error
- applicant create flags exactly the blank names and reads back by id
- document and live photo uploads bind to a real applicant and default side
- check create demands report_names and a known applicant
- the check completes from the clock and emits check.completed exactly once
- simulate_fail completes with consider and consider breakdowns
- the webhook receiver MACs the exact raw bytes

**opensea-style**

- the X-API-KEY gate 401s every surface with the V1ErrorWrapper envelope
- the asset list seeds five mock-punks NFTs and filters by collection_slug
- single-asset reads match the address case-insensitively and 404 unknown shapes
- collections read back contracts and string-typed stats; unknown slugs 404
- limit/next cursor pagination walks the pages and 400s a malformed cursor
- events filter by collection_slug and event_type
- listings carry the Seaport ask shape: the NFT in offer, payment in consideration
- offers invert the shape: payment in offer, the NFT in consideration
- created offers are stateful, deterministic, and defaulted

**paypal-style**

- client_credentials over Basic auth mints a distinct Bearer with PayPal's token envelope
- the minted bearer authorizes the Orders API
- minting without HTTP Basic client auth is a 401 AUTHENTICATION_FAILURE envelope
- a bearer that was never minted is rejected with 401
- the advertised 9-hour expires_in is enforced — the token dies past it
- any Basic credentials mint a token — no client registry (deviation, asserted as-is)
- create assigns ORDERID-N, stamps create_time, and echoes intent + purchase_units
- a CREATED order carries self/approve/capture links
- get round-trips the order; unknown ids are 404 INVALID_RESOURCE_ID
- orders are accepted without purchase_units — no create-time validation (deviation, asserted as-is)
- capture or authorize before payer approval is 422 ORDER_NOT_APPROVED
- simulate_fail approval keeps the order CREATED with 422 PAYER_ACTION_REQUIRED
- approval flips CREATED -> APPROVED and swaps in capture/authorize links
- re-approval is idempotent
- capture completes the order and embeds a COMPLETED capture in purchase_units
- the capture resource is readable via the payments API
- re-capturing the order is 422 ORDER_ALREADY_CAPTURED
- authorize completes the order and lands a CREATED authorization
- re-authorizing the order is 422 ORDER_ALREADY_AUTHORIZED
- GET shows the auth with a 3-day honor window from the virtual clock
- reauthorize refreshes the honor window and syncs the embedded order copy
- void is 204, moves the auth to VOIDED, and syncs the order
- a voided authorization rejects every action with 422
- malformed, mismatched-currency, and over-authorization amounts are 400s with real issue codes
- a partial capture keeps final_capture false and moves the auth to CAPTURED
- the capture is appended to the order and links up to the authorization
- a captured authorization is terminal
- refunds are created PENDING and reserve the unrefunded balance
- the 3-second settle window flips PENDING -> COMPLETED on read
- the settled refund is reported as refunded_amount on the capture
- a FAILED refund frees the balance again
- PayPal-Request-Id replays return the same order
- a replay returns the order's current state, not a cached snapshot (deviation, asserted as-is)
- requests without the header (or with a new one) are not deduplicated
- webhook registration round-trips through the list
- signature verification answers SUCCESS only for known webhook ids
- deletion is 204, and repeats are 404

**persona-style**

- a missing, bare or wrong-scheme token is a 401 in the JSON:API error envelope
- a create mints a zero-padded inq_ id in the JSON:API envelope
- sequential creates advance the id sequence
- any Bearer is accepted: the gate checks presence, not a store (as-is)
- a create missing template_id or reference_id is a 400 invalid_request
- the status derives from the clock created to pending to completed
- resume restarts the clock at pending without duplicating verifications
- simulate_fail declines at the terminal transition and seeds nothing
- unknown inquiries are JSON:API 404s on every parameterized route
- verifications are empty until the terminal transition fires
- completion seeds the government-id and selfie verifications
- a fresh correctly-signed webhook is accepted
- a tampered body or wrong MAC is a 401 invalid_signature
- a stale or far-future t is a 401 invalid_timestamp
- a missing header or unparseable signature is a 401
- polling through pending still emits exactly one inquiry.completed
- re-reads and post-resume re-completions do not re-emit
- a declined inquiry emits inquiry.declined signed the same way

**photos-style**

- authorize without redirect_uri, state or client_id is 400 invalid_request
- authorize redirects with a fresh code and echoes the state
- a redirect_uri that already carries a query joins with &
- exchanging an unknown code is 400 invalid_grant
- a client mismatch answers invalid_client but leaves the code usable
- the happy exchange mints the bearer pair
- the minted bearer reads the data plane
- authorization codes are single-use
- unknown grant types are unsupported_grant_type
- refresh without client credentials is 400 invalid_client
- refresh with an unknown refresh token is 400 invalid_grant
- refresh mints a new access token but keeps the refresh token
- the refreshed token serves the same user's library
- refresh-issued access tokens expire like any other
- every data surface answers 401 UNAUTHENTICATED without a bearer
- non-Bearer schemes and unknown or empty tokens are equally 401
- the minted bearer passes the gate on every surface
- the access token dies at its expiry on the virtual clock
- /v1/uploads answers a plain-text uploadToken
- batchCreate links the token to a media item
- mime types follow the file extension
- an unknown upload token answers the per-item status error
- mixed batches keep request order
- upload tokens are single-use
- an albumId is accepted without validation (as-is)
- an empty batch answers an empty result list
- =d serves the original bytes with the recorded content type
- =dv serves the same original bytes
- a bare baseUrl serves the derivative payload instead
- baseUrl is computed from the request host at read time
- unknown ids answer the 404 envelope
- pages walk by pageToken and the last partial page has no next
- the default page holds 25 items
- pageSize clamps at 100
- a single item fetch and the 404 envelope
- items are private to their user
- an unfiltered search returns everything in creation order
- mediaTypeFilter selects PHOTO or VIDEO by mime prefix
- dateFilter ranges and exact dates bound creationTime
- partial dates span their whole period
- multiple ranges are OR'd and keep upload order
- media type and date filters compose
- albumId scopes the search
- search paginates from the JSON body
- create returns the album shape
- a missing album title defaults to Untitled Album
- unknown albums answer the 404 envelope
- list walks pages with the 20 default and the 50 clamp
- albums are private to their user
- delete removes the album but leaves its media

**pinata-style**

- missing or half-present credentials are 401 with the error envelope
- the API key pair and a Bearer JWT both open testAuthentication
- pinJSONToIPFS pins content to a real CIDv0
- re-pinning identical content is isDuplicate, not a new pin
- pinFileToIPFS sizes and names the pin from the multipart parts
- pinList filters by hash, size, status, and metadata name
- pinStart/pinEnd bound the date-pinned window
- pinByHash requires hash and matches the CID exactly
- pinList pages at the real default of 10 rows
- unpin removes the CID; a second unpin is 403 FORBIDDEN

**powerplatform-style**

- every route sits behind the entra bearer gate: a missing, non-bearer, or empty token answers 401 in the microsoft error envelope
- the gate does not validate the token: any well-formed bearer passes (as-is)
- environments list as the odata value envelope with arm resource ids and nested properties
- the api-version query convention is not modeled: the param is ignored (version is baked into the /v2 path — reported)
- environment lifecycle is not modeled: states are static and nothing moves on the clock (reported)
- the collection lazily seeds two dataverse accounts on first read
- create answers 201 with a location entity uri and OData-Version header, echoing the record
- the accounts({accountid}) key convention retrieves and 404s with the dataverse 0x80040217 envelope
- a client-supplied accountid is honored and targeted by later reads
- patch is a partial merge answering 204; delete answers 204 and a second delete 404s
- $filter supports eq/contains with AND and numeric comparisons on unquoted literals
- $orderby sorts asc and desc; $skip applies before paging
- $select projects fields and $count=true reports the post-filter pre-paging total
- $top/$skipToken walk every account exactly once with @odata.nextLink only between pages
- a nextLink round-trips the caller's $filter and $select so a paged walk stays filtered
- paging is disabled without $top and an invalid skipToken answers 400 badrequest
- an environment with no flows falls back to the seeded welcome flow
- creating a flow persists it per environment behind arm flow ids; other environments keep the seeded fallback
- connectors are static arm api resources with tiers

**printful-style**

- a missing or non-Bearer Authorization is the 401 error envelope
- any non-empty bearer key is accepted — the dev-key model
- a sync product mints a sequential id; variants read back verbatim
- unknown products get the 404 error envelope
- an unpaged list is a bare data array with no paging object
- limit/offset pages walk the paging envelope without repeats
- a malformed offset cursor is the 400 error envelope
- v1 create is result-wrapped with an integer id and draft status
- v1 GET round-trips the result; unknown ids are 404
- the v2 list serves one canonical order doc per order, from both create surfaces
- the status csv filter applies before paging
- a status update flips the canonical doc both surfaces read
- order timestamps are sequence-derived, not wall-clock (documented mock choice)
- STANDARD and EXPRESS quotes scale with the item count
- an unset configuration reads as an empty result
- POST sets and PUT replaces the single config; the secret stays masked
- DELETE returns success, empties the read, and silences delivery
- a config without a url is the 400 error envelope
- deliveries are HMAC-SHA256-signed over the exact delivered bytes
- the types filter delivers only subscribed topics
- an empty types list subscribes to every event type
- a v1-created order emits the v1 result shape as the event data

**printify-style**

- a missing or non-Bearer Authorization is a flat 401 at every surface
- the static catalog serves both blueprints and their variant tables
- product create mints sequential hex ids for each blueprint/provider pair
- product lists are shop-scoped and walk the page cursor without repeats
- update merges under the clock and delete leaves a flat 404
- both order-create route forms build the same priced pending document
- order polling strips .json and send flips it to fulfilled
- the global order list pages by limit/page and rejects garbage cursors
- webhook secrets stay masked through every read, and delete leaves a flat 404
- deliveries are HMAC-signed by the subscribing hook's own secret

**psd2-style**

- the tpp token endpoint mints a bearer; other grants and missing or unknown bearers are rejected
- a created consent answers 201 received with self and startAuthorisation links, and reads back
- the sca redirect flow advances one hop per PUT: started → psuAuthenticated → scaReceived
- an update carrying neither method nor OTP is a 400 PARAMETER_INVALID that leaves the chain put
- after the 1s challenge window a read derives finalised and the consent reads valid
- delete terminates the consent and consent-bound reads then reject it
- account reads require a valid consent: 401 CONSENT_INVALID without one
- a valid consent unlocks the seeded account list with per-account links
- withBalance=true embeds an interimBooked balance in each account entry
- the balances read returns interimBooked and forwardAvailable pairs and 404s unknown accounts
- the transaction report requires bookingStatus and dateFrom
- bookingStatus splits booked from pending and dateFrom/dateTo bound the report
- a restricted consent scopes the account list and 404s uncovered reads
- a consent past its validUntil finalises but gates reads with 401 CONSENT_EXPIRED
- with no Consent-ID header, only-expired consents still answer CONSENT_EXPIRED
- an unknown Consent-ID is 400 CONSENT_INVALID; a not-yet-finalised one is 401 CONSENT_INVALID
- page/size walks every account exactly once with a next link only between pages
- the next href round-trips the caller's other query params (withBalance)
- a malformed page cursor is 400 FORMAT_ERROR; a cursor past the end is an empty last page
- the tpp bearer dies at its 3600s expires_in with 401 TOKEN_EXPIRED
- a payment validates its product and amount before answering 201 RCVD with startAuthorisation
- the payment SCA chain mirrors the consent chain and finalises on read
- the transaction status walks RCVD → ACTC → ACSC on the clock and terminal payments refuse cancellation
- a non-terminal payment cancels to 204/CANC and simulate_fail drives RJCT

**qbo-style**

- authorize without client_id/redirect_uri/state is invalid_request
- authorize 302s back to the redirect_uri with code, state and a fresh realmId
- the auth code exchanges once into a token pair; reuse is invalid_grant
- refresh rotates the refresh token and kills the old one (the QBO churn)
- unknown grants and unknown codes are OAuth 400s
- v3 calls demand a live bearer: absent, unknown and expired tokens are 401 fault 32001
- the bearer is realm-bound: another company's path is 401
- DisplayName is required: a 400 fault 610
- customer create assigns Id, SyncToken 0 and QBO defaults
- reads by path id and ?id= round-trip; unknown ids are 404 fault 620
- POST with Id updates: a sparse merge bumps SyncToken and leaves unspecified fields alone
- DELETE deactivates: the record stays readable by id but leaves the active list
- invoice create prices its Line items into TotalAmt/Balance and mints a DocNumber
- a Line is required: a 400 fault 610
- void flips status Voided and zeroes Balance, keeping the record
- DELETE is a hard delete: the record is gone afterwards
- entity detection follows the FROM token, so CustomerRef.value reads Invoices
- WHERE filters by equality, LIKE and IN over stored fields
- ORDER BY DESC with MAXRESULTS caps the page and reports maxResults
- the POST query endpoint takes the statement from the body
- default reads hide deactivated customers; WHERE Active = False surfaces them
- an unknown entity answers an empty QueryResponse; a statement without one is a 400 fault
- STARTPOSITION pages with MAXRESULTS: row 2 of the sorted set

**reddit-style**

- a missing or generic User-Agent is 429 on both routes
- the token endpoint requires HTTP Basic client credentials
- a permanent authorization_code mints access and refresh together
- a refresh grant returns a fresh access token and no new refresh
- submit requires a bearer the adapter itself minted
- a valid submit returns the t3_ thing envelope
- missing sr or title stay HTTP 200 with Reddit error triples
- an access token dies after its one-hour window

**revenuecat-style**

- a missing or unknown key is a 401 {code, message} envelope
- the public pk_ SDK key passes subscriber reads and receipt posts but is 401 on restricted writes
- GET subscriber is get-or-create and answers in the v1 CustomerInfo envelope
- receipt validation mirrors the real 400 order: app_user_id, platform, fetch_token, bad token
- an ios receipt grants the pro entitlement with real trial math, and renewals stack
- a google-play dict receipt feeds the product and lands in non_subscriptions
- revoke lapses a live subscription; delete and the 404 envelopes
- expiry is derived on read: a lapsed trial drops its entitlement

**sendgrid-style**

- the bearer gate rejects missing and unknown keys with SendGrid's grant envelope
- mail send answers 202 with an empty body, an X-Message-Id, and flattened personalizations
- the retrieval endpoint pages with limit and the opaque offset cursor
- the delivery lifecycle derives processed -> delivered (or dropped) on read, exactly once
- the Email Activity query language narrows the list
- event webhook settings round-trip and require a URL when enabled
- deliveries are ECDSA P-256 signed over timestamp + raw body and fire once per recipient stage

**servicenow-style**

- unknown credentials are 401 at the gate
- create assigns a sys_id and INC number
- get round-trips the fields
- update persists the new state
- sysparm_query narrows the list with a total count
- offset/limit pagination pages via the Link header without repeats
- tables are isolated from each other
- unknown sys_id and unknown table are 404
- delete removes the record for good

**signin-with-apple-style**

- authorize redirects with a single-use code plus state and validates its params
- the token exchange mints a real es256 id_token with apple claim shapes
- the served jwks verifies the minted id_token signature
- auth codes are single-use and client_secrets are verified cryptographically
- the refresh grant rotates access tokens and rejects stale or foreign inputs

**smartbill-style**

- requests without credentials are turned away with the errorText envelope
- non-Basic schemes, malformed base64, and colon-less pairs are 401, never a 5xx
- any username:token Basic pair is accepted, under any header case
- the company bootstrap registers a cif and echoes it without internal fields
- a missing cif is a 422 and an unknown cif is a plain 404
- invoice create answers 200 with an empty body and numbers documents sequentially
- totals are computed per line and returned as JSON numbers on read-back
- the read-back drops internal fields and defaults issueDate from the clock
- documents are scoped by series: the FCT number space is not the PRO one
- cancel marks the invoice canceled and records the cancellation tax
- restore flips the document back to active
- canceling an unknown invoice is the 404 errorText envelope
- a payment whose invoicesList number is a JSON number lands on its invoice
- paymentstatus walks to paid and clamps overpayment at zero
- deleting a payment un-pays the invoice; a second delete is 404
- a payment body without the payment envelope is 422
- estimates number on their own PRO counter and cancel like invoices
- purchase invoices number on the ACH counter and carry the supplier object
- stock movements seed quantities that read back grouped by warehouse
- out movements decrement stock and cannot drain a product that was never in
- productName and productCode filters narrow the grouped read
- tax and series metadata are static {list} envelopes with no cif
- document send records the message; a missing envelope is 422
- undecodable and non-object bodies are a 400 errorText, never a 5xx
- an empty body still creates when the cif rides in the query

**sqs-style**

- signed calls pass on both transports with the real MD5
- missing and garbage auth are 403
- tampered signatures and wrong or unknown keys are 403
- a stale x-amz-date is RequestTimeTooSkewed; a fresh signature passes
- a delayed send is not receivable until the delay lapses
- MaxNumberOfMessages bounds are enforced
- receive hides the message until the timeout lapses, counted NotVisible
- redelivery mints a fresh receipt handle and bumps the receive count
- ChangeMessageVisibility extends the in-flight window
- delete removes the message; stale handles are ReceiptHandleIsInvalid
- one bad entry fails alone; the rest of the batch still sends
- delivered entries round-trip their message attributes
- oversize and duplicate-id batches are rejected
- purge empties the queue immediately over the queue-URL transport
- a second purge inside 60s is 403, then works again after the window
- create, GetQueueUrl, and prefix-filtered ListQueues round-trip
- identical re-create is idempotent; conflicting attributes are QueueAlreadyExists
- SetQueueAttributes persists; unknown names are InvalidAttributeName
- DeleteQueue tears the queue down for its messages too
- the throttled profile alternates empty receives deterministically

**tenderly-style**

- the access-key gate rejects missing and unknown bearers with the slug envelope
- networks answer the bare array and switch to the paged envelope under perPage
- a plain simulation round-trips the deterministic Tenderly shape
- a value transfer emits the ERC-20 Transfer log and balance overrides
- reverting simulations carry the ABI-encoded Error(string) output
- bundles fan out per simulation and stored results list and retrieve by id

**thegraph-style**

- pools collection arguments sort by volume and join token0/token1
- where filters map the graph-node suffix operators
- validation failures and the first cap surface as GraphQL errors
- domains join owner/resolvedAddress; lookups miss as null
- _meta reports the deployment head; Token.pools joins in reverse
- the REST SDL surface is public and rejects unknown bearer keys

**threads-style**

- authorize without redirect_uri, state or client_id is invalid_request
- authorize redirects back with a fresh code and the state echoed
- a redirect_uri that already carries a query is joined with &
- the exchange demands grant_type=authorization_code
- an unknown code is 400 invalid_grant
- a good exchange mints a token, user and refresh token
- the code is single-use: a replay is invalid_grant
- client mismatches are 400 invalid_client
- a mismatched attempt leaves the code redeemable (house rule)
- a second flow mints a distinct user
- a missing bearer is 401 in the Graph error envelope
- wrong schemes and unknown bearers answer the same 190
- every API route enforces the same gate
- a bearer dies at its clock-derived 60-day expiry
- me returns the static mock profile
- every user's token sees the same static profile (deviation, as-is)
- ?fields= is ignored: the full profile always comes back
- a container without media_type=TEXT and text is a code-100 400
- create assigns a c_* container id
- a TEXT container polls finished immediately (no processing window)
- back-to-back publish assigns an m_* media id
- republishing the same container mints a second media (deviation, as-is)
- simulate_fail ends in error and never publishes
- unknown container ids answer the catch-all 404
- the inbox lists the user's media newest first
- each post carries one synthetic reply child
- the inbox is scoped to the path user
- ?fields= projection is ignored (deviation, as-is)
- all four manifest metrics return in canonical order
- values are deterministic across reads
- ?metric= projects to the requested names in canonical order
- an unknown metric name empties the data set (deviation, as-is)
- insights for an unknown media id are the catch-all 404
- refresh demands a known refresh_token
- a refresh mints a fresh 60-day token bound to the same user
- the response omits the rotated refresh_token (deviation, as-is)
- the used refresh token is single-use: a replay is invalid_grant
- the original access token keeps its own 60-day life
- the refreshed token outlives the original's expiry

**twitter-style**

- the mock oauth2 endpoint mints a bearer and the bearer gate is never enforced
- create enforces the 280-char limit and reply-chain integrity with v2 400 envelopes
- create answers 201 {data:{id,text}} with kv-sequence ids and clock-stamped created_at
- read by id projects tweet.fields and expands author_id into includes
- delete answers {data:{deleted:true}} and later reads are 404s
- /me resolves the literal route before /2/users/{id} and returns v2's default field set
- show by id and lookup by username round-trip the seeded users
- unknown users are resource-not-found 404s in the v2 envelope
- the timeline is newest-first and loses nothing by default
- start_time/end_time bound created_at and exclude=replies drops threads
- max_results pages via meta.next_token; an invalid pagination_token is a 400
- the tweet list shares the same v2 paging and stays unpaged without max_results

**walletconnect-style**

- every route demands a projectId — body, query, or bearer all pass
- a wc: URI pairing round-trips its topic, relay protocol, and symKey
- an auto pairing mints a fresh topic and a 64-hex symKey
- proposing requires pairingTopic — and accepts one never paired
- approve acknowledges the session and derives eip155 namespaces
- the session list is a bare array capped by limit
- the approval gate is missing: an unacknowledged session still answers
- wallet requests answer in a JSON-RPC 2.0 envelope with monotonic ids
- signing and transaction methods return synthetic 0x-hex hashes
- extend echoes the fixed session TTL without persisting anything
- disconnect retires the topic and every later call 404s

**whatsapp-style**

- a missing bearer is 401 in the Meta error envelope
- wrong schemes, bare tokens and unknown bearers answer the same 190
- every route enforces the same gate
- the seeded test token dies at its clock-derived 10-year expiry
- a text send answers Meta's contacts + messages envelope
- message ids are a zero-padded monotonic sequence
- a template send is accepted and reads back as type template
- a send without a usable recipient is a code-131026 400
- mark-as-read is unmodeled: a status=read body falls into the send path
- a fresh message reads back sent
- the status stays sent through the in-flight window
- delivered is derived at +3s and stays delivered
- simulate_fail ends at failed (simulator extension, as-is)
- unknown wamids are a code-803 404
- each send emits exactly one signed messages webhook
- no status webhook fires before the terminal window
- the terminal transition emits the statuses webhook exactly once
- a multipart upload stores real bytes and reports their digest
- the content download returns the exact bytes at the stored mime
- a specific part content-type outranks the filename extension
- a metadata-only JSON upload has no bytes to download
- uploads demand messaging_product=whatsapp (code 100)
- a multipart body without a file part is a 1304 400
- the seeded phone reads back its registration profile
- register answers success true and the phone stays readable
- register on an unknown phone id still succeeds (as-is)
- an unknown resource id is a code-803 404
- the seeded welcome_message template lists APPROVED
- a created template starts PENDING and echoes its payload
- the approval lifecycle moves PENDING to APPROVED and REJECTED
- an invalid status target leaves the template unchanged (as-is)
- unknown template ids are a code-803 404
- templates page by limit + after cursors
- a malformed after cursor is a code-100 400

**workday-style**

- requests without a Bearer or Basic scheme are 401 at the gate
- both Bearer and Basic credentials clear the gate
- Create_Worker mints an id that reads back through staffing
- the RaaS custom report wraps rows in Report_Entry
- search narrows the worker list before paging
- limit/offset pages tile the list without repeats
- compensation serves the seed shelf and empty for created workers
- payroll, positions, and financials share the list envelope
- an unknown worker is a 404 with the Workday error envelope

**x-articles-style**

- authorize 302s to the redirect_uri carrying a fresh code and the echoed state
- authorize demands redirect_uri, the S256 method and a non-empty challenge
- the token endpoint demands HTTP Basic client creds and a known grant type
- a valid code exchange mints a bearer+refresh pair and the code is single-use
- a mismatched redirect_uri or a missing verifier fails without burning the code
- refresh grants rotate the pair and retire the presented token
- the bearer gate is never enforced
- media upload mints media_id_strings that attach as cover_media_id
- draft create validates title and content_state.blocks
- a draft reads back with its full metadata
- publish flips the draft and attaches the minted post_id
- republishing mints a fresh post_id
- unknown article ids are 404s on get and publish
- create enforces required text and the inclusive 280-char limit
- replies must target a known tweet
- tweets read back whole and unknown ids are 404s

**xero-style**

- a missing or unknown bearer gets the same 401 TokenExpired envelope; the seeded static token passes
- GET /connections needs only the bearer and lists the two demo tenants
- api.xro calls without xero-tenant-id are 400 TenantRequired, and the header matches case-insensitively
- the seeded static token expires on the virtual clock, and the bearer gate outranks the tenant gate
- PUT /Invoices sums every line into the totals and echoes each computed LineAmount
- a single-object body creates one invoice with clock-derived Date and DueDate defaults
- GET /Invoices/{id} round-trips the stored invoice; unknown ids are the 404 envelope
- payments accumulate on the ledger and are echoed with their own PaymentID
- a negative amount is a refund bounded by what was paid
- over-payment (and an over-refund) is Xero's validation error and leaves the ledger untouched
- the invoice flips to PAID exactly at a zero balance and then refuses further payments
- DRAFT invoices are not payable and unknown ids are the 404 envelope
- DELETE voids to 204 and the record survives with Status VOIDED and a zeroed balance
- the voided invoice stays listable via the Statuses filter
- re-voiding, voiding a PAID invoice, and unknown ids are rejected
- PUT /Contacts creates with Xero defaults and reads back by id
- the Contacts array upserts by ContactID and ContactNumber, merging over the stored record
- duplicate active names are Xero's real validation error, in Elements
- archive is an update: the contact stays readable and releases its name
- invalid statuses and unknown ids are the plain ValidationError / NotFound envelopes
- where ANDs clauses in Xero's grammar, and Statuses/InvoiceNumber/ContactID filter the invoice list
- order sorts by any field in both directions (dates sort as instants)
- contacts search matches name and email case-blind, while where Name.Contains is case-sensitive
- the seeded chart of accounts and the static catalogs speak the same grammar
- page/pageSize walk every contact exactly once, with nextPage only between pages
- without pageSize paging is off; a page past the end is an empty 200 page
- a malformed page falls back to page 1 (as-is: no 400)
- a delivery signed with base64(HMAC-SHA256(key, raw bytes)) is accepted
- missing, tampered, and wrong-key signatures all answer the 401 envelope Xero requires

**zuora-style**

- an unknown bearer is 401
- account create assigns an id and reads back
- subscribing to a catalog plan prices the subscription
- unknown accounts and empty plan lists are 400s
- EndOfTerm cancel stays Active and a second cancel is rejected
- ZOQL finds the account by name
- webhook registration round-trips through the list

## Adapter surface detail

Per adapter: the **covered surface** — the exact routes served, read
straight from `adapter.yaml` — and the curated gaps from
`conformance/matrix.yaml`: **missing** (a real-API capability that is
absent) vs **deviations** (covered, but documented to differ). Deep
behavior notes live in each adapter's README.

### adyen-style

**Covered** — 14 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v68/payments` |
| POST | `/v68/payments/details` |
| GET | `/v68/payments` |
| POST | `/v68/paymentMethods` |
| POST | `/v68/paymentLinks` |
| GET | `/v68/paymentLinks/{linkId}` |
| POST | `/v68/payments/{paymentPspReference}/captures` |
| POST | `/v68/payments/{paymentPspReference}/refunds` |
| POST | `/v68/payments/{paymentPspReference}/reversals` |
| POST | `/v68/payments/{paymentPspReference}/cancels` |
| POST | `/v68/notifications/test` |
| POST | `/v68/webhooks` |
| GET | `/v68/webhooks` |
| DELETE | `/v68/webhooks/{webhookId}` |

</details>

**Provider surface** — derived from spec adyen-openapi CheckoutService-v68 + PaymentService-v68 @ 68, 68: 39 real routes · 9 covered · 23% · 30 not implemented

<details><summary>not implemented (30)</summary>

- `POST` `/v68/adjustAuthorisation`
- `POST` `/v68/applePay/sessions`
- `POST` `/v68/authorise`
- `POST` `/v68/authorise3d`
- `POST` `/v68/authorise3ds2`
- `POST` `/v68/cancel`
- `POST` `/v68/cancelOrRefund`
- `POST` `/v68/cancels`
- `POST` `/v68/capture`
- `POST` `/v68/cardDetails`
- `POST` `/v68/donate`
- `POST` `/v68/donationCampaigns`
- `POST` `/v68/donations`
- `POST` `/v68/forward`
- `POST` `/v68/getAuthenticationResult`
- `POST` `/v68/orders`
- `POST` `/v68/orders/cancel`
- `POST` `/v68/originKeys`
- `PATCH` `/v68/paymentLinks/{linkId}`
- `POST` `/v68/paymentMethods/balance`
- `POST` `/v68/payments/{paymentPspReference}/amountUpdates`
- `POST` `/v68/paypal/updateOrder`
- `POST` `/v68/refund`
- `POST` `/v68/retrieve3ds2Result`
- `POST` `/v68/sessions`
- `GET` `/v68/sessions/{sessionId}`
- `POST` `/v68/storedPaymentMethods`
- `POST` `/v68/technicalCancel`
- `POST` `/v68/validateShopperId`
- `POST` `/v68/voidPendingRefund`

</details>

**Missing** (4)

- No Payouts, Disputes, or Terminal API (cloud/POS) endpoints
- No paymentMethods/balance, gift-card, or stored-value endpoints
- No amountUpdates, technicalCancels, or auto-rescue modification routes
- No stored payment method lifecycle — tokens cannot be stored, listed, or disabled

**Deviations** (8)

- Per-hook hmacKey and events filter are local extensions — real Adyen hides the key
- simulate_fail flag on /v68/payments forces Refused (simulator-only failure injection)
- paymentLinks url is synthetic — no hosted checkout page; pay via the link reference
- paymentMethods serves a fixed 5-method catalog with empty storedPaymentMethods
- Webhook HMAC signs the base64-encoded signing string with eventCode in field 7; deliveries go to the first matching hook only
- Idempotency replay re-renders the payment's current state, not the original response
- Modification pspReferences carry CAP/REF/REV/CAN prefixes; real Adyen's are numeric
- paymentMethods accepts any merchantAccount; real Adyen 403s on unknown accounts

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v68/payments` — body, stateful, webhooks, clock
- `POST` `/v68/payments/details` — body, stateful, webhooks, clock
- `GET` `/v68/payments` — query, stateful, paginate, clock
- `POST` `/v68/paymentMethods` — body, stateful, clock
- `POST` `/v68/paymentLinks` — body, stateful, clock
- `GET` `/v68/paymentLinks/{linkId}` — params, stateful, clock
- `POST` `/v68/payments/{paymentPspReference}/captures` — body, params, stateful, webhooks, clock
- `POST` `/v68/payments/{paymentPspReference}/refunds` — body, params, stateful, webhooks, clock
- `POST` `/v68/payments/{paymentPspReference}/reversals` — body, params, stateful, webhooks, clock
- `POST` `/v68/payments/{paymentPspReference}/cancels` — body, params, stateful, webhooks, clock
- `POST` `/v68/notifications/test` — body, stateful, clock
- `POST` `/v68/webhooks` — body, stateful, clock
- `GET` `/v68/webhooks` — stateful, clock
- `DELETE` `/v68/webhooks/{webhookId}` — params, stateful, clock

</details>

### anaplan-style

**Covered** — 18 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/2/0/workspaces` |
| GET | `/2/0/workspaces/{workspaceId}/models` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/modules` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/files` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` |
| POST | `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` |
| PUT | `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}/chunks` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/imports` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/exports` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/actions` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/processes` |
| POST | `/2/0/workspaces/{workspaceId}/models/{modelId}/imports/{importId}/tasks` |
| POST | `/2/0/workspaces/{workspaceId}/models/{modelId}/imports/{importId}/jobs` |
| POST | `/2/0/workspaces/{workspaceId}/models/{modelId}/exports/{exportId}/tasks` |
| POST | `/2/0/workspaces/{workspaceId}/models/{modelId}/exports/{exportId}/jobs` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}/tasks/{taskId}` |
| GET | `/2/0/workspaces/{workspaceId}/models/{modelId}` |

</details>

**Missing** (4)

- No line-item, list, view, or module-data endpoints — data moves via CSV only
- No file DELETE; no workspace or model CRUD (catalogs are read-only)
- No ALM surface — revisions, comparisons, synthetic models
- No Anaplan token service (/token/authenticate) — Basic/Bearer only

**Deviations** (5)

- Task state derives from the clock — IN_PROGRESS at +1s, COMPLETE at +3s
- simulate_fail in the task body is a simulator-only trigger (real Anaplan has none)
- PUT file upload is the same surface as POST; /jobs aliases /tasks
- links[0].href pinned to api.anaplan.com regardless of request host
- Unknown workspace/model scope returns 200 + empty items rather than 404

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/2/0/workspaces` — query, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models` — query, params, auth, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/modules` — query, params, auth, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/files` — query, params, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` — params, auth, stateful, errors
- `POST` `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` — params, auth, stateful, errors
- `PUT` `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}` — params, auth, stateful, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/files/{fileId}/chunks` — query, params, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/imports` — query, params, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/exports` — query, params, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/actions` — query, params, auth, stateful, paginate, errors
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/processes` — query, params, auth, stateful, paginate, errors
- `POST` `/2/0/workspaces/{workspaceId}/models/{modelId}/imports/{importId}/tasks` — body, params, auth, stateful, errors, clock
- `POST` `/2/0/workspaces/{workspaceId}/models/{modelId}/imports/{importId}/jobs` — body, params, auth, stateful, errors, clock
- `POST` `/2/0/workspaces/{workspaceId}/models/{modelId}/exports/{exportId}/tasks` — body, params, auth, stateful, errors, clock
- `POST` `/2/0/workspaces/{workspaceId}/models/{modelId}/exports/{exportId}/jobs` — body, params, auth, stateful, errors, clock
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}/tasks/{taskId}` — params, auth, stateful, errors, clock
- `GET` `/2/0/workspaces/{workspaceId}/models/{modelId}` — params, auth, errors

</details>

### apple-apns-style

**Covered** — 2 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/3/device/{deviceToken}` |
| GET | `/3/device/{deviceToken}/notifications` |

</details>

**Missing** (4)

- No apns-topic, apns-push-type, apns-priority, or apns-collapse-id handling
- No provider-certificate auth — only JWT provider tokens
- No 429 TooManyRequests or 503 ServiceUnavailable rate-limit responses
- No Web Push endpoints (Safari webpush) or VOIP push handling

**Deviations** (3)

- Provider JWT verified against one fixed P-256 key whose private half is published
- GET /3/device/{token}/notifications is a simulator-only endpoint (no real fetch API)
- sent_at on the notifications endpoint is a constant; 410 Unregistered is modeled but unreachable

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/3/device/{deviceToken}` — body, params, auth, stateful, errors, clock
- `GET` `/3/device/{deviceToken}/notifications` — params, auth, stateful, clock

</details>

### apple-appstoreconnect-style

**Covered** — 15 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1/apps` |
| POST | `/v1/apps` |
| POST | `/v1/appStoreVersionSubmissions` |
| GET | `/v1/users` |
| GET | `/v1/salesReports` |
| GET | `/v1/apps/{id}` |
| PATCH | `/v1/apps/{id}` |
| GET | `/v1/apps/{id}/appStoreVersions` |
| POST | `/v1/apps/{id}/appStoreVersions` |
| GET | `/v1/apps/{id}/builds` |
| GET | `/v1/apps/{id}/appPrices` |
| GET | `/v1/builds/{id}` |
| GET | `/v1/appStoreVersions/{id}` |
| PATCH | `/v1/appStoreVersions/{id}` |
| GET | `/v1/appStoreVersions/{id}/builds` |

</details>

**Provider surface** — derived from spec App Store Connect OpenAPI Specification @ 4.4.1: 1263 real routes · 10 covered · 0% · 1253 not implemented

<details><summary>not implemented (1253)</summary>

- `POST` `/v1/accessibilityDeclarations`
- `DELETE` `/v1/accessibilityDeclarations/{id}`
- `GET` `/v1/accessibilityDeclarations/{id}`
- `PATCH` `/v1/accessibilityDeclarations/{id}`
- `GET` `/v1/actors`
- `GET` `/v1/actors/{id}`
- `PATCH` `/v1/ageRatingDeclarations/{id}`
- `GET` `/v1/alternativeDistributionDomains`
- `POST` `/v1/alternativeDistributionDomains`
- `DELETE` `/v1/alternativeDistributionDomains/{id}`
- `GET` `/v1/alternativeDistributionDomains/{id}`
- `GET` `/v1/alternativeDistributionKeys`
- `POST` `/v1/alternativeDistributionKeys`
- `DELETE` `/v1/alternativeDistributionKeys/{id}`
- `GET` `/v1/alternativeDistributionKeys/{id}`
- `GET` `/v1/alternativeDistributionPackageDeltas/{id}`
- `GET` `/v1/alternativeDistributionPackageVariants/{id}`
- `GET` `/v1/alternativeDistributionPackageVersions/{id}`
- `GET` `/v1/alternativeDistributionPackageVersions/{id}/deltas`
- `GET` `/v1/alternativeDistributionPackageVersions/{id}/relationships/deltas`
- `GET` `/v1/alternativeDistributionPackageVersions/{id}/relationships/variants`
- `GET` `/v1/alternativeDistributionPackageVersions/{id}/variants`
- `POST` `/v1/alternativeDistributionPackages`
- `GET` `/v1/alternativeDistributionPackages/{id}`
- `GET` `/v1/alternativeDistributionPackages/{id}/relationships/versions`
- `GET` `/v1/alternativeDistributionPackages/{id}/versions`
- `GET` `/v1/analyticsReportInstances/{id}`
- `GET` `/v1/analyticsReportInstances/{id}/relationships/segments`
- `GET` `/v1/analyticsReportInstances/{id}/segments`
- `POST` `/v1/analyticsReportRequests`
- `DELETE` `/v1/analyticsReportRequests/{id}`
- `GET` `/v1/analyticsReportRequests/{id}`
- `GET` `/v1/analyticsReportRequests/{id}/relationships/reports`
- `GET` `/v1/analyticsReportRequests/{id}/reports`
- `GET` `/v1/analyticsReportSegments/{id}`
- `GET` `/v1/analyticsReports/{id}`
- `GET` `/v1/analyticsReports/{id}/instances`
- `GET` `/v1/analyticsReports/{id}/relationships/instances`
- `POST` `/v1/androidToIosAppMappingDetails`
- `DELETE` `/v1/androidToIosAppMappingDetails/{id}`
- `GET` `/v1/androidToIosAppMappingDetails/{id}`
- `PATCH` `/v1/androidToIosAppMappingDetails/{id}`
- `GET` `/v1/appCategories`
- `GET` `/v1/appCategories/{id}`
- `GET` `/v1/appCategories/{id}/parent`
- `GET` `/v1/appCategories/{id}/relationships/parent`
- `GET` `/v1/appCategories/{id}/relationships/subcategories`
- `GET` `/v1/appCategories/{id}/subcategories`
- `POST` `/v1/appClipAdvancedExperienceImages`
- `GET` `/v1/appClipAdvancedExperienceImages/{id}`
… and 1203 more


</details>

**Missing** (7)

- No TestFlight beta testing (betaGroups, betaTesters, buildBetaDetails)
- No IAP or subscriptions (inAppPurchasesV2, subscriptionGroups)
- No provisioning surface — bundleIds, certificates, devices, profiles
- No app metadata: localizations, ageRating, categories, phased release
- No customer reviews endpoints (customerReviews and responses)
- No user invitations or user CRUD (GET /v1/users list only)
- No App Analytics (analyticsReportRequests, metrics) — salesReports only

**Deviations** (7)

- JWT signature crypto NOT verified — structural plus registry check only
- Review is clock-driven: WAITING_FOR_REVIEW +1s to IN_REVIEW, +3s to READY_FOR_SALE
- Builds settle PROCESSING to VALID at +3s — no separate in-flight state
- simulate_fail extension: app create forces build INVALID, version create REJECTED
- A first build is minted at app create — no build upload path
- A malformed cursor answers 200 with data null; real ASC answers 400
- salesReports returns a JSON:API object; real ASC streams a gzip TSV and 400s on missing filters

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1/apps` — query, auth, stateful, paginate, filter, clock
- `POST` `/v1/apps` — body, auth, stateful, clock
- `POST` `/v1/appStoreVersionSubmissions` — body, auth, stateful, clock
- `GET` `/v1/users` — query, auth, stateful, paginate, filter, clock
- `GET` `/v1/salesReports` — query, auth, stateful, clock
- `GET` `/v1/apps/{id}` — params, auth, stateful, clock
- `PATCH` `/v1/apps/{id}` — body, params, auth, stateful, clock
- `GET` `/v1/apps/{id}/appStoreVersions` — query, params, auth, stateful, filter, clock
- `POST` `/v1/apps/{id}/appStoreVersions` — body, params, auth, stateful, clock
- `GET` `/v1/apps/{id}/builds` — query, params, auth, stateful, filter, clock
- `GET` `/v1/apps/{id}/appPrices` — params, auth, stateful, clock
- `GET` `/v1/builds/{id}` — params, auth, stateful, clock
- `GET` `/v1/appStoreVersions/{id}` — params, auth, stateful, clock
- `PATCH` `/v1/appStoreVersions/{id}` — body, params, auth, stateful, clock
- `GET` `/v1/appStoreVersions/{id}/builds` — query, params, auth, stateful, filter, clock

</details>

### apple-music-style

**Covered** — 18 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1/catalog/{storefront}/search` |
| GET | `/v1/catalog/{storefront}/charts` |
| GET | `/v1/catalog/{storefront}/songs` |
| GET | `/v1/catalog/{storefront}/albums` |
| GET | `/v1/catalog/{storefront}/artists` |
| GET | `/v1/catalog/{storefront}/playlists` |
| GET | `/v1/catalog/{storefront}/songs/{id}` |
| GET | `/v1/catalog/{storefront}/albums/{id}` |
| GET | `/v1/catalog/{storefront}/artists/{id}` |
| GET | `/v1/me/library/songs` |
| GET | `/v1/me/library/albums` |
| GET | `/v1/me/library/playlists` |
| GET | `/v1/me/library/recently-added` |
| POST | `/v1/me/library` |
| DELETE | `/v1/me/library/{type}/{id}` |
| POST | `/v1/me/played` |
| GET | `/v1/me/ratings/{type}/{id}` |
| PUT | `/v1/me/ratings/{type}/{id}` |

</details>

**Missing** (5)

- No music-videos, stations, genres, or curators catalog endpoints
- No storefronts endpoint (GET /v1/storefronts)
- No library search (GET /v1/me/library/search)
- No personal playlist create or add-tracks (POST /v1/me/library/playlists)
- No recommendations or play history (heavy-rotation, recent/played)

**Deviations** (5)

- Developer JWT signature not verified — structural check plus exact-string token registry
- Music-User-Token accepts any non-empty value — no real user-token validation
- Only registered developer tokens pass the gate; real Apple accepts any properly signed ES256 token
- Storefront codes are validated but do not scope the catalog (gb == us)
- Library lists carry a meta.total the real API does not return

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1/catalog/{storefront}/search` — query, params, stateful, paginate, clock
- `GET` `/v1/catalog/{storefront}/charts` — query, params, stateful, paginate, filter, clock
- `GET` `/v1/catalog/{storefront}/songs` — query, params, stateful, paginate, clock
- `GET` `/v1/catalog/{storefront}/albums` — query, params, stateful, paginate, clock
- `GET` `/v1/catalog/{storefront}/artists` — query, params, stateful, paginate, clock
- `GET` `/v1/catalog/{storefront}/playlists` — query, params, stateful, paginate, clock
- `GET` `/v1/catalog/{storefront}/songs/{id}` — params, stateful, clock
- `GET` `/v1/catalog/{storefront}/albums/{id}` — params, stateful, clock
- `GET` `/v1/catalog/{storefront}/artists/{id}` — params, stateful, clock
- `GET` `/v1/me/library/songs` — query, stateful, paginate, clock
- `GET` `/v1/me/library/albums` — query, params, stateful, paginate, clock
- `GET` `/v1/me/library/playlists` — query, stateful, paginate, clock
- `GET` `/v1/me/library/recently-added` — query, params, stateful, paginate, filter, clock
- `POST` `/v1/me/library` — body, query, params, stateful, clock
- `DELETE` `/v1/me/library/{type}/{id}` — params, stateful, clock
- `POST` `/v1/me/played` — body, query, stateful, clock
- `GET` `/v1/me/ratings/{type}/{id}` — params, stateful, clock
- `PUT` `/v1/me/ratings/{type}/{id}` — body, params, stateful, clock

</details>

### apple-searchads-style

**Covered** — 12 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/oauth2/token` |
| POST | `/api/v4/campaigns/find` |
| POST | `/api/v4/campaigns` |
| POST | `/api/v4/reports/campaigns` |
| GET | `/api/v4/campaigns/{campaign_id}` |
| PUT | `/api/v4/campaigns/{campaign_id}` |
| POST | `/api/v4/campaigns/{campaign_id}/ads` |
| POST | `/api/v4/campaigns/{campaign_id}/keywords/targeting/find` |
| PUT | `/api/v4/campaigns/{campaign_id}/keywords/targeting/bulk` |
| POST | `/api/v4/campaigns/{campaign_id}/keywords/targeting` |
| PUT | `/api/v4/campaigns/{campaign_id}/keywords/targeting/{keyword_id}` |
| DELETE | `/api/v4/campaigns/{campaign_id}/keywords/targeting/{keyword_id}` |

</details>

**Missing** (4)

- No ad group find or update — only POST campaigns/{id}/ads create
- No negative keywords endpoints (keywords/negative find/create/update)
- No search-terms, keyword, or ads reports — only /reports/campaigns
- No audience targeting, geo/demographic dimensions, or bid adjustments

**Deviations** (5)

- ES256 client-secret JWT is not signature-verified — structural checks only
- Reports group by campaign only; any other groupBy key returns 400
- Selector conditions cover a fixed field set per resource (id, name, budget, status, times)
- Bulk keyword update is non-atomic: rows before an unknown id persist though the batch 404s
- Unknown selector condition fields are silently ignored; real find/report 400s

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/oauth2/token` — body, stateful, errors, clock
- `POST` `/api/v4/campaigns/find` — body, auth, stateful, filter, clock
- `POST` `/api/v4/campaigns` — body, auth, stateful, errors, clock
- `POST` `/api/v4/reports/campaigns` — body, auth, stateful, filter, errors, clock
- `GET` `/api/v4/campaigns/{campaign_id}` — params, auth, stateful, errors, clock
- `PUT` `/api/v4/campaigns/{campaign_id}` — body, params, auth, stateful, errors, clock
- `POST` `/api/v4/campaigns/{campaign_id}/ads` — body, params, auth, stateful, errors, clock
- `POST` `/api/v4/campaigns/{campaign_id}/keywords/targeting/find` — body, params, auth, stateful, filter, errors, clock
- `PUT` `/api/v4/campaigns/{campaign_id}/keywords/targeting/bulk` — body, params, auth, stateful, errors, clock
- `POST` `/api/v4/campaigns/{campaign_id}/keywords/targeting` — body, params, auth, stateful, errors, clock
- `PUT` `/api/v4/campaigns/{campaign_id}/keywords/targeting/{keyword_id}` — body, params, auth, stateful, errors, clock
- `DELETE` `/api/v4/campaigns/{campaign_id}/keywords/targeting/{keyword_id}` — params, auth, stateful, errors, clock

</details>

### apps-script-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1/projects` |
| POST | `/v1/projects` |
| GET | `/v1/projects/{scriptId}` |
| DELETE | `/v1/projects/{scriptId}` |
| GET | `/v1/projects/{scriptId}/content` |
| PUT | `/v1/projects/{scriptId}/content` |
| POST | `/v1/projects/{scriptId}/content` |
| POST | `/v1/projects/{scriptId}/deployments` |
| GET | `/v1/projects/{scriptId}/deployments` |
| POST | `/v1/scripts/{scriptId}:run` |
| POST | `/v1/projects/{scriptId}/scripts/{functionName}/run` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 16 real routes · 7 covered · 43% · 9 not implemented

<details><summary>not implemented (9)</summary>

- `GET` `/v1/processes`
- `GET` `/v1/processes:listScriptProcesses`
- `DELETE` `/v1/projects/{scriptId}/deployments/{deploymentId}`
- `GET` `/v1/projects/{scriptId}/deployments/{deploymentId}`
- `PUT` `/v1/projects/{scriptId}/deployments/{deploymentId}`
- `GET` `/v1/projects/{scriptId}/metrics`
- `GET` `/v1/projects/{scriptId}/versions`
- `POST` `/v1/projects/{scriptId}/versions`
- `GET` `/v1/projects/{scriptId}/versions/{versionNumber}`

</details>

**Missing** (2)

- No deployment get/update/delete — only create and list
- No versions endpoint (GET /v1/projects/{scriptId}/versions)

**Deviations** (3)

- :run never executes code — known patterns return canned results, others echo parameters
- scripts.run also served at a legacy path form (projects/{id}/scripts/{fn}/run)
- content update accepts POST as well as the real API's PUT

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1/projects` — query, auth, stateful, paginate, clock
- `POST` `/v1/projects` — body, auth, stateful, clock
- `GET` `/v1/projects/{scriptId}` — params, auth, stateful, clock
- `DELETE` `/v1/projects/{scriptId}` — params, auth, stateful, clock
- `GET` `/v1/projects/{scriptId}/content` — params, auth, stateful, clock
- `PUT` `/v1/projects/{scriptId}/content` — body, params, auth, stateful, clock
- `POST` `/v1/projects/{scriptId}/content` — body, params, auth, stateful, clock
- `POST` `/v1/projects/{scriptId}/deployments` — body, params, auth, stateful, clock
- `GET` `/v1/projects/{scriptId}/deployments` — params, auth, stateful, clock
- `POST` `/v1/scripts/{scriptId}:run` — body, params, auth, stateful, clock
- `POST` `/v1/projects/{scriptId}/scripts/{functionName}/run` — body, params, auth, stateful, clock

</details>

### auth0-style

**Covered** — 17 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/.well-known/openid-configuration` |
| GET | `/.well-known/jwks.json` |
| GET | `/authorize` |
| POST | `/oauth/token` |
| GET | `/userinfo` |
| POST | `/oauth/revoke` |
| POST | `/dbconnections/signup` |
| GET | `/api/v2/users` |
| POST | `/api/v2/users` |
| GET | `/api/v2/roles` |
| POST | `/api/v2/roles` |
| GET | `/api/v2/users/{id}` |
| PATCH | `/api/v2/users/{id}` |
| DELETE | `/api/v2/users/{id}` |
| GET | `/api/v2/users/{id}/roles` |
| POST | `/api/v2/users/{id}/roles` |
| DELETE | `/api/v2/users/{id}/roles` |

</details>

**Provider surface** — derived from spec Auth0 Management API OAS @ 2.0: 469 real routes · 10 covered · 2% · 459 not implemented

<details><summary>not implemented (459)</summary>

- `GET` `/api/v2/actions/actions`
- `POST` `/api/v2/actions/actions`
- `GET` `/api/v2/actions/actions/{actionId}/versions`
- `GET` `/api/v2/actions/actions/{actionId}/versions/{id}`
- `POST` `/api/v2/actions/actions/{actionId}/versions/{id}/deploy`
- `DELETE` `/api/v2/actions/actions/{id}`
- `GET` `/api/v2/actions/actions/{id}`
- `PATCH` `/api/v2/actions/actions/{id}`
- `POST` `/api/v2/actions/actions/{id}/deploy`
- `POST` `/api/v2/actions/actions/{id}/test`
- `GET` `/api/v2/actions/executions/{id}`
- `GET` `/api/v2/actions/modules`
- `POST` `/api/v2/actions/modules`
- `DELETE` `/api/v2/actions/modules/{id}`
- `GET` `/api/v2/actions/modules/{id}`
- `PATCH` `/api/v2/actions/modules/{id}`
- `GET` `/api/v2/actions/modules/{id}/actions`
- `POST` `/api/v2/actions/modules/{id}/rollback`
- `GET` `/api/v2/actions/modules/{id}/versions`
- `POST` `/api/v2/actions/modules/{id}/versions`
- `GET` `/api/v2/actions/modules/{id}/versions/{versionId}`
- `GET` `/api/v2/actions/triggers`
- `GET` `/api/v2/actions/triggers/{triggerId}/bindings`
- `PATCH` `/api/v2/actions/triggers/{triggerId}/bindings`
- `GET` `/api/v2/agents`
- `POST` `/api/v2/agents`
- `DELETE` `/api/v2/agents/{id}`
- `GET` `/api/v2/agents/{id}`
- `PATCH` `/api/v2/agents/{id}`
- `DELETE` `/api/v2/anomaly/blocks/ips/{id}`
- `GET` `/api/v2/anomaly/blocks/ips/{id}`
- `GET` `/api/v2/attack-protection/bot-detection`
- `PATCH` `/api/v2/attack-protection/bot-detection`
- `GET` `/api/v2/attack-protection/breached-password-detection`
- `PATCH` `/api/v2/attack-protection/breached-password-detection`
- `GET` `/api/v2/attack-protection/brute-force-protection`
- `PATCH` `/api/v2/attack-protection/brute-force-protection`
- `GET` `/api/v2/attack-protection/captcha`
- `PATCH` `/api/v2/attack-protection/captcha`
- `GET` `/api/v2/attack-protection/phone-provider-protection`
- `PATCH` `/api/v2/attack-protection/phone-provider-protection`
- `GET` `/api/v2/attack-protection/suspicious-ip-throttling`
- `PATCH` `/api/v2/attack-protection/suspicious-ip-throttling`
- `GET` `/api/v2/branding`
- `PATCH` `/api/v2/branding`
- `GET` `/api/v2/branding/phone/providers`
- `POST` `/api/v2/branding/phone/providers`
- `DELETE` `/api/v2/branding/phone/providers/{id}`
- `GET` `/api/v2/branding/phone/providers/{id}`
- `PATCH` `/api/v2/branding/phone/providers/{id}`
… and 409 more


</details>

**Missing** (3)

- No MFA, Organizations, actions/hooks/flows, or email delivery
- No user blocking or password change endpoints
- No from/take checkpoint paging (page/per_page only)

**Deviations** (4)

- No hosted login or consent screen — /authorize auto-authenticates login_hint or first user
- OAuth errors still 302 to unvalidated redirect_uri (RFC 6749 would refuse)
- q is exact-match or substring only (no Lucene)
- No scope enforcement — any valid RS256 token may call /api/v2/*

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/.well-known/openid-configuration` — —
- `GET` `/.well-known/jwks.json` — —
- `GET` `/authorize` — query, stateful, filter, clock
- `POST` `/oauth/token` — body, stateful, clock
- `GET` `/userinfo` — stateful, clock
- `POST` `/oauth/revoke` — body, stateful
- `POST` `/dbconnections/signup` — body, stateful, clock
- `GET` `/api/v2/users` — query, stateful, paginate, filter, clock
- `POST` `/api/v2/users` — body, stateful, clock
- `GET` `/api/v2/roles` — query, stateful, paginate, filter, clock
- `POST` `/api/v2/roles` — body, stateful, clock
- `GET` `/api/v2/users/{id}` — params, stateful, clock
- `PATCH` `/api/v2/users/{id}` — body, params, stateful, clock
- `DELETE` `/api/v2/users/{id}` — params, stateful, clock
- `GET` `/api/v2/users/{id}/roles` — params, stateful, clock
- `POST` `/api/v2/users/{id}/roles` — body, params, stateful, clock
- `DELETE` `/api/v2/users/{id}/roles` — body, params, stateful, clock

</details>

### avalara-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v2/tax/calculate` |
| POST | `/v2/transactions/create` |
| GET | `/v2/transactions` |
| GET | `/v2/transactions/{id}` |
| POST | `/v2/transactions/{id}/void` |
| GET | `/v2/companies` |
| GET | `/v2/definitions/nexuses` |
| GET | `/v2/definitions/taxcodes` |

</details>

**Missing** (5)

- No company CRUD — GET /v2/companies list only
- No address validation (/v2/addresses/resolve)
- No createoradjust, settle, or per-line transaction operations
- No customers, certificates, or exemption endpoints
- No jurisdiction lookups — definitions serve nexuses and taxcodes only

**Deviations** (3)

- Tax is a deterministic split — State 50%, County 25%, City 20%, Special 5% of the rate
- Void returns a minimal {id, status} envelope; real AvaTax returns the full TransactionModel
- Re-void is idempotent 200; real AvaTax rejects voiding a Cancelled document

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v2/tax/calculate` — body
- `POST` `/v2/transactions/create` — body, stateful, clock
- `GET` `/v2/transactions` — query, stateful, paginate, filter
- `GET` `/v2/transactions/{id}` — params, stateful
- `POST` `/v2/transactions/{id}/void` — params, stateful
- `GET` `/v2/companies` — query, stateful, paginate, filter
- `GET` `/v2/definitions/nexuses` — query, paginate, filter
- `GET` `/v2/definitions/taxcodes` — query, paginate, filter

</details>

### aws-cognito-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth2/authorize` |
| POST | `/oauth2/token` |
| GET | `/oauth2/userInfo` |
| GET | `/login` |
| GET | `/logout` |
| POST | `/` |
| GET | `/{userPoolId}/.well-known/jwks.json` |

</details>

**Missing** (6)

- No USER_SRP_AUTH — only USER_PASSWORD_AUTH and admin flows
- No AdminGetUser, AdminDeleteUser, or attribute-update operations
- No groups, custom auth challenges, or lambda triggers
- No ResendConfirmationCode or ChangePassword operations
- No GetOpenIdToken or developer-authenticated identity flows
- No hosted-UI OIDC discovery or /oauth2/revoke endpoints

**Deviations** (3)

- Service API SigV4 is structure-checked only — signature not cryptographically enforced
- Verification/reset codes are the last 6 digits of the username, zero-padded
- Hosted UI has no login page — authorize auto-binds login_hint user or seeded demo-user

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth2/authorize` — query, stateful, errors
- `POST` `/oauth2/token` — body, stateful, errors, clock
- `GET` `/oauth2/userInfo` — auth, stateful, clock
- `GET` `/login` — query
- `GET` `/logout` — query
- `POST` `/` — body, stateful, errors, clock
- `GET` `/{userPoolId}/.well-known/jwks.json` — —

</details>

### aws-iam-sts-style

**Covered** — 2 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/` |
| POST | `/` |

</details>

**Missing** (3)

- No UpdateRole/DeleteRole, role policy ops, user CRUD, groups, or policies
- No access-key list/update/delete beyond CreateAccessKey
- No AssumeRoleWithSAML

**Deviations** (3)

- Canonical path/query rebuilt from decoded values — duplicate query keys indistinguishable
- RFC 1123 Date header fallback not parsed — x-amz-date is required
- Only the documented example AKID/secret validates (single credential pair)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/` — body, query, auth, stateful, paginate, filter, errors, clock
- `POST` `/` — body, query, auth, stateful, paginate, filter, errors, clock

</details>

### aws-s3-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/{bucket}` |
| PUT | `/{bucket}` |
| DELETE | `/{bucket}` |
| PUT | `/{bucket}/{key+}` |
| GET | `/{bucket}/{key+}` |
| HEAD | `/{bucket}/{key+}` |
| DELETE | `/{bucket}/{key+}` |
| POST | `/{bucket}/{key+}` |

</details>

**Missing** (5)

- No bucket policy, tagging, ACL, CORS, lifecycle, or website subresources
- No object versioning (?versions listing, versionId delete) or object lock
- No CopyObject (x-amz-copy-source) or UploadPartCopy
- No browser form POST uploads (POST policy)
- No ListMultipartUploads (GET /{bucket}?uploads)

**Deviations** (5)

- ETags are SHA-256-based (real S3 uses MD5); multipart ETag is sha256(etags)-N
- Multipart 5 MiB minimum part size not enforced (small parts allowed)
- DELETE of a missing bucket is an idempotent 204 (real S3: 404 NoSuchBucket)
- SigV4 canonical URI/query rebuilt from decoded values — duplicates indistinguishable
- No RFC 1123 Date fallback; canonical header whitespace collapsing not applied

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/{bucket}` — query, params, stateful, paginate, filter, errors, clock
- `PUT` `/{bucket}` — body, query, params, stateful, errors, clock
- `DELETE` `/{bucket}` — query, params, stateful, errors, clock
- `PUT` `/{bucket}/{key+}` — query, params, stateful, errors, clock
- `GET` `/{bucket}/{key+}` — query, params, stateful, errors, clock
- `HEAD` `/{bucket}/{key+}` — query, params, stateful, errors, clock
- `DELETE` `/{bucket}/{key+}` — query, params, stateful, errors, clock
- `POST` `/{bucket}/{key+}` — query, params, stateful, errors, clock

</details>

### azure-devops-style

**Covered** — 17 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/{org}/_apis/projects` |
| GET | `/{org}/{project}/_apis/pipelines` |
| GET | `/{org}/{project}/_apis/pipelines/{pipelineId}` |
| GET | `/{org}/{project}/_apis/pipelines/{pipelineId}/runs` |
| POST | `/{org}/{project}/_apis/pipelines/{pipelineId}/runs` |
| GET | `/{org}/{project}/_apis/pipelines/{pipelineId}/runs/{runId}` |
| GET | `/{org}/{project}/_apis/git/repositories` |
| GET | `/{org}/{project}/_apis/git/repositories/{repoId}/items` |
| GET | `/{org}/{project}/_apis/git/repositories/{repoId}/commits` |
| POST | `/{org}/{project}/_apis/git/repositories/{repoId}/pushes` |
| GET | `/{org}/{project}/_apis/work/teamsettings/iterations` |
| GET | `/{org}/{project}/_apis/wit/workitems` |
| GET | `/{org}/{project}/_apis/wit/workitems/{id}` |
| PATCH | `/{org}/{project}/_apis/wit/workitems/{id}` |
| POST | `/{org}/{project}/_apis/wit/workitems/{type}` |
| POST | `/{org}/{project}/_apis/wit/wiql` |
| POST | `/{org}/_apis/hooks/subscriptions` |

</details>

**Provider surface** — derived from spec vsts-rest-api-specs core 7.2 + pipelines/git/wit/hooks/work 7.1 @ 7.2-preview, 7.1, 7.1, 7.1, 7.1, 7.1: 305 real routes · 17 covered · 5% · 277 not implemented

<details><summary>not implemented (277)</summary>

- `GET` `/{collection}/_apis/hooks/consumers`
- `GET` `/{collection}/_apis/hooks/consumers/{consumerId}`
- `GET` `/{collection}/_apis/hooks/consumers/{consumerId}/actions`
- `GET` `/{collection}/_apis/hooks/consumers/{consumerId}/actions/{consumerActionId}`
- `POST` `/{collection}/_apis/hooks/notificationsquery`
- `GET` `/{collection}/_apis/hooks/publishers`
- `GET` `/{collection}/_apis/hooks/publishers/{publisherId}`
- `GET` `/{collection}/_apis/hooks/publishers/{publisherId}/eventtypes`
- `GET` `/{collection}/_apis/hooks/publishers/{publisherId}/eventtypes/{eventTypeId}`
- `POST` `/{collection}/_apis/hooks/publishers/{publisherId}/inputValuesQuery`
- `POST` `/{collection}/_apis/hooks/publishersquery`
- `GET` `/{collection}/_apis/hooks/subscriptions`
- `DELETE` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}`
- `GET` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}`
- `PUT` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}`
- `GET` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}/diagnostics`
- `PUT` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}/diagnostics`
- `GET` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}/notifications`
- `GET` `/{collection}/_apis/hooks/subscriptions/{subscriptionId}/notifications/{notificationId}`
- `POST` `/{collection}/_apis/hooks/subscriptionsquery`
- `POST` `/{collection}/_apis/hooks/testnotifications`
- `GET` `/{collection}/_apis/wit/artifactlinktypes`
- `GET` `/{collection}/_apis/wit/workitemicons`
- `GET` `/{collection}/_apis/wit/workitemicons/{icon}`
- `GET` `/{collection}/_apis/wit/workitemrelationtypes`
- `GET` `/{collection}/_apis/wit/workitemrelationtypes/{relation}`
- `GET` `/{collection}/_apis/wit/workitemtransitions`
- `GET` `/{collection}/_apis/work/accountmyworkrecentactivity`
- `GET` `/{collection}/{project}/_apis/git/deletedrepositories`
- `GET` `/{collection}/{project}/_apis/git/favorites/refs`
- `POST` `/{collection}/{project}/_apis/git/favorites/refs`
- `DELETE` `/{collection}/{project}/_apis/git/favorites/refs/{favoriteId}`
- `GET` `/{collection}/{project}/_apis/git/favorites/refs/{favoriteId}`
- `GET` `/{collection}/{project}/_apis/git/policy/configurations`
- `GET` `/{collection}/{project}/_apis/git/pullrequests`
- `GET` `/{collection}/{project}/_apis/git/pullrequests/{pullRequestId}`
- `GET` `/{collection}/{project}/_apis/git/recycleBin/repositories`
- `DELETE` `/{collection}/{project}/_apis/git/recycleBin/repositories/{repositoryId}`
- `PATCH` `/{collection}/{project}/_apis/git/recycleBin/repositories/{repositoryId}`
- `POST` `/{collection}/{project}/_apis/git/repositories`
- `DELETE` `/{collection}/{project}/_apis/git/repositories/{repositoryId}`
- `GET` `/{collection}/{project}/_apis/git/repositories/{repositoryId}`
- `PATCH` `/{collection}/{project}/_apis/git/repositories/{repositoryId}`
- `POST` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/annotatedtags`
- `GET` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/annotatedtags/{objectId}`
- `POST` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/blobs`
- `GET` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/blobs/{sha1}`
- `GET` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/cherryPicks`
- `POST` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/cherryPicks`
- `GET` `/{collection}/{project}/_apis/git/repositories/{repositoryId}/cherryPicks/{cherryPickId}`
… and 227 more


</details>

**Missing** (8)

- No WIQL OR predicates, @Me/@Project macros, or non-WorkItems FROM targets
- No work-item comments, links/attachments, or revisions endpoints
- No project CRUD — projects are list-only
- No pipeline create/update or run artifacts/logs/approvals endpoints
- No repo create, refs/branch ops, pull requests, or tags
- No team-settings writes — iterations are list-only, no boards/columns
- No service-hook list/update/delete or publisher/consumer discovery
- No project-create and no pull-request routes (repos/pushes/commits/items only)

**Deviations** (6)

- Run state derives from clock — inProgress at +1s, completed/succeeded at +3s
- simulate_fail run parameter (templateParameters or top-level) forces result failed
- Run-state webhooks may double-emit when list/bulk reads race single-run polls
- A non-JSON versionDescriptor is silently ignored (falls back to the default branch); real ADO 400s
- Items always returns the JSON envelope with inline content; real ADO serves raw bytes for single items
- A no-op replace patch skips the rev bump and audit fields

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/{org}/_apis/projects` — query, auth, stateful, paginate, errors, clock
- `GET` `/{org}/{project}/_apis/pipelines` — query, auth, stateful, paginate, errors, clock
- `GET` `/{org}/{project}/_apis/pipelines/{pipelineId}` — params, auth, stateful, clock
- `GET` `/{org}/{project}/_apis/pipelines/{pipelineId}/runs` — query, params, auth, stateful, paginate, webhooks, errors, clock
- `POST` `/{org}/{project}/_apis/pipelines/{pipelineId}/runs` — body, params, auth, stateful, clock
- `GET` `/{org}/{project}/_apis/pipelines/{pipelineId}/runs/{runId}` — params, auth, stateful, webhooks, clock
- `GET` `/{org}/{project}/_apis/git/repositories` — query, params, auth, stateful, paginate, errors, clock
- `GET` `/{org}/{project}/_apis/git/repositories/{repoId}/items` — query, params, auth, stateful, clock
- `GET` `/{org}/{project}/_apis/git/repositories/{repoId}/commits` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/{org}/{project}/_apis/git/repositories/{repoId}/pushes` — body, params, auth, stateful, webhooks, clock
- `GET` `/{org}/{project}/_apis/work/teamsettings/iterations` — query, auth, stateful, paginate, errors, clock
- `GET` `/{org}/{project}/_apis/wit/workitems` — query, auth, stateful, clock
- `GET` `/{org}/{project}/_apis/wit/workitems/{id}` — params, auth, stateful, errors, clock
- `PATCH` `/{org}/{project}/_apis/wit/workitems/{id}` — body, params, auth, stateful, webhooks, clock
- `POST` `/{org}/{project}/_apis/wit/workitems/{type}` — body, params, auth, stateful, webhooks, clock
- `POST` `/{org}/{project}/_apis/wit/wiql` — body, query, auth, stateful, filter, clock
- `POST` `/{org}/_apis/hooks/subscriptions` — body, auth, stateful, clock

</details>

### azure-servicebus-style

**Covered** — 18 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/{queue}/messages` |
| DELETE | `/{queue}/messages/head` |
| POST | `/{queue}/messages/{lockToken}/{action}` |
| GET | `/$topicInfo` |
| GET | `/topics` |
| PUT | `/topics/{topic}` |
| GET | `/topics/{topic}` |
| DELETE | `/topics/{topic}` |
| POST | `/topics/{topic}/messages` |
| GET | `/topics/{topic}/subscriptions` |
| PUT | `/topics/{topic}/subscriptions/{sub}` |
| GET | `/topics/{topic}/subscriptions/{sub}` |
| DELETE | `/topics/{topic}/subscriptions/{sub}` |
| POST | `/topics/{topic}/subscriptions/{sub}/messages` |
| POST | `/topics/{topic}/subscriptions/{sub}/messages/{lockToken}/{action}` |
| POST | `/{account}/{queue}/messages` |
| GET | `/{account}/{queue}/messages` |
| DELETE | `/{account}/{queue}/messages/{messageid}` |

</details>

**Missing** (6)

- No queue management — queues are neither created nor listed
- No subscription rules — fan-out is the default match-all broadcast only
- No dead-letter settle action or DLQ receive (subqueue $deadletterqueue)
- No sessions, scheduled send, or duplicate detection
- No AMQP 1.0 transport — HTTP/REST surface only
- No Storage queue peek, update, clear, or queue create/list/delete

**Deviations** (3)

- Default 30s peek-lock, overridable via simulator-only lockduration query param
- Bearer auth accepted with any non-empty token — only SAS is verified
- Storage queue send accepts JSON MessageText in place of the real XML body

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/{queue}/messages` — body, query, params, stateful, clock
- `DELETE` `/{queue}/messages/head` — params, stateful, clock
- `POST` `/{queue}/messages/{lockToken}/{action}` — query, params, stateful, clock
- `GET` `/$topicInfo` — query, stateful, clock
- `GET` `/topics` — stateful, clock
- `PUT` `/topics/{topic}` — body, params, stateful, clock
- `GET` `/topics/{topic}` — params, stateful, clock
- `DELETE` `/topics/{topic}` — params, stateful, clock
- `POST` `/topics/{topic}/messages` — body, params, stateful, clock
- `GET` `/topics/{topic}/subscriptions` — params, stateful, clock
- `PUT` `/topics/{topic}/subscriptions/{sub}` — body, params, stateful, clock
- `GET` `/topics/{topic}/subscriptions/{sub}` — params, stateful, clock
- `DELETE` `/topics/{topic}/subscriptions/{sub}` — params, stateful, clock
- `POST` `/topics/{topic}/subscriptions/{sub}/messages` — query, params, stateful, clock
- `POST` `/topics/{topic}/subscriptions/{sub}/messages/{lockToken}/{action}` — query, params, stateful, clock
- `POST` `/{account}/{queue}/messages` — body, params, stateful, clock
- `GET` `/{account}/{queue}/messages` — query, params, stateful, clock
- `DELETE` `/{account}/{queue}/messages/{messageid}` — query, params, stateful, clock

</details>

### azure-storage-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/` |
| PUT | `/{container}` |
| GET | `/{container}` |
| HEAD | `/{container}` |
| DELETE | `/{container}` |
| PUT | `/{container}/{blob}` |
| GET | `/{container}/{blob}` |
| HEAD | `/{container}/{blob}` |
| DELETE | `/{container}/{blob}` |

</details>

**Provider surface** — derived from spec azure-rest-api-specs BlobStorage 2026-06-06 @ 2026-06-06: 69 real routes · 5 covered · 7% · 3 not implemented

<details><summary>not implemented (3)</summary>

- `POST` `/?comp=batch`
- `PUT` `/?restype=service&comp=properties`
- `POST` `/{containerName}/{blob}?comp=query`

</details>

**Missing** (6)

- No Append Blob or Page Blob types — Block Blob only
- No lease operations (?comp=lease) on blobs or containers
- No blob snapshots or copy (?comp=copy, from URL)
- No container ACL or metadata set/get — HEAD metadata only
- No service-level properties, stats, CORS, or user delegation keys
- No blob tags/index (?comp=tags) or soft delete/immutability

**Deviations** (3)

- Content-MD5 carries base64 SHA-256 (engine has no MD5) — documented deviation
- SAS checked structurally (sv/sig/se present) and any non-empty bearer accepted
- PUT on an existing container updates it in place 201 (real Azure: 409 conflict)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/` — query, stateful, paginate, clock
- `PUT` `/{container}` — query, params, stateful, clock
- `GET` `/{container}` — query, params, stateful, paginate, errors, clock
- `HEAD` `/{container}` — query, params, stateful, errors, clock
- `DELETE` `/{container}` — query, params, stateful
- `PUT` `/{container}/{blob}` — query, params, stateful, errors, clock
- `GET` `/{container}/{blob}` — query, params, stateful, errors, clock
- `HEAD` `/{container}/{blob}` — query, params, stateful, errors, clock
- `DELETE` `/{container}/{blob}` — query, params, stateful

</details>

### blog-style

**Covered** — 0 routes · GraphQL schema

### bluesky-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/xrpc/com.atproto.server.createSession` |
| POST | `/xrpc/com.atproto.server.refreshSession` |
| POST | `/xrpc/com.atproto.repo.createRecord` |
| POST | `/xrpc/com.atproto.repo.deleteRecord` |
| GET | `/xrpc/com.atproto.identity.resolveHandle` |
| GET | `/xrpc/app.bsky.actor.getProfile` |
| GET | `/xrpc/app.bsky.feed.searchPosts` |

</details>

**Provider surface** — derived from spec atproto lexicons app.bsky.* + com.atproto.* (XRPC: query=GET, procedure=POST; records/objects/subscriptions skipped): 202 real routes · 7 covered · 3% · 195 not implemented

<details><summary>not implemented (195)</summary>

- `GET` `/xrpc/app.bsky.actor.getPreferences`
- `GET` `/xrpc/app.bsky.actor.getProfiles`
- `GET` `/xrpc/app.bsky.actor.getSuggestions`
- `POST` `/xrpc/app.bsky.actor.putPreferences`
- `GET` `/xrpc/app.bsky.actor.searchActors`
- `GET` `/xrpc/app.bsky.actor.searchActorsTypeahead`
- `POST` `/xrpc/app.bsky.ageassurance.begin`
- `GET` `/xrpc/app.bsky.ageassurance.getConfig`
- `GET` `/xrpc/app.bsky.ageassurance.getState`
- `POST` `/xrpc/app.bsky.bookmark.createBookmark`
- `POST` `/xrpc/app.bsky.bookmark.deleteBookmark`
- `GET` `/xrpc/app.bsky.bookmark.getBookmarks`
- `POST` `/xrpc/app.bsky.contact.dismissMatch`
- `GET` `/xrpc/app.bsky.contact.getMatches`
- `GET` `/xrpc/app.bsky.contact.getSyncStatus`
- `POST` `/xrpc/app.bsky.contact.importContacts`
- `POST` `/xrpc/app.bsky.contact.removeData`
- `POST` `/xrpc/app.bsky.contact.sendNotification`
- `POST` `/xrpc/app.bsky.contact.startPhoneVerification`
- `POST` `/xrpc/app.bsky.contact.verifyPhone`
- `POST` `/xrpc/app.bsky.draft.createDraft`
- `POST` `/xrpc/app.bsky.draft.deleteDraft`
- `GET` `/xrpc/app.bsky.draft.getDrafts`
- `POST` `/xrpc/app.bsky.draft.updateDraft`
- `GET` `/xrpc/app.bsky.embed.getEmbedExternalView`
- `GET` `/xrpc/app.bsky.feed.describeFeedGenerator`
- `GET` `/xrpc/app.bsky.feed.getActorFeeds`
- `GET` `/xrpc/app.bsky.feed.getActorLikes`
- `GET` `/xrpc/app.bsky.feed.getAuthorFeed`
- `GET` `/xrpc/app.bsky.feed.getFeed`
- `GET` `/xrpc/app.bsky.feed.getFeedGenerator`
- `GET` `/xrpc/app.bsky.feed.getFeedGenerators`
- `GET` `/xrpc/app.bsky.feed.getFeedSkeleton`
- `GET` `/xrpc/app.bsky.feed.getLikes`
- `GET` `/xrpc/app.bsky.feed.getListFeed`
- `GET` `/xrpc/app.bsky.feed.getPostThread`
- `GET` `/xrpc/app.bsky.feed.getPosts`
- `GET` `/xrpc/app.bsky.feed.getQuotes`
- `GET` `/xrpc/app.bsky.feed.getRepostedBy`
- `GET` `/xrpc/app.bsky.feed.getSuggestedFeeds`
- `GET` `/xrpc/app.bsky.feed.getTimeline`
- `GET` `/xrpc/app.bsky.feed.searchPostsV2`
- `POST` `/xrpc/app.bsky.feed.sendInteractions`
- `GET` `/xrpc/app.bsky.graph.getActorStarterPacks`
- `GET` `/xrpc/app.bsky.graph.getBlocks`
- `GET` `/xrpc/app.bsky.graph.getFollowers`
- `GET` `/xrpc/app.bsky.graph.getFollows`
- `GET` `/xrpc/app.bsky.graph.getKnownFollowers`
- `GET` `/xrpc/app.bsky.graph.getList`
- `GET` `/xrpc/app.bsky.graph.getListBlocks`
… and 145 more


</details>

**Missing** (7)

- No repo reads: com.atproto.repo getRecord, listRecords, describeRepo, uploadBlob
- No com.atproto.server getSession or deleteSession
- No app.bsky.feed getTimeline, getPostThread, getFeed, getLikes
- No app.bsky.graph getFollows, getFollowers, mutes, blocks
- No app.bsky.notification listNotifications or getUnreadCount
- No app.bsky.actor updateProfile or preference endpoints
- No com.atproto.moderation createReport; no app.bsky.chat conversations

**Deviations** (4)

- searchPosts returns seeded synthetic results, not an index over created records
- createSession mints tokens for any identifier/password pair; no credential check
- refreshSession invalidates the old accessJwt too; real AT Protocol leaves it valid to exp
- cids cycle a fixed pool of 8 real CIDv1 strings rather than hashing record content

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/xrpc/com.atproto.server.createSession` — body, stateful, errors
- `POST` `/xrpc/com.atproto.server.refreshSession` — auth, stateful
- `POST` `/xrpc/com.atproto.repo.createRecord` — body, auth, stateful, errors
- `POST` `/xrpc/com.atproto.repo.deleteRecord` — body, auth, stateful
- `GET` `/xrpc/com.atproto.identity.resolveHandle` — query, stateful, errors
- `GET` `/xrpc/app.bsky.actor.getProfile` — query, stateful, errors
- `GET` `/xrpc/app.bsky.feed.searchPosts` — query, stateful, clock

</details>

### braintree-style

**Covered** — 15 routes · GraphQL schema

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/merchants/{merchantId}/transactions/advanced_search` |
| POST | `/merchants/{merchantId}/transactions` |
| GET | `/merchants/{merchantId}/transactions/{id}` |
| POST | `/merchants/{merchantId}/transactions/{id}/settle` |
| POST | `/merchants/{merchantId}/transactions/{id}/void` |
| POST | `/merchants/{merchantId}/transactions/{id}/refund` |
| POST | `/merchants/{merchantId}/payment_methods` |
| POST | `/merchants/{merchantId}/client_token` |
| POST | `/merchants/{merchantId}/plans` |
| GET | `/merchants/{merchantId}/plans` |
| GET | `/merchants/{merchantId}/plans/{id}` |
| POST | `/merchants/{merchantId}/subscriptions` |
| GET | `/merchants/{merchantId}/subscriptions/{id}` |
| POST | `/merchants/{merchantId}/subscriptions/{id}/cancel` |
| POST | `/webhooks` |

</details>

**Missing** (8)

- No REST customer endpoints: create, get, search, update, delete (/customers)
- No payment method fetch or delete: GET/DELETE /payment_methods/{token}
- No addresses or credit_card_verifications endpoints
- No subscription update, retry, or search; no plan delete
- No disputes endpoints: search, open, accept, add evidence
- No merchant accounts, settlements, or documents endpoints
- GraphQL subset: no paymentMethod, clientToken, PayPal, or dispute operations
- No Braintree Auth OAuth endpoints (token exchange, merchant onboarding)

**Deviations** (7)

- timings compressed: transactions settle at +3s, subscriptions bill a cycle every 2s
- webhook registration exposed at POST /webhooks; real Braintree is Control Panel only
- webhook deliveries are JSON + bt-* headers, not the real form-encoded bt_* POST
- POST /graphql is served without the Bearer/Basic auth check the REST surface enforces
- simulate_authorization_expiry sim-only flag: auths expire in 1s vs 7 simulated days
- REST creates answer 200; real Braintree answers 201 Created
- Client tokens are opaque strings, not the real base64 JSON encoding

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/merchants/{merchantId}/transactions/advanced_search` — body, stateful, filter, webhooks, clock
- `POST` `/merchants/{merchantId}/transactions` — body, stateful, webhooks, clock
- `GET` `/merchants/{merchantId}/transactions/{id}` — params, stateful, webhooks, clock
- `POST` `/merchants/{merchantId}/transactions/{id}/settle` — body, params, stateful, webhooks, clock
- `POST` `/merchants/{merchantId}/transactions/{id}/void` — params, stateful, webhooks, clock
- `POST` `/merchants/{merchantId}/transactions/{id}/refund` — body, params, stateful, webhooks, clock
- `POST` `/merchants/{merchantId}/payment_methods` — body, stateful
- `POST` `/merchants/{merchantId}/client_token` — stateful
- `POST` `/merchants/{merchantId}/plans` — body, stateful, clock
- `GET` `/merchants/{merchantId}/plans` — stateful
- `GET` `/merchants/{merchantId}/plans/{id}` — params, stateful
- `POST` `/merchants/{merchantId}/subscriptions` — body, stateful, clock
- `GET` `/merchants/{merchantId}/subscriptions/{id}` — params, stateful, webhooks, clock
- `POST` `/merchants/{merchantId}/subscriptions/{id}/cancel` — params, stateful, webhooks, clock
- `POST` `/webhooks` — body, stateful, webhooks, errors, clock

</details>

### braze-style

**Covered** — 12 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/messages/send` |
| POST | `/messages/schedule/create` |
| POST | `/users/track` |
| POST | `/users/alias/new` |
| POST | `/users/identify` |
| POST | `/users/delete` |
| POST | `/users/export/ids` |
| POST | `/campaigns/trigger/send` |
| GET | `/segments/list` |
| GET | `/messages/scheduled` |
| POST | `/webhooks` |
| GET | `/webhooks` |

</details>

**Missing** (8)

- No canvas endpoints: /canvas/trigger/send, /canvas/list, /canvas/data_series
- No campaign analytics: /campaigns/list, /campaigns/data_series, /campaigns/details
- No /messages/schedule/update or delete; no /campaigns/trigger/schedule/create
- No /users/export by segment; no /events/list or /purchases/product_list
- No email endpoints: /email/status, /email/hard_bounces, /email/spam, /email/unsubscribes
- No subscription groups: /subscription/status/set, /subscription/user/status, /get
- No content blocks: /content_blocks list, info, create, update
- No preference centers: /preference_center/v1 list and per-user URL endpoints

**Deviations** (6)

- POST /webhooks registration is a local extension; real Braze has no webhook REST API
- message.sent webhook payloads use a synthetic shape; Braze has no documented scheme
- scheduled sends flip to sent on first read past the time; message.sent fires once then
- key store models expiry for app-group keys; real Braze keys do not expire
- /users/track echoes *_processed counts the real API does not return
- Segments list pages by a cursor; the real endpoint pages by 100s of page param

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/messages/send` — body, auth, stateful, webhooks, errors, clock
- `POST` `/messages/schedule/create` — body, auth, stateful, errors, clock
- `POST` `/users/track` — body, auth, stateful, errors, clock
- `POST` `/users/alias/new` — body, auth, stateful, errors, clock
- `POST` `/users/identify` — body, auth, stateful, errors, clock
- `POST` `/users/delete` — body, auth, stateful, errors, clock
- `POST` `/users/export/ids` — body, auth, stateful, filter, errors, clock
- `POST` `/campaigns/trigger/send` — body, auth, stateful, webhooks, errors, clock
- `GET` `/segments/list` — query, auth, stateful, paginate, errors, clock
- `GET` `/messages/scheduled` — query, auth, stateful, filter, webhooks, errors, clock
- `POST` `/webhooks` — body, auth, stateful, clock
- `GET` `/webhooks` — auth, stateful, clock

</details>

### chainlink-style

**Covered** — 21 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/feeds` |
| GET | `/feeds/{feedID}` |
| GET | `/feeds/{feedID}/latestRoundData` |
| GET | `/feeds/{feedID}/rounds` |
| GET | `/feeds/{feedID}/rounds/{roundId}` |
| POST | `/v2/functions/createSecrets` |
| POST | `/v2/functions/encryptSecrets` |
| POST | `/v2/functions/createRequest` |
| GET | `/v2/functions/request/{requestID}` |
| GET | `/v2/functions/secrets/{secretID}` |
| POST | `/v2/automation/registerUpkeep` |
| GET | `/v2/automation/upkeeps` |
| GET | `/v2/automation/{id}` |
| POST | `/v2/automation/{id}/fund` |
| POST | `/v2/automation/{id}/cancel` |
| POST | `/v2/automation/{id}/withdraw` |
| GET | `/v2/automation/{id}/check` |
| POST | `/v2/automation/{id}/perform` |
| GET | `/v2/automation/{id}/performs` |
| GET | `/v2/ccip/messages` |
| GET | `/v2/ccip/lane/{src}/{dst}` |

</details>

**Missing** (6)

- No Functions subscription management: create, fund, update, cancel subscription
- No Functions requests listing or DON listing endpoints
- No Automation update, pause, or resume endpoints for upkeeps
- No CCIP message detail, executions, token-pool, or send endpoints
- No Data Streams product: stream auth, WebSocket report feeds, report upload
- No feed timeseries/chart history endpoint beyond /rounds paging

**Deviations** (7)

- feed rounds aggregate per 60s heartbeat vs real deviation/3600s; answers drift ±0.25%
- DON secrets use a deterministic HMAC envelope, not real randomized ECIES encryption
- Functions requests: queued 0-1s, running 1-3s, fulfilled at +3s (derive-on-read)
- createRequest accepts simulate_fail to inject failures; real sandbox has no trigger
- keeper performs are derived on read per elapsed cadence tick; real network performs on-chain
- invalid_cursor error code is lowercase while every other code is SCREAMING_SNAKE
- CCIP lane status is active with ramp addresses for any src/dst pair, including nonexistent chains

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/feeds` — query, stateful, paginate, clock
- `GET` `/feeds/{feedID}` — params, stateful, clock
- `GET` `/feeds/{feedID}/latestRoundData` — params, stateful, clock
- `GET` `/feeds/{feedID}/rounds` — query, params, stateful, paginate, clock
- `GET` `/feeds/{feedID}/rounds/{roundId}` — params, stateful, clock
- `POST` `/v2/functions/createSecrets` — body, stateful, clock
- `POST` `/v2/functions/encryptSecrets` — body, stateful, clock
- `POST` `/v2/functions/createRequest` — body, stateful, clock
- `GET` `/v2/functions/request/{requestID}` — params, stateful, clock
- `GET` `/v2/functions/secrets/{secretID}` — params, stateful, clock
- `POST` `/v2/automation/registerUpkeep` — body, stateful, clock
- `GET` `/v2/automation/upkeeps` — query, stateful, paginate, clock
- `GET` `/v2/automation/{id}` — params, stateful, clock
- `POST` `/v2/automation/{id}/fund` — body, params, stateful, clock
- `POST` `/v2/automation/{id}/cancel` — params, stateful, clock
- `POST` `/v2/automation/{id}/withdraw` — body, params, stateful, clock
- `GET` `/v2/automation/{id}/check` — params, stateful, clock
- `POST` `/v2/automation/{id}/perform` — params, stateful, clock
- `GET` `/v2/automation/{id}/performs` — query, params, stateful, paginate, clock
- `GET` `/v2/ccip/messages` — query, stateful, paginate, clock
- `GET` `/v2/ccip/lane/{src}/{dst}` — params, stateful, clock

</details>

### cloudflare-style

**Covered** — 35 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/zones` |
| POST | `/zones` |
| GET | `/zones/{zone_id}` |
| DELETE | `/zones/{zone_id}` |
| GET | `/zones/{zone_id}/dns_records` |
| POST | `/zones/{zone_id}/dns_records` |
| GET | `/zones/{zone_id}/dns_records/{dns_record_id}` |
| PUT | `/zones/{zone_id}/dns_records/{dns_record_id}` |
| PATCH | `/zones/{zone_id}/dns_records/{dns_record_id}` |
| DELETE | `/zones/{zone_id}/dns_records/{dns_record_id}` |
| GET | `/zones/{zone_id}/firewall/rules` |
| POST | `/zones/{zone_id}/firewall/rules` |
| GET | `/zones/{zone_id}/firewall/rules/{rule_id}` |
| PUT | `/zones/{zone_id}/firewall/rules/{rule_id}` |
| PATCH | `/zones/{zone_id}/firewall/rules/{rule_id}` |
| DELETE | `/zones/{zone_id}/firewall/rules/{rule_id}` |
| GET | `/zones/{zone_id}/page_rules` |
| POST | `/zones/{zone_id}/page_rules` |
| GET | `/zones/{zone_id}/page_rules/{rule_id}` |
| PUT | `/zones/{zone_id}/page_rules/{rule_id}` |
| PATCH | `/zones/{zone_id}/page_rules/{rule_id}` |
| DELETE | `/zones/{zone_id}/page_rules/{rule_id}` |
| POST | `/zones/{zone_id}/purge_cache` |
| GET | `/accounts/{account_id}/workers/scripts` |
| PUT | `/accounts/{account_id}/workers/scripts/{script_name}` |
| GET | `/accounts/{account_id}/workers/scripts/{script_name}` |
| DELETE | `/accounts/{account_id}/workers/scripts/{script_name}` |
| GET | `/accounts/{account_id}/workers/scripts/{script_name}/deployments` |
| GET | `/accounts/{account_id}/r2/buckets` |
| POST | `/accounts/{account_id}/r2/buckets` |
| DELETE | `/accounts/{account_id}/r2/buckets/{bucket_name}` |
| GET | `/accounts/{account_id}/d1/database` |
| POST | `/accounts/{account_id}/d1/database` |
| DELETE | `/accounts/{account_id}/d1/database/{database_id}` |
| POST | `/accounts/{account_id}/d1/database/{database_id}/query` |

</details>

**Provider surface** — derived from spec cloudflare api-schemas (paths /client/v4 prefix stripped) @ 4.0.0: 3334 real routes · 29 covered · 0% · 3304 not implemented

<details><summary>not implemented (3304)</summary>

- `GET` `/accounts`
- `POST` `/accounts`
- `POST` `/accounts/move`
- `GET` `/accounts/{accountId}/v1/images`
- `POST` `/accounts/{accountId}/v1/images`
- `DELETE` `/accounts/{accountId}/v1/images/{imageId}`
- `GET` `/accounts/{accountId}/v1/images/{imageId}`
- `PATCH` `/accounts/{accountId}/v1/images/{imageId}`
- `PUT` `/accounts/{accountId}/v1/images/{imageId}`
- `GET` `/accounts/{accountId}/v1/images/{imageId}/blob`
- `GET` `/accounts/{accountId}/v2/images`
- `POST` `/accounts/{accountId}/v2/images/direct_upload`
- `GET` `/accounts/{accountId}/zones/{zoneId}/v1/images/flows`
- `PUT` `/accounts/{accountId}/zones/{zoneId}/v1/images/flows`
- `GET` `/accounts/{account_identifier}/custom_pages`
- `GET` `/accounts/{account_identifier}/custom_pages/assets`
- `POST` `/accounts/{account_identifier}/custom_pages/assets`
- `DELETE` `/accounts/{account_identifier}/custom_pages/assets/{asset_name}`
- `GET` `/accounts/{account_identifier}/custom_pages/assets/{asset_name}`
- `PUT` `/accounts/{account_identifier}/custom_pages/assets/{asset_name}`
- `POST` `/accounts/{account_identifier}/custom_pages/preview_tokens`
- `GET` `/accounts/{account_identifier}/custom_pages/{identifier}`
- `PUT` `/accounts/{account_identifier}/custom_pages/{identifier}`
- `DELETE` `/accounts/{account_id}`
- `GET` `/accounts/{account_id}`
- `PUT` `/accounts/{account_id}`
- `GET` `/accounts/{account_id}/abuse-reports`
- `GET` `/accounts/{account_id}/abuse-reports/{report_id}/appeals/eligibility`
- `GET` `/accounts/{account_id}/abuse-reports/{report_id}/emails`
- `GET` `/accounts/{account_id}/abuse-reports/{report_id}/mitigations`
- `POST` `/accounts/{account_id}/abuse-reports/{report_id}/mitigations/appeal`
- `GET` `/accounts/{account_id}/abuse-reports/{report_param}`
- `POST` `/accounts/{account_id}/abuse-reports/{report_param}`
- `GET` `/accounts/{account_id}/access/ai-controls/mcp/portals`
- `POST` `/accounts/{account_id}/access/ai-controls/mcp/portals`
- `DELETE` `/accounts/{account_id}/access/ai-controls/mcp/portals/{id}`
- `GET` `/accounts/{account_id}/access/ai-controls/mcp/portals/{id}`
- `PUT` `/accounts/{account_id}/access/ai-controls/mcp/portals/{id}`
- `GET` `/accounts/{account_id}/access/ai-controls/mcp/portals/{portal_id}/servers/{server_id}/effective-redirect-uri`
- `GET` `/accounts/{account_id}/access/ai-controls/mcp/servers`
- `POST` `/accounts/{account_id}/access/ai-controls/mcp/servers`
- `DELETE` `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}`
- `GET` `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}`
- `PUT` `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}`
- `POST` `/accounts/{account_id}/access/ai-controls/mcp/servers/{id}/sync`
- `GET` `/accounts/{account_id}/access/apps`
- `POST` `/accounts/{account_id}/access/apps`
- `GET` `/accounts/{account_id}/access/apps/ca`
- `DELETE` `/accounts/{account_id}/access/apps/{app_id}`
- `GET` `/accounts/{account_id}/access/apps/{app_id}`
… and 3254 more


</details>

**Missing** (8)

- No Workers KV: namespace or key-value endpoints (storage/kv/values)
- No Workers routes, custom domains, cron triggers, secrets, or tail endpoints
- No R2 object endpoints (listing, uploads, downloads) or S3 API surface
- No D1 get/update/import/export or time-travel endpoints
- No user, account, member, or role management endpoints (/user, /accounts)
- No zone settings, SSL/certificates, or GraphQL analytics endpoints
- No bulk DNS create/delete (dns_records/batch) or DNS import/export
- No rate limiting rules or WAF custom rulesets beyond zone firewall rules

**Deviations** (6)

- any non-empty bearer token accepted; real token permission scoping not validated
- paths served without the /client/v4 prefix — cloudflare-go's BaseURL replaces the whole base, raw REST clients must strip it
- zone status runs pending -> initializing -> active in ~4s; real waits on nameservers
- deployments expose a status field; real Deployment objects carry rollout percentages
- simulate_fail on zone create / worker deploy injects moved or failed; no real trigger
- D1 query runs a small SQL subset; DROP/ALTER and other statements return 400

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/zones` — query, stateful, paginate, filter, clock
- `POST` `/zones` — body, stateful, clock
- `GET` `/zones/{zone_id}` — params, stateful, clock
- `DELETE` `/zones/{zone_id}` — params, stateful, clock
- `GET` `/zones/{zone_id}/dns_records` — query, params, stateful, paginate, filter, clock
- `POST` `/zones/{zone_id}/dns_records` — body, params, stateful, clock
- `GET` `/zones/{zone_id}/dns_records/{dns_record_id}` — params, stateful, clock
- `PUT` `/zones/{zone_id}/dns_records/{dns_record_id}` — body, params, stateful, clock
- `PATCH` `/zones/{zone_id}/dns_records/{dns_record_id}` — body, params, stateful, clock
- `DELETE` `/zones/{zone_id}/dns_records/{dns_record_id}` — params, stateful
- `GET` `/zones/{zone_id}/firewall/rules` — query, params, stateful, paginate, clock
- `POST` `/zones/{zone_id}/firewall/rules` — body, params, stateful, clock
- `GET` `/zones/{zone_id}/firewall/rules/{rule_id}` — params, stateful, clock
- `PUT` `/zones/{zone_id}/firewall/rules/{rule_id}` — body, params, stateful, clock
- `PATCH` `/zones/{zone_id}/firewall/rules/{rule_id}` — body, params, stateful, clock
- `DELETE` `/zones/{zone_id}/firewall/rules/{rule_id}` — params, stateful
- `GET` `/zones/{zone_id}/page_rules` — query, params, stateful, paginate, filter, clock
- `POST` `/zones/{zone_id}/page_rules` — body, params, stateful, clock
- `GET` `/zones/{zone_id}/page_rules/{rule_id}` — params, stateful, clock
- `PUT` `/zones/{zone_id}/page_rules/{rule_id}` — body, params, stateful, clock
- `PATCH` `/zones/{zone_id}/page_rules/{rule_id}` — body, params, stateful, clock
- `DELETE` `/zones/{zone_id}/page_rules/{rule_id}` — params, stateful
- `POST` `/zones/{zone_id}/purge_cache` — body, params, stateful, clock
- `GET` `/accounts/{account_id}/workers/scripts` — query, params, stateful, paginate, clock
- `PUT` `/accounts/{account_id}/workers/scripts/{script_name}` — body, params, stateful, clock
- `GET` `/accounts/{account_id}/workers/scripts/{script_name}` — params, stateful, clock
- `DELETE` `/accounts/{account_id}/workers/scripts/{script_name}` — params, stateful
- `GET` `/accounts/{account_id}/workers/scripts/{script_name}/deployments` — params, stateful, clock
- `GET` `/accounts/{account_id}/r2/buckets` — query, params, stateful, paginate, clock
- `POST` `/accounts/{account_id}/r2/buckets` — body, params, stateful, clock
- `DELETE` `/accounts/{account_id}/r2/buckets/{bucket_name}` — params, stateful
- `GET` `/accounts/{account_id}/d1/database` — query, params, stateful, paginate, clock
- `POST` `/accounts/{account_id}/d1/database` — body, params, stateful, clock
- `DELETE` `/accounts/{account_id}/d1/database/{database_id}` — params, stateful
- `POST` `/accounts/{account_id}/d1/database/{database_id}/query` — body, params, stateful, filter

</details>

### cloudkit-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/database/1/{container}/{env}/public/users/current` |
| GET | `/database/1/{container}/{env}/public/zones/list` |
| GET | `/database/1/{container}/{env}/public/records/lookup` |
| GET | `/database/1/{container}/{env}/public/records/query` |
| POST | `/database/1/{container}/{env}/public/records/modify` |

</details>

**Missing** (6)

- No private or shared database surfaces (/database/1/.../private|shared)
- No assets: no /assets/upload endpoint or asset field handling
- No /users/discover (find users by email or address)
- No zone mutations (/zones/modify); zones cannot be created or deleted
- No subscriptions: /subscriptions/list, /subscriptions/modify (push)
- No web-user token auth; server-to-server key signatures only

**Deviations** (2)

- records/lookup and records/query are GET-with-body; real CloudKit specifies POST
- query comparators are a limited subset; FULL_TEXT, LIKE, and list variants missing

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/database/1/{container}/{env}/public/users/current` — query, auth, clock
- `GET` `/database/1/{container}/{env}/public/zones/list` — body, query, auth, stateful, paginate, filter, clock
- `GET` `/database/1/{container}/{env}/public/records/lookup` — body, query, auth, stateful, clock
- `GET` `/database/1/{container}/{env}/public/records/query` — body, query, auth, stateful, paginate, filter, clock
- `POST` `/database/1/{container}/{env}/public/records/modify` — body, query, auth, stateful, clock

</details>

### discord-style

**Covered** — 26 routes (+1 ws)

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth2/authorize` |
| POST | `/oauth2/token` |
| GET | `/oauth2/@me` |
| GET | `/users/@me/guilds` |
| GET | `/users/@me` |
| GET | `/guilds/{guild_id}` |
| GET | `/guilds/{guild_id}/channels` |
| POST | `/channels/{channel_id}/messages` |
| GET | `/channels/{channel_id}/messages` |
| GET | `/channels/{channel_id}/messages/{message_id}` |
| GET | `/v10/channels/{channel_id}/messages/{message_id}` |
| PUT | `/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` |
| POST | `/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` |
| POST | `/interactions` |
| GET | `/v10/oauth2/authorize` |
| POST | `/v10/oauth2/token` |
| GET | `/v10/oauth2/@me` |
| GET | `/v10/users/@me/guilds` |
| GET | `/v10/users/@me` |
| GET | `/v10/guilds/{guild_id}` |
| GET | `/v10/guilds/{guild_id}/channels` |
| POST | `/v10/channels/{channel_id}/messages` |
| GET | `/v10/channels/{channel_id}/messages` |
| PUT | `/v10/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` |
| POST | `/v10/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` |
| POST | `/v10/interactions` |
| WS | `/gateway` |

</details>

**Provider surface** — derived from spec discord-api-spec @ 10: 242 real routes · 9 covered · 3% · 228 not implemented

<details><summary>not implemented (228)</summary>

- `GET` `/applications/@me`
- `PATCH` `/applications/@me`
- `GET` `/applications/{application_id}`
- `PATCH` `/applications/{application_id}`
- `GET` `/applications/{application_id}/activity-instances/{instance_id}`
- `POST` `/applications/{application_id}/attachment`
- `GET` `/applications/{application_id}/commands`
- `POST` `/applications/{application_id}/commands`
- `PUT` `/applications/{application_id}/commands`
- `DELETE` `/applications/{application_id}/commands/{command_id}`
- `GET` `/applications/{application_id}/commands/{command_id}`
- `PATCH` `/applications/{application_id}/commands/{command_id}`
- `GET` `/applications/{application_id}/emojis`
- `POST` `/applications/{application_id}/emojis`
- `DELETE` `/applications/{application_id}/emojis/{emoji_id}`
- `GET` `/applications/{application_id}/emojis/{emoji_id}`
- `PATCH` `/applications/{application_id}/emojis/{emoji_id}`
- `GET` `/applications/{application_id}/entitlements`
- `POST` `/applications/{application_id}/entitlements`
- `DELETE` `/applications/{application_id}/entitlements/{entitlement_id}`
- `GET` `/applications/{application_id}/entitlements/{entitlement_id}`
- `POST` `/applications/{application_id}/entitlements/{entitlement_id}/consume`
- `GET` `/applications/{application_id}/guilds/{guild_id}/commands`
- `POST` `/applications/{application_id}/guilds/{guild_id}/commands`
- `PUT` `/applications/{application_id}/guilds/{guild_id}/commands`
- `GET` `/applications/{application_id}/guilds/{guild_id}/commands/permissions`
- `DELETE` `/applications/{application_id}/guilds/{guild_id}/commands/{command_id}`
- `GET` `/applications/{application_id}/guilds/{guild_id}/commands/{command_id}`
- `PATCH` `/applications/{application_id}/guilds/{guild_id}/commands/{command_id}`
- `GET` `/applications/{application_id}/guilds/{guild_id}/commands/{command_id}/permissions`
- `PUT` `/applications/{application_id}/guilds/{guild_id}/commands/{command_id}/permissions`
- `GET` `/applications/{application_id}/role-connections/metadata`
- `PUT` `/applications/{application_id}/role-connections/metadata`
- `DELETE` `/channels/{channel_id}`
- `GET` `/channels/{channel_id}`
- `PATCH` `/channels/{channel_id}`
- `POST` `/channels/{channel_id}/followers`
- `GET` `/channels/{channel_id}/invites`
- `POST` `/channels/{channel_id}/invites`
- `POST` `/channels/{channel_id}/messages/bulk-delete`
- `GET` `/channels/{channel_id}/messages/pins`
- `DELETE` `/channels/{channel_id}/messages/pins/{message_id}`
- `PUT` `/channels/{channel_id}/messages/pins/{message_id}`
- `DELETE` `/channels/{channel_id}/messages/{message_id}`
- `PATCH` `/channels/{channel_id}/messages/{message_id}`
- `POST` `/channels/{channel_id}/messages/{message_id}/crosspost`
- `DELETE` `/channels/{channel_id}/messages/{message_id}/reactions`
- `DELETE` `/channels/{channel_id}/messages/{message_id}/reactions/{emoji_name}`
- `GET` `/channels/{channel_id}/messages/{message_id}/reactions/{emoji_name}`
- `DELETE` `/channels/{channel_id}/messages/{message_id}/reactions/{emoji_name}/@me`
… and 178 more


</details>

**Missing** (8)

- No message edit or delete: PATCH/DELETE /channels/{id}/messages/{msg_id}
- No channel create/update/delete or channel webhooks endpoints
- No reaction listing or removal endpoints (GET/DELETE /reactions/{emoji})
- No application command registration (PUT /applications/{app_id}/commands)
- No guild member endpoints (/guilds/{id}/members)
- No DM channels (POST /users/@me/channels) or invite endpoints
- No OAuth token revoke (/oauth2/token/revoke) or /applications/@me
- No pins, typing, threads, or audit log endpoints

**Deviations** (5)

- gateway is a fixed script: HELLO, lenient IDENTIFY, READY, one synthetic MESSAGE_CREATE
- Reactions are 204 no-ops — no reaction state is stored or echoed on messages
- POST /interactions answers ping with type 1, everything else a type 5 deferred ack
- posted messages emit signed MESSAGE_CREATE webhooks; real Discord dispatches via gateway
- message listing pages via opaque after cursors + Link headers, not snowflake ids

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth2/authorize` — query, stateful, errors
- `POST` `/oauth2/token` — body, stateful, errors, clock
- `GET` `/oauth2/@me` — auth, stateful, clock
- `GET` `/users/@me/guilds` — auth, stateful, clock
- `GET` `/users/@me` — auth, stateful, clock
- `GET` `/guilds/{guild_id}` — params, auth, stateful, errors, clock
- `GET` `/guilds/{guild_id}/channels` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/channels/{channel_id}/messages` — body, params, auth, stateful, webhooks, clock
- `GET` `/channels/{channel_id}/messages` — query, params, auth, stateful, paginate, errors, clock
- `GET` `/channels/{channel_id}/messages/{message_id}` — params, auth, stateful, errors, clock
- `GET` `/v10/channels/{channel_id}/messages/{message_id}` — params, auth, stateful, errors, clock
- `PUT` `/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` — auth, stateful, clock
- `POST` `/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` — auth, stateful, clock
- `POST` `/interactions` — body, auth
- `GET` `/v10/oauth2/authorize` — query, stateful, errors
- `POST` `/v10/oauth2/token` — body, stateful, errors, clock
- `GET` `/v10/oauth2/@me` — auth, stateful, clock
- `GET` `/v10/users/@me/guilds` — auth, stateful, clock
- `GET` `/v10/users/@me` — auth, stateful, clock
- `GET` `/v10/guilds/{guild_id}` — params, auth, stateful, errors, clock
- `GET` `/v10/guilds/{guild_id}/channels` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/v10/channels/{channel_id}/messages` — body, params, auth, stateful, webhooks, clock
- `GET` `/v10/channels/{channel_id}/messages` — query, params, auth, stateful, paginate, errors, clock
- `PUT` `/v10/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` — auth, stateful, clock
- `POST` `/v10/channels/{channel_id}/messages/{message_id}/reactions/{emoji}/@me` — auth, stateful, clock
- `POST` `/v10/interactions` — body, auth

</details>

### drive-style

**Covered** — 13 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/o/oauth2/auth` |
| POST | `/o/oauth2/token` |
| POST | `/upload/drive/v3/files` |
| PUT | `/upload/drive/v3/files/{upload_id}` |
| DELETE | `/upload/drive/v3/files/{upload_id}` |
| GET | `/drive/v3/files` |
| POST | `/drive/v3/files` |
| GET | `/drive/v3/files/{id}` |
| PATCH | `/drive/v3/files/{id}` |
| DELETE | `/drive/v3/files/{id}` |
| GET | `/drive/v3/about` |
| GET | `/drive/v3/changes/startPageToken` |
| GET | `/drive/v3/changes` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 64 real routes · 8 covered · 12% · 56 not implemented

<details><summary>not implemented (56)</summary>

- `GET` `/drive/v3/apps`
- `GET` `/drive/v3/apps/{appId}`
- `POST` `/drive/v3/changes/watch`
- `POST` `/drive/v3/channels/stop`
- `GET` `/drive/v3/drives`
- `POST` `/drive/v3/drives`
- `DELETE` `/drive/v3/drives/{driveId}`
- `GET` `/drive/v3/drives/{driveId}`
- `PATCH` `/drive/v3/drives/{driveId}`
- `POST` `/drive/v3/drives/{driveId}/hide`
- `POST` `/drive/v3/drives/{driveId}/unhide`
- `GET` `/drive/v3/files/generateCseToken`
- `GET` `/drive/v3/files/generateIds`
- `DELETE` `/drive/v3/files/trash`
- `GET` `/drive/v3/files/{fileId}/accessproposals`
- `GET` `/drive/v3/files/{fileId}/accessproposals/{proposalId}`
- `POST` `/drive/v3/files/{fileId}/accessproposals/{proposalId}:resolve`
- `GET` `/drive/v3/files/{fileId}/approvals`
- `GET` `/drive/v3/files/{fileId}/approvals/{approvalId}`
- `POST` `/drive/v3/files/{fileId}/approvals/{approvalId}:approve`
- `POST` `/drive/v3/files/{fileId}/approvals/{approvalId}:cancel`
- `POST` `/drive/v3/files/{fileId}/approvals/{approvalId}:comment`
- `POST` `/drive/v3/files/{fileId}/approvals/{approvalId}:decline`
- `POST` `/drive/v3/files/{fileId}/approvals/{approvalId}:reassign`
- `POST` `/drive/v3/files/{fileId}/approvals:start`
- `GET` `/drive/v3/files/{fileId}/comments`
- `POST` `/drive/v3/files/{fileId}/comments`
- `DELETE` `/drive/v3/files/{fileId}/comments/{commentId}`
- `GET` `/drive/v3/files/{fileId}/comments/{commentId}`
- `PATCH` `/drive/v3/files/{fileId}/comments/{commentId}`
- `GET` `/drive/v3/files/{fileId}/comments/{commentId}/replies`
- `POST` `/drive/v3/files/{fileId}/comments/{commentId}/replies`
- `DELETE` `/drive/v3/files/{fileId}/comments/{commentId}/replies/{replyId}`
- `GET` `/drive/v3/files/{fileId}/comments/{commentId}/replies/{replyId}`
- `PATCH` `/drive/v3/files/{fileId}/comments/{commentId}/replies/{replyId}`
- `POST` `/drive/v3/files/{fileId}/copy`
- `POST` `/drive/v3/files/{fileId}/download`
- `GET` `/drive/v3/files/{fileId}/export`
- `GET` `/drive/v3/files/{fileId}/listLabels`
- `POST` `/drive/v3/files/{fileId}/modifyLabels`
- `GET` `/drive/v3/files/{fileId}/permissions`
- `POST` `/drive/v3/files/{fileId}/permissions`
- `DELETE` `/drive/v3/files/{fileId}/permissions/{permissionId}`
- `GET` `/drive/v3/files/{fileId}/permissions/{permissionId}`
- `PATCH` `/drive/v3/files/{fileId}/permissions/{permissionId}`
- `GET` `/drive/v3/files/{fileId}/revisions`
- `DELETE` `/drive/v3/files/{fileId}/revisions/{revisionId}`
- `GET` `/drive/v3/files/{fileId}/revisions/{revisionId}`
- `PATCH` `/drive/v3/files/{fileId}/revisions/{revisionId}`
- `POST` `/drive/v3/files/{fileId}/watch`
… and 6 more


</details>

**Missing** (7)

- No permissions/sharing endpoints on files (GET/POST/DELETE permissions)
- No comments or replies endpoints (/files/{id}/comments)
- No file copy (POST /files/{id}/copy) or export (GET /files/{id}/export)
- No revisions endpoints (/files/{id}/revisions)
- No shared drives endpoints (/drives); no supportsAllDrives handling
- No push notification channels (files.watch, changes.watch, channels/stop)
- No generateIds, apps list, or batch (multipart/mixed) request support

**Deviations** (5)

- uploads take JSON {name, content, parents}; real Drive uses multipart/related bodies
- list q is a limited field/op subset; queries outside it 400 rather than running
- orderBy honors only the first recognized key; real Drive applies every key
- metadata-only files.create defaults mimeType to the folder type when absent; real Drive defaults to a plain file
- ?alt=media on a content-less file returns 404; real Drive serves 200 with an empty body

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/o/oauth2/auth` — query, stateful, errors
- `POST` `/o/oauth2/token` — body, stateful, errors, clock
- `POST` `/upload/drive/v3/files` — body, query, stateful, clock
- `PUT` `/upload/drive/v3/files/{upload_id}` — query, params, stateful, clock
- `DELETE` `/upload/drive/v3/files/{upload_id}` — query, params, stateful, errors
- `GET` `/drive/v3/files` — query, stateful, paginate, filter, clock
- `POST` `/drive/v3/files` — body, stateful, clock
- `GET` `/drive/v3/files/{id}` — query, params, stateful, errors, clock
- `PATCH` `/drive/v3/files/{id}` — body, params, stateful, errors, clock
- `DELETE` `/drive/v3/files/{id}` — params, stateful, errors, clock
- `GET` `/drive/v3/about` — stateful, clock
- `GET` `/drive/v3/changes/startPageToken` — stateful, clock
- `GET` `/drive/v3/changes` — query, stateful, paginate, filter, clock

</details>

### dropbox-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/2/files/upload` |
| POST | `/2/files/download` |
| POST | `/2/files/list_folder` |
| POST | `/2/files/get_metadata` |
| POST | `/2/files/create_folder` |
| POST | `/2/files/delete` |
| POST | `/2/files/get_temporary_link` |
| POST | `/2/users/get_current_account` |

</details>

**Provider surface** — derived from spec dropbox-api-spec files.stone + users.stone (every route POST — API v2 is RPC-style, Stone declares no verb): 72 real routes · 8 covered · 11% · 64 not implemented

<details><summary>not implemented (64)</summary>

- `POST` `/2/files/alpha/get_metadata`
- `POST` `/2/files/alpha/upload`
- `POST` `/2/files/copy`
- `POST` `/2/files/copy_batch`
- `POST` `/2/files/copy_batch/check`
- `POST` `/2/files/copy_batch/check_v2`
- `POST` `/2/files/copy_batch_v2`
- `POST` `/2/files/copy_reference/get`
- `POST` `/2/files/copy_reference/save`
- `POST` `/2/files/copy_v2`
- `POST` `/2/files/create_folder_batch`
- `POST` `/2/files/create_folder_batch/check`
- `POST` `/2/files/create_folder_v2`
- `POST` `/2/files/delete_batch`
- `POST` `/2/files/delete_batch/check`
- `POST` `/2/files/delete_v2`
- `POST` `/2/files/download_zip`
- `POST` `/2/files/export`
- `POST` `/2/files/get_file_lock_batch`
- `POST` `/2/files/get_preview`
- `POST` `/2/files/get_temporary_upload_link`
- `POST` `/2/files/get_thumbnail`
- `POST` `/2/files/get_thumbnail_batch`
- `POST` `/2/files/get_thumbnail_v2`
- `POST` `/2/files/list_folder/continue`
- `POST` `/2/files/list_folder/get_latest_cursor`
- `POST` `/2/files/list_folder/longpoll`
- `POST` `/2/files/list_revisions`
- `POST` `/2/files/lock_file_batch`
- `POST` `/2/files/move`
- `POST` `/2/files/move_batch`
- `POST` `/2/files/move_batch/check`
- `POST` `/2/files/move_batch/check_v2`
- `POST` `/2/files/move_batch_v2`
- `POST` `/2/files/move_v2`
- `POST` `/2/files/paper/create`
- `POST` `/2/files/paper/update`
- `POST` `/2/files/permanently_delete`
- `POST` `/2/files/properties/add`
- `POST` `/2/files/properties/overwrite`
- `POST` `/2/files/properties/update`
- `POST` `/2/files/restore`
- `POST` `/2/files/save_url`
- `POST` `/2/files/save_url/check_job_status`
- `POST` `/2/files/search`
- `POST` `/2/files/search/continue_v2`
- `POST` `/2/files/search_v2`
- `POST` `/2/files/tags/add`
- `POST` `/2/files/tags/get`
- `POST` `/2/files/tags/remove`
… and 14 more


</details>

**Missing** (8)

- No move or copy endpoints (/2/files/move_v2, /2/files/copy_v2)
- No upload sessions for large files (/2/files/upload_session/*)
- No file search (/2/files/search_v2)
- No thumbnails or previews (get_thumbnail_b64, get_preview)
- No shared links or sharing folder endpoints (/2/sharing/*)
- No file history (list_revisions, restore, copy_reference)
- No users/get_space_usage or users/get_account batch
- No /2/files/list_folder/continue or list_folder/get_latest_cursor

**Deviations** (4)

- requests with no Authorization header are accepted; real Dropbox requires auth
- upload takes JSON {path, content}; real /2/files/upload posts raw bytes + Dropbox-API-Arg
- list_folder returns the entire path-prefix subtree in one response
- get_temporary_link mints a synthetic URL that does not serve the content

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/2/files/upload` — body, auth, stateful, errors, clock
- `POST` `/2/files/download` — body, auth, stateful, errors, clock
- `POST` `/2/files/list_folder` — body, auth, stateful, paginate, errors, clock
- `POST` `/2/files/get_metadata` — body, auth, stateful, errors, clock
- `POST` `/2/files/create_folder` — body, auth, stateful, errors, clock
- `POST` `/2/files/delete` — body, auth, stateful, errors, clock
- `POST` `/2/files/get_temporary_link` — body, auth, stateful, errors, clock
- `POST` `/2/users/get_current_account` — auth, stateful, clock

</details>

### dune-style

**Covered** — 6 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/v1/query/{query_id}/execute` |
| POST | `/api/v1/query/{query_id}/result` |
| GET | `/api/v1/auth/validate` |
| GET | `/api/v1/execution/{execution_id}/status` |
| GET | `/api/v1/execution/{execution_id}/results/csv` |
| GET | `/api/v1/execution/{execution_id}/results` |

</details>

**Missing** (5)

- No query management: GET/POST/PATCH/DELETE /api/v1/query endpoints
- No execution cancel (POST /api/v1/execution/{id}/cancel)
- No stateless execution endpoint (DuneStateless /stateless/executions)
- No CSV transfer to external storage (transfers endpoints)
- No table metadata endpoints (GET /api/v1/table/{namespace}/{table})

**Deviations** (4)

- executions follow a fixed clock: EXECUTING at +1s, COMPLETED at +3s after execute
- queries come from a static 3-entry catalog; no real SQL is executed
- simulate_fail body flag forces QUERY_STATE_FAILED; real API has no failure trigger
- Auth is a presence-only Bearer; real Dune uses the x-dune-api-key header

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/v1/query/{query_id}/execute` — body, params, auth, stateful, errors, clock
- `POST` `/api/v1/query/{query_id}/result` — body, params, auth, stateful, errors, clock
- `GET` `/api/v1/auth/validate` — auth
- `GET` `/api/v1/execution/{execution_id}/status` — params, auth, stateful, errors, clock
- `GET` `/api/v1/execution/{execution_id}/results/csv` — query, params, auth, stateful, errors, clock
- `GET` `/api/v1/execution/{execution_id}/results` — query, params, auth, stateful, errors, clock

</details>

### dynamodb-style

**Covered** — 1 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/` |

</details>

**Missing** (8)

- No secondary indexes: GSI/LSI creation and index-targeted queries
- No transactions: TransactGetItems, TransactWriteItems
- No PartiQL: ExecuteStatement, BatchExecuteStatement
- No TTL: DescribeTimeToLive, UpdateTimeToLive
- No backup or restore: CreateBackup, RestoreTableFromBackup
- No UpdateTable, TagResource/UntagResource/ListTags, or DescribeLimits
- No PITR or import/export: ExportTableToPointInTime, ImportTable
- No global tables (CreateGlobalTable, ListGlobalTables)

**Deviations** (5)

- expression subset: OR/NOT/parens/IN/size()/doc paths rejected as ValidationException
- tables are ACTIVE immediately and DeleteTable is synchronous; no CREATING/DELETING
- UnprocessedKeys/UnprocessedItems always empty; no throttling, ConsumedCapacity fixed at 1
- Query/Scan Limit caps returned post-filter items; real caps items evaluated
- UpdateItem REMOVE on a key attribute silently no-ops instead of erroring

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/` — body, query, stateful, paginate, errors, clock

</details>

### echo-style

**Covered** — 0 routes (+1 ws) · gRPC `stunt.example.Echo`

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| WS | `/ws/echo` |

</details>

### emailoctopus-style

**Covered** — 21 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/lists` |
| POST | `/lists` |
| GET | `/lists/{list_id}` |
| PUT | `/lists/{list_id}` |
| DELETE | `/lists/{list_id}` |
| POST | `/lists/{list_id}/fields` |
| PUT | `/lists/{list_id}/fields/{tag}` |
| DELETE | `/lists/{list_id}/fields/{tag}` |
| GET | `/lists/{list_id}/contacts` |
| POST | `/lists/{list_id}/contacts` |
| PUT | `/lists/{list_id}/contacts` |
| PUT | `/lists/{list_id}/contacts/batch` |
| GET | `/lists/{list_id}/contacts/{contact_id}` |
| PUT | `/lists/{list_id}/contacts/{contact_id}` |
| DELETE | `/lists/{list_id}/contacts/{contact_id}` |
| GET | `/campaigns` |
| GET | `/campaigns/{campaign_id}` |
| GET | `/campaigns/{campaign_id}/reports/summary` |
| GET | `/campaigns/{campaign_id}/reports/links` |
| GET | `/campaigns/{campaign_id}/reports` |
| POST | `/automations/{automation_id}/queue` |

</details>

**Missing** (2)

- No rate limiting: 429 too-many-requests responses and quotas not simulated
- No 403 access-denied, 415 unsupported-media-type, or 405 method problem responses

**Deviations** (3)

- any non-empty bearer token is accepted; real keys are dashboard-issued API keys
- contact ids use truncated SHA-256 of the email; the real API uses MD5
- v2 has no webhooks; adapter emits unsigned lifecycle events as a local extension

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/lists` — query, stateful, paginate, filter
- `POST` `/lists` — body, stateful, filter, webhooks, clock
- `GET` `/lists/{list_id}` — params, stateful, filter
- `PUT` `/lists/{list_id}` — body, params, stateful, filter, webhooks, clock
- `DELETE` `/lists/{list_id}` — params, stateful, filter, webhooks, clock
- `POST` `/lists/{list_id}/fields` — body, params, stateful, webhooks, clock
- `PUT` `/lists/{list_id}/fields/{tag}` — body, params, stateful, filter, webhooks, clock
- `DELETE` `/lists/{list_id}/fields/{tag}` — params, stateful, filter, webhooks, clock
- `GET` `/lists/{list_id}/contacts` — query, params, stateful, paginate, filter
- `POST` `/lists/{list_id}/contacts` — body, params, stateful, filter, webhooks, clock
- `PUT` `/lists/{list_id}/contacts` — body, params, stateful, filter, webhooks, clock
- `PUT` `/lists/{list_id}/contacts/batch` — body, params, stateful, webhooks, clock
- `GET` `/lists/{list_id}/contacts/{contact_id}` — params, stateful
- `PUT` `/lists/{list_id}/contacts/{contact_id}` — body, params, stateful, webhooks, clock
- `DELETE` `/lists/{list_id}/contacts/{contact_id}` — params, stateful, webhooks, clock
- `GET` `/campaigns` — query, stateful, paginate, filter, clock
- `GET` `/campaigns/{campaign_id}` — params, stateful, clock
- `GET` `/campaigns/{campaign_id}/reports/summary` — params, stateful, clock
- `GET` `/campaigns/{campaign_id}/reports/links` — params, stateful, clock
- `GET` `/campaigns/{campaign_id}/reports` — query, params, stateful, paginate, clock
- `POST` `/automations/{automation_id}/queue` — body, params, stateful, webhooks, clock

</details>

### entra-id-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/common/oauth2/v2.0/authorize` |
| POST | `/common/oauth2/v2.0/token` |
| GET | `/common/discovery/v2.0/keys` |
| GET | `/v1.0/me` |
| GET | `/v1.0/users` |
| POST | `/v1.0/users` |
| GET | `/v1.0/users/{id}` |
| GET | `/v1.0/applications` |
| GET | `/v1.0/servicePrincipals` |

</details>

**Provider surface** — derived from spec msgraph-metadata v1.0 @ v1.0: 17531 real routes · 6 covered · 0% · 17525 not implemented

<details><summary>not implemented (17525)</summary>

- `GET` `/v1.0/admin`
- `PATCH` `/v1.0/admin`
- `DELETE` `/v1.0/admin/configurationManagement`
- `GET` `/v1.0/admin/configurationManagement`
- `PATCH` `/v1.0/admin/configurationManagement`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts`
- `POST` `/v1.0/admin/configurationManagement/configurationDrifts`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults`
- `POST` `/v1.0/admin/configurationManagement/configurationMonitoringResults`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors`
- `POST` `/v1.0/admin/configurationManagement/configurationMonitors`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs`
- `POST` `/v1.0/admin/configurationManagement/configurationSnapshotJobs`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots`
- `POST` `/v1.0/admin/configurationManagement/configurationSnapshots`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `DELETE` `/v1.0/admin/edge`
- `GET` `/v1.0/admin/edge`
- `PATCH` `/v1.0/admin/edge`
- `DELETE` `/v1.0/admin/edge/internetExplorerMode`
- `GET` `/v1.0/admin/edge/internetExplorerMode`
- `PATCH` `/v1.0/admin/edge/internetExplorerMode`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists`
- `POST` `/v1.0/admin/edge/internetExplorerMode/siteLists`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists/$count`
- `DELETE` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
- `PATCH` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
… and 17475 more


</details>

**Missing** (8)

- No $filter, $search, $orderby, $select, or $expand on Graph queries
- No user PATCH or DELETE (/v1.0/users/{id})
- No application or servicePrincipal create, update, or delete operations
- No groups, members, or memberOf endpoints (/v1.0/groups)
- No directory roles, role assignments, or organization endpoints
- No B2B invitations (POST /invitations) or guest users
- No client-credentials or device-code token grant support
- No signInLogs, audit logs, or user activities

**Deviations** (3)

- Authorize auto-approves with an instant 302; no consent screen
- nextLink cursor param is $skipToken (camelCase); real Graph emits $skiptoken
- users create ignores mailNickname; mail defaults to the UPN

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/common/oauth2/v2.0/authorize` — query, stateful, errors
- `POST` `/common/oauth2/v2.0/token` — body, stateful, errors, clock
- `GET` `/common/discovery/v2.0/keys` — —
- `GET` `/v1.0/me` — auth, stateful, clock
- `GET` `/v1.0/users` — query, auth, stateful, paginate, errors, clock
- `POST` `/v1.0/users` — body, auth, stateful, clock
- `GET` `/v1.0/users/{id}` — params, auth, stateful, errors, clock
- `GET` `/v1.0/applications` — query, auth, stateful, paginate, errors, clock
- `GET` `/v1.0/servicePrincipals` — query, auth, stateful, paginate, errors, clock

</details>

### erc4337-style

**Covered** — 2 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/` |
| POST | `/paymaster/sign` |

</details>

**Missing** (5)

- No eth_chainId, eth_blockNumber, or eth_getBlockByNumber passthrough
- No ERC-7677 paymaster RPC (pm_* methods); only local /paymaster/sign
- No EntryPoint v0.6 support; v0.7 entrypoint only
- No debug_bundler_* ops: sendBundleNow, clearState, dropUserOperation
- No WebSocket transport or newHeads subscriptions

**Deviations** (6)

- gas estimates are deterministic fixed values; real bundlers differ per implementation
- inclusion runs on a fixed clock: mempool 0-1s, bundled 1-3s, included at >=3s
- eth_sendUserOperation accepts {simulate_fail:true} as a third params element
- mock paymaster POST /paymaster/sign mints synthetic sponsorship signatures
- userOp keeps the v0.6 paymasterAndData field though the adapter is EntryPoint-v0.7-only
- Error envelopes use generic -32602 rather than AA-prefixed codes (-32500...)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/` — body, stateful, clock
- `POST` `/paymaster/sign` — body, errors

</details>

### escrow-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/2017-09-01/customer/me` |
| GET | `/2017-09-01/transaction` |
| POST | `/2017-09-01/transaction` |
| GET | `/2017-09-01/transaction/reference/{reference}` |
| GET | `/2017-09-01/transaction/{id}` |
| PATCH | `/2017-09-01/transaction/{id}` |
| POST | `/2017-09-01/customer/me/webhook` |
| GET | `/2017-09-01/customer/me/webhook` |
| POST | `/sim/transaction/{id}/fund` |

</details>

**Missing** (3)

- No list filters on GET /2017-09-01/transaction (status, date, email)
- No reject or return-item actions (agree/accept/ship/receive/cancel exist)
- No fee calculation endpoint (/2017-09-01/transaction/fees)

**Deviations** (4)

- POST /sim/transaction/{id}/fund is a simulator-only affordance for hosted-page funding
- List returns {transactions:[...]}; real Escrow.com returns a bare array
- An unparseable schedule amount stores 0.00 instead of a 400 field error
- ship/receive/cancel are not gated on agreement or secured funds

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/2017-09-01/customer/me` — auth
- `GET` `/2017-09-01/transaction` — query, auth, stateful, paginate
- `POST` `/2017-09-01/transaction` — body, auth, stateful, webhooks, errors, clock
- `GET` `/2017-09-01/transaction/reference/{reference}` — params, auth, stateful, errors
- `GET` `/2017-09-01/transaction/{id}` — params, auth, stateful, errors
- `PATCH` `/2017-09-01/transaction/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/2017-09-01/customer/me/webhook` — body, auth, stateful, errors
- `GET` `/2017-09-01/customer/me/webhook` — auth, stateful
- `POST` `/sim/transaction/{id}/fund` — params, auth, stateful, webhooks, errors

</details>

### eth-jsonrpc-style

**Covered** — 1 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/` |

</details>

**Missing** (5)

- No EVM execution — eth_getCode always 0x, contracts never run
- No eth_getStorageAt, eth_getTransactionByBlock*, or uncle methods
- No debug/trace namespaces (debug_traceTransaction, trace_transaction)
- No eth_maxPriorityFeePerGas or eth_blobBaseFee methods
- No WebSocket subscriptions (eth_subscribe); HTTP POST / only

**Deviations** (4)

- eth_estimateGas fixed at 0x5208 (21000); eth_gasPrice fixed at 1 Gwei
- Tx hashes derive from a pseudo-keccak, not real keccak256
- Mining delay fixed at 3s; blockNumber advances one block per sent tx
- eth_sendRawTransaction accepts simulator-only {simulate_fail: true} for a revert

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/` — body, stateful, clock

</details>

### etherscan-style

**Covered** — 1 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/api` |

</details>

**Missing** (3)

- No getLogs action (txlistinternal/tokentx are served, hard-coded empty)
- No logs, proxy, or gastracker modules (gasoracle, eth_call passthrough)
- No getminedblocks, getblocknobytime, or nodecount actions

**Deviations** (2)

- Auth accepts any non-empty apikey; only a missing key yields the error envelope
- txlistinternal/tokentx/tokenbalance return hard-coded empty results

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/api` — query, stateful, filter

</details>

### fattureincloud-style

**Covered** — 42 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/user/companies` |
| GET | `/c/{company_id}/company/info` |
| PUT | `/c/{company_id}/company/info` |
| GET | `/c/{company_id}/received_documents` |
| POST | `/c/{company_id}/received_documents` |
| GET | `/c/{company_id}/received_documents/info` |
| GET | `/c/{company_id}/received_documents/{id}` |
| PUT | `/c/{company_id}/received_documents/{id}` |
| DELETE | `/c/{company_id}/received_documents/{id}` |
| GET | `/c/{company_id}/issued_documents` |
| POST | `/c/{company_id}/issued_documents` |
| GET | `/c/{company_id}/issued_documents/info` |
| GET | `/c/{company_id}/issued_documents/{id}` |
| PUT | `/c/{company_id}/issued_documents/{id}` |
| DELETE | `/c/{company_id}/issued_documents/{id}` |
| GET | `/c/{company_id}/suppliers` |
| POST | `/c/{company_id}/suppliers` |
| GET | `/c/{company_id}/suppliers/{id}` |
| PUT | `/c/{company_id}/suppliers/{id}` |
| DELETE | `/c/{company_id}/suppliers/{id}` |
| GET | `/c/{company_id}/clients` |
| POST | `/c/{company_id}/clients` |
| GET | `/c/{company_id}/clients/{id}` |
| PUT | `/c/{company_id}/clients/{id}` |
| DELETE | `/c/{company_id}/clients/{id}` |
| GET | `/c/{company_id}/products` |
| POST | `/c/{company_id}/products` |
| GET | `/c/{company_id}/products/{id}` |
| PUT | `/c/{company_id}/products/{id}` |
| DELETE | `/c/{company_id}/products/{id}` |
| GET | `/c/{company_id}/taxes` |
| POST | `/c/{company_id}/taxes` |
| GET | `/c/{company_id}/taxes/{id}` |
| PUT | `/c/{company_id}/taxes/{id}` |
| DELETE | `/c/{company_id}/taxes/{id}` |
| GET | `/c/{company_id}/cashbook/{year}/{month}` |
| POST | `/c/{company_id}/archive` |
| GET | `/c/{company_id}/subscriptions` |
| POST | `/c/{company_id}/subscriptions` |
| GET | `/c/{company_id}/subscriptions/{id}` |
| PUT | `/c/{company_id}/subscriptions/{id}` |
| DELETE | `/c/{company_id}/subscriptions/{id}` |

</details>

**Provider surface** — derived from spec openapi-fattureincloud @ 2.1.8: 123 real routes · 31 covered · 25% · 92 not implemented

<details><summary>not implemented (92)</summary>

- `GET` `/c/{company_id}/archive`
- `POST` `/c/{company_id}/archive/attachment`
- `DELETE` `/c/{company_id}/archive/{document_id}`
- `GET` `/c/{company_id}/archive/{document_id}`
- `PUT` `/c/{company_id}/archive/{document_id}`
- `GET` `/c/{company_id}/bin/issued_documents`
- `DELETE` `/c/{company_id}/bin/issued_documents/{document_id}`
- `GET` `/c/{company_id}/bin/issued_documents/{document_id}`
- `POST` `/c/{company_id}/bin/issued_documents/{document_id}/recover`
- `GET` `/c/{company_id}/bin/received_documents`
- `DELETE` `/c/{company_id}/bin/received_documents/{document_id}`
- `GET` `/c/{company_id}/bin/received_documents/{document_id}`
- `POST` `/c/{company_id}/bin/received_documents/{document_id}/recover`
- `GET` `/c/{company_id}/cashbook`
- `POST` `/c/{company_id}/cashbook`
- `DELETE` `/c/{company_id}/cashbook/{document_id}`
- `PUT` `/c/{company_id}/cashbook/{document_id}`
- `GET` `/c/{company_id}/company/plan_usage`
- `GET` `/c/{company_id}/emails`
- `GET` `/c/{company_id}/entities/clients`
- `POST` `/c/{company_id}/entities/clients`
- `GET` `/c/{company_id}/entities/clients/info`
- `DELETE` `/c/{company_id}/entities/clients/{client_id}`
- `GET` `/c/{company_id}/entities/clients/{client_id}`
- `PUT` `/c/{company_id}/entities/clients/{client_id}`
- `GET` `/c/{company_id}/entities/suppliers`
- `POST` `/c/{company_id}/entities/suppliers`
- `DELETE` `/c/{company_id}/entities/suppliers/{supplier_id}`
- `GET` `/c/{company_id}/entities/suppliers/{supplier_id}`
- `PUT` `/c/{company_id}/entities/suppliers/{supplier_id}`
- `GET` `/c/{company_id}/info/archive_categories`
- `GET` `/c/{company_id}/info/cost_centers`
- `GET` `/c/{company_id}/info/payment_accounts`
- `GET` `/c/{company_id}/info/payment_methods`
- `GET` `/c/{company_id}/info/product_categories`
- `GET` `/c/{company_id}/info/received_document_categories`
- `GET` `/c/{company_id}/info/revenue_centers`
- `GET` `/c/{company_id}/info/vat_types`
- `POST` `/c/{company_id}/issued_documents/attachment`
- `GET` `/c/{company_id}/issued_documents/join`
- `POST` `/c/{company_id}/issued_documents/totals`
- `GET` `/c/{company_id}/issued_documents/transform`
- `DELETE` `/c/{company_id}/issued_documents/{document_id}/attachment`
- `GET` `/c/{company_id}/issued_documents/{document_id}/e_invoice/error_reason`
- `POST` `/c/{company_id}/issued_documents/{document_id}/e_invoice/send`
- `GET` `/c/{company_id}/issued_documents/{document_id}/e_invoice/xml`
- `GET` `/c/{company_id}/issued_documents/{document_id}/e_invoice/xml_verify`
- `GET` `/c/{company_id}/issued_documents/{document_id}/email`
- `POST` `/c/{company_id}/issued_documents/{document_id}/email`
- `POST` `/c/{company_id}/issued_documents/{document_id}/totals`
… and 42 more


</details>

**Missing** (3)

- OAuth2 token dance not implemented (no authorize or token endpoints)
- No e-invoice send/retrieve side effects or email dispatch
- No receipts, settings, or document attachment endpoints

**Deviations** (6)

- Any non-empty bearer accepted; missing/malformed header is a genuine 401
- POST /entities/{c}/archive takes JSON; the real endpoint is multipart
- Webhook HMAC uses fixed secret fic-stunt-webhook-signing-secret
- DELETE returns bare {}; real API wraps delete responses in {data: ...}
- Webhook deliveries use a platform envelope, not CloudEvents (ce-* headers, JWT bearer)
- Update events are generalized <category>.update; real API uses per-document-kind types

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/user/companies` — stateful
- `GET` `/c/{company_id}/company/info` — params, stateful
- `PUT` `/c/{company_id}/company/info` — body, params, stateful
- `GET` `/c/{company_id}/received_documents` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/received_documents` — body, params, stateful, webhooks
- `GET` `/c/{company_id}/received_documents/info` — params, stateful
- `GET` `/c/{company_id}/received_documents/{id}` — params, stateful
- `PUT` `/c/{company_id}/received_documents/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/received_documents/{id}` — params, stateful
- `GET` `/c/{company_id}/issued_documents` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/issued_documents` — body, params, stateful, webhooks
- `GET` `/c/{company_id}/issued_documents/info` — params, stateful
- `GET` `/c/{company_id}/issued_documents/{id}` — params, stateful
- `PUT` `/c/{company_id}/issued_documents/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/issued_documents/{id}` — params, stateful
- `GET` `/c/{company_id}/suppliers` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/suppliers` — body, params, stateful, webhooks
- `GET` `/c/{company_id}/suppliers/{id}` — params, stateful
- `PUT` `/c/{company_id}/suppliers/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/suppliers/{id}` — params, stateful
- `GET` `/c/{company_id}/clients` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/clients` — body, params, stateful, webhooks
- `GET` `/c/{company_id}/clients/{id}` — params, stateful
- `PUT` `/c/{company_id}/clients/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/clients/{id}` — params, stateful
- `GET` `/c/{company_id}/products` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/products` — body, params, stateful, webhooks
- `GET` `/c/{company_id}/products/{id}` — params, stateful
- `PUT` `/c/{company_id}/products/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/products/{id}` — params, stateful
- `GET` `/c/{company_id}/taxes` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/taxes` — body, params, stateful, webhooks, clock
- `GET` `/c/{company_id}/taxes/{id}` — params, stateful
- `PUT` `/c/{company_id}/taxes/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/taxes/{id}` — params, stateful
- `GET` `/c/{company_id}/cashbook/{year}/{month}` — params, stateful
- `POST` `/c/{company_id}/archive` — body, params, stateful
- `GET` `/c/{company_id}/subscriptions` — query, params, stateful, paginate, filter
- `POST` `/c/{company_id}/subscriptions` — body, params, stateful
- `GET` `/c/{company_id}/subscriptions/{id}` — params, stateful
- `PUT` `/c/{company_id}/subscriptions/{id}` — body, params, stateful, webhooks
- `DELETE` `/c/{company_id}/subscriptions/{id}` — params, stateful

</details>

### firebase-style

**Covered** — 22 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/accounts:signInWithPassword` |
| POST | `/v1/accounts:signUp` |
| POST | `/v1/accounts:signInWithIdp` |
| POST | `/v1/accounts:getAccountInfo` |
| POST | `/v1/accounts:lookup` |
| POST | `/identitytoolkit/v3/relyingparty/{action}` |
| POST | `/v1/token` |
| POST | `/v1/projects/{project}/databases/(default)/documents:runQuery` |
| GET | `/v1/projects/{project}/databases/(default)/documents/{collection}` |
| POST | `/v1/projects/{project}/databases/(default)/documents/{collection}` |
| GET | `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` |
| PATCH | `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` |
| DELETE | `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` |
| GET | `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}` |
| POST | `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}` |
| GET | `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` |
| PATCH | `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` |
| DELETE | `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` |
| POST | `/v1/projects/{project}/messages:send` |
| GET | `/v1/projects/{project}/messages` |
| POST | `/v1/projects/{project}/topics/{topic}:subscribe` |
| POST | `/v1/projects/{project}/topics/{topic}:unsubscribe` |

</details>

**Missing** (4)

- No Realtime Database, Cloud Storage, or App Check surfaces
- No password reset (sendOobCode), account update/delete, or phone auth
- No Firestore index management, listCollectionIds, batchGet, or listen
- runQuery lacks composite/unary filters, offset, and startAt/endAt cursors

**Deviations** (8)

- Firestore subcollections supported one level deep only
- runQuery covers a structuredQuery subset: from/where/orderBy/limit, 8 filter ops
- Auth checks credential presence only; Bearer or key value never validated
- FCM topic :subscribe/:unsubscribe stand in for the Instance ID API
- GET .../messages lists sent messages — simulator extension, no real endpoint
- securetoken /v1/token errors use the Identity Toolkit envelope; real securetoken answers OAuth-style {error: invalid_grant}
- securetoken access_token mirrors id_token; real Firebase mints distinct tokens
- signUp includes registered:true and an empty displayName (real API emits those on sign-in only)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/accounts:signInWithPassword` — body, query, auth, stateful, clock
- `POST` `/v1/accounts:signUp` — body, query, auth, stateful, clock
- `POST` `/v1/accounts:signInWithIdp` — body, query, auth, stateful, clock
- `POST` `/v1/accounts:getAccountInfo` — body, query, auth, stateful, clock
- `POST` `/v1/accounts:lookup` — body, query, auth, stateful, clock
- `POST` `/identitytoolkit/v3/relyingparty/{action}` — body, query, params, auth, stateful, clock
- `POST` `/v1/token` — body, query, auth, stateful, clock
- `POST` `/v1/projects/{project}/databases/(default)/documents:runQuery` — body, query, params, auth, stateful, filter, clock
- `GET` `/v1/projects/{project}/databases/(default)/documents/{collection}` — body, query, params, auth, stateful, paginate, clock
- `POST` `/v1/projects/{project}/databases/(default)/documents/{collection}` — body, query, params, auth, stateful, clock
- `GET` `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` — body, query, params, auth, stateful, clock
- `PATCH` `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` — body, query, params, auth, stateful, clock
- `DELETE` `/v1/projects/{project}/databases/(default)/documents/{collection}/{id}` — body, query, params, auth, stateful
- `GET` `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}` — body, query, params, auth, stateful, paginate, clock
- `POST` `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}` — body, query, params, auth, stateful, clock
- `GET` `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` — body, query, params, auth, stateful, clock
- `PATCH` `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` — body, query, params, auth, stateful, clock
- `DELETE` `/v1/projects/{project}/databases/(default)/documents/{collection}/{document}/{sub}/{id}` — body, query, params, auth, stateful
- `POST` `/v1/projects/{project}/messages:send` — body, query, params, auth, stateful
- `GET` `/v1/projects/{project}/messages` — body, query, params, auth, stateful, paginate
- `POST` `/v1/projects/{project}/topics/{topic}:subscribe` — body, query, params, auth, stateful
- `POST` `/v1/projects/{project}/topics/{topic}:unsubscribe` — body, query, params, auth, stateful

</details>

### ga4-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1beta/accounts` |
| GET | `/v1beta/properties` |
| GET | `/v1beta/properties/{property}/dataStreams` |
| GET | `/v1admin/accounts` |
| GET | `/v1admin/properties` |
| GET | `/v1admin/properties/{property}/dataStreams` |
| POST | `/v1beta/properties/{resource}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 66 real routes · 11 covered · 16% · 55 not implemented

<details><summary>not implemented (55)</summary>

- `GET` `/v1beta/properties/{propertiesId}/audienceExports`
- `POST` `/v1beta/properties/{propertiesId}/audienceExports`
- `GET` `/v1beta/properties/{propertiesId}/audienceExports/{audienceExportsId}`
- `POST` `/v1beta/properties/{propertiesId}/audienceExports/{audienceExportsId}:query`
- `GET` `/v1beta/properties/{propertiesId}/metadata`
- `GET` `/v1beta/accountSummaries`
- `DELETE` `/v1beta/accounts/{accountsId}`
- `GET` `/v1beta/accounts/{accountsId}`
- `PATCH` `/v1beta/accounts/{accountsId}`
- `GET` `/v1beta/accounts/{accountsId}/dataSharingSettings`
- `POST` `/v1beta/accounts/{accountsId}:runAccessReport`
- `POST` `/v1beta/accounts/{accountsId}:searchChangeHistoryEvents`
- `POST` `/v1beta/accounts:provisionAccountTicket`
- `POST` `/v1beta/properties`
- `DELETE` `/v1beta/properties/{propertiesId}`
- `GET` `/v1beta/properties/{propertiesId}`
- `PATCH` `/v1beta/properties/{propertiesId}`
- `GET` `/v1beta/properties/{propertiesId}/conversionEvents`
- `POST` `/v1beta/properties/{propertiesId}/conversionEvents`
- `DELETE` `/v1beta/properties/{propertiesId}/conversionEvents/{conversionEventsId}`
- `GET` `/v1beta/properties/{propertiesId}/conversionEvents/{conversionEventsId}`
- `PATCH` `/v1beta/properties/{propertiesId}/conversionEvents/{conversionEventsId}`
- `GET` `/v1beta/properties/{propertiesId}/customDimensions`
- `POST` `/v1beta/properties/{propertiesId}/customDimensions`
- `GET` `/v1beta/properties/{propertiesId}/customDimensions/{customDimensionsId}`
- `PATCH` `/v1beta/properties/{propertiesId}/customDimensions/{customDimensionsId}`
- `POST` `/v1beta/properties/{propertiesId}/customDimensions/{customDimensionsId}:archive`
- `GET` `/v1beta/properties/{propertiesId}/customMetrics`
- `POST` `/v1beta/properties/{propertiesId}/customMetrics`
- `GET` `/v1beta/properties/{propertiesId}/customMetrics/{customMetricsId}`
- `PATCH` `/v1beta/properties/{propertiesId}/customMetrics/{customMetricsId}`
- `POST` `/v1beta/properties/{propertiesId}/customMetrics/{customMetricsId}:archive`
- `GET` `/v1beta/properties/{propertiesId}/dataRetentionSettings`
- `PATCH` `/v1beta/properties/{propertiesId}/dataRetentionSettings`
- `POST` `/v1beta/properties/{propertiesId}/dataStreams`
- `DELETE` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}`
- `GET` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}`
- `PATCH` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}`
- `GET` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}/measurementProtocolSecrets`
- `POST` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}/measurementProtocolSecrets`
- `DELETE` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}/measurementProtocolSecrets/{measurementProtocolSecretsId}`
- `GET` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}/measurementProtocolSecrets/{measurementProtocolSecretsId}`
- `PATCH` `/v1beta/properties/{propertiesId}/dataStreams/{dataStreamsId}/measurementProtocolSecrets/{measurementProtocolSecretsId}`
- `GET` `/v1beta/properties/{propertiesId}/firebaseLinks`
- `POST` `/v1beta/properties/{propertiesId}/firebaseLinks`
- `DELETE` `/v1beta/properties/{propertiesId}/firebaseLinks/{firebaseLinksId}`
- `GET` `/v1beta/properties/{propertiesId}/googleAdsLinks`
- `POST` `/v1beta/properties/{propertiesId}/googleAdsLinks`
- `DELETE` `/v1beta/properties/{propertiesId}/googleAdsLinks/{googleAdsLinksId}`
- `PATCH` `/v1beta/properties/{propertiesId}/googleAdsLinks/{googleAdsLinksId}`
… and 5 more


</details>

**Missing** (4)

- No pivots, cohortSpec, metricAggregations, or keepEmptyRows in runReport
- No runPivotReport, batchRunReports, getMetadata, or checkCompatibility
- No Admin write ops: account/property/dataStream create, patch, delete
- No googleAdsLinks, firebaseLinks, audiences, or conversionEvents

**Deviations** (3)

- Dimensions: date/country/deviceCategory only; metrics: sessions/activeUsers/screenPageViews
- properties.list honors only the filter=parent:<account> form
- Admin API served at both /v1admin (GA) and /v1beta (the shipped Go client's version); shapes shared

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1beta/accounts` — query, auth, stateful, paginate, errors, clock
- `GET` `/v1beta/properties` — query, auth, stateful, paginate, errors, clock
- `GET` `/v1beta/properties/{property}/dataStreams` — query, params, auth, stateful, paginate, errors, clock
- `GET` `/v1admin/accounts` — query, auth, stateful, paginate, errors, clock
- `GET` `/v1admin/properties` — query, auth, stateful, paginate, errors, clock
- `GET` `/v1admin/properties/{property}/dataStreams` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/v1beta/properties/{resource}` — body, params, auth, stateful, filter, errors, clock

</details>

### gcalendar-style

**Covered** — 10 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/calendar/v3/users/me/calendarList` |
| GET | `/calendar/v3/calendars/primary` |
| POST | `/calendar/v3/calendars/{calendarId}/events/quickAdd` |
| POST | `/calendar/v3/calendars/{calendarId}/events/import` |
| GET | `/calendar/v3/calendars/{calendarId}/events` |
| POST | `/calendar/v3/calendars/{calendarId}/events` |
| GET | `/calendar/v3/calendars/{calendarId}/events/{eventId}/instances` |
| GET | `/calendar/v3/calendars/{calendarId}/events/{eventId}` |
| PATCH | `/calendar/v3/calendars/{calendarId}/events/{eventId}` |
| DELETE | `/calendar/v3/calendars/{calendarId}/events/{eventId}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 38 real routes · 9 covered · 23% · 29 not implemented

<details><summary>not implemented (29)</summary>

- `POST` `/calendar/v3/calendars`
- `DELETE` `/calendar/v3/calendars/{calendarId}`
- `GET` `/calendar/v3/calendars/{calendarId}`
- `PATCH` `/calendar/v3/calendars/{calendarId}`
- `PUT` `/calendar/v3/calendars/{calendarId}`
- `GET` `/calendar/v3/calendars/{calendarId}/acl`
- `POST` `/calendar/v3/calendars/{calendarId}/acl`
- `POST` `/calendar/v3/calendars/{calendarId}/acl/watch`
- `DELETE` `/calendar/v3/calendars/{calendarId}/acl/{ruleId}`
- `GET` `/calendar/v3/calendars/{calendarId}/acl/{ruleId}`
- `PATCH` `/calendar/v3/calendars/{calendarId}/acl/{ruleId}`
- `PUT` `/calendar/v3/calendars/{calendarId}/acl/{ruleId}`
- `POST` `/calendar/v3/calendars/{calendarId}/clear`
- `POST` `/calendar/v3/calendars/{calendarId}/events/watch`
- `PUT` `/calendar/v3/calendars/{calendarId}/events/{eventId}`
- `POST` `/calendar/v3/calendars/{calendarId}/events/{eventId}/move`
- `POST` `/calendar/v3/calendars/{calendarId}/transferOwnership`
- `POST` `/calendar/v3/channels/stop`
- `GET` `/calendar/v3/colors`
- `POST` `/calendar/v3/freeBusy`
- `POST` `/calendar/v3/users/me/calendarList`
- `POST` `/calendar/v3/users/me/calendarList/watch`
- `DELETE` `/calendar/v3/users/me/calendarList/{calendarId}`
- `GET` `/calendar/v3/users/me/calendarList/{calendarId}`
- `PATCH` `/calendar/v3/users/me/calendarList/{calendarId}`
- `PUT` `/calendar/v3/users/me/calendarList/{calendarId}`
- `GET` `/calendar/v3/users/me/settings`
- `POST` `/calendar/v3/users/me/settings/watch`
- `GET` `/calendar/v3/users/me/settings/{setting}`

</details>

**Missing** (4)

- No RRULE MONTHLY/YEARLY frequencies or BY* parts (BYDAY, BYSETPOS)
- No calendars CRUD or calendarList/ACL write endpoints
- No events watch, move, or freebusy.query endpoints
- No colors or users.settings endpoints

**Deviations** (2)

- Event create without start/end defaults them (now+30m, +90m); real API requires both
- quickAdd uses the text verbatim as the summary with a now+30m slot; real Calendar parses natural-language dates

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/calendar/v3/users/me/calendarList` — query, auth, stateful, paginate, clock
- `GET` `/calendar/v3/calendars/primary` — auth, stateful, clock
- `POST` `/calendar/v3/calendars/{calendarId}/events/quickAdd` — query, params, auth, stateful, clock
- `POST` `/calendar/v3/calendars/{calendarId}/events/import` — body, params, auth, stateful, clock
- `GET` `/calendar/v3/calendars/{calendarId}/events` — query, params, auth, stateful, paginate, filter, clock
- `POST` `/calendar/v3/calendars/{calendarId}/events` — body, params, auth, stateful, clock
- `GET` `/calendar/v3/calendars/{calendarId}/events/{eventId}/instances` — query, params, auth, stateful, paginate, filter, clock
- `GET` `/calendar/v3/calendars/{calendarId}/events/{eventId}` — params, auth, stateful, clock
- `PATCH` `/calendar/v3/calendars/{calendarId}/events/{eventId}` — body, params, auth, stateful, clock
- `DELETE` `/calendar/v3/calendars/{calendarId}/events/{eventId}` — params, auth, stateful, clock

</details>

### gdocs-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/documents` |
| GET | `/v1/documents/{documentId}/revisions` |
| POST | `/v1/documents/{documentId}:batchUpdate` |
| POST | `/v1/documents/{documentId}/batchUpdate` |
| GET | `/v1/documents/{documentId}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 3 real routes · 3 covered · 100% · 0 not implemented

**Missing** (3)

- Tables, headers/footers, suggestions, and writeControl not modeled
- Most batchUpdate request types absent: replaceAllText, replaceImage, named ranges
- No createTable or other table requests (insertTableRow, updateTableCellStyle)

**Deviations** (5)

- batchUpdate replies map 1:1 to requests; real API may return fewer
- batchUpdate also served at the legacy slash form (documents/{id}/batchUpdate)
- GET revisions endpoint is extra-API; the real Docs API v1 has none
- Inserted text adopts the style of the run it lands in
- Inserting newline continues bullet/named style into the new paragraph

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/documents` — body, auth, stateful, clock
- `GET` `/v1/documents/{documentId}/revisions` — params, auth, stateful, clock
- `POST` `/v1/documents/{documentId}:batchUpdate` — body, params, auth, stateful, clock
- `POST` `/v1/documents/{documentId}/batchUpdate` — body, params, auth, stateful, clock
- `GET` `/v1/documents/{documentId}` — params, auth, stateful, clock

</details>

### github-style

**Covered** — 26 routes · GraphQL schema

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/app` |
| GET | `/app/installations` |
| POST | `/app/installations/{installation_id}/access_tokens` |
| GET | `/installation` |
| GET | `/repos/{owner}/{repo}` |
| GET | `/repos/{owner}/{repo}/issues` |
| POST | `/repos/{owner}/{repo}/issues` |
| GET | `/repos/{owner}/{repo}/issues/{issue_number}` |
| PATCH | `/repos/{owner}/{repo}/issues/{issue_number}` |
| GET | `/repos/{owner}/{repo}/issues/{issue_number}/comments` |
| POST | `/repos/{owner}/{repo}/issues/{issue_number}/comments` |
| POST | `/repos/{owner}/{repo}/issues/{issue_number}/labels/{name}` |
| DELETE | `/repos/{owner}/{repo}/issues/{issue_number}/labels/{name}` |
| GET | `/repos/{owner}/{repo}/issues/{issue_number}/events` |
| GET | `/repos/{owner}/{repo}/pulls` |
| POST | `/repos/{owner}/{repo}/pulls` |
| GET | `/repos/{owner}/{repo}/pulls/{pull_number}` |
| PATCH | `/repos/{owner}/{repo}/pulls/{pull_number}` |
| PUT | `/repos/{owner}/{repo}/pulls/{pull_number}/merge` |
| GET | `/repos/{owner}/{repo}/pulls/{pull_number}/reviews` |
| POST | `/repos/{owner}/{repo}/pulls/{pull_number}/reviews` |
| POST | `/repos/{owner}/{repo}/dispatches` |
| GET | `/repos/{owner}/{repo}/actions/runs` |
| GET | `/repos/{owner}/{repo}/actions/runs/{run_id}` |
| POST | `/repos/{owner}/{repo}/hooks` |
| POST | `/webhooks/receive` |

</details>

**Provider surface** — derived from sdk octokit @ 5.0.5 (floor): 998 real routes · 23 covered · 2% · 971 not implemented

<details><summary>not implemented (971)</summary>

- `GET` `/advisories`
- `GET` `/advisories/{ghsa_id}`
- `POST` `/app-manifests/{code}/conversions`
- `GET` `/app/hook/config`
- `PATCH` `/app/hook/config`
- `GET` `/app/hook/deliveries`
- `GET` `/app/hook/deliveries/{delivery_id}`
- `POST` `/app/hook/deliveries/{delivery_id}/attempts`
- `GET` `/app/installation-requests`
- `DELETE` `/app/installations/{installation_id}`
- `GET` `/app/installations/{installation_id}`
- `DELETE` `/app/installations/{installation_id}/suspended`
- `PUT` `/app/installations/{installation_id}/suspended`
- `DELETE` `/applications/{client_id}/grant`
- `DELETE` `/applications/{client_id}/token`
- `PATCH` `/applications/{client_id}/token`
- `POST` `/applications/{client_id}/token`
- `POST` `/applications/{client_id}/token/scoped`
- `GET` `/apps/{app_slug}`
- `GET` `/codes_of_conduct`
- `GET` `/codes_of_conduct/{key}`
- `POST` `/credentials/revoke`
- `GET` `/emojis`
- `GET` `/enterprises/{enterprise}/code-security/configurations`
- `POST` `/enterprises/{enterprise}/code-security/configurations`
- `GET` `/enterprises/{enterprise}/code-security/configurations/defaults`
- `DELETE` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}`
- `GET` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}`
- `PATCH` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}`
- `POST` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}/attach`
- `PUT` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}/defaults`
- `GET` `/enterprises/{enterprise}/code-security/configurations/{configuration_id}/repositories`
- `GET` `/enterprises/{enterprise}/dependabot/alerts`
- `GET` `/enterprises/{enterprise}/teams`
- `POST` `/enterprises/{enterprise}/teams`
- `GET` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships`
- `POST` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships/add`
- `POST` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships/remove`
- `DELETE` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships/{username}`
- `GET` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships/{username}`
- `PUT` `/enterprises/{enterprise}/teams/{enterprise-team}/memberships/{username}`
- `GET` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations`
- `POST` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations/add`
- `POST` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations/remove`
- `DELETE` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations/{org}`
- `GET` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations/{org}`
- `PUT` `/enterprises/{enterprise}/teams/{enterprise-team}/organizations/{org}`
- `DELETE` `/enterprises/{enterprise}/teams/{team_slug}`
- `GET` `/enterprises/{enterprise}/teams/{team_slug}`
- `PATCH` `/enterprises/{enterprise}/teams/{team_slug}`
… and 921 more


</details>

**Missing** (7)

- No X-Hub-Signature (SHA-1) or X-GitHub-Delivery UUID webhook headers
- No users, orgs, teams, or search endpoints
- No git data, contents, branches, or releases endpoints
- No PR review comments, files, or requested_reviewers endpoints
- No actions workflows, jobs, artifacts, or logs endpoints
- No webhook list/patch/delete or deliveries endpoints
- No GraphQL nodes or mutations beyond viewer, repository, issues, pulls

**Deviations** (4)

- POST /graphql served without the REST Bearer/PAT check (transport lacks auth hook)
- App JWT RS256 signature not verified; the credential store is the check
- Webhook body is a stunt {type, payload} envelope, not GitHub's bare event body
- Runs advance on fixed clock (queued+1s, in_progress+3s); dispatch takes simulate_fail

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/app` — auth, stateful, clock
- `GET` `/app/installations` — query, auth, stateful, paginate, clock
- `POST` `/app/installations/{installation_id}/access_tokens` — params, auth, stateful, clock
- `GET` `/installation` — auth, stateful, clock
- `GET` `/repos/{owner}/{repo}` — params, auth, stateful, errors, clock
- `GET` `/repos/{owner}/{repo}/issues` — query, params, auth, stateful, paginate, filter, clock
- `POST` `/repos/{owner}/{repo}/issues` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/issues/{issue_number}` — params, auth, stateful, errors, clock
- `PATCH` `/repos/{owner}/{repo}/issues/{issue_number}` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/issues/{issue_number}/comments` — query, params, auth, stateful, paginate, filter, errors, clock
- `POST` `/repos/{owner}/{repo}/issues/{issue_number}/comments` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/repos/{owner}/{repo}/issues/{issue_number}/labels/{name}` — params, auth, stateful, webhooks, errors, clock
- `DELETE` `/repos/{owner}/{repo}/issues/{issue_number}/labels/{name}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/issues/{issue_number}/events` — query, params, auth, stateful, paginate, filter, errors, clock
- `GET` `/repos/{owner}/{repo}/pulls` — query, params, auth, stateful, paginate, filter, clock
- `POST` `/repos/{owner}/{repo}/pulls` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/pulls/{pull_number}` — params, auth, stateful, errors, clock
- `PATCH` `/repos/{owner}/{repo}/pulls/{pull_number}` — body, params, auth, stateful, webhooks, errors, clock
- `PUT` `/repos/{owner}/{repo}/pulls/{pull_number}/merge` — params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/pulls/{pull_number}/reviews` — query, params, auth, stateful, paginate, filter, errors, clock
- `POST` `/repos/{owner}/{repo}/pulls/{pull_number}/reviews` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/repos/{owner}/{repo}/dispatches` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/repos/{owner}/{repo}/actions/runs` — query, params, auth, stateful, paginate, filter, webhooks, clock
- `GET` `/repos/{owner}/{repo}/actions/runs/{run_id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/repos/{owner}/{repo}/hooks` — body, params, auth, stateful, errors, clock
- `POST` `/webhooks/receive` — stateful

</details>

### gmail-style

**Covered** — 16 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/gmail/v1/users/{userId}/labels` |
| POST | `/gmail/v1/users/{userId}/labels` |
| DELETE | `/gmail/v1/users/{userId}/labels/{id}` |
| POST | `/gmail/v1/users/{userId}/messages/send` |
| GET | `/gmail/v1/users/{userId}/messages` |
| POST | `/gmail/v1/users/{userId}/messages` |
| POST | `/gmail/v1/users/{userId}/messages/batchModify` |
| POST | `/gmail/v1/users/{userId}/messages/{messageId}/trash` |
| POST | `/gmail/v1/users/{userId}/messages/{messageId}/modify` |
| GET | `/gmail/v1/users/{userId}/messages/{messageId}/attachments/{attachmentId}` |
| GET | `/gmail/v1/users/{userId}/messages/{messageId}` |
| DELETE | `/gmail/v1/users/{userId}/messages/{messageId}` |
| GET | `/gmail/v1/users/{userId}/drafts` |
| POST | `/gmail/v1/users/{userId}/drafts` |
| DELETE | `/gmail/v1/users/{userId}/drafts/{id}` |
| GET | `/gmail/v1/users/{userId}/threads/{threadId}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 79 real routes · 16 covered · 20% · 63 not implemented

<details><summary>not implemented (63)</summary>

- `POST` `/gmail/v1/users/{userId}/drafts/send`
- `GET` `/gmail/v1/users/{userId}/drafts/{id}`
- `PUT` `/gmail/v1/users/{userId}/drafts/{id}`
- `GET` `/gmail/v1/users/{userId}/history`
- `GET` `/gmail/v1/users/{userId}/labels/{id}`
- `PATCH` `/gmail/v1/users/{userId}/labels/{id}`
- `PUT` `/gmail/v1/users/{userId}/labels/{id}`
- `POST` `/gmail/v1/users/{userId}/messages/batchDelete`
- `POST` `/gmail/v1/users/{userId}/messages/import`
- `POST` `/gmail/v1/users/{userId}/messages/{id}/untrash`
- `GET` `/gmail/v1/users/{userId}/profile`
- `GET` `/gmail/v1/users/{userId}/settings/autoForwarding`
- `PUT` `/gmail/v1/users/{userId}/settings/autoForwarding`
- `GET` `/gmail/v1/users/{userId}/settings/cse/identities`
- `POST` `/gmail/v1/users/{userId}/settings/cse/identities`
- `DELETE` `/gmail/v1/users/{userId}/settings/cse/identities/{cseEmailAddress}`
- `GET` `/gmail/v1/users/{userId}/settings/cse/identities/{cseEmailAddress}`
- `PATCH` `/gmail/v1/users/{userId}/settings/cse/identities/{emailAddress}`
- `GET` `/gmail/v1/users/{userId}/settings/cse/keypairs`
- `POST` `/gmail/v1/users/{userId}/settings/cse/keypairs`
- `GET` `/gmail/v1/users/{userId}/settings/cse/keypairs/{keyPairId}`
- `POST` `/gmail/v1/users/{userId}/settings/cse/keypairs/{keyPairId}:disable`
- `POST` `/gmail/v1/users/{userId}/settings/cse/keypairs/{keyPairId}:enable`
- `POST` `/gmail/v1/users/{userId}/settings/cse/keypairs/{keyPairId}:obliterate`
- `GET` `/gmail/v1/users/{userId}/settings/delegates`
- `POST` `/gmail/v1/users/{userId}/settings/delegates`
- `DELETE` `/gmail/v1/users/{userId}/settings/delegates/{delegateEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/delegates/{delegateEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/filters`
- `POST` `/gmail/v1/users/{userId}/settings/filters`
- `DELETE` `/gmail/v1/users/{userId}/settings/filters/{id}`
- `GET` `/gmail/v1/users/{userId}/settings/filters/{id}`
- `GET` `/gmail/v1/users/{userId}/settings/forwardingAddresses`
- `POST` `/gmail/v1/users/{userId}/settings/forwardingAddresses`
- `DELETE` `/gmail/v1/users/{userId}/settings/forwardingAddresses/{forwardingEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/forwardingAddresses/{forwardingEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/imap`
- `PUT` `/gmail/v1/users/{userId}/settings/imap`
- `GET` `/gmail/v1/users/{userId}/settings/language`
- `PUT` `/gmail/v1/users/{userId}/settings/language`
- `GET` `/gmail/v1/users/{userId}/settings/pop`
- `PUT` `/gmail/v1/users/{userId}/settings/pop`
- `GET` `/gmail/v1/users/{userId}/settings/sendAs`
- `POST` `/gmail/v1/users/{userId}/settings/sendAs`
- `DELETE` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}`
- `PATCH` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}`
- `PUT` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}`
- `GET` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}/smimeInfo`
- `POST` `/gmail/v1/users/{userId}/settings/sendAs/{sendAsEmail}/smimeInfo`
… and 13 more


</details>

**Missing** (6)

- No Gmail search operators (from:, to:, after:, has:attachment) in q
- No threads.list, history.list, or watch/stop push endpoints
- No drafts send/update/get or threads modify/trash endpoints
- No messages.import, untrash, or batchDelete endpoints
- No labels get/patch or users.getProfile endpoints
- No settings surface: filters, sendAs, forwardingAddresses, vacation

**Deviations** (3)

- q is substring match on snippet + Subject header only
- Omitted/0 maxResults returns everything; real API defaults to 100
- Label create is idempotent on existing name; real Gmail returns 409

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/gmail/v1/users/{userId}/labels` — auth, stateful
- `POST` `/gmail/v1/users/{userId}/labels` — body, auth, stateful
- `DELETE` `/gmail/v1/users/{userId}/labels/{id}` — params, auth, stateful
- `POST` `/gmail/v1/users/{userId}/messages/send` — body, auth, stateful
- `GET` `/gmail/v1/users/{userId}/messages` — query, params, auth, stateful, paginate
- `POST` `/gmail/v1/users/{userId}/messages` — body, auth, stateful
- `POST` `/gmail/v1/users/{userId}/messages/batchModify` — body, auth, stateful
- `POST` `/gmail/v1/users/{userId}/messages/{messageId}/trash` — params, auth, stateful
- `POST` `/gmail/v1/users/{userId}/messages/{messageId}/modify` — body, params, auth, stateful
- `GET` `/gmail/v1/users/{userId}/messages/{messageId}/attachments/{attachmentId}` — params, auth, stateful
- `GET` `/gmail/v1/users/{userId}/messages/{messageId}` — query, params, auth, stateful
- `DELETE` `/gmail/v1/users/{userId}/messages/{messageId}` — params, auth, stateful
- `GET` `/gmail/v1/users/{userId}/drafts` — query, auth, stateful, paginate
- `POST` `/gmail/v1/users/{userId}/drafts` — body, auth, stateful
- `DELETE` `/gmail/v1/users/{userId}/drafts/{id}` — params, auth, stateful
- `GET` `/gmail/v1/users/{userId}/threads/{threadId}` — params, auth, stateful

</details>

### google-admin-style

**Covered** — 13 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/admin/directory/v1/users` |
| POST | `/admin/directory/v1/users` |
| GET | `/admin/directory/v1/users/{userKey}` |
| PUT | `/admin/directory/v1/users/{userKey}` |
| DELETE | `/admin/directory/v1/users/{userKey}` |
| GET | `/admin/directory/v1/users/{userKey}/tokens` |
| GET | `/admin/directory/v1/groups` |
| POST | `/admin/directory/v1/groups` |
| GET | `/admin/directory/v1/groups/{groupKey}` |
| DELETE | `/admin/directory/v1/groups/{groupKey}` |
| GET | `/admin/directory/v1/groups/{groupKey}/members` |
| POST | `/admin/directory/v1/groups/{groupKey}/members` |
| DELETE | `/admin/directory/v1/groups/{groupKey}/members/{memberKey}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 128 real routes · 13 covered · 10% · 115 not implemented

<details><summary>not implemented (115)</summary>

- `GET` `/admin/directory/v1/customer/{customerId}/devices/chromeos`
- `POST` `/admin/directory/v1/customer/{customerId}/devices/chromeos/moveDevicesToOu`
- `GET` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}`
- `PATCH` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}`
- `PUT` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}`
- `GET` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}/commands/{commandId}`
- `POST` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{deviceId}:issueCommand`
- `POST` `/admin/directory/v1/customer/{customerId}/devices/chromeos/{resourceId}/action`
- `POST` `/admin/directory/v1/customer/{customerId}/devices/chromeos:batchChangeStatus`
- `GET` `/admin/directory/v1/customer/{customerId}/devices/chromeos:countChromeOsDevices`
- `GET` `/admin/directory/v1/customer/{customerId}/devices/mobile`
- `DELETE` `/admin/directory/v1/customer/{customerId}/devices/mobile/{resourceId}`
- `GET` `/admin/directory/v1/customer/{customerId}/devices/mobile/{resourceId}`
- `POST` `/admin/directory/v1/customer/{customerId}/devices/mobile/{resourceId}/action`
- `GET` `/admin/directory/v1/customer/{customerId}/orgunits`
- `POST` `/admin/directory/v1/customer/{customerId}/orgunits`
- `DELETE` `/admin/directory/v1/customer/{customerId}/orgunits/{orgunitsId}`
- `GET` `/admin/directory/v1/customer/{customerId}/orgunits/{orgunitsId}`
- `PATCH` `/admin/directory/v1/customer/{customerId}/orgunits/{orgunitsId}`
- `PUT` `/admin/directory/v1/customer/{customerId}/orgunits/{orgunitsId}`
- `GET` `/admin/directory/v1/customer/{customerId}/schemas`
- `POST` `/admin/directory/v1/customer/{customerId}/schemas`
- `DELETE` `/admin/directory/v1/customer/{customerId}/schemas/{schemaKey}`
- `GET` `/admin/directory/v1/customer/{customerId}/schemas/{schemaKey}`
- `PATCH` `/admin/directory/v1/customer/{customerId}/schemas/{schemaKey}`
- `PUT` `/admin/directory/v1/customer/{customerId}/schemas/{schemaKey}`
- `GET` `/admin/directory/v1/customer/{customer}/domainaliases`
- `POST` `/admin/directory/v1/customer/{customer}/domainaliases`
- `DELETE` `/admin/directory/v1/customer/{customer}/domainaliases/{domainAliasName}`
- `GET` `/admin/directory/v1/customer/{customer}/domainaliases/{domainAliasName}`
- `GET` `/admin/directory/v1/customer/{customer}/domains`
- `POST` `/admin/directory/v1/customer/{customer}/domains`
- `DELETE` `/admin/directory/v1/customer/{customer}/domains/{domainName}`
- `GET` `/admin/directory/v1/customer/{customer}/domains/{domainName}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/buildings`
- `POST` `/admin/directory/v1/customer/{customer}/resources/buildings`
- `DELETE` `/admin/directory/v1/customer/{customer}/resources/buildings/{buildingId}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/buildings/{buildingId}`
- `PATCH` `/admin/directory/v1/customer/{customer}/resources/buildings/{buildingId}`
- `PUT` `/admin/directory/v1/customer/{customer}/resources/buildings/{buildingId}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/calendars`
- `POST` `/admin/directory/v1/customer/{customer}/resources/calendars`
- `DELETE` `/admin/directory/v1/customer/{customer}/resources/calendars/{calendarResourceId}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/calendars/{calendarResourceId}`
- `PATCH` `/admin/directory/v1/customer/{customer}/resources/calendars/{calendarResourceId}`
- `PUT` `/admin/directory/v1/customer/{customer}/resources/calendars/{calendarResourceId}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/features`
- `POST` `/admin/directory/v1/customer/{customer}/resources/features`
- `DELETE` `/admin/directory/v1/customer/{customer}/resources/features/{featureKey}`
- `GET` `/admin/directory/v1/customer/{customer}/resources/features/{featureKey}`
… and 65 more


</details>

**Missing** (4)

- No orgunits, roles, roleAssignments, or schemas resources
- No asps, verificationCodes, mobileDevices, or chromeosDevices
- No user/group aliases, user photos, domains, or customers endpoints
- No users.patch/groups.patch, members.get, or members.update endpoints

**Deviations** (4)

- Users query supports bare terms plus email:/name:/orgUnitPath=/isSuspended= only
- Groups query silently ignores unrecognized query forms
- Static convenience tokens (ya29.mock-admin-token, conformance-token) seeded far-future
- users.list ignores customer/domain exactly-one-of enforcement; real Directory requires one

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/admin/directory/v1/users` — query, auth, stateful, paginate, filter, errors, clock
- `POST` `/admin/directory/v1/users` — body, auth, stateful, errors, clock
- `GET` `/admin/directory/v1/users/{userKey}` — params, auth, stateful, errors, clock
- `PUT` `/admin/directory/v1/users/{userKey}` — body, params, auth, stateful, errors, clock
- `DELETE` `/admin/directory/v1/users/{userKey}` — params, auth, stateful, errors, clock
- `GET` `/admin/directory/v1/users/{userKey}/tokens` — query, params, auth, stateful, paginate, errors, clock
- `GET` `/admin/directory/v1/groups` — query, auth, stateful, paginate, filter, errors, clock
- `POST` `/admin/directory/v1/groups` — body, auth, stateful, errors, clock
- `GET` `/admin/directory/v1/groups/{groupKey}` — params, auth, stateful, errors, clock
- `DELETE` `/admin/directory/v1/groups/{groupKey}` — params, auth, stateful, errors, clock
- `GET` `/admin/directory/v1/groups/{groupKey}/members` — query, params, auth, stateful, paginate, filter, errors, clock
- `POST` `/admin/directory/v1/groups/{groupKey}/members` — body, params, auth, stateful, errors, clock
- `DELETE` `/admin/directory/v1/groups/{groupKey}/members/{memberKey}` — params, auth, stateful, errors, clock

</details>

### google-cloudtasks-style

**Covered** — 16 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v2/projects/{project}/locations` |
| GET | `/v2/projects/{project}/locations/{location}` |
| GET | `/v2/projects/{project}/locations/{location}/cmekConfig` |
| PATCH | `/v2/projects/{project}/locations/{location}/cmekConfig` |
| POST | `/v2/projects/{project}/locations/{location}/queues` |
| GET | `/v2/projects/{project}/locations/{location}/queues` |
| GET | `/v2/projects/{project}/locations/{location}/queues/{queue}` |
| PATCH | `/v2/projects/{project}/locations/{location}/queues/{queue}` |
| DELETE | `/v2/projects/{project}/locations/{location}/queues/{queue}` |
| POST | `/v2/projects/{project}/locations/{location}/queues/{queue_verb}` |
| POST | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks` |
| GET | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks` |
| POST | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks:buffer` |
| POST | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task_verb}` |
| GET | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task}` |
| DELETE | `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task}` |

</details>

**Missing** (7)

- No background dispatch loop — tasks are never auto-delivered at scheduleTime; only tasks.run drives attempts
- No gRPC transport (REST only); google-cloud-* client libraries default to gRPC
- oauthToken/oidcToken are stored verbatim — no token minting at dispatch time
- stackdriverLoggingConfig is stored but no logs are written
- IAM policies are stored but not enforced — testIamPermissions always grants
- No App Engine queue.yaml/xml semantics (DISABLED state, queue-file overrides)
- CMEK config is metadata-only; nothing is encrypted

**Deviations** (7)

- Any OAuth2 bearer token is accepted; real Google validates tokens and IAM permissions
- tasks.run models the worker instead of calling it — success completes and deletes the task; the failing-worker profile simulates a 500 with retryConfig backoff
- queues.list filter supports only name/state with =, !=, and : containment (subset of the real filter grammar)
- tasks.list returns creation order; the real service defines no order
- Generated task IDs are counter-based 19-digit decimals, not random
- Purge is synchronous; real purge can take up to 60s to complete
- Deleted-task tombstones hold names exactly 24h (real retention is up to 24h, 9 days for queue.yaml queues)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v2/projects/{project}/locations` — query, params, paginate
- `GET` `/v2/projects/{project}/locations/{location}` — params
- `GET` `/v2/projects/{project}/locations/{location}/cmekConfig` — params, stateful
- `PATCH` `/v2/projects/{project}/locations/{location}/cmekConfig` — body, params, stateful
- `POST` `/v2/projects/{project}/locations/{location}/queues` — body, query, params, stateful
- `GET` `/v2/projects/{project}/locations/{location}/queues` — query, params, stateful, paginate
- `GET` `/v2/projects/{project}/locations/{location}/queues/{queue}` — params, stateful
- `PATCH` `/v2/projects/{project}/locations/{location}/queues/{queue}` — body, query, params, stateful
- `DELETE` `/v2/projects/{project}/locations/{location}/queues/{queue}` — params, stateful
- `POST` `/v2/projects/{project}/locations/{location}/queues/{queue_verb}` — body, params, stateful, clock
- `POST` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks` — body, query, params, stateful, clock
- `GET` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks` — query, params, stateful, paginate
- `POST` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks:buffer` — body, params, stateful, clock
- `POST` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task_verb}` — body, query, params, stateful, clock
- `GET` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task}` — query, params, stateful
- `DELETE` `/v2/projects/{project}/locations/{location}/queues/{queue}/tasks/{task}` — params, stateful, clock

</details>

### google-iam-style

**Covered** — 10 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/oauth2/v4/token` |
| GET | `/oauth2/v3/certs` |
| GET | `/v1/projects/{project}/serviceAccounts` |
| POST | `/v1/projects/{project}/serviceAccounts` |
| GET | `/v1/projects/{project}/serviceAccounts/{sa}` |
| DELETE | `/v1/projects/{project}/serviceAccounts/{sa}` |
| GET | `/v1/projects/{project}/serviceAccounts/{sa}/keys` |
| POST | `/v1/projects/{project}/serviceAccounts/{sa_verb}` |
| POST | `/v1/roles:queryGrantableRoles` |
| POST | `/v1/projects/{project}/roles:queryGrantableRoles` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 133 real routes · 14 covered · 10% · 119 not implemented

<details><summary>not implemented (119)</summary>

- `POST` `/v1/iamPolicies:lintPolicy`
- `POST` `/v1/iamPolicies:queryAuditableServices`
- `GET` `/v1/locations/{locationsId}/workforcePools`
- `POST` `/v1/locations/{locationsId}/workforcePools`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}`
- `PATCH` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/operations/{operationsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}`
- `PATCH` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys/{keysId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys/{keysId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys/{keysId}/operations/{operationsId}`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/keys/{keysId}:undelete`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/operations/{operationsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}`
- `PATCH` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}/tokens`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}/tokens`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}/tokens/{tokensId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}/tokens/{tokensId}`
- `PATCH` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}/tokens/{tokensId}`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}/scimTenants/{scimTenantsId}:undelete`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/providers/{providersId}:undelete`
- `DELETE` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/subjects/{subjectsId}`
- `GET` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/subjects/{subjectsId}/operations/{operationsId}`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}/subjects/{subjectsId}:undelete`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}:getIamPolicy`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}:setIamPolicy`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}:testIamPermissions`
- `POST` `/v1/locations/{locationsId}/workforcePools/{workforcePoolsId}:undelete`
- `GET` `/v1/organizations/{organizationsId}/roles`
- `POST` `/v1/organizations/{organizationsId}/roles`
- `DELETE` `/v1/organizations/{organizationsId}/roles/{rolesId}`
- `GET` `/v1/organizations/{organizationsId}/roles/{rolesId}`
- `PATCH` `/v1/organizations/{organizationsId}/roles/{rolesId}`
- `POST` `/v1/organizations/{organizationsId}/roles/{rolesId}:undelete`
- `POST` `/v1/permissions:queryTestablePermissions`
- `GET` `/v1/projects/{projectsId}/locations/{locationsId}/oauthClients`
- `POST` `/v1/projects/{projectsId}/locations/{locationsId}/oauthClients`
- `DELETE` `/v1/projects/{projectsId}/locations/{locationsId}/oauthClients/{oauthClientsId}`
- `GET` `/v1/projects/{projectsId}/locations/{locationsId}/oauthClients/{oauthClientsId}`
… and 69 more


</details>

**Missing** (4)

- No serviceAccountKeys create/delete, signJwt, or signBlob methods
- No serviceAccount patch, disable/enable, undelete, or getIamPolicy
- No generateIdToken method
- No roles list, get, create, or custom-role CRUD endpoints

**Deviations** (2)

- JWKS serves one fixed synthetic RSA-2048 key (kid mock-google-key-1)
- roles:queryGrantableRoles also served project-scoped (extra form; the real path is project-less)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/oauth2/v4/token` — body, stateful, errors, clock
- `GET` `/oauth2/v3/certs` — —
- `GET` `/v1/projects/{project}/serviceAccounts` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/v1/projects/{project}/serviceAccounts` — body, params, auth, stateful, errors, clock
- `GET` `/v1/projects/{project}/serviceAccounts/{sa}` — params, auth, stateful, errors, clock
- `DELETE` `/v1/projects/{project}/serviceAccounts/{sa}` — params, auth, stateful, errors, clock
- `GET` `/v1/projects/{project}/serviceAccounts/{sa}/keys` — query, params, auth, stateful, paginate, errors, clock
- `POST` `/v1/projects/{project}/serviceAccounts/{sa_verb}` — body, params, auth, stateful, errors, clock
- `POST` `/v1/roles:queryGrantableRoles` — body, auth, stateful, errors, clock
- `POST` `/v1/projects/{project}/roles:queryGrantableRoles` — body, auth, stateful, errors, clock

</details>

### google-style

**Covered** — 4 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/o/oauth2/auth` |
| POST | `/o/oauth2/token` |
| GET | `/oauth2/v3/certs` |
| GET | `/oauth2/v3/userinfo` |

</details>

**Missing** (2)

- No revoke or tokeninfo endpoints
- No device-code grant (/device.code) or OIDC discovery document

**Deviations** (2)

- Authorize auto-approves with an instant 302; no consent screen
- id_tokens signed by a fixed synthetic RSA key (kid mock-google-key-1)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/o/oauth2/auth` — query, stateful, errors
- `POST` `/o/oauth2/token` — body, stateful, errors, clock
- `GET` `/oauth2/v3/certs` — —
- `GET` `/oauth2/v3/userinfo` — auth, stateful, clock

</details>

### gsearchconsole-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/webmasters/v3/sites` |
| GET | `/webmasters/v3/sites/{siteUrl}` |
| PUT | `/webmasters/v3/sites/{siteUrl}` |
| DELETE | `/webmasters/v3/sites/{siteUrl}` |
| POST | `/webmasters/v3/sites/{siteUrl}/searchAnalytics/query` |
| GET | `/webmasters/v3/sites/{siteUrl}/sitemaps` |
| GET | `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` |
| PUT | `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` |
| DELETE | `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` |
| POST | `/v1/urlInspection/index:inspect` |
| POST | `/webmasters/v3/sites/{siteUrl}/inspect` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 11 real routes · 10 covered · 90% · 1 not implemented

<details><summary>not implemented (1)</summary>

- `POST` `/v1/urlTestingTools/mobileFriendlyTest:run`

</details>

**Missing** (2)

- 16-month window not modeled; ranges derive at most 90 days / ~1800 cells
- No country dimension in search analytics

**Deviations** (4)

- Regex filters (includingRegex/excludingRegex) degrade to equals/notEquals
- Site verification completes ~2s after sites.add via derive-on-read clock
- Inspection verdicts keyed to magic path tokens (noindex, soft404, servererror)
- URL-prefix sites/sitemaps addressed by single-segment paths (decoded routing)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/webmasters/v3/sites` — query, auth, stateful, paginate, clock
- `GET` `/webmasters/v3/sites/{siteUrl}` — params, auth, stateful, clock
- `PUT` `/webmasters/v3/sites/{siteUrl}` — params, auth, stateful, clock
- `DELETE` `/webmasters/v3/sites/{siteUrl}` — params, auth, stateful, clock
- `POST` `/webmasters/v3/sites/{siteUrl}/searchAnalytics/query` — body, params, auth, stateful, filter, clock
- `GET` `/webmasters/v3/sites/{siteUrl}/sitemaps` — query, params, auth, stateful, paginate, clock
- `GET` `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` — params, auth, stateful, clock
- `PUT` `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` — params, auth, stateful, clock
- `DELETE` `/webmasters/v3/sites/{siteUrl}/sitemaps/{feedpath}` — params, auth, stateful, clock
- `POST` `/v1/urlInspection/index:inspect` — body, auth, stateful, clock
- `POST` `/webmasters/v3/sites/{siteUrl}/inspect` — body, params, auth, stateful, clock

</details>

### gsheets-style

**Covered** — 10 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v4/spreadsheets` |
| GET | `/v4/spreadsheets/{spreadsheetId}/values:batchGet` |
| POST | `/v4/spreadsheets/{spreadsheetId}/values:batchGet` |
| POST | `/v4/spreadsheets/{spreadsheetId}/values:batchUpdate` |
| POST | `/v4/spreadsheets/{spreadsheetId}/sheets` |
| POST | `/v4/spreadsheets/{ss_id_or_verb}` |
| GET | `/v4/spreadsheets/{spreadsheetId}` |
| GET | `/v4/spreadsheets/{spreadsheetId}/values/{range}` |
| PUT | `/v4/spreadsheets/{spreadsheetId}/values/{range}` |
| POST | `/v4/spreadsheets/{spreadsheetId}/values/{range_verb}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 17 real routes · 10 covered · 58% · 7 not implemented

<details><summary>not implemented (7)</summary>

- `GET` `/v4/spreadsheets/{spreadsheetId}/developerMetadata/{metadataId}`
- `POST` `/v4/spreadsheets/{spreadsheetId}/developerMetadata:search`
- `POST` `/v4/spreadsheets/{spreadsheetId}/sheets/{sheetId}:copyTo`
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchClear`
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchClearByDataFilter`
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchGetByDataFilter`
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchUpdateByDataFilter`

</details>

**Missing** (4)

- No row-only A1 ranges (1:5) or quoted sheet titles
- No copyTo, named ranges, developer metadata, or byDataFilter endpoints
- batchUpdate limited to 4 request types; no insertDimension, mergeCells, sortRange
- No valueRenderOption or dateTimeRenderOption on values reads

**Deviations** (3)

- Repeated ranges query params collapse to the first value (engine query params are single-valued)
- Cell values always come back as strings; numeric cells stringify as floats (42 -> "42.0"), no USER_ENTERED/RAW typing
- Spreadsheet get ignores fields= and returns the full object

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v4/spreadsheets` — body, auth, stateful
- `GET` `/v4/spreadsheets/{spreadsheetId}/values:batchGet` — body, query, params, auth, stateful
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchGet` — body, query, params, auth, stateful
- `POST` `/v4/spreadsheets/{spreadsheetId}/values:batchUpdate` — body, params, auth, stateful
- `POST` `/v4/spreadsheets/{spreadsheetId}/sheets` — body, params, auth, stateful
- `POST` `/v4/spreadsheets/{ss_id_or_verb}` — body, params, auth, stateful
- `GET` `/v4/spreadsheets/{spreadsheetId}` — query, params, auth, stateful
- `GET` `/v4/spreadsheets/{spreadsheetId}/values/{range}` — query, params, auth, stateful
- `PUT` `/v4/spreadsheets/{spreadsheetId}/values/{range}` — body, params, auth, stateful
- `POST` `/v4/spreadsheets/{spreadsheetId}/values/{range_verb}` — body, params, auth, stateful

</details>

### gtasks-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/tasks/v1/users/@me/lists` |
| POST | `/tasks/v1/users/@me/lists` |
| GET | `/tasks/v1/lists` |
| POST | `/tasks/v1/lists` |
| POST | `/tasks/v1/lists/{tasklistId}/tasks/{taskId}/move` |
| GET | `/tasks/v1/lists/{tasklistId}/tasks` |
| POST | `/tasks/v1/lists/{tasklistId}/tasks` |
| GET | `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` |
| PUT | `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` |
| PATCH | `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` |
| DELETE | `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 14 real routes · 9 covered · 64% · 5 not implemented

<details><summary>not implemented (5)</summary>

- `POST` `/tasks/v1/lists/{tasklist}/clear`
- `DELETE` `/tasks/v1/users/@me/lists/{tasklist}`
- `GET` `/tasks/v1/users/@me/lists/{tasklist}`
- `PATCH` `/tasks/v1/users/@me/lists/{tasklist}`
- `PUT` `/tasks/v1/users/@me/lists/{tasklist}`

</details>

**Missing** (3)

- No task-list get, patch, or delete endpoints
- No tasks.clear endpoint
- showDeleted/showHidden/showAssigned list params unmodeled

**Deviations** (2)

- Responses omit the kind field (tasks#task, tasks#taskList); SDKs decode fine without it
- tasks.insert ignores a client-sent status/completed (always needsAction); due is stored verbatim

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/tasks/v1/users/@me/lists` — query, auth, stateful, paginate, clock
- `POST` `/tasks/v1/users/@me/lists` — body, auth, stateful, clock
- `GET` `/tasks/v1/lists` — query, auth, stateful, paginate, clock
- `POST` `/tasks/v1/lists` — body, auth, stateful, clock
- `POST` `/tasks/v1/lists/{tasklistId}/tasks/{taskId}/move` — body, query, params, auth, stateful, clock
- `GET` `/tasks/v1/lists/{tasklistId}/tasks` — query, params, auth, stateful, paginate, filter, clock
- `POST` `/tasks/v1/lists/{tasklistId}/tasks` — body, params, auth, stateful, clock
- `GET` `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` — params, auth, stateful, clock
- `PUT` `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` — body, params, auth, stateful, clock
- `PATCH` `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` — body, params, auth, stateful, clock
- `DELETE` `/tasks/v1/lists/{tasklistId}/tasks/{taskId}` — params, auth, stateful

</details>

### helius-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/` |
| POST | `/v0/transactions` |
| GET | `/v0/addresses/{address}/transactions` |
| GET | `/v0/addresses/{address}/balances` |
| GET | `/v0/addresses/{address}/nfts` |
| POST | `/v0/names` |
| POST | `/v0/webhooks` |
| GET | `/v0/webhooks` |
| GET | `/v0/webhooks/{webhookId}` |
| PUT | `/v0/webhooks/{webhookId}` |
| DELETE | `/v0/webhooks/{webhookId}` |

</details>

**Missing** (3)

- RPC covers 6 methods; no getAccountInfo, getSlot, getSignaturesForAddress
- No DAS API (getAsset, searchAssets) or /v0/tokens metadata endpoints
- No getPriorityFeeEstimate, requestAirdrop, or WebSocket subscriptions

**Deviations** (6)

- Webhook payloads carry one transaction each; real Helius batches an array
- Confirmation milestones fixed by clock: processed 1-2s, confirmed 2-3s, final 3s+
- sendTransaction config takes simulate_fail/simulate_type/simulate_address
- Enhanced transactions limit capped at 100 (real API max 1000)
- A crossed before/until cursor pair silently ignores the until signature
- The confirmation webhook fires only when a read lands inside the 2-3s confirmed window

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/` — body, query, auth, stateful, webhooks, clock
- `POST` `/v0/transactions` — body, query, auth, errors, clock
- `GET` `/v0/addresses/{address}/transactions` — query, params, auth, stateful, filter, webhooks, clock
- `GET` `/v0/addresses/{address}/balances` — query, params, auth
- `GET` `/v0/addresses/{address}/nfts` — query, params, auth
- `POST` `/v0/names` — body, query, auth
- `POST` `/v0/webhooks` — body, query, auth, stateful, clock
- `GET` `/v0/webhooks` — query, auth, stateful
- `GET` `/v0/webhooks/{webhookId}` — query, params, auth, stateful, errors
- `PUT` `/v0/webhooks/{webhookId}` — body, query, params, auth, stateful, errors
- `DELETE` `/v0/webhooks/{webhookId}` — query, params, auth, stateful, errors

</details>

### hn-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v0/topstories.json` |
| GET | `/v0/newstories.json` |
| GET | `/v0/beststories.json` |
| GET | `/v0/askstories.json` |
| GET | `/v0/showstories.json` |
| GET | `/v0/jobstories.json` |
| POST | `/login` |
| GET | `/logout` |
| POST | `/submit` |
| GET | `/v0/item/{id}` |
| GET | `/v0/user/{id}` |

</details>

**Missing** (3)

- No GET /v0/maxitem.json or GET /v0/updates.json endpoints
- No poll or pollopt item types; no deleted or dead item flags
- No realtime updates (Firebase SSE watch) on item or list reads

**Deviations** (4)

- Write flow /login + /submit from a reference client; official Firebase API is read-only
- Challenge injection after N submits (anti-abuse) mirrors mock_hn, configurable via KV
- Firebase REST query params (print=pretty, orderBy, limitToFirst) are accepted and ignored
- The .json suffix is optional on item reads; real Firebase requires it

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v0/topstories.json` — stateful
- `GET` `/v0/newstories.json` — stateful
- `GET` `/v0/beststories.json` — stateful
- `GET` `/v0/askstories.json` — stateful
- `GET` `/v0/showstories.json` — stateful
- `GET` `/v0/jobstories.json` — stateful
- `POST` `/login` — body, stateful, errors
- `GET` `/logout` — —
- `POST` `/submit` — body, auth, stateful
- `GET` `/v0/item/{id}` — params, stateful
- `GET` `/v0/user/{id}` — params, stateful

</details>

### hubspot-style

**Covered** — 33 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/crm/v3/objects/contacts` |
| POST | `/crm/v3/objects/contacts` |
| GET | `/crm/v3/objects/contacts/{id}` |
| PATCH | `/crm/v3/objects/contacts/{id}` |
| DELETE | `/crm/v3/objects/contacts/{id}` |
| POST | `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/batch/create` |
| POST | `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/batch/archive` |
| PUT | `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/{toObjectId}/{associationType}` |
| GET | `/crm/v3/objects/contacts/{id}/associations/{toObjectType}` |
| GET | `/crm/v3/objects/companies` |
| POST | `/crm/v3/objects/companies` |
| GET | `/crm/v3/objects/companies/{id}` |
| PATCH | `/crm/v3/objects/companies/{id}` |
| DELETE | `/crm/v3/objects/companies/{id}` |
| GET | `/crm/v3/objects/deals` |
| POST | `/crm/v3/objects/deals` |
| GET | `/crm/v3/objects/deals/{id}` |
| PATCH | `/crm/v3/objects/deals/{id}` |
| DELETE | `/crm/v3/objects/deals/{id}` |
| GET | `/crm/v3/objects/tickets` |
| POST | `/crm/v3/objects/tickets` |
| GET | `/crm/v3/objects/tickets/{id}` |
| PATCH | `/crm/v3/objects/tickets/{id}` |
| DELETE | `/crm/v3/objects/tickets/{id}` |
| POST | `/crm/v3/objects/{objectType}/search` |
| POST | `/crm/v3/objects/{objectType}/batch/create` |
| POST | `/crm/v3/objects/{objectType}/batch/read` |
| POST | `/crm/v3/objects/{objectType}/batch/update` |
| POST | `/crm/v3/objects/{objectType}/batch/archive` |
| POST | `/crm/v3/objects/{objectType}/{id}/restore` |
| POST | `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/batch/create` |
| POST | `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/batch/archive` |
| DELETE | `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/{toObjectId}/{associationType}` |

</details>

**Provider surface** — derived from sdk hubspot-node @ 14.0.1 (floor): 564 real routes · 25 covered · 4% · 526 not implemented

<details><summary>not implemented (526)</summary>

- `POST` `/automation/v4/actions/callbacks/complete`
- `POST` `/automation/v4/actions/callbacks/{callbackId}/complete`
- `GET` `/automation/v4/actions/{appId}`
- `POST` `/automation/v4/actions/{appId}`
- `GET` `/business-units/v3/business-units/user/{userId}`
- `GET` `/cms/audit-logs/v3`
- `GET` `/cms/pages/v3/landing-pages/cursor`
- `GET` `/cms/pages/v3/landing-pages/cursor/query`
- `GET` `/cms/pages/v3/landing-pages/folders/cursor`
- `GET` `/cms/pages/v3/landing-pages/folders/cursor/query`
- `GET` `/cms/pages/v3/site-pages/cursor`
- `GET` `/cms/pages/v3/site-pages/cursor/query`
- `GET` `/cms/site-search/v3/search`
- `GET` `/cms/url-redirects/v3`
- `POST` `/cms/url-redirects/v3`
- `GET` `/cms/v3/audit-logs/`
- `GET` `/cms/v3/blogs/authors`
- `POST` `/cms/v3/blogs/authors`
- `POST` `/cms/v3/blogs/authors/batch/archive`
- `POST` `/cms/v3/blogs/authors/batch/create`
- `POST` `/cms/v3/blogs/authors/batch/read`
- `POST` `/cms/v3/blogs/authors/batch/update`
- `POST` `/cms/v3/blogs/authors/multi-language/attach-to-lang-group`
- `POST` `/cms/v3/blogs/authors/multi-language/create-language-variation`
- `POST` `/cms/v3/blogs/authors/multi-language/detach-from-lang-group`
- `PUT` `/cms/v3/blogs/authors/multi-language/set-new-lang-primary`
- `POST` `/cms/v3/blogs/authors/multi-language/update-languages`
- `DELETE` `/cms/v3/blogs/authors/{objectId}`
- `GET` `/cms/v3/blogs/authors/{objectId}`
- `PATCH` `/cms/v3/blogs/authors/{objectId}`
- `GET` `/cms/v3/blogs/posts`
- `POST` `/cms/v3/blogs/posts`
- `POST` `/cms/v3/blogs/posts/batch/archive`
- `POST` `/cms/v3/blogs/posts/batch/create`
- `POST` `/cms/v3/blogs/posts/batch/read`
- `POST` `/cms/v3/blogs/posts/batch/update`
- `POST` `/cms/v3/blogs/posts/clone`
- `POST` `/cms/v3/blogs/posts/multi-language/attach-to-lang-group`
- `POST` `/cms/v3/blogs/posts/multi-language/create-language-variation`
- `POST` `/cms/v3/blogs/posts/multi-language/detach-from-lang-group`
- `PUT` `/cms/v3/blogs/posts/multi-language/set-new-lang-primary`
- `POST` `/cms/v3/blogs/posts/multi-language/update-languages`
- `POST` `/cms/v3/blogs/posts/schedule`
- `DELETE` `/cms/v3/blogs/posts/{objectId}`
- `GET` `/cms/v3/blogs/posts/{objectId}`
- `PATCH` `/cms/v3/blogs/posts/{objectId}`
- `GET` `/cms/v3/blogs/posts/{objectId}/draft`
- `PATCH` `/cms/v3/blogs/posts/{objectId}/draft`
- `POST` `/cms/v3/blogs/posts/{objectId}/draft/push-live`
- `POST` `/cms/v3/blogs/posts/{objectId}/draft/reset`
… and 476 more


</details>

**Missing** (4)

- No webhook subscriptions or signed deliveries (X-HubSpot-Signature-v3 documented only)
- No owners, line_items, products, quotes, or custom object types
- No engagements (calls, emails, meetings, notes, tasks) endpoints
- No properties, pipelines, or import/export endpoints

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/crm/v3/objects/contacts` — query, auth, stateful, filter, clock
- `POST` `/crm/v3/objects/contacts` — query, auth, stateful, clock
- `GET` `/crm/v3/objects/contacts/{id}` — query, params, auth, stateful, clock
- `PATCH` `/crm/v3/objects/contacts/{id}` — query, params, auth, stateful, clock
- `DELETE` `/crm/v3/objects/contacts/{id}` — query, params, auth, stateful, clock
- `POST` `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/batch/create` — query, params, auth, stateful, clock
- `POST` `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/batch/archive` — query, params, auth, stateful, clock
- `PUT` `/crm/v3/objects/contacts/{id}/associations/{toObjectType}/{toObjectId}/{associationType}` — query, params, auth, stateful, clock
- `GET` `/crm/v3/objects/contacts/{id}/associations/{toObjectType}` — query, params, auth, stateful, clock
- `GET` `/crm/v3/objects/companies` — query, auth, stateful, filter, clock
- `POST` `/crm/v3/objects/companies` — query, auth, stateful, clock
- `GET` `/crm/v3/objects/companies/{id}` — query, params, auth, stateful, clock
- `PATCH` `/crm/v3/objects/companies/{id}` — query, params, auth, stateful, clock
- `DELETE` `/crm/v3/objects/companies/{id}` — query, params, auth, stateful, clock
- `GET` `/crm/v3/objects/deals` — query, auth, stateful, filter, clock
- `POST` `/crm/v3/objects/deals` — query, auth, stateful, clock
- `GET` `/crm/v3/objects/deals/{id}` — query, params, auth, stateful, clock
- `PATCH` `/crm/v3/objects/deals/{id}` — query, params, auth, stateful, clock
- `DELETE` `/crm/v3/objects/deals/{id}` — query, params, auth, stateful, clock
- `GET` `/crm/v3/objects/tickets` — query, auth, stateful, filter, clock
- `POST` `/crm/v3/objects/tickets` — query, auth, stateful, clock
- `GET` `/crm/v3/objects/tickets/{id}` — query, params, auth, stateful, clock
- `PATCH` `/crm/v3/objects/tickets/{id}` — query, params, auth, stateful, clock
- `DELETE` `/crm/v3/objects/tickets/{id}` — query, params, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/search` — query, auth, stateful, filter, clock
- `POST` `/crm/v3/objects/{objectType}/batch/create` — query, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/batch/read` — query, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/batch/update` — query, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/batch/archive` — query, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/{id}/restore` — query, params, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/batch/create` — query, params, auth, stateful, clock
- `POST` `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/batch/archive` — query, params, auth, stateful, clock
- `DELETE` `/crm/v3/objects/{objectType}/{id}/associations/{toObjectType}/{toObjectId}/{associationType}` — query, params, auth, stateful, clock

</details>

### instagram-style

**Covered** — 10 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth/authorize` |
| POST | `/oauth/access_token` |
| GET | `/v21.0/me` |
| GET | `/v21.0/refresh_access_token` |
| GET | `/v21.0/{container_id}` |
| GET | `/v21.0/{media_id}/comments` |
| GET | `/v21.0/{media_id}/insights` |
| POST | `/v21.0/{ig_user_id}/media_publish` |
| POST | `/v21.0/{ig_user_id}/media` |
| GET | `/v21.0/{ig_user_id}/media` |

</details>

**Missing** (4)

- No account-level insights (GET /{ig_user_id}/insights), per-media only
- No stories publishing (media_type=STORIES) or story insights
- No hashtag search (ig_hashtag_search, top_media, recent_media)
- No comment replies, delete, hide, or moderation endpoints

**Deviations** (5)

- Container processing fixed at ~3s IN_PROGRESS before FINISHED or ERROR
- simulate_fail=true create flag forces container ERROR; real API has no such switch
- Cursors are forward-only plain offsets; no before cursor or paging.previous
- An unknown insights metric returns 200 with empty data; real Graph answers error code 100
- media_publish does not check container ownership across users

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth/authorize` — query, stateful, errors
- `POST` `/oauth/access_token` — body, stateful, errors, clock
- `GET` `/v21.0/me` — auth, stateful, clock
- `GET` `/v21.0/refresh_access_token` — query, stateful, errors, clock
- `GET` `/v21.0/{container_id}` — query, params, auth, stateful, errors, clock
- `GET` `/v21.0/{media_id}/comments` — query, params, auth, stateful, errors, clock
- `GET` `/v21.0/{media_id}/insights` — query, params, auth, stateful, filter, errors, clock
- `POST` `/v21.0/{ig_user_id}/media_publish` — query, params, auth, stateful, errors, clock
- `POST` `/v21.0/{ig_user_id}/media` — body, params, auth, stateful, errors, clock
- `GET` `/v21.0/{ig_user_id}/media` — query, params, auth, stateful, paginate, filter, errors, clock

</details>

### jira-style

**Covered** — 32 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/rest/api/3/myself` |
| GET | `/rest/api/3/serverInfo` |
| GET | `/rest/api/3/project` |
| GET | `/rest/api/3/project/search` |
| GET | `/rest/api/3/project/{key}` |
| POST | `/rest/api/3/search/jql` |
| GET | `/rest/api/3/search` |
| POST | `/rest/api/3/issue` |
| GET | `/rest/api/3/issue/{key}` |
| PUT | `/rest/api/3/issue/{key}` |
| DELETE | `/rest/api/3/issue/{key}` |
| GET | `/rest/api/3/issue/{key}/transitions` |
| POST | `/rest/api/3/issue/{key}/transitions` |
| POST | `/rest/api/2/issue` |
| GET | `/rest/api/2/issue/{key}` |
| PUT | `/rest/api/2/issue/{key}` |
| DELETE | `/rest/api/2/issue/{key}` |
| GET | `/rest/api/2/issue/{key}/transitions` |
| POST | `/rest/api/2/issue/{key}/transitions` |
| GET | `/rest/api/2/issue/{key}/comment` |
| GET | `/rest/api/2/issue/{key}/comment/{id}` |
| POST | `/rest/api/2/issue/{key}/comment` |
| PUT | `/rest/api/2/issue/{key}/comment/{id}` |
| DELETE | `/rest/api/2/issue/{key}/comment/{id}` |
| GET | `/rest/api/3/issue/{key}/comment` |
| GET | `/rest/api/3/issue/{key}/comment/{id}` |
| POST | `/rest/api/3/issue/{key}/comment` |
| PUT | `/rest/api/3/issue/{key}/comment/{id}` |
| DELETE | `/rest/api/3/issue/{key}/comment/{id}` |
| POST | `/rest/api/3/webhook` |
| GET | `/rest/api/3/webhook` |
| DELETE | `/rest/api/3/webhook` |

</details>

**Provider surface** — derived from sdk jira-js @ 6.1.0 (floor): 634 real routes · 22 covered · 3% · 611 not implemented

<details><summary>not implemented (611)</summary>

- `POST` `/rest/agile/1.0/backlog/issue`
- `POST` `/rest/agile/1.0/backlog/{boardId}/issue`
- `GET` `/rest/agile/1.0/board`
- `POST` `/rest/agile/1.0/board`
- `GET` `/rest/agile/1.0/board/filter/{filterId}`
- `DELETE` `/rest/agile/1.0/board/{boardId}`
- `GET` `/rest/agile/1.0/board/{boardId}`
- `GET` `/rest/agile/1.0/board/{boardId}/configuration`
- `GET` `/rest/agile/1.0/board/{boardId}/epic`
- `GET` `/rest/agile/1.0/board/{boardId}/features`
- `PUT` `/rest/agile/1.0/board/{boardId}/features`
- `POST` `/rest/agile/1.0/board/{boardId}/issue`
- `GET` `/rest/agile/1.0/board/{boardId}/project`
- `GET` `/rest/agile/1.0/board/{boardId}/project/full`
- `GET` `/rest/agile/1.0/board/{boardId}/properties`
- `DELETE` `/rest/agile/1.0/board/{boardId}/properties/{propertyKey}`
- `GET` `/rest/agile/1.0/board/{boardId}/properties/{propertyKey}`
- `PUT` `/rest/agile/1.0/board/{boardId}/properties/{propertyKey}`
- `GET` `/rest/agile/1.0/board/{boardId}/quickfilter`
- `GET` `/rest/agile/1.0/board/{boardId}/quickfilter/{quickFilterId}`
- `GET` `/rest/agile/1.0/board/{boardId}/reports`
- `GET` `/rest/agile/1.0/board/{boardId}/sprint`
- `GET` `/rest/agile/1.0/board/{boardId}/version`
- `POST` `/rest/agile/1.0/epic/none/issue`
- `GET` `/rest/agile/1.0/epic/{epicIdOrKey}`
- `POST` `/rest/agile/1.0/epic/{epicIdOrKey}`
- `POST` `/rest/agile/1.0/epic/{epicIdOrKey}/issue`
- `PUT` `/rest/agile/1.0/epic/{epicIdOrKey}/rank`
- `PUT` `/rest/agile/1.0/issue/rank`
- `GET` `/rest/agile/1.0/issue/{issueIdOrKey}`
- `GET` `/rest/agile/1.0/issue/{issueIdOrKey}/estimation`
- `PUT` `/rest/agile/1.0/issue/{issueIdOrKey}/estimation`
- `POST` `/rest/agile/1.0/sprint`
- `DELETE` `/rest/agile/1.0/sprint/{sprintId}`
- `GET` `/rest/agile/1.0/sprint/{sprintId}`
- `POST` `/rest/agile/1.0/sprint/{sprintId}`
- `PUT` `/rest/agile/1.0/sprint/{sprintId}`
- `POST` `/rest/agile/1.0/sprint/{sprintId}/issue`
- `GET` `/rest/agile/1.0/sprint/{sprintId}/properties`
- `DELETE` `/rest/agile/1.0/sprint/{sprintId}/properties/{propertyKey}`
- `GET` `/rest/agile/1.0/sprint/{sprintId}/properties/{propertyKey}`
- `PUT` `/rest/agile/1.0/sprint/{sprintId}/properties/{propertyKey}`
- `POST` `/rest/agile/1.0/sprint/{sprintId}/swap`
- `POST` `/rest/api/2/issue/{issueIdOrKey}/worklog`
- `PUT` `/rest/api/2/issue/{issueIdOrKey}/worklog/{id}`
- `GET` `/rest/api/3/announcementBanner`
- `PUT` `/rest/api/3/announcementBanner`
- `POST` `/rest/api/3/app/field/value`
- `GET` `/rest/api/3/app/field/{fieldIdOrKey}/context/configuration`
- `PUT` `/rest/api/3/app/field/{fieldIdOrKey}/context/configuration`
… and 561 more


</details>

**Missing** (5)

- No attachments, worklogs, watchers, or issue link endpoints
- No project create/update, versions, or components endpoints
- No agile boards, sprints, or backlog endpoints
- No users search, avatars, or notification endpoints
- No workflow or field configuration management endpoints

**Deviations** (6)

- Comment bodies are plain strings, not Atlassian Document Format objects
- Enhanced-search nextPageToken is a plain decimal offset, not an opaque token
- JQL subset: parenthesised grouping unsupported; unknown fields 400
- JQL dates compare as ISO-8601 strings, not parsed datetimes
- Single fixed simplified workflow for all projects; real workflows are configurable
- GET /rest/api/3/webhook (list registrations) marked simulator-only

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/rest/api/3/myself` — auth
- `GET` `/rest/api/3/serverInfo` — auth
- `GET` `/rest/api/3/project` — auth, stateful
- `GET` `/rest/api/3/project/search` — auth, stateful
- `GET` `/rest/api/3/project/{key}` — params, auth, stateful, errors
- `POST` `/rest/api/3/search/jql` — body, auth, stateful, filter, errors
- `GET` `/rest/api/3/search` — query, auth, stateful, filter, errors
- `POST` `/rest/api/3/issue` — body, auth, stateful, webhooks, errors, clock
- `GET` `/rest/api/3/issue/{key}` — params, auth, stateful, errors
- `PUT` `/rest/api/3/issue/{key}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/rest/api/3/issue/{key}` — params, auth, stateful, errors
- `GET` `/rest/api/3/issue/{key}/transitions` — params, auth, stateful, errors
- `POST` `/rest/api/3/issue/{key}/transitions` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/rest/api/2/issue` — body, auth, stateful, webhooks, errors, clock
- `GET` `/rest/api/2/issue/{key}` — params, auth, stateful, errors
- `PUT` `/rest/api/2/issue/{key}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/rest/api/2/issue/{key}` — params, auth, stateful, errors
- `GET` `/rest/api/2/issue/{key}/transitions` — params, auth, stateful, errors
- `POST` `/rest/api/2/issue/{key}/transitions` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/rest/api/2/issue/{key}/comment` — query, params, auth, stateful, errors
- `GET` `/rest/api/2/issue/{key}/comment/{id}` — params, auth, stateful, errors
- `POST` `/rest/api/2/issue/{key}/comment` — body, params, auth, stateful, webhooks, errors, clock
- `PUT` `/rest/api/2/issue/{key}/comment/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/rest/api/2/issue/{key}/comment/{id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/rest/api/3/issue/{key}/comment` — query, params, auth, stateful, errors
- `GET` `/rest/api/3/issue/{key}/comment/{id}` — params, auth, stateful, errors
- `POST` `/rest/api/3/issue/{key}/comment` — body, params, auth, stateful, webhooks, errors, clock
- `PUT` `/rest/api/3/issue/{key}/comment/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/rest/api/3/issue/{key}/comment/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/rest/api/3/webhook` — body, auth, stateful
- `GET` `/rest/api/3/webhook` — query, auth, stateful
- `DELETE` `/rest/api/3/webhook` — body, auth, stateful

</details>

### jumio-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/netverify/v2/scans` |
| GET | `/netverify/v2/scans/{scan_reference}` |
| DELETE | `/netverify/v2/scans/{scan_reference}` |
| GET | `/netverify/v2/scans/{scan_reference}/data` |
| POST | `/netverify/v2/webhooks` |

</details>

**Missing** (3)

- No document or selfie image upload/retrieval endpoints
- No hosted redirect verification flow; API scan creation only
- No Document Verification, Data Verification, or Transaction Screening APIs

**Deviations** (6)

- Scan lifecycle on a fixed clock: PENDING ~3s then DONE or FAILED at +3s
- simulate_fail and simulate_reject_reason create fields are stunt-only hooks
- Webhook HMAC secret is the public constant stunt_jumio_mock_signing_key
- POST /netverify/v2/webhooks is a local stand-in receiver, not a Jumio endpoint
- Bearer-presence gate; real Jumio uses HTTP Basic against a server-token store
- Scan references are decimal groups, not UUIDs; extracted PII is fixed synthetic

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/netverify/v2/scans` — body, auth, stateful, errors, clock
- `GET` `/netverify/v2/scans/{scan_reference}` — params, auth, stateful, webhooks, errors, clock
- `DELETE` `/netverify/v2/scans/{scan_reference}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/netverify/v2/scans/{scan_reference}/data` — params, auth, stateful, webhooks, errors, clock
- `POST` `/netverify/v2/webhooks` — auth, stateful, clock

</details>

### linkedin-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth/v2/authorization` |
| POST | `/oauth/v2/accessToken` |
| GET | `/v2/userinfo` |
| POST | `/v2/ugcPosts` |
| GET | `/rest/comments` |
| POST | `/rest/comments` |
| GET | `/rest/posts/{urn}` |
| GET | `/rest/memberCreatorPostAnalytics` |

</details>

**Missing** (4)

- No ugcPosts delete or edit (DELETE /v2/ugcPosts/{id})
- No organizations or company page API (GET /v2/organizations)
- No reactions or likes endpoints (socialActions likes)
- No video upload flow or multi-image carousel posts

**Deviations** (3)

- Rate-limit injection on POST /v2/ugcPosts publish is a simulator test hook
- An unknown analytics queryType silently falls back to the base total; real LinkedIn 400s
- Refresh tokens never expire; only access tokens carry the 60-day expiry

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth/v2/authorization` — query, stateful, errors
- `POST` `/oauth/v2/accessToken` — body, stateful, errors, clock
- `GET` `/v2/userinfo` — auth, stateful, clock
- `POST` `/v2/ugcPosts` — body, auth, stateful, errors, clock
- `GET` `/rest/comments` — query, auth, stateful, paginate, errors, clock
- `POST` `/rest/comments` — body, auth, stateful, errors, clock
- `GET` `/rest/posts/{urn}` — params, auth, stateful, errors, clock
- `GET` `/rest/memberCreatorPostAnalytics` — query, auth, stateful, errors, clock

</details>

### llm-style

**Covered** — 3 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/chat/completions` |
| GET | `/v1/models` |
| POST | `/v1/messages` |

</details>

**Provider surface** — derived from sdk openai-node @ 7.5.0 (floor): 246 real routes · 2 covered · 0% · 238 not implemented

<details><summary>not implemented (238)</summary>

- `GET` `/v1/assistants`
- `POST` `/v1/assistants`
- `DELETE` `/v1/assistants/{assistantID}`
- `GET` `/v1/assistants/{assistantID}`
- `POST` `/v1/assistants/{assistantID}`
- `POST` `/v1/audio/speech`
- `POST` `/v1/audio/transcriptions`
- `POST` `/v1/audio/translations`
- `GET` `/v1/batches`
- `POST` `/v1/batches`
- `GET` `/v1/batches/{batchID}`
- `POST` `/v1/batches/{batchID}/cancel`
- `GET` `/v1/chat/completions`
- `DELETE` `/v1/chat/completions/{completionID}`
- `GET` `/v1/chat/completions/{completionID}`
- `POST` `/v1/chat/completions/{completionID}`
- `POST` `/v1/chatkit/sessions`
- `POST` `/v1/chatkit/sessions/{sessionID}/cancel`
- `GET` `/v1/chatkit/threads`
- `DELETE` `/v1/chatkit/threads/{threadID}`
- `GET` `/v1/chatkit/threads/{threadID}`
- `POST` `/v1/completions`
- `GET` `/v1/containers`
- `POST` `/v1/containers`
- `DELETE` `/v1/containers/{containerID}`
- `GET` `/v1/containers/{containerID}`
- `POST` `/v1/containers/{containerID}/files`
- `DELETE` `/v1/containers/{container_id}/files/{fileID}`
- `GET` `/v1/containers/{container_id}/files/{fileID}`
- `GET` `/v1/containers/{container_id}/files/{fileID}/content`
- `POST` `/v1/content_provenance_checks`
- `POST` `/v1/conversations`
- `DELETE` `/v1/conversations/{conversationID}`
- `GET` `/v1/conversations/{conversationID}`
- `POST` `/v1/conversations/{conversationID}`
- `POST` `/v1/conversations/{conversationID}/items`
- `DELETE` `/v1/conversations/{conversation_id}/items/{itemID}`
- `GET` `/v1/conversations/{conversation_id}/items/{itemID}`
- `POST` `/v1/embeddings`
- `GET` `/v1/evals`
- `POST` `/v1/evals`
- `DELETE` `/v1/evals/{evalID}`
- `GET` `/v1/evals/{evalID}`
- `POST` `/v1/evals/{evalID}`
- `POST` `/v1/evals/{evalID}/runs`
- `DELETE` `/v1/evals/{eval_id}/runs/{runID}`
- `GET` `/v1/evals/{eval_id}/runs/{runID}`
- `POST` `/v1/evals/{eval_id}/runs/{runID}`
- `GET` `/v1/evals/{eval_id}/runs/{run_id}/output_items/{outputItemID}`
- `GET` `/v1/files`
… and 188 more


</details>

**Missing** (4)

- No embeddings (POST /v1/embeddings) or legacy completions endpoints
- No Anthropic SSE streaming (stream:true only handled for OpenAI)
- No tool use, function calling, or JSON mode
- No image or multimodal content blocks

**Deviations** (3)

- Responses deterministic: echo of the last user message; no model or randomness
- Reply derived solely from the last user message; earlier history ignored
- stream:true (OpenAI) returns one SSE chunk plus [DONE], not token-by-token

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/chat/completions` — body, auth, stateful, clock
- `GET` `/v1/models` — query, auth, stateful, paginate, errors, clock
- `POST` `/v1/messages` — body, auth, stateful, clock

</details>

### marketo-style

**Covered** — 21 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/identity/oauth/token` |
| POST | `/rest/v1/leads.json` |
| GET | `/rest/v1/leads` |
| POST | `/rest/v1/leads` |
| GET | `/rest/v1/leads/describe` |
| GET | `/rest/v1/leads/{id}` |
| GET | `/rest/v1/leads/{id}.json` |
| POST | `/rest/v1/campaigns/{id}/trigger` |
| GET | `/rest/v1/campaigns` |
| GET | `/rest/v1/programs` |
| GET | `/rest/v1/folders` |
| GET | `/rest/v1/activities/pagingtoken` |
| GET | `/rest/v1/activities` |
| POST | `/bulk/v1/leads/export/create` |
| POST | `/bulk/v1/leads/export/create.json` |
| GET | `/bulk/v1/leads/export/{exportId}/status` |
| GET | `/bulk/v1/leads/export/{exportId}/status.json` |
| GET | `/bulk/v1/leads/export/{exportId}/file` |
| GET | `/bulk/v1/leads/export/{exportId}/file.json` |
| POST | `/bulk/v1/leads/export/{exportId}/cancel` |
| POST | `/bulk/v1/leads/export/{exportId}/cancel.json` |

</details>

**Missing** (5)

- No bulk lead import (enqueue, batch status, failures, warnings)
- No bulk activity extract (POST /bulk/v1/activities/export/*)
- No custom objects API (/rest/v1/customobjects)
- No asset APIs (emails, forms, landing pages, files) under /rest/asset/v1
- No lead delete (POST /rest/v1/leads/delete.json) or campaign schedule

**Deviations** (3)

- Export job timing fixed: Processing after ~1s, Completed after ~3s
- Signed completion webhook (X-Stunt-Signature, fixed secret) is a simulator extension
- Daily quota 602 modeled but threshold set to 100k so tests are unaffected

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/identity/oauth/token` — query, stateful, errors, clock
- `POST` `/rest/v1/leads.json` — body, query, auth, stateful, clock
- `GET` `/rest/v1/leads` — query, auth, stateful, paginate, filter, clock
- `POST` `/rest/v1/leads` — body, query, auth, stateful, clock
- `GET` `/rest/v1/leads/describe` — query, auth, stateful, clock
- `GET` `/rest/v1/leads/{id}` — query, params, auth, stateful, errors, clock
- `GET` `/rest/v1/leads/{id}.json` — query, params, auth, stateful, errors, clock
- `POST` `/rest/v1/campaigns/{id}/trigger` — body, query, params, auth, stateful, errors, clock
- `GET` `/rest/v1/campaigns` — query, auth, stateful, paginate, clock
- `GET` `/rest/v1/programs` — query, auth, stateful, paginate, clock
- `GET` `/rest/v1/folders` — query, auth, stateful, paginate, clock
- `GET` `/rest/v1/activities/pagingtoken` — query, auth, stateful, clock
- `GET` `/rest/v1/activities` — query, auth, stateful, paginate, clock
- `POST` `/bulk/v1/leads/export/create` — body, query, auth, stateful, clock
- `POST` `/bulk/v1/leads/export/create.json` — body, query, auth, stateful, clock
- `GET` `/bulk/v1/leads/export/{exportId}/status` — query, params, auth, stateful, webhooks, errors, clock
- `GET` `/bulk/v1/leads/export/{exportId}/status.json` — query, params, auth, stateful, webhooks, errors, clock
- `GET` `/bulk/v1/leads/export/{exportId}/file` — query, params, auth, stateful, webhooks, errors, clock
- `GET` `/bulk/v1/leads/export/{exportId}/file.json` — query, params, auth, stateful, webhooks, errors, clock
- `POST` `/bulk/v1/leads/export/{exportId}/cancel` — query, params, auth, stateful, webhooks, errors, clock
- `POST` `/bulk/v1/leads/export/{exportId}/cancel.json` — query, params, auth, stateful, webhooks, errors, clock

</details>

### microsoft-graph-style

**Covered** — 55 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1.0/me` |
| POST | `/v1.0/subscriptions` |
| GET | `/v1.0/subscriptions` |
| GET | `/v1.0/subscriptions/{id}` |
| DELETE | `/v1.0/subscriptions/{id}` |
| GET | `/v1.0/users` |
| GET | `/v1.0/users/{id}` |
| GET | `/v1.0/me/mailFolders` |
| GET | `/v1.0/me/mailFolders/{id}/messages` |
| GET | `/v1.0/me/messages` |
| POST | `/v1.0/me/messages` |
| POST | `/v1.0/me/messages/{id}/send` |
| GET | `/v1.0/me/messages/{id}` |
| PATCH | `/v1.0/me/messages/{id}` |
| DELETE | `/v1.0/me/messages/{id}` |
| POST | `/v1.0/me/sendMail` |
| GET | `/v1.0/me/calendarView` |
| GET | `/v1.0/me/calendar/calendarView` |
| GET | `/v1.0/me/events` |
| POST | `/v1.0/me/events` |
| POST | `/v1.0/me/events/{id}/accept` |
| POST | `/v1.0/me/events/{id}/decline` |
| POST | `/v1.0/me/events/{id}/tentativelyAccept` |
| GET | `/v1.0/me/events/{id}` |
| DELETE | `/v1.0/me/events/{id}` |
| PATCH | `/v1.0/me/events/{id}` |
| GET | `/v1.0/me/drive` |
| GET | `/v1.0/me/drive/root/children` |
| POST | `/v1.0/me/drive/root/children` |
| GET | `/v1.0/me/drive/items/{id}/children` |
| POST | `/v1.0/me/drive/items/{id}/children` |
| GET | `/v1.0/me/drive/items/{id}/content` |
| POST | `/v1.0/me/drive/items/{id}/restore` |
| GET | `/v1.0/me/drive/items/{id}` |
| DELETE | `/v1.0/me/drive/items/{id}` |
| PUT | `/v1.0/me/drive/root:/{item}/content` |
| PUT | `/v1.0/me/drive/items/{parent}/{item}/content` |
| POST | `/v1.0/me/drive/root:/{item}/createUploadSession` |
| POST | `/v1.0/me/drive/items/{parent}/{item}/createUploadSession` |
| PUT | `/v1.0/_upload/{session}` |
| GET | `/v1.0/me/drive/root:/{item}` |
| GET | `/v1.0/groups/{id}/sites` |
| GET | `/v1.0/me/chats` |
| POST | `/v1.0/me/chats` |
| DELETE | `/v1.0/chats/{id}` |
| GET | `/v1.0/chats/{id}/messages` |
| POST | `/v1.0/chats/{id}/messages` |
| DELETE | `/v1.0/chats/{id}/messages/{messageId}` |
| GET | `/v1.0/me/drive/items/{id}/workbook/worksheets` |
| POST | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/add` |
| GET | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows` |
| POST | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows` |
| PATCH | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/{index}` |
| DELETE | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/{index}` |
| GET | `/v1.0/me/drive/items/{id}/workbook/tables/{name}/range` |

</details>

**Provider surface** — derived from spec msgraph-metadata v1.0 @ v1.0: 17531 real routes · 34 covered · 0% · 17497 not implemented

<details><summary>not implemented (17497)</summary>

- `GET` `/v1.0/admin`
- `PATCH` `/v1.0/admin`
- `DELETE` `/v1.0/admin/configurationManagement`
- `GET` `/v1.0/admin/configurationManagement`
- `PATCH` `/v1.0/admin/configurationManagement`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts`
- `POST` `/v1.0/admin/configurationManagement/configurationDrifts`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationDrifts/{configurationDrift-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults`
- `POST` `/v1.0/admin/configurationManagement/configurationMonitoringResults`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitoringResults/{configurationMonitoringResult-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors`
- `POST` `/v1.0/admin/configurationManagement/configurationMonitors`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}`
- `DELETE` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `GET` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `PATCH` `/v1.0/admin/configurationManagement/configurationMonitors/{configurationMonitor-id}/baseline`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs`
- `POST` `/v1.0/admin/configurationManagement/configurationSnapshotJobs`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationSnapshotJobs/{configurationSnapshotJob-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots`
- `POST` `/v1.0/admin/configurationManagement/configurationSnapshots`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots/$count`
- `DELETE` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `GET` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `PATCH` `/v1.0/admin/configurationManagement/configurationSnapshots/{configurationBaseline-id}`
- `DELETE` `/v1.0/admin/edge`
- `GET` `/v1.0/admin/edge`
- `PATCH` `/v1.0/admin/edge`
- `DELETE` `/v1.0/admin/edge/internetExplorerMode`
- `GET` `/v1.0/admin/edge/internetExplorerMode`
- `PATCH` `/v1.0/admin/edge/internetExplorerMode`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists`
- `POST` `/v1.0/admin/edge/internetExplorerMode/siteLists`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists/$count`
- `DELETE` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
- `GET` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
- `PATCH` `/v1.0/admin/edge/internetExplorerMode/siteLists/{browserSiteList-id}`
… and 17447 more


</details>

**Missing** (8)

- No Excel workbook sessions (createSession, refreshSession, closeSession)
- No mail reply/forward, attachments, or message move/copy endpoints
- No calendar or mail folder create/update/delete, no event instances
- No drive item copy, move, rename, permissions, or sharing invites
- No drive search, delta, recent, or sharedWithMe endpoints
- No teams or channels endpoints (chats and chat messages only)
- No Excel worksheet or table create/update/delete, no workbook calculate
- No todo, planner, contacts, presence, or /search surfaces

**Deviations** (6)

- Webhook validationToken handshake not enforced; subscription accepted immediately
- Upload session ids are deterministic counters, not unguessable tokens
- OData $filter limited to the equality pattern (field eq value)
- Static seeded mock-bearer-token bypasses the entra-id token flow
- @odata.nextLink/@odata.context point at graph.microsoft.com, not the serving host (prod-faithful; a local SDK harness must rebase)
- Resumable upload session URLs are absolute http:// — the JS SDK's OneDriveLargeFileUploadTask urlJoins them into a broken path

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1.0/me` — auth, stateful, clock
- `POST` `/v1.0/subscriptions` — body, auth, stateful, webhooks, clock
- `GET` `/v1.0/subscriptions` — auth, stateful, clock
- `GET` `/v1.0/subscriptions/{id}` — params, auth, stateful, clock
- `DELETE` `/v1.0/subscriptions/{id}` — params, auth, stateful, clock
- `GET` `/v1.0/users` — query, auth, stateful, paginate, clock
- `GET` `/v1.0/users/{id}` — params, auth, stateful, clock
- `GET` `/v1.0/me/mailFolders` — query, auth, stateful, paginate, clock
- `GET` `/v1.0/me/mailFolders/{id}/messages` — query, params, auth, stateful, paginate, clock
- `GET` `/v1.0/me/messages` — query, auth, stateful, paginate, clock
- `POST` `/v1.0/me/messages` — body, auth, stateful, webhooks, clock
- `POST` `/v1.0/me/messages/{id}/send` — params, auth, stateful, webhooks, clock
- `GET` `/v1.0/me/messages/{id}` — params, auth, stateful, clock
- `PATCH` `/v1.0/me/messages/{id}` — body, params, auth, stateful, webhooks, clock
- `DELETE` `/v1.0/me/messages/{id}` — params, auth, stateful, clock
- `POST` `/v1.0/me/sendMail` — body, auth, stateful, webhooks, clock
- `GET` `/v1.0/me/calendarView` — query, auth, stateful, paginate, clock
- `GET` `/v1.0/me/calendar/calendarView` — query, auth, stateful, paginate, clock
- `GET` `/v1.0/me/events` — query, auth, stateful, paginate, clock
- `POST` `/v1.0/me/events` — body, auth, stateful, webhooks, clock
- `POST` `/v1.0/me/events/{id}/accept` — params, auth, stateful, webhooks, clock
- `POST` `/v1.0/me/events/{id}/decline` — params, auth, stateful, webhooks, clock
- `POST` `/v1.0/me/events/{id}/tentativelyAccept` — params, auth, stateful, webhooks, clock
- `GET` `/v1.0/me/events/{id}` — params, auth, stateful, clock
- `DELETE` `/v1.0/me/events/{id}` — params, auth, stateful, webhooks, clock
- `PATCH` `/v1.0/me/events/{id}` — body, params, auth, stateful, webhooks, clock
- `GET` `/v1.0/me/drive` — auth, stateful, clock
- `GET` `/v1.0/me/drive/root/children` — query, auth, stateful, paginate, clock
- `POST` `/v1.0/me/drive/root/children` — body, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}/children` — query, params, auth, stateful, paginate, clock
- `POST` `/v1.0/me/drive/items/{id}/children` — body, params, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}/content` — params, auth, stateful, clock
- `POST` `/v1.0/me/drive/items/{id}/restore` — params, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}` — params, auth, stateful, clock
- `DELETE` `/v1.0/me/drive/items/{id}` — params, auth, stateful, clock
- `PUT` `/v1.0/me/drive/root:/{item}/content` — query, params, auth, stateful, clock
- `PUT` `/v1.0/me/drive/items/{parent}/{item}/content` — query, params, auth, stateful, clock
- `POST` `/v1.0/me/drive/root:/{item}/createUploadSession` — body, params, auth, stateful, clock
- `POST` `/v1.0/me/drive/items/{parent}/{item}/createUploadSession` — body, params, auth, stateful, clock
- `PUT` `/v1.0/_upload/{session}` — params, stateful, clock
- `GET` `/v1.0/me/drive/root:/{item}` — query, params, auth, stateful, clock
- `GET` `/v1.0/groups/{id}/sites` — query, params, auth, stateful, paginate, clock
- `GET` `/v1.0/me/chats` — query, auth, stateful, paginate, clock
- `POST` `/v1.0/me/chats` — body, auth, stateful, clock
- `DELETE` `/v1.0/chats/{id}` — params, auth, stateful, clock
- `GET` `/v1.0/chats/{id}/messages` — query, params, auth, stateful, paginate, clock
- `POST` `/v1.0/chats/{id}/messages` — body, params, auth, stateful, webhooks, clock
- `DELETE` `/v1.0/chats/{id}/messages/{messageId}` — params, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}/workbook/worksheets` — query, params, auth, stateful, paginate, clock
- `POST` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/add` — body, params, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows` — query, params, auth, stateful, paginate, clock
- `POST` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows` — body, params, auth, stateful, clock
- `PATCH` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/{index}` — body, params, auth, stateful, clock
- `DELETE` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/rows/{index}` — params, auth, stateful, clock
- `GET` `/v1.0/me/drive/items/{id}/workbook/tables/{name}/range` — params, auth, stateful, clock

</details>

### netsuite-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/services/rest/query/v1/suiteql` |
| POST | `/services/rest/v1/suiteql` |
| GET | `/services/rest/record/v1/metadata-catalog` |
| GET | `/services/rest/record/v1/{recordType}` |
| POST | `/services/rest/record/v1/{recordType}` |
| GET | `/services/rest/record/v1/{recordType}/{id}` |
| PATCH | `/services/rest/record/v1/{recordType}/{id}` |
| DELETE | `/services/rest/record/v1/{recordType}/{id}` |
| POST | `/services/rest/record/v1/{recordType}/{id}/!transform/{target}` |

</details>

**Missing** (4)

- No creditMemo, purchaseOrder, vendorBill, journalEntry, or cashSale records
- No sublist child resources (e.g. salesOrder/{id}/item/{line})
- No per-record-type metadata catalog (metadata-catalog/{recordType})
- No file cabinet, blob upload, or REST analytics endpoints

**Deviations** (3)

- TBA/NLAuth/Bearer only structurally checked; OAuth 1.0a HMAC not validated
- SuiteQL matches only the FROM table; WHERE and ORDER BY clauses are ignored
- Duplicate-externalId create returns the stored record without updating it

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/services/rest/query/v1/suiteql` — query, auth, stateful, filter
- `POST` `/services/rest/v1/suiteql` — query, auth, stateful, filter
- `GET` `/services/rest/record/v1/metadata-catalog` — auth
- `GET` `/services/rest/record/v1/{recordType}` — query, auth, stateful, filter
- `POST` `/services/rest/record/v1/{recordType}` — auth, stateful
- `GET` `/services/rest/record/v1/{recordType}/{id}` — params, auth, stateful
- `PATCH` `/services/rest/record/v1/{recordType}/{id}` — params, auth, stateful
- `DELETE` `/services/rest/record/v1/{recordType}/{id}` — params, auth, stateful
- `POST` `/services/rest/record/v1/{recordType}/{id}/!transform/{target}` — params, auth, stateful, clock

</details>

### oneinch-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v6.0/1/approve/spender` |
| GET | `/v6.0/1/approve/calldata` |
| GET | `/v6.0/1/tokens` |
| GET | `/v6.0/1/quote` |
| GET | `/v6.0/1/swap` |

</details>

**Missing** (3)

- No Fusion+ order flow (order quotes, submission, status, events)
- No Limit Order Protocol endpoints (create, list, history)
- No raw transaction broadcast, status check, or chains list endpoints

**Deviations** (4)

- Quotes deterministic from src/dst/amount; same input yields same toAmount and split
- Quote field is toAmount; real v6.0 returns dstAmount
- Same-token quotes return amount x pseudo-rate; real API rejects
- slippage is optional and ignored on swap; real v6.0 requires it

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v6.0/1/approve/spender` — —
- `GET` `/v6.0/1/approve/calldata` — query, errors
- `GET` `/v6.0/1/tokens` — —
- `GET` `/v6.0/1/quote` — query, errors
- `GET` `/v6.0/1/swap` — query, errors

</details>

### onfido-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v3.6/applicants` |
| POST | `/v3.6/documents` |
| POST | `/v3.6/live_photos` |
| POST | `/v3.6/checks` |
| GET | `/v3.6/applicants/{applicant_id}` |
| GET | `/v3.6/checks/{check_id}` |
| POST | `/v3.6/webhooks` |

</details>

**Provider surface** — derived from spec onfido-openapi-spec @ v3.6: 84 real routes · 7 covered · 8% · 73 not implemented

<details><summary>not implemented (73)</summary>

- `GET` `/v3.6/addresses/pick`
- `GET` `/v3.6/advanced_electronic_signature/documents`
- `GET` `/v3.6/applicants`
- `DELETE` `/v3.6/applicants/{applicant_id}`
- `PUT` `/v3.6/applicants/{applicant_id}`
- `GET` `/v3.6/applicants/{applicant_id}/consents`
- `POST` `/v3.6/applicants/{applicant_id}/restore`
- `DELETE` `/v3.6/biometric_tokens/{user_id}`
- `GET` `/v3.6/biometric_tokens/{user_id}`
- `PUT` `/v3.6/biometric_tokens/{user_id}/{token_uuid}`
- `GET` `/v3.6/checks`
- `GET` `/v3.6/checks/{check_id}/download`
- `POST` `/v3.6/checks/{check_id}/resume`
- `GET` `/v3.6/documents`
- `GET` `/v3.6/documents/{document_id}`
- `GET` `/v3.6/documents/{document_id}/download`
- `GET` `/v3.6/documents/{document_id}/nfc_face`
- `GET` `/v3.6/documents/{document_id}/video/download`
- `POST` `/v3.6/extractions`
- `GET` `/v3.6/id_photos`
- `POST` `/v3.6/id_photos`
- `GET` `/v3.6/id_photos/{id_photo_id}`
- `GET` `/v3.6/id_photos/{id_photo_id}/download`
- `GET` `/v3.6/live_photos`
- `GET` `/v3.6/live_photos/{live_photo_id}`
- `GET` `/v3.6/live_photos/{live_photo_id}/download`
- `GET` `/v3.6/live_videos`
- `GET` `/v3.6/live_videos/{live_video_id}`
- `GET` `/v3.6/live_videos/{live_video_id}/download`
- `GET` `/v3.6/live_videos/{live_video_id}/frame`
- `GET` `/v3.6/motion_captures`
- `GET` `/v3.6/motion_captures/{motion_capture_id}`
- `GET` `/v3.6/motion_captures/{motion_capture_id}/download`
- `GET` `/v3.6/motion_captures/{motion_capture_id}/frame`
- `DELETE` `/v3.6/passkeys/{username}`
- `GET` `/v3.6/passkeys/{username}`
- `PUT` `/v3.6/passkeys/{username}/{passkey_id}`
- `GET` `/v3.6/ping`
- `GET` `/v3.6/qualified_electronic_signature/documents`
- `GET` `/v3.6/repeat_attempts/{report_id}`
- `GET` `/v3.6/reports`
- `GET` `/v3.6/reports/{report_id}`
- `POST` `/v3.6/reports/{report_id}/cancel`
- `POST` `/v3.6/reports/{report_id}/resume`
- `POST` `/v3.6/results_feedback`
- `POST` `/v3.6/sdk_token`
- `GET` `/v3.6/signing_documents`
- `POST` `/v3.6/signing_documents`
- `GET` `/v3.6/signing_documents/{signing_document_id}`
- `GET` `/v3.6/signing_documents/{signing_document_id}/download`
… and 23 more


</details>

**Missing** (5)

- No SDK token generation (POST /v3.6/sdk_token)
- No applicant list, update, delete, or resume endpoints
- No reports sub-resource (GET /v3.6/reports/{id}); results inline only
- No motion capture or video uploads; no document/live photo list or delete
- No webhook registration or listing (local receiver only)

**Deviations** (6)

- Check lifecycle fixed: in_progress ~3s then complete; awaiting_applicant skipped
- simulate_fail yields result consider; real sandbox uses special sandbox documents
- Webhook HMAC secret is the public constant stunt_onfido_mock_signing_key
- POST /v3.6/webhooks is a local stand-in receiver, not an Onfido endpoint
- Synthetic sequential ids (app-000001...) where real Onfido uses UUIDs
- The awaiting_applicant phase is skipped; documents assumed on file

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v3.6/applicants` — body, auth, stateful, errors, clock
- `POST` `/v3.6/documents` — body, auth, stateful, errors, clock
- `POST` `/v3.6/live_photos` — body, auth, stateful, errors, clock
- `POST` `/v3.6/checks` — body, auth, stateful, errors, clock
- `GET` `/v3.6/applicants/{applicant_id}` — params, auth, stateful, errors
- `GET` `/v3.6/checks/{check_id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v3.6/webhooks` — auth, stateful, clock

</details>

### opensea-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/api/v2/assets` |
| GET | `/api/v2/assets/{chain}/{address}/{identifier}` |
| GET | `/api/v2/collections/{slug}` |
| GET | `/api/v2/events` |
| GET | `/api/v2/orders/{chain}/{protocol}/listings` |
| GET | `/api/v2/orders/{chain}/{protocol}/offers` |
| POST | `/api/v2/offers` |

</details>

**Provider surface** — derived from spec OpenSea ReadMe registry spec (semi-official) @ 2.0.0: 139 real routes · 3 covered · 2% · 136 not implemented

<details><summary>not implemented (136)</summary>

- `GET` `/api/v2/account/{address}/collections`
- `GET` `/api/v2/account/{address}/favorites`
- `GET` `/api/v2/account/{address}/listings`
- `GET` `/api/v2/account/{address}/offers`
- `GET` `/api/v2/account/{address}/offers_received`
- `GET` `/api/v2/account/{address}/perpetual_watchlist`
- `GET` `/api/v2/account/{address}/pnl`
- `GET` `/api/v2/account/{address}/pnl/closed-positions`
- `GET` `/api/v2/account/{address}/pnl/token-transfers`
- `GET` `/api/v2/account/{address}/portfolio`
- `GET` `/api/v2/account/{address}/portfolio/history`
- `GET` `/api/v2/account/{address}/token-activity`
- `GET` `/api/v2/account/{address}/token_watchlist`
- `GET` `/api/v2/account/{address}/tokens`
- `DELETE` `/api/v2/accounts/agent`
- `PUT` `/api/v2/accounts/agent`
- `DELETE` `/api/v2/accounts/agent-relationships`
- `GET` `/api/v2/accounts/agent-relationships`
- `POST` `/api/v2/accounts/agent-relationships`
- `POST` `/api/v2/accounts/agent-relationships/confirm`
- `GET` `/api/v2/accounts/resolve/{identifier}`
- `POST` `/api/v2/accounts/wallets/siwx`
- `DELETE` `/api/v2/accounts/wallets/{wallet}`
- `DELETE` `/api/v2/accounts/wallets/{wallet}/private`
- `PUT` `/api/v2/accounts/wallets/{wallet}/private`
- `GET` `/api/v2/accounts/{address_or_username}`
- `GET` `/api/v2/accounts/{address_or_username}/agent-relationships`
- `DELETE` `/api/v2/accounts/{address_or_username}/follow`
- `POST` `/api/v2/accounts/{address_or_username}/follow`
- `GET` `/api/v2/accounts/{address_or_username}/followers`
- `GET` `/api/v2/accounts/{address_or_username}/following`
- `GET` `/api/v2/accounts/{address_or_username}/relationship`
- `DELETE` `/api/v2/accounts/{address_or_username}/watch`
- `POST` `/api/v2/accounts/{address_or_username}/watch`
- `POST` `/api/v2/assets/transfer`
- `POST` `/api/v2/auth/keys`
- `GET` `/api/v2/chain/{chain}/account/{address}/nfts`
- `GET` `/api/v2/chain/{chain}/contract/{address}`
- `GET` `/api/v2/chain/{chain}/contract/{address}/nfts`
- `GET` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}`
- `GET` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}/analytics`
- `GET` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}/collection`
- `GET` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}/owners`
- `POST` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}/refresh`
- `POST` `/api/v2/chain/{chain}/contract/{address}/nfts/{identifier}/validate-metadata`
- `GET` `/api/v2/chain/{chain}/payment_token/{address}`
- `GET` `/api/v2/chain/{chain}/token/{address}`
- `GET` `/api/v2/chain/{chain}/token/{address}/activity`
- `GET` `/api/v2/chain/{chain}/token/{address}/activity/stats`
- `GET` `/api/v2/chain/{chain}/token/{address}/holders`
… and 86 more


</details>

**Missing** (4)

- No collections list endpoint (GET /api/v2/collections), only get-by-slug
- No listing creation or order cancellation (offer creation only)
- No account lookup (GET /api/v2/accounts/{address})
- No NFT transfer history endpoint (chain/{chain}/transfers)

**Deviations** (4)

- X-API-KEY accepted as any non-empty value; no real key validation
- Asset routes serve the deprecated v2 surface; real v2 replaced them with collection-scoped nfts endpoints
- Identical offers re-create and store duplicate orders (no order_hash dedupe)
- Create-offer body and response are simulator-specific, not the documented criteria-offer shapes

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/api/v2/assets` — query, auth, stateful, paginate, errors
- `GET` `/api/v2/assets/{chain}/{address}/{identifier}` — params, auth, stateful, errors
- `GET` `/api/v2/collections/{slug}` — params, auth, stateful, errors
- `GET` `/api/v2/events` — query, auth, stateful, paginate, errors
- `GET` `/api/v2/orders/{chain}/{protocol}/listings` — query, params, auth, stateful, paginate, errors
- `GET` `/api/v2/orders/{chain}/{protocol}/offers` — query, params, auth, stateful, paginate, errors
- `POST` `/api/v2/offers` — body, auth, stateful

</details>

### paypal-style

**Covered** — 17 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/oauth2/token` |
| POST | `/v2/checkout/orders` |
| GET | `/v2/checkout/orders/{id}` |
| POST | `/v2/checkout/orders/{id}/approve` |
| POST | `/v2/checkout/orders/{id}/capture` |
| POST | `/v2/checkout/orders/{id}/authorize` |
| GET | `/v2/payments/authorizations/{id}` |
| POST | `/v2/payments/authorizations/{id}/reauthorize` |
| POST | `/v2/payments/authorizations/{id}/void` |
| POST | `/v2/payments/authorizations/{id}/capture` |
| GET | `/v2/payments/captures/{id}` |
| POST | `/v2/payments/captures/{capture_id}/refund` |
| GET | `/v2/payments/refunds/{id}` |
| POST | `/v1/notifications/webhooks` |
| GET | `/v1/notifications/webhooks` |
| DELETE | `/v1/notifications/webhooks/{id}` |
| POST | `/v1/notifications/verify-webhook-signature` |

</details>

**Provider surface** — derived from spec paypal-rest-api-specifications checkout_orders_v2 + payments_payment_v2 @ 2.32, 2.12: 17 real routes · 11 covered · 64% · 6 not implemented

<details><summary>not implemented (6)</summary>

- `POST` `/v2/checkout/orders/order-update-callback`
- `PATCH` `/v2/checkout/orders/{id}`
- `POST` `/v2/checkout/orders/{id}/confirm-payment-source`
- `POST` `/v2/checkout/orders/{id}/track`
- `PATCH` `/v2/checkout/orders/{id}/trackers/{tracker_id}`
- `POST` `/v2/payments/find-eligible-methods`

</details>

**Missing** (6)

- No PATCH order update (PATCH /v2/checkout/orders/{id})
- No payouts API (POST /v1/payments/payouts)
- No disputes API (/v1/customer/disputes)
- No subscriptions, billing plans, or catalog products APIs
- No webhook event-types list or simulate-event endpoints
- No order patch endpoint (PATCH /v2/checkout/orders/{id})

**Deviations** (8)

- Payer approval endpoint /approve is simulator-only; real flow is browser rel=approve
- simulate_fail flags on approve and refund are stunt-only test hooks
- Webhook deliveries unsigned; real PayPal uses a certificate-based signature scheme
- verify-webhook-signature returns SUCCESS for any known webhook_id, no real check
- Refund derives terminal state on read after fixed ~3s (PENDING to COMPLETED/FAILED)
- Token endpoint validates only the Basic scheme — any credentials mint, grant_type ignored
- Captures always complete immediately; no PENDING/ON_HOLD capture states
- Idempotency replay re-renders the order's current state, not the cached original response

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/oauth2/token` — body, stateful, clock
- `POST` `/v2/checkout/orders` — body, stateful, clock
- `GET` `/v2/checkout/orders/{id}` — params, stateful, clock
- `POST` `/v2/checkout/orders/{id}/approve` — body, params, stateful, webhooks, clock
- `POST` `/v2/checkout/orders/{id}/capture` — params, stateful, webhooks, clock
- `POST` `/v2/checkout/orders/{id}/authorize` — params, stateful, webhooks, clock
- `GET` `/v2/payments/authorizations/{id}` — params, stateful, clock
- `POST` `/v2/payments/authorizations/{id}/reauthorize` — params, stateful, clock
- `POST` `/v2/payments/authorizations/{id}/void` — params, stateful, webhooks, clock
- `POST` `/v2/payments/authorizations/{id}/capture` — body, params, stateful, webhooks, clock
- `GET` `/v2/payments/captures/{id}` — params, stateful, filter, webhooks, clock
- `POST` `/v2/payments/captures/{capture_id}/refund` — body, params, stateful, filter, clock
- `GET` `/v2/payments/refunds/{id}` — params, stateful, webhooks, clock
- `POST` `/v1/notifications/webhooks` — body, stateful, clock
- `GET` `/v1/notifications/webhooks` — stateful, clock
- `DELETE` `/v1/notifications/webhooks/{id}` — params, stateful, clock
- `POST` `/v1/notifications/verify-webhook-signature` — body, stateful, clock

</details>

### persona-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/inquiry/v1/inquiries` |
| GET | `/api/inquiry/v1/inquiries/{inquiry_id}` |
| POST | `/api/inquiry/v1/inquiries/{inquiry_id}/resume` |
| GET | `/api/inquiry/v1/inquiries/{inquiry_id}/verifications` |
| POST | `/api/inquiry/v1/webhooks` |

</details>

**Provider surface** — derived from spec Persona API reference @ 1.0.0: 213 real routes · 4 covered · 1% · 209 not implemented

<details><summary>not implemented (209)</summary>

- `GET` `/api/inquiry/v1/account-types/{account-type-id}`
- `GET` `/api/inquiry/v1/accounts`
- `POST` `/api/inquiry/v1/accounts`
- `POST` `/api/inquiry/v1/accounts/search`
- `DELETE` `/api/inquiry/v1/accounts/{account-id}`
- `GET` `/api/inquiry/v1/accounts/{account-id}`
- `PATCH` `/api/inquiry/v1/accounts/{account-id}`
- `POST` `/api/inquiry/v1/accounts/{account-id}/add-relation`
- `POST` `/api/inquiry/v1/accounts/{account-id}/add-tag`
- `POST` `/api/inquiry/v1/accounts/{account-id}/consolidate`
- `GET` `/api/inquiry/v1/accounts/{account-id}/relations`
- `POST` `/api/inquiry/v1/accounts/{account-id}/remove-relation`
- `POST` `/api/inquiry/v1/accounts/{account-id}/remove-tag`
- `POST` `/api/inquiry/v1/accounts/{account-id}/run-action`
- `POST` `/api/inquiry/v1/accounts/{account-id}/set-tags`
- `GET` `/api/inquiry/v1/api-keys`
- `POST` `/api/inquiry/v1/api-keys`
- `GET` `/api/inquiry/v1/api-keys/{api-key-id}`
- `PATCH` `/api/inquiry/v1/api-keys/{api-key-id}`
- `POST` `/api/inquiry/v1/api-keys/{api-key-id}/clone`
- `POST` `/api/inquiry/v1/api-keys/{api-key-id}/expire`
- `GET` `/api/inquiry/v1/api-logs`
- `GET` `/api/inquiry/v1/api-logs/{api-log-id}`
- `GET` `/api/inquiry/v1/case-templates/{case-template-id}`
- `GET` `/api/inquiry/v1/cases`
- `POST` `/api/inquiry/v1/cases`
- `POST` `/api/inquiry/v1/cases/search`
- `DELETE` `/api/inquiry/v1/cases/{case-id}`
- `GET` `/api/inquiry/v1/cases/{case-id}`
- `PATCH` `/api/inquiry/v1/cases/{case-id}`
- `POST` `/api/inquiry/v1/cases/{case-id}/add-objects`
- `POST` `/api/inquiry/v1/cases/{case-id}/add-tag`
- `POST` `/api/inquiry/v1/cases/{case-id}/assign`
- `POST` `/api/inquiry/v1/cases/{case-id}/remove-objects`
- `POST` `/api/inquiry/v1/cases/{case-id}/remove-tag`
- `POST` `/api/inquiry/v1/cases/{case-id}/set-status`
- `POST` `/api/inquiry/v1/cases/{case-id}/set-tags`
- `GET` `/api/inquiry/v1/connect/connections`
- `POST` `/api/inquiry/v1/connect/connections`
- `GET` `/api/inquiry/v1/connect/connections/{connection-id}`
- `POST` `/api/inquiry/v1/connect/connections/{connection-id}/deactivate`
- `POST` `/api/inquiry/v1/connect/connections/{connection-id}/reactivate`
- `GET` `/api/inquiry/v1/connect/share-tokens`
- `POST` `/api/inquiry/v1/connect/share-tokens`
- `GET` `/api/inquiry/v1/connect/share-tokens/{share-token-id}`
- `POST` `/api/inquiry/v1/connect/share-tokens/{share-token-id}/expire`
- `POST` `/api/inquiry/v1/connect/share-tokens/{share-token-id}/redeem`
- `GET` `/api/inquiry/v1/devices`
- `GET` `/api/inquiry/v1/devices/{device-id}`
- `GET` `/api/inquiry/v1/document/generics/{document-id}`
… and 159 more


</details>

**Missing** (5)

- No inquiries list endpoint (GET /api/inquiry/v1/inquiries)
- No inquiry templates or reports endpoints
- No document or selfie upload endpoints (verifications auto-seeded)
- No Transactions API (bank account linking and verification)
- No inquiry cancel, expire, redact, or mark-under-review actions

**Deviations** (6)

- Fixed clock lifecycle: created (0-1s), pending (1-3s), completed or declined (+3s)
- simulate_fail create flag yields declined instead of completed (stunt-only)
- Webhook HMAC secret is the public constant stunt_persona_mock_signing_key
- POST /api/inquiry/v1/webhooks is a local stand-in receiver with 5-minute replay window
- JSON:API attributes are snake_case; real Persona serializes kebab-case
- Create takes a flat body; real API expects the JSON:API data/attributes wrapper

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/inquiry/v1/inquiries` — body, auth, stateful, errors, clock
- `GET` `/api/inquiry/v1/inquiries/{inquiry_id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/api/inquiry/v1/inquiries/{inquiry_id}/resume` — params, auth, stateful, errors, clock
- `GET` `/api/inquiry/v1/inquiries/{inquiry_id}/verifications` — params, auth, stateful, errors
- `POST` `/api/inquiry/v1/webhooks` — auth, stateful, clock

</details>

### photos-style

**Covered** — 12 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/o/oauth2/auth` |
| POST | `/o/oauth2/token` |
| POST | `/v1/uploads` |
| POST | `/v1/mediaItems:batchCreate` |
| POST | `/v1/mediaItems:search` |
| GET | `/v1/mediaItems` |
| GET | `/v1/mediaItems/{id}` |
| GET | `/v1/media-dl/{id}` |
| GET | `/v1/albums` |
| POST | `/v1/albums` |
| GET | `/v1/albums/{id}` |
| DELETE | `/v1/albums/{id}` |

</details>

**Missing** (5)

- No album item management (addItems, removeItems, batchRemoveMediaItems)
- No album title update (PATCH /v1/albums/{id})
- No album enrichments (text, map) via addEnrichment
- No shared albums (list, join, leave, unshare)
- No favorites marking or favorite filtering in search

**Deviations** (5)

- Bare-id media download returns derivative bytes; =d/=dv return original upload
- search honors mediaTypeFilter and dateFilter only (no contentFilter or album filters)
- Naming both PHOTO and VIDEO in mediaTypeFilter silently keeps only the last; real API 400s
- albumId in batchCreate is not validated; mediaItemsCount stays 0 and description is dropped
- Deleting an album leaves its items findable via search {albumId}

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/o/oauth2/auth` — query, stateful, errors
- `POST` `/o/oauth2/token` — body, stateful, errors, clock
- `POST` `/v1/uploads` — auth, stateful, clock
- `POST` `/v1/mediaItems:batchCreate` — body, auth, stateful, clock
- `POST` `/v1/mediaItems:search` — body, auth, stateful, filter, clock
- `GET` `/v1/mediaItems` — query, auth, stateful, clock
- `GET` `/v1/mediaItems/{id}` — params, auth, stateful, errors, clock
- `GET` `/v1/media-dl/{id}` — params, stateful, errors
- `GET` `/v1/albums` — query, auth, stateful, clock
- `POST` `/v1/albums` — body, auth, stateful, clock
- `GET` `/v1/albums/{id}` — params, auth, stateful, errors, clock
- `DELETE` `/v1/albums/{id}` — params, auth, stateful, errors, clock

</details>

### pinata-style

**Covered** — 6 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/pinning/pinFileToIPFS` |
| POST | `/pinning/pinJSONToIPFS` |
| DELETE | `/pinning/unpin/{cid}` |
| GET | `/data/pinList` |
| GET | `/data/testAuthentication` |
| GET | `/data/pinByHash` |

</details>

**Missing** (4)

- No pin-by-CID endpoint (POST /pinning/addHashToPinQueue)
- No pin-jobs listing (GET /pinning/pinJobs)
- No metadata update or pin-policy change (POST /pinning/hashMetadata)
- No pinned-data-usage endpoint (GET /data/userPinnedDataTotal)

**Deviations** (3)

- Credentials are presence-checked only; any non-empty key pair or Bearer JWT passes
- Every stored pin is status pinned — unpinned/pending/failed not modeled (no job queue)
- JSON pin CIDs derive from stunt canonical serialization, not byte-identical to real Pinata

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/pinning/pinFileToIPFS` — stateful, clock
- `POST` `/pinning/pinJSONToIPFS` — body, stateful, clock
- `DELETE` `/pinning/unpin/{cid}` — params, stateful
- `GET` `/data/pinList` — query, stateful, filter
- `GET` `/data/testAuthentication` — —
- `GET` `/data/pinByHash` — query, stateful

</details>

### plaid-style

**Covered** — 13 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/link/token/create` |
| POST | `/item/public_token/exchange` |
| POST | `/accounts/balance/get` |
| POST | `/accounts/get` |
| POST | `/transactions/sync` |
| POST | `/identity/get` |
| POST | `/item/get` |
| POST | `/item/remove` |
| POST | `/institutions/get` |
| POST | `/institutions/get_by_id` |
| POST | `/sandbox/public_token/create` |
| POST | `/sandbox/item/reset_login` |
| POST | `/sandbox/item/fire_webhook` |

</details>

**Provider surface** — derived from sdk plaid-node @ 32.0.0 (floor): 294 real routes · 13 covered · 4% · 281 not implemented

<details><summary>not implemented (281)</summary>

- `POST` `/application/get`
- `POST` `/asset_report/audit_copy/create`
- `POST` `/asset_report/audit_copy/get`
- `POST` `/asset_report/audit_copy/remove`
- `POST` `/asset_report/create`
- `POST` `/asset_report/filter`
- `POST` `/asset_report/get`
- `POST` `/asset_report/pdf/get`
- `POST` `/asset_report/refresh`
- `POST` `/asset_report/remove`
- `POST` `/auth/get`
- `POST` `/bank_transfer/balance/get`
- `POST` `/bank_transfer/cancel`
- `POST` `/bank_transfer/create`
- `POST` `/bank_transfer/event/list`
- `POST` `/bank_transfer/event/sync`
- `POST` `/bank_transfer/get`
- `POST` `/bank_transfer/list`
- `POST` `/bank_transfer/migrate_account`
- `POST` `/bank_transfer/sweep/get`
- `POST` `/bank_transfer/sweep/list`
- `POST` `/beacon/account_risk/v1/evaluate`
- `POST` `/beacon/duplicate/get`
- `POST` `/beacon/report/create`
- `POST` `/beacon/report/get`
- `POST` `/beacon/report/list`
- `POST` `/beacon/report_syndication/get`
- `POST` `/beacon/report_syndication/list`
- `POST` `/beacon/user/account_insights/get`
- `POST` `/beacon/user/create`
- `POST` `/beacon/user/get`
- `POST` `/beacon/user/history/list`
- `POST` `/beacon/user/review`
- `POST` `/beacon/user/update`
- `POST` `/beta/credit/v1/bank_employment/get`
- `POST` `/beta/transactions/rules/v1/create`
- `POST` `/beta/transactions/rules/v1/list`
- `POST` `/beta/transactions/rules/v1/remove`
- `POST` `/beta/transactions/user_insights/v1/get`
- `POST` `/beta/transactions/v1/enhance`
- `POST` `/cashflow_report/get`
- `POST` `/cashflow_report/refresh`
- `POST` `/categories/get`
- `POST` `/consent/events/get`
- `POST` `/consumer_report/pdf/get`
- `POST` `/cra/check_report/base_report/get`
- `POST` `/cra/check_report/cashflow_insights/get`
- `POST` `/cra/check_report/create`
- `POST` `/cra/check_report/income_insights/get`
- `POST` `/cra/check_report/network_insights/get`
… and 231 more


</details>

**Missing** (5)

- No /auth/get (account and routing numbers)
- No legacy POST /transactions/get endpoint
- No /institutions/search endpoint
- No /item/webhook/update or /item/token/invalidate
- No liabilities, assets, investments, or income products

**Deviations** (3)

- X-Plaid-Signature JWT-style webhook signature is documented but never enforced
- fire_webhook SYNC_UPDATES_AVAILABLE doubles as transaction mutation (one posted, one removed)
- client_id/secret credentials are presence-checked only, never validated

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/link/token/create` — body, auth, stateful, clock
- `POST` `/item/public_token/exchange` — body, auth, stateful, errors
- `POST` `/accounts/balance/get` — body, auth, stateful, filter, errors
- `POST` `/accounts/get` — body, auth, stateful, filter, errors
- `POST` `/transactions/sync` — body, auth, stateful, filter, webhooks, errors
- `POST` `/identity/get` — body, auth, stateful, filter, errors
- `POST` `/item/get` — body, auth, stateful, errors
- `POST` `/item/remove` — body, auth, stateful, errors
- `POST` `/institutions/get` — body, auth, stateful, filter
- `POST` `/institutions/get_by_id` — body, auth, stateful, errors
- `POST` `/sandbox/public_token/create` — body, auth, stateful, errors, clock
- `POST` `/sandbox/item/reset_login` — body, auth, stateful, webhooks, errors
- `POST` `/sandbox/item/fire_webhook` — body, auth, stateful, filter, webhooks, errors

</details>

### powerplatform-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v2/environments` |
| GET | `/v2/environments/{env}/connectors` |
| GET | `/v2/environments/{env}/api/data/v9.2/accounts` |
| POST | `/v2/environments/{env}/api/data/v9.2/accounts` |
| GET | `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` |
| PATCH | `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` |
| DELETE | `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` |
| GET | `/v2/environments/{env}/flows` |
| POST | `/v2/environments/{env}/flows` |

</details>

**Missing** (4)

- No environment lifecycle operations (create, update, delete)
- Only the accounts table is served — no contacts, leads, or other tables
- No flow update, delete, or run operations
- No $expand, $apply, or $search query options

**Deviations** (6)

- No default page size: whole list returns unless $top is set; real Dataverse pages at 5000
- Client-supplied accountid accepted on create; auto ids are acc-<n>, not GUIDs
- Environments with no stored flows list a fallback seeded seeded-flow-001 entry
- api-version is ignored (version baked into the /v2 path); real Power Platform requires ?api-version=
- $skipToken is camelCase; real Dataverse entity paging uses $skiptoken
- POST accounts echoes the created record; real Dataverse returns 201 empty with OData-EntityId

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v2/environments` — query, auth, paginate, errors
- `GET` `/v2/environments/{env}/connectors` — query, params, auth, paginate, errors
- `GET` `/v2/environments/{env}/api/data/v9.2/accounts` — query, params, auth, stateful, paginate, filter, errors
- `POST` `/v2/environments/{env}/api/data/v9.2/accounts` — body, params, auth, stateful
- `GET` `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` — params, auth, stateful, errors
- `PATCH` `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` — body, params, auth, stateful, errors
- `DELETE` `/v2/environments/{env}/api/data/v9.2/accounts({accountid})` — params, auth, stateful, errors
- `GET` `/v2/environments/{env}/flows` — query, params, auth, stateful, paginate, errors
- `POST` `/v2/environments/{env}/flows` — body, params, auth, stateful

</details>

### printful-style

**Covered** — 13 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v2/store/products` |
| POST | `/v2/store/products` |
| GET | `/v2/store/products/{product_id}` |
| POST | `/orders` |
| GET | `/orders/{order_id}` |
| GET | `/v2/store/orders` |
| POST | `/v2/store/orders` |
| POST | `/v2/store/orders/{order_id}` |
| POST | `/v2/shipping/rates` |
| GET | `/webhooks` |
| POST | `/webhooks` |
| PUT | `/webhooks` |
| DELETE | `/webhooks` |

</details>

**Provider surface** — derived from spec Printful OpenAPI @ 1.0: 55 real routes · 5 covered · 9% · 50 not implemented

<details><summary>not implemented (50)</summary>

- `GET` `/approval-sheets`
- `POST` `/approval-sheets`
- `POST` `/approval-sheets/changes`
- `GET` `/categories`
- `GET` `/categories/{id}`
- `GET` `/countries`
- `POST` `/files`
- `POST` `/files/thread-colors`
- `GET` `/files/{id}`
- `POST` `/mockup-generator/create-task/{id}`
- `GET` `/mockup-generator/printfiles/{id}`
- `GET` `/mockup-generator/task`
- `GET` `/mockup-generator/templates/{id}`
- `GET` `/oauth/scopes`
- `GET` `/orders`
- `POST` `/orders/estimate-costs`
- `DELETE` `/orders/{id}`
- `PUT` `/orders/{id}`
- `POST` `/orders/{id}/confirm`
- `GET` `/product-templates`
- `DELETE` `/product-templates/{id}`
- `GET` `/product-templates/{id}`
- `GET` `/products`
- `GET` `/products/variant/{id}`
- `GET` `/products/{id}`
- `GET` `/products/{id}/sizes`
- `GET` `/reports/statistics`
- `POST` `/shipping/rates`
- `POST` `/store/packing-slip`
- `GET` `/store/products`
- `POST` `/store/products`
- `DELETE` `/store/products/{id}`
- `GET` `/store/products/{id}`
- `PUT` `/store/products/{id}`
- `POST` `/store/products/{id}/variants`
- `DELETE` `/store/variants/{id}`
- `GET` `/store/variants/{id}`
- `PUT` `/store/variants/{id}`
- `GET` `/stores`
- `GET` `/stores/{id}`
- `GET` `/sync/products`
- `DELETE` `/sync/products/{id}`
- `GET` `/sync/products/{id}`
- `DELETE` `/sync/variant/{id}`
- `GET` `/sync/variant/{id}`
- `PUT` `/sync/variant/{id}`
- `GET` `/tax/countries`
- `POST` `/tax/rates`
- `GET` `/warehouse/products`
- `GET` `/warehouse/products/{id}`

</details>

**Missing** (5)

- No package_shipped, package_returned, product_synced, or order_hold events
- No product update or delete (PUT/DELETE /v2/store/products/{product_id})
- No order confirm or cancel (POST /orders/{id}/confirm, DELETE /orders/{id})
- No catalog endpoints (catalog variants, print files, mockup generator)
- No reference endpoints (countries, taxes, store info)

**Deviations** (3)

- Webhook set without a secret signs with built-in mock secret stunt_mock_pful_webhook_secret
- v2 responses are bare data/resources; real Printful wraps every response in {code, result}
- Timestamps are sequence-derived synthetic values, never wall-clock

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v2/store/products` — query, auth, stateful, paginate, errors
- `POST` `/v2/store/products` — body, auth, stateful
- `GET` `/v2/store/products/{product_id}` — params, auth, stateful, errors
- `POST` `/orders` — body, auth, stateful, webhooks, clock
- `GET` `/orders/{order_id}` — params, auth, stateful, errors
- `GET` `/v2/store/orders` — query, auth, stateful, paginate, filter, errors
- `POST` `/v2/store/orders` — body, auth, stateful, webhooks, clock
- `POST` `/v2/store/orders/{order_id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v2/shipping/rates` — body, auth
- `GET` `/webhooks` — auth, stateful
- `POST` `/webhooks` — body, auth, stateful, errors
- `PUT` `/webhooks` — body, auth, stateful, errors
- `DELETE` `/webhooks` — auth, stateful

</details>

### printify-style

**Covered** — 16 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1/catalog/blueprints.json` |
| GET | `/v1/catalog/blueprints/{blueprint_id}/variants.json` |
| GET | `/v1/shops/{shop_id}/products.json` |
| POST | `/v1/shops/{shop_id}/products.json` |
| GET | `/v1/shops/{shop_id}/products/{product_id}` |
| PUT | `/v1/shops/{shop_id}/products/{product_id}` |
| DELETE | `/v1/shops/{shop_id}/products/{product_id}` |
| POST | `/v1/shops/{shop_id}/orders.json` |
| GET | `/v1/shops/{shop_id}/orders/{order_id}` |
| GET | `/v1/orders.json` |
| POST | `/v1/orders.json` |
| POST | `/v1/orders/{order_id}/send.json` |
| GET | `/v1/shops/{shop_id}/webhooks.json` |
| POST | `/v1/shops/{shop_id}/webhooks.json` |
| GET | `/v1/shops/{shop_id}/webhooks/{webhook_id}` |
| DELETE | `/v1/shops/{shop_id}/webhooks/{webhook_id}` |

</details>

**Provider surface** — derived from spec Printify OpenAPI @ 1.0.0: 40 real routes · 11 covered · 27% · 29 not implemented

<details><summary>not implemented (29)</summary>

- `GET` `/v1/catalog/blueprints/{blueprint_id}.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/shipping.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/shipping/economy.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/shipping/express.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/shipping/priority.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/shipping/standard.json`
- `GET` `/v1/catalog/blueprints/{blueprint_id}/print_providers/{print_provider_id}/variants.json`
- `GET` `/v1/catalog/print_providers.json`
- `GET` `/v1/catalog/print_providers/{print_provider_id}.json`
- `GET` `/v1/shops.json`
- `DELETE` `/v1/shops/{shop_id}/connection.json`
- `GET` `/v1/shops/{shop_id}/orders.json`
- `POST` `/v1/shops/{shop_id}/orders/express.json`
- `POST` `/v1/shops/{shop_id}/orders/shipping.json`
- `POST` `/v1/shops/{shop_id}/orders/{order_id}/cancel.json`
- `POST` `/v1/shops/{shop_id}/orders/{order_id}/send_to_production.json`
- `GET` `/v1/shops/{shop_id}/products/{product_id}/gpsr.json`
- `POST` `/v1/shops/{shop_id}/products/{product_id}/publish.json`
- `POST` `/v1/shops/{shop_id}/products/{product_id}/publishing_failed.json`
- `POST` `/v1/shops/{shop_id}/products/{product_id}/publishing_succeeded.json`
- `POST` `/v1/shops/{shop_id}/products/{product_id}/unpublish.json`
- `PUT` `/v1/shops/{shop_id}/webhooks/{webhook_id}.json`
- `POST` `/v1/shops/{shop_id}/webhooks/{webhook_id}/simulate`
- `GET` `/v1/uploads.json`
- `POST` `/v1/uploads/images.json`
- `GET` `/v1/uploads/{image_id}.json`
- `POST` `/v1/uploads/{image_id}/archive.json`
- `GET` `/v2/catalog/blueprints/{blueprint_id}/print_providers/{print_provider_id}/shipping.json`

</details>

**Missing** (5)

- No shops endpoints (GET /v1/shops.json); shop_id is a path placeholder
- No image uploads (POST /v1/uploads/images.json)
- No order update route (PUT /v1/shops/{shop_id}/orders/{order_id}.json)
- No product publish/unpublish (publish.json, unpublish.json)
- No shipping calculation or shipping-methods endpoints

**Deviations** (4)

- Webhook without a secret signs with built-in mock secret stunt_mock_potify_webhook_secret
- List envelopes are a stunt invention with hardcoded current_page/per_page/last_page; real Printify returns bare arrays
- total_price is a synthetic whole number (qty x 20); real prices are per-variant cent strings
- The order list is global across shops; real Printify lists orders shop-scoped

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1/catalog/blueprints.json` — query, auth, paginate, errors
- `GET` `/v1/catalog/blueprints/{blueprint_id}/variants.json` — query, params, auth, paginate, errors
- `GET` `/v1/shops/{shop_id}/products.json` — query, params, auth, stateful, paginate, errors
- `POST` `/v1/shops/{shop_id}/products.json` — body, params, auth, stateful, webhooks, clock
- `GET` `/v1/shops/{shop_id}/products/{product_id}` — params, auth, stateful, errors
- `PUT` `/v1/shops/{shop_id}/products/{product_id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/shops/{shop_id}/products/{product_id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/shops/{shop_id}/orders.json` — body, params, auth, stateful, webhooks, clock
- `GET` `/v1/shops/{shop_id}/orders/{order_id}` — params, auth, stateful, errors
- `GET` `/v1/orders.json` — query, auth, stateful, paginate, errors
- `POST` `/v1/orders.json` — body, params, auth, stateful, webhooks, clock
- `POST` `/v1/orders/{order_id}/send.json` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/shops/{shop_id}/webhooks.json` — params, auth, stateful
- `POST` `/v1/shops/{shop_id}/webhooks.json` — body, params, auth, stateful, errors, clock
- `GET` `/v1/shops/{shop_id}/webhooks/{webhook_id}` — params, auth, stateful, errors
- `DELETE` `/v1/shops/{shop_id}/webhooks/{webhook_id}` — params, auth, stateful, errors

</details>

### producthunt-style

**Covered** — 0 routes · GraphQL schema

**Missing** (3)

- Only postCreate mutation — no vote, comment, or post-update mutations
- No users or topics queries (user, users, topic)
- No comments or collections surfaces

**Deviations** (2)

- GraphQL served at /v2/api/graphql.json; real Product Hunt path is /v2/api/graphql
- GraphQL endpoint is open — no OAuth developer-token check (transport has no auth hook)

### psd2-style

**Covered** — 19 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/oauth/token` |
| POST | `/v1/consents` |
| GET | `/v1/consents/{consentId}` |
| DELETE | `/v1/consents/{consentId}` |
| POST | `/v1/consents/{consentId}/authorisations` |
| GET | `/v1/consents/{consentId}/authorisations/{authorisationId}` |
| PUT | `/v1/consents/{consentId}/authorisations/{authorisationId}` |
| POST | `/v1/consents/{consentId}/authorisations/{authorisationId}` |
| GET | `/v1/accounts` |
| GET | `/v1/accounts/{resourceId}/balances` |
| GET | `/v1/accounts/{resourceId}/transactions` |
| POST | `/v1/payments/{product}` |
| GET | `/v1/payments/{product}/{paymentId}/status` |
| POST | `/v1/payments/{product}/{paymentId}/authorisations` |
| GET | `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` |
| PUT | `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` |
| POST | `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` |
| GET | `/v1/payments/{product}/{paymentId}` |
| DELETE | `/v1/payments/{product}/{paymentId}` |

</details>

**Missing** (6)

- No Confirmation of Funds (POST /v1/funds-confirmations)
- No card accounts (GET /v1/card-accounts and card transactions)
- No periodic or bulk payments (standing orders)
- No transaction detail (GET /v1/accounts/{id}/transactions/{resourceId})
- No GET /v1/consents/{id}/status sub-resource
- No payment cancellation-authorisations SCA sub-resource

**Deviations** (7)

- SCA finalisation is derive-on-read after a fixed 1s challenge window
- Payment status derives on read: ACTC at 1s, ACSC at 3s — fixed, not bank async
- simulate_fail: true in POST /payments forces RJCT (simulator-only trigger)
- Signed transition webhooks are a simulator extension; NextGenPSD2 defines none
- scaRedirect _links URL is synthetic — no real bank SCA login page behind it
- DELETE consent returns 200 + body; real NextGenPSD2 returns 204 No Content
- PARAMETER_MISSING-<FIELD> error codes are simulator conventions, not the official code list

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/oauth/token` — body, stateful, clock
- `POST` `/v1/consents` — body, stateful, clock
- `GET` `/v1/consents/{consentId}` — params, stateful, clock
- `DELETE` `/v1/consents/{consentId}` — params, stateful, clock
- `POST` `/v1/consents/{consentId}/authorisations` — params, stateful, clock
- `GET` `/v1/consents/{consentId}/authorisations/{authorisationId}` — params, stateful, webhooks, clock
- `PUT` `/v1/consents/{consentId}/authorisations/{authorisationId}` — body, params, stateful, clock
- `POST` `/v1/consents/{consentId}/authorisations/{authorisationId}` — body, params, stateful, clock
- `GET` `/v1/accounts` — query, stateful, paginate, webhooks, clock
- `GET` `/v1/accounts/{resourceId}/balances` — params, stateful, webhooks, clock
- `GET` `/v1/accounts/{resourceId}/transactions` — query, params, stateful, filter, webhooks, clock
- `POST` `/v1/payments/{product}` — body, params, stateful, webhooks, clock
- `GET` `/v1/payments/{product}/{paymentId}/status` — params, stateful, webhooks, clock
- `POST` `/v1/payments/{product}/{paymentId}/authorisations` — params, stateful, clock
- `GET` `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` — params, stateful, webhooks, clock
- `PUT` `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` — body, params, stateful, clock
- `POST` `/v1/payments/{product}/{paymentId}/authorisations/{authorisationId}` — body, params, stateful, clock
- `GET` `/v1/payments/{product}/{paymentId}` — params, stateful, webhooks, clock
- `DELETE` `/v1/payments/{product}/{paymentId}` — params, stateful, webhooks, clock

</details>

### qbo-style

**Covered** — 11 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth/v2/authorize` |
| POST | `/oauth/v2/tokens/bearer` |
| GET | `/v3/company/{realmId}/query` |
| POST | `/v3/company/{realmId}/query` |
| GET | `/v3/company/{realmId}/customer` |
| POST | `/v3/company/{realmId}/customer` |
| GET | `/v3/company/{realmId}/customer/{id}` |
| DELETE | `/v3/company/{realmId}/customer/{id}` |
| POST | `/v3/company/{realmId}/invoice` |
| GET | `/v3/company/{realmId}/invoice/{id}` |
| DELETE | `/v3/company/{realmId}/invoice/{id}` |

</details>

**Missing** (6)

- Only Customer and Invoice — no Payment, Estimate, Item, Vendor, etc.
- No QSQL aggregates (COUNT, SUM, MAX, MIN, AVG)
- No batch endpoint (POST /v3/company/{realmId}/batch)
- No CDC endpoint (GET /v3/company/{realmId}/cdc)
- No reports endpoints (Profit and Loss, Balance Sheet, Trial Balance)
- No Intuit webhooks (QBO event notifications)

**Deviations** (4)

- Malformed FROM tokens fall back to substring entity matching instead of erroring
- Full (non-sparse) update merges like sparse; real QBO replaces and clears omitted fields
- SyncToken optimistic concurrency is not enforced — stale tokens still update
- Data is not realm-partitioned: one realm's token reads another realm's records

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth/v2/authorize` — query, stateful, errors
- `POST` `/oauth/v2/tokens/bearer` — body, stateful, errors, clock
- `GET` `/v3/company/{realmId}/query` — body, query, params, auth, stateful, filter, clock
- `POST` `/v3/company/{realmId}/query` — body, query, params, auth, stateful, filter, clock
- `GET` `/v3/company/{realmId}/customer` — query, params, auth, stateful, filter, clock
- `POST` `/v3/company/{realmId}/customer` — body, params, auth, stateful, clock
- `GET` `/v3/company/{realmId}/customer/{id}` — params, auth, stateful, clock
- `DELETE` `/v3/company/{realmId}/customer/{id}` — params, auth, stateful, clock
- `POST` `/v3/company/{realmId}/invoice` — body, query, params, auth, stateful, clock
- `GET` `/v3/company/{realmId}/invoice/{id}` — params, auth, stateful, clock
- `DELETE` `/v3/company/{realmId}/invoice/{id}` — params, auth, stateful, clock

</details>

### reddit-style

**Covered** — 2 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/v1/access_token` |
| POST | `/api/submit` |

</details>

**Missing** (5)

- No listing endpoints (subreddit hot/new/top, thread comment pages)
- No votes or comments (/api/vote, /api/comment)
- No identity endpoint (GET /api/v1/me)
- No token revocation (POST /api/v1/revoke_token)
- No subreddit, search, or inbox/messages endpoints

**Deviations** (3)

- User-Agent gate simplified: any UA containing / and ( passes, else 429
- The authorization_code grant never validates code or redirect_uri — any or missing code mints tokens
- Post ids are plain sequence strings, not Reddit base36

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/v1/access_token` — body, auth, stateful, errors, clock
- `POST` `/api/submit` — body, auth, stateful, errors, clock

</details>

### resend-style

**Covered** — 6 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/emails` |
| GET | `/emails` |
| GET | `/emails/{id}` |
| POST | `/webhooks` |
| GET | `/webhooks` |
| DELETE | `/webhooks/{id}` |

</details>

**Provider surface** — derived from sdk resend-node @ 6.22.0 (floor): 20 real routes · 2 covered · 10% · 18 not implemented

<details><summary>not implemented (18)</summary>

- `POST` `/api-keys`
- `POST` `/automations`
- `POST` `/broadcasts`
- `POST` `/contact-properties`
- `POST` `/contacts`
- `POST` `/contacts/imports`
- `POST` `/domains`
- `POST` `/domains/claim`
- `POST` `/emails/batch`
- `POST` `/events`
- `POST` `/events/send`
- `POST` `/segments`
- `POST` `/suppressions`
- `POST` `/suppressions/batch/add`
- `POST` `/suppressions/batch/remove`
- `POST` `/templates`
- `GET` `/topics`
- `POST` `/topics`

</details>

**Missing** (6)

- No domains surface (create, list, verify, delete)
- No API keys management (/api-keys)
- No batch send (POST /emails/batch)
- No scheduled sends (schedule, cancel schedule)
- No audiences or contacts
- No broadcasts or tags

**Deviations** (3)

- Delivery derives on read: sent at +1s, delivered at +3s — fixed, not async
- simulate_fail: true in POST /emails forces bounced terminal (simulator extension)
- Webhook events fire exactly once on the first deriving read, not on real delivery

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/emails` — body, auth, stateful, clock
- `GET` `/emails` — query, auth, stateful, paginate, webhooks, errors, clock
- `GET` `/emails/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/webhooks` — body, auth, stateful, clock
- `GET` `/webhooks` — auth, stateful
- `DELETE` `/webhooks/{id}` — params, auth, stateful, errors

</details>

### revenuecat-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/receipts` |
| POST | `/v1/webhooks` |
| GET | `/v1/webhooks` |
| POST | `/v1/subscribers/{app_user_id}/subscriptions/{product_id}/revoke` |
| GET | `/v1/subscribers/{app_user_id}` |
| POST | `/v1/subscribers/{app_user_id}` |
| DELETE | `/v1/subscribers/{app_user_id}` |

</details>

**Provider surface** — derived from spec RevenueCat API v1 reference @ 1.0: 15 real routes · 4 covered · 26% · 11 not implemented

<details><summary>not implemented (11)</summary>

- `POST` `/v1/subscribers/{app_user_id}/attributes`
- `POST` `/v1/subscribers/{app_user_id}/attribution`
- `POST` `/v1/subscribers/{app_user_id}/entitlements/{entitlement_identifier}/promotional`
- `POST` `/v1/subscribers/{app_user_id}/entitlements/{entitlement_identifier}/revoke_promotionals`
- `GET` `/v1/subscribers/{app_user_id}/offerings`
- `DELETE` `/v1/subscribers/{app_user_id}/offerings/override`
- `POST` `/v1/subscribers/{app_user_id}/offerings/{offering_uuid}/override`
- `POST` `/v1/subscribers/{app_user_id}/subscriptions/{product_identifier}/defer`
- `POST` `/v1/subscribers/{app_user_id}/subscriptions/{store_transaction_identifier}/cancel`
- `POST` `/v1/subscribers/{app_user_id}/subscriptions/{store_transaction_identifier}/extend`
- `POST` `/v1/subscribers/{app_user_id}/transactions/{store_transaction_identifier}/refund`

</details>

**Missing** (5)

- No attribution endpoint (POST /v1/subscribers/{id}/attribution)
- No offers API (promotional offer creation)
- No v2 webhooks — only unsigned v1 events
- Only ios and android platforms — no amazon, stripe, or web billing
- No v2 REST surface (customers, subscriptions, entitlements)

**Deviations** (5)

- fetch_token prefixed with invalid is the deterministic bad-receipt 400 path
- Subscription expiry is derive-on-read; first read past it fires EXPIRATION
- POST /v1/subscribers accepts _expires_at seeding to drive EXPIRATION in tests
- pk_ public keys are simulator convention; real RC public keys are appl_/goog_-prefixed
- REST webhook registration does not exist in real RC v1 (dashboard-configured)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/receipts` — body, auth, stateful, webhooks, errors, clock
- `POST` `/v1/webhooks` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/webhooks` — auth, stateful, clock
- `POST` `/v1/subscribers/{app_user_id}/subscriptions/{product_id}/revoke` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/subscribers/{app_user_id}` — params, auth, stateful, webhooks, clock
- `POST` `/v1/subscribers/{app_user_id}` — body, params, auth, stateful, webhooks, clock
- `DELETE` `/v1/subscribers/{app_user_id}` — params, auth, stateful, errors, clock

</details>

### salesforce-style

**Covered** — 29 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/services/oauth2/token` |
| GET | `/services/data/v60.0/sobjects` |
| GET | `/services/data/v60.0/sobjects/Account` |
| GET | `/services/data/v60.0/sobjects/Contact` |
| GET | `/services/data/v60.0/sobjects/Opportunity` |
| GET | `/services/data/v60.0/sobjects/Lead` |
| GET | `/services/data/v60.0/sobjects/User` |
| POST | `/services/data/v60.0/sobjects/Account` |
| GET | `/services/data/v60.0/sobjects/Account/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Account/{id}` |
| DELETE | `/services/data/v60.0/sobjects/Account/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Account/{extIdField}/{extIdValue}` |
| POST | `/services/data/v60.0/sobjects/Contact` |
| GET | `/services/data/v60.0/sobjects/Contact/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Contact/{id}` |
| DELETE | `/services/data/v60.0/sobjects/Contact/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Contact/{extIdField}/{extIdValue}` |
| POST | `/services/data/v60.0/sobjects/Opportunity` |
| GET | `/services/data/v60.0/sobjects/Opportunity/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Opportunity/{id}` |
| DELETE | `/services/data/v60.0/sobjects/Opportunity/{id}` |
| PATCH | `/services/data/v60.0/sobjects/Opportunity/{extIdField}/{extIdValue}` |
| GET | `/services/data/v60.0/query` |
| GET | `/services/data/v60.0/queryAll` |
| GET | `/services/data/v60.0/query/{queryLocator}` |
| POST | `/services/data/v60.0/composite` |
| POST | `/services/data/v60.0/composite/sobjects` |
| PATCH | `/services/data/v60.0/composite/sobjects` |
| DELETE | `/services/data/v60.0/composite/sobjects` |

</details>

**Missing** (7)

- No Lead or User CRUD routes
- No query or queryAll sub-requests in composite batches
- No SOSL search (GET /search)
- No composite tree upsert (POST /composite/tree)
- No batch endpoint (GET /composite/batch/sobjects)
- No Bulk API 2.0 (jobs/ingest, jobs/query)
- No GET updated/deleted incremental-refresh endpoints

**Deviations** (4)

- instance_url echoes the caller host over http:// (real: the org https:// instance)
- Governor limits (100 SOQL/txn, 10k DML rows) documented but not enforced
- SOQL WHERE subset: no parenthesized grouping; date literals compared lexically
- Password grant accepted for convenience; real SF requires web-server or JWT flow

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/services/oauth2/token` — body, stateful, errors, clock
- `GET` `/services/data/v60.0/sobjects` — auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Account` — auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Contact` — auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Opportunity` — auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Lead` — auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/User` — auth, stateful, clock
- `POST` `/services/data/v60.0/sobjects/Account` — body, auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Account/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Account/{id}` — body, params, auth, stateful, clock
- `DELETE` `/services/data/v60.0/sobjects/Account/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Account/{extIdField}/{extIdValue}` — body, params, auth, stateful, clock
- `POST` `/services/data/v60.0/sobjects/Contact` — body, auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Contact/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Contact/{id}` — body, params, auth, stateful, clock
- `DELETE` `/services/data/v60.0/sobjects/Contact/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Contact/{extIdField}/{extIdValue}` — body, params, auth, stateful, clock
- `POST` `/services/data/v60.0/sobjects/Opportunity` — body, auth, stateful, clock
- `GET` `/services/data/v60.0/sobjects/Opportunity/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Opportunity/{id}` — body, params, auth, stateful, clock
- `DELETE` `/services/data/v60.0/sobjects/Opportunity/{id}` — params, auth, stateful, clock
- `PATCH` `/services/data/v60.0/sobjects/Opportunity/{extIdField}/{extIdValue}` — body, params, auth, stateful, clock
- `GET` `/services/data/v60.0/query` — query, auth, stateful, clock
- `GET` `/services/data/v60.0/queryAll` — query, auth, stateful, clock
- `GET` `/services/data/v60.0/query/{queryLocator}` — params, auth, stateful, clock
- `POST` `/services/data/v60.0/composite` — body, auth, stateful, clock
- `POST` `/services/data/v60.0/composite/sobjects` — body, auth, stateful, clock
- `PATCH` `/services/data/v60.0/composite/sobjects` — body, auth, stateful, clock
- `DELETE` `/services/data/v60.0/composite/sobjects` — query, auth, stateful, clock

</details>

### sendgrid-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v3/mail/send` |
| GET | `/v3/messages` |
| POST | `/v3/user/webhooks/event/settings` |
| GET | `/v3/user/webhooks/event/settings` |
| POST | `/v3/user/webhooks/event/test` |

</details>

**Provider surface** — derived from spec sendgrid-oai tsg_mail_v3 + tsg_email_activity_v3 + tsg_webhooks_v3 @ 1.0.0, 1.0.0, 1.0.0: 26 real routes · 4 covered · 15% · 22 not implemented

<details><summary>not implemented (22)</summary>

- `POST` `/v3/mail/batch`
- `GET` `/v3/mail/batch/{batch_id}`
- `POST` `/v3/messages/download`
- `GET` `/v3/messages/download/{download_uuid}`
- `GET` `/v3/messages/{msg_id}`
- `GET` `/v3/user/webhooks/event/settings/all`
- `GET` `/v3/user/webhooks/event/settings/signed/{id}`
- `PATCH` `/v3/user/webhooks/event/settings/signed/{id}`
- `DELETE` `/v3/user/webhooks/event/settings/{id}`
- `GET` `/v3/user/webhooks/event/settings/{id}`
- `PATCH` `/v3/user/webhooks/event/settings/{id}`
- `GET` `/v3/user/webhooks/parse/settings`
- `POST` `/v3/user/webhooks/parse/settings`
- `DELETE` `/v3/user/webhooks/parse/settings/{hostname}`
- `GET` `/v3/user/webhooks/parse/settings/{hostname}`
- `PATCH` `/v3/user/webhooks/parse/settings/{hostname}`
- `GET` `/v3/user/webhooks/parse/stats`
- `GET` `/v3/user/webhooks/security/policies`
- `POST` `/v3/user/webhooks/security/policies`
- `DELETE` `/v3/user/webhooks/security/policies/{id}`
- `GET` `/v3/user/webhooks/security/policies/{id}`
- `PATCH` `/v3/user/webhooks/security/policies/{id}`

</details>

**Missing** (7)

- No single-message fetch (GET /v3/messages/{msg_id})
- No GET of event-webhook settings (POST-only)
- No suppression lists (bounces, blocks, invalid emails, spam reports)
- No scheduled-send management (/v3/scheduled_sends)
- No API keys management (/v3/api_keys)
- No sender authentication or domains setup
- No templates surface (/v3/templates)

**Deviations** (6)

- Webhook ECDSA signature is raw r||s (64 bytes), not Twilio ASN.1 DER encoding
- simulate_fail: true in send body forces dropped terminal (simulator extension)
- delivered derives at fixed +3s on first list read, not real async delivery
- Email Activity query subset: =, !=, CONTAINS terms AND-ed over six fields
- Each delivery wraps one event in the transport envelope; real SendGrid batches a JSON array of events
- asm, sandbox_mode, and batch_id are accepted but not modeled

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v3/mail/send` — body, auth, stateful, webhooks, clock
- `GET` `/v3/messages` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `POST` `/v3/user/webhooks/event/settings` — body, auth, stateful, errors, clock
- `GET` `/v3/user/webhooks/event/settings` — auth, stateful, clock
- `POST` `/v3/user/webhooks/event/test` — auth, stateful, webhooks, errors, clock

</details>

### servicenow-style

**Covered** — 44 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/api/now/table/incident` |
| POST | `/api/now/table/incident` |
| GET | `/api/now/table/incident/{sys_id}` |
| PUT | `/api/now/table/incident/{sys_id}` |
| PATCH | `/api/now/table/incident/{sys_id}` |
| DELETE | `/api/now/table/incident/{sys_id}` |
| GET | `/api/now/table/task` |
| POST | `/api/now/table/task` |
| GET | `/api/now/table/task/{sys_id}` |
| PUT | `/api/now/table/task/{sys_id}` |
| PATCH | `/api/now/table/task/{sys_id}` |
| DELETE | `/api/now/table/task/{sys_id}` |
| GET | `/api/now/table/change_request` |
| POST | `/api/now/table/change_request` |
| GET | `/api/now/table/change_request/{sys_id}` |
| PUT | `/api/now/table/change_request/{sys_id}` |
| PATCH | `/api/now/table/change_request/{sys_id}` |
| DELETE | `/api/now/table/change_request/{sys_id}` |
| GET | `/api/now/table/cmdb_ci` |
| POST | `/api/now/table/cmdb_ci` |
| GET | `/api/now/table/cmdb_ci/{sys_id}` |
| PUT | `/api/now/table/cmdb_ci/{sys_id}` |
| PATCH | `/api/now/table/cmdb_ci/{sys_id}` |
| DELETE | `/api/now/table/cmdb_ci/{sys_id}` |
| GET | `/api/now/table/sys_user` |
| POST | `/api/now/table/sys_user` |
| GET | `/api/now/table/sys_user/{sys_id}` |
| PUT | `/api/now/table/sys_user/{sys_id}` |
| PATCH | `/api/now/table/sys_user/{sys_id}` |
| DELETE | `/api/now/table/sys_user/{sys_id}` |
| GET | `/api/now/table/sys_user_group` |
| POST | `/api/now/table/sys_user_group` |
| GET | `/api/now/table/sys_user_group/{sys_id}` |
| PUT | `/api/now/table/sys_user_group/{sys_id}` |
| PATCH | `/api/now/table/sys_user_group/{sys_id}` |
| DELETE | `/api/now/table/sys_user_group/{sys_id}` |
| GET | `/api/now/table/sc_req_item` |
| POST | `/api/now/table/sc_req_item` |
| GET | `/api/now/table/sc_req_item/{sys_id}` |
| PUT | `/api/now/table/sc_req_item/{sys_id}` |
| PATCH | `/api/now/table/sc_req_item/{sys_id}` |
| DELETE | `/api/now/table/sc_req_item/{sys_id}` |
| GET | `/api/now/table/sys_metadata` |
| POST | `/api/now/import/u_my_table` |

</details>

**Missing** (5)

- Only a fixed table set (incident, task, change_request, cmdb_ci, ...) — no custom tables
- No attachment API (/api/now/attachment)
- No aggregate statistics API (/api/now/stats/{table})
- No service catalog API (/api/sn_sc/servicecatalog)
- No batch API (/api/now/v1/batch)

**Deviations** (1)

- sysparm_query supports an operator subset; NOT LIKE and similar 400-rejected

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/api/now/table/incident` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/incident` — body, auth, stateful, clock
- `GET` `/api/now/table/incident/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/incident/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/incident/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/incident/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/task` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/task` — body, auth, stateful, clock
- `GET` `/api/now/table/task/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/task/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/task/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/task/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/change_request` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/change_request` — body, auth, stateful, clock
- `GET` `/api/now/table/change_request/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/change_request/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/change_request/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/change_request/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/cmdb_ci` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/cmdb_ci` — body, auth, stateful, clock
- `GET` `/api/now/table/cmdb_ci/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/cmdb_ci/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/cmdb_ci/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/cmdb_ci/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/sys_user` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/sys_user` — body, auth, stateful, clock
- `GET` `/api/now/table/sys_user/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/sys_user/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/sys_user/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/sys_user/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/sys_user_group` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/sys_user_group` — body, auth, stateful, clock
- `GET` `/api/now/table/sys_user_group/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/sys_user_group/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/sys_user_group/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/sys_user_group/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/sc_req_item` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/table/sc_req_item` — body, auth, stateful, clock
- `GET` `/api/now/table/sc_req_item/{sys_id}` — params, auth, stateful, clock
- `PUT` `/api/now/table/sc_req_item/{sys_id}` — body, params, auth, stateful, clock
- `PATCH` `/api/now/table/sc_req_item/{sys_id}` — body, params, auth, stateful, clock
- `DELETE` `/api/now/table/sc_req_item/{sys_id}` — params, auth, stateful, clock
- `GET` `/api/now/table/sys_metadata` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/now/import/u_my_table` — body, auth, stateful, clock

</details>

### shopify-style

**Covered** — 21 routes · GraphQL schema

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/admin/oauth/authorize` |
| POST | `/admin/oauth/access_token` |
| GET | `/admin/api/2024-10/products.json` |
| POST | `/admin/api/2024-10/products.json` |
| GET | `/admin/api/2024-10/products/{product_id}` |
| PUT | `/admin/api/2024-10/products/{product_id}` |
| DELETE | `/admin/api/2024-10/products/{product_id}` |
| GET | `/admin/api/2024-10/orders.json` |
| POST | `/admin/api/2024-10/orders.json` |
| GET | `/admin/api/2024-10/orders/{order_id}` |
| POST | `/admin/api/2024-10/orders/{order_id}/cancel.json` |
| POST | `/admin/api/2024-10/orders/{order_id}/close.json` |
| POST | `/admin/api/2024-10/orders/{order_id}/fulfillments.json` |
| POST | `/admin/api/2024-10/orders/{order_id}/transactions.json` |
| GET | `/admin/api/2024-10/customers.json` |
| POST | `/admin/api/2024-10/customers.json` |
| PUT | `/admin/api/2024-10/customers/{customer_id}` |
| DELETE | `/admin/api/2024-10/customers/{customer_id}` |
| GET | `/admin/api/2024-10/webhooks.json` |
| POST | `/admin/api/2024-10/webhooks.json` |
| DELETE | `/admin/api/2024-10/webhooks/{webhook_id}` |

</details>

**Missing** (7)

- No fulfillment-orders or fulfillment-events endpoints (fulfillments POST only)
- No transaction listing (GET /orders/{id}/transactions.json)
- No refunds endpoint (POST /orders/{id}/refunds.json)
- No Inventory API (inventory_items, inventory_levels)
- No product image or standalone variant CRUD routes
- GraphQL schema limited to shop, product, order, customer types
- No price rules, discount codes, gift cards, or draft orders

**Deviations** (4)

- GraphQL endpoint skips the X-Shopify-Access-Token check the REST surface enforces
- Webhook payloads ride stunt {type, payload} envelope, not raw Shopify event bodies
- OAuth authorize redirect omits the hmac query-param signature it documents
- GraphQL query arg subset: bare substring plus field:value equality tokens only

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/admin/oauth/authorize` — query, stateful, errors
- `POST` `/admin/oauth/access_token` — body, stateful, errors
- `GET` `/admin/api/2024-10/products.json` — query, auth, stateful, paginate, clock
- `POST` `/admin/api/2024-10/products.json` — body, auth, stateful, webhooks, clock
- `GET` `/admin/api/2024-10/products/{product_id}` — params, auth, stateful, errors, clock
- `PUT` `/admin/api/2024-10/products/{product_id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/admin/api/2024-10/products/{product_id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/admin/api/2024-10/orders.json` — query, auth, stateful, paginate, filter, clock
- `POST` `/admin/api/2024-10/orders.json` — body, auth, stateful, webhooks, errors, clock
- `GET` `/admin/api/2024-10/orders/{order_id}` — params, auth, stateful, errors, clock
- `POST` `/admin/api/2024-10/orders/{order_id}/cancel.json` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/admin/api/2024-10/orders/{order_id}/close.json` — params, auth, stateful, webhooks, errors, clock
- `POST` `/admin/api/2024-10/orders/{order_id}/fulfillments.json` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/admin/api/2024-10/orders/{order_id}/transactions.json` — body, params, auth, stateful, errors, clock
- `GET` `/admin/api/2024-10/customers.json` — query, auth, stateful, paginate, clock
- `POST` `/admin/api/2024-10/customers.json` — body, auth, stateful, webhooks, errors, clock
- `PUT` `/admin/api/2024-10/customers/{customer_id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/admin/api/2024-10/customers/{customer_id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/admin/api/2024-10/webhooks.json` — query, auth, stateful, paginate, clock
- `POST` `/admin/api/2024-10/webhooks.json` — body, auth, stateful, clock
- `DELETE` `/admin/api/2024-10/webhooks/{webhook_id}` — params, auth, stateful, errors, clock

</details>

### signin-with-apple-style

**Covered** — 3 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/auth/authorize` |
| POST | `/auth/token` |
| GET | `/auth/keys` |

</details>

**Missing** (3)

- No token revocation (POST /auth/revoke)
- No user endpoint (GET /auth/user for name/email)
- No server-to-server events (POST /api/v1/revoke)

**Deviations** (2)

- JWKS serves one fixed synthetic P-256 key (kid mock-siwa-key-1) — no rotation
- client_secret checks alg, signature, aud, exp only — iss/sub claims not enforced

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/auth/authorize` — query, stateful, errors
- `POST` `/auth/token` — body, stateful, errors, clock
- `GET` `/auth/keys` — —

</details>

### slack-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/auth.test` |
| POST | `/api/chat.postMessage` |
| POST | `/api/conversations.create` |
|  | `/api/conversations.list` |
|  | `/api/conversations.history` |
| POST | `/api/reactions.add` |
| POST | `/api/apps.events.url` |

</details>

**Provider surface** — derived from sdk slack-node @ 7.19.0 (floor): 272 real routes · 6 covered · 2% · 266 not implemented

<details><summary>not implemented (266)</summary>

- `POST` `/api/admin.analytics.getFile`
- `POST` `/api/admin.apps.activities.list`
- `POST` `/api/admin.apps.approve`
- `POST` `/api/admin.apps.approved.list`
- `POST` `/api/admin.apps.clearResolution`
- `POST` `/api/admin.apps.config.lookup`
- `POST` `/api/admin.apps.config.set`
- `POST` `/api/admin.apps.requests.cancel`
- `POST` `/api/admin.apps.requests.list`
- `POST` `/api/admin.apps.restrict`
- `POST` `/api/admin.apps.restricted.list`
- `POST` `/api/admin.apps.uninstall`
- `POST` `/api/admin.auth.policy.assignEntities`
- `POST` `/api/admin.auth.policy.getEntities`
- `POST` `/api/admin.auth.policy.removeEntities`
- `POST` `/api/admin.barriers.create`
- `POST` `/api/admin.barriers.delete`
- `POST` `/api/admin.barriers.list`
- `POST` `/api/admin.barriers.update`
- `POST` `/api/admin.conversations.archive`
- `POST` `/api/admin.conversations.bulkArchive`
- `POST` `/api/admin.conversations.bulkDelete`
- `POST` `/api/admin.conversations.bulkMove`
- `POST` `/api/admin.conversations.convertToPrivate`
- `POST` `/api/admin.conversations.convertToPublic`
- `POST` `/api/admin.conversations.create`
- `POST` `/api/admin.conversations.delete`
- `POST` `/api/admin.conversations.disconnectShared`
- `POST` `/api/admin.conversations.ekm.listOriginalConnectedChannelInfo`
- `POST` `/api/admin.conversations.getConversationPrefs`
- `POST` `/api/admin.conversations.getCustomRetention`
- `POST` `/api/admin.conversations.getTeams`
- `POST` `/api/admin.conversations.invite`
- `POST` `/api/admin.conversations.lookup`
- `POST` `/api/admin.conversations.removeCustomRetention`
- `POST` `/api/admin.conversations.rename`
- `POST` `/api/admin.conversations.restrictAccess.addGroup`
- `POST` `/api/admin.conversations.restrictAccess.listGroups`
- `POST` `/api/admin.conversations.restrictAccess.removeGroup`
- `POST` `/api/admin.conversations.search`
- `POST` `/api/admin.conversations.setConversationPrefs`
- `POST` `/api/admin.conversations.setCustomRetention`
- `POST` `/api/admin.conversations.setTeams`
- `POST` `/api/admin.conversations.unarchive`
- `POST` `/api/admin.emoji.add`
- `POST` `/api/admin.emoji.addAlias`
- `POST` `/api/admin.emoji.list`
- `POST` `/api/admin.emoji.remove`
- `POST` `/api/admin.emoji.rename`
- `POST` `/api/admin.functions.list`
… and 216 more


</details>

**Missing** (6)

- Only 7 Web API methods; no chat.update, chat.delete, or chat.scheduleMessage
- No conversations.members, join, leave, open, or rename; no users.list/users.info
- No reactions.remove or reactions.list
- No message threads: conversations.replies and chat.getPermalink absent
- No files (files.upload/info/list), search, views, or dialogs surfaces
- Only message, channel_created, reaction_added events; no app_mention or team_join

**Deviations** (2)

- apps.events.url config endpoint is simulator-only; real Slack sets it in the app dashboard
- Events deliveries wrap Slack event_callback payloads in an extra stunt envelope

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/auth.test` — auth, stateful, clock
- `POST` `/api/chat.postMessage` — body, auth, stateful, webhooks, clock
- `POST` `/api/conversations.create` — body, auth, stateful, webhooks, clock
- `` `/api/conversations.list` — body, query, auth, stateful, paginate, clock
- `` `/api/conversations.history` — body, query, auth, stateful, paginate, clock
- `POST` `/api/reactions.add` — body, auth, stateful, webhooks, clock
- `POST` `/api/apps.events.url` — body, auth, stateful, webhooks, clock

</details>

### smartbill-style

**Covered** — 18 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/invoice` |
| GET | `/invoice` |
| PUT | `/invoice/cancel` |
| PUT | `/invoice/restore` |
| GET | `/invoice/paymentstatus` |
| POST | `/estimate` |
| GET | `/estimate` |
| PUT | `/estimate/cancel` |
| POST | `/purchase` |
| GET | `/purchase` |
| POST | `/payment` |
| DELETE | `/payment/v2` |
| GET | `/stocks` |
| POST | `/document/send` |
| GET | `/tax` |
| GET | `/series` |
| POST | `/sim/company` |
| POST | `/sim/stocks/movement` |

</details>

**Missing** (3)

- No invoice/estimate/purchase list endpoints
- No PDF rendering, e-Factura (ANAF SPV) transmission, or email/SMS delivery
- No GET /invoice/paymentstatus (paidAmount/unpaidAmount/paid reporting)

**Deviations** (4)

- paymentId on POST /invoice/payment is a simulator extension for the delete flow
- /tax and /series require no cif (real SmartBill scopes both per company)
- cif falls back to ?cif= for POST bodies; the real API takes companyVatCode from the body only
- Overpaid invoices report paidAmount above total and a zero-total invoice can never read paid

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/invoice` — body, query, stateful, clock
- `GET` `/invoice` — query, stateful
- `PUT` `/invoice/cancel` — body, query, stateful
- `PUT` `/invoice/restore` — body, query, stateful
- `GET` `/invoice/paymentstatus` — query, stateful
- `POST` `/estimate` — body, query, stateful, clock
- `GET` `/estimate` — query, stateful
- `PUT` `/estimate/cancel` — body, query, stateful
- `POST` `/purchase` — body, query, stateful, clock
- `GET` `/purchase` — query, stateful
- `POST` `/payment` — body, query, stateful, clock
- `DELETE` `/payment/v2` — body, query, stateful
- `GET` `/stocks` — query, stateful
- `POST` `/document/send` — body, query, stateful, clock
- `GET` `/tax` — —
- `GET` `/series` — —
- `POST` `/sim/company` — body, stateful
- `POST` `/sim/stocks/movement` — body, query, stateful

</details>

### sqs-style

**Covered** — 2 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/` |
| POST | `/{queueName}` |

</details>

**Missing** (4)

- No ListQueues MaxResults/NextToken paging; no AttributeNames prefix wildcards (.*)
- No AddPermission/RemovePermission, Tag/Untag/ListQueueTags, or ListDeadLetterSourceQueues
- No presigned URL (query-parameter) auth; SigV4 Authorization header only
- FIFO queues allowed by name only; no MessageGroupId or deduplication semantics

**Deviations** (5)

- QueueUrl omits the 12-digit account id; http://<host>/<queueName> instead of the AWS path
- No long polling: WaitTimeSeconds is validated but never blocks; receive returns at once
- MD5OfMessageAttributes omitted (compound encoding not reproduced), only body MD5
- PurgeQueue is immediate, not async; the one-purge-per-60s rule is still enforced
- Message ids and receipt handles are synthetic deterministic strings, not real AWS ids

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/` — body, query, stateful, clock
- `POST` `/{queueName}` — body, query, params, stateful, clock

</details>

### square-style

**Covered** — 18 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/oauth2/token` |
| GET | `/v2/payments` |
| POST | `/v2/payments` |
| GET | `/v2/payments/{id}` |
| DELETE | `/v2/payments/{id}` |
| POST | `/v2/payments/{id}/complete` |
| POST | `/v2/payments/{id}/capture` |
| GET | `/v2/refunds` |
| POST | `/v2/refunds` |
| GET | `/v2/locations` |
| POST | `/v2/catalog/search` |
| POST | `/v2/orders` |
| POST | `/v2/orders/calculate` |
| GET | `/v2/orders/{id}` |
| PUT | `/v2/orders/{id}` |
| DELETE | `/v2/orders/{id}` |
| POST | `/v2/orders/{id}/pay` |
| POST | `/v2/orders/{id}/complete` |

</details>

**Provider surface** — derived from sdk square-node @ 45.1.0 (floor): 329 real routes · 13 covered · 3% · 316 not implemented

<details><summary>not implemented (316)</summary>

- `POST` `/v2/apple-pay/domains`
- `GET` `/v2/bank-accounts`
- `POST` `/v2/bank-accounts`
- `GET` `/v2/bank-accounts/by-v1-id/{v1_bank_account_id}`
- `GET` `/v2/bank-accounts/{bank_account_id}`
- `POST` `/v2/bank-accounts/{bank_account_id}/disable`
- `GET` `/v2/bookings`
- `POST` `/v2/bookings`
- `POST` `/v2/bookings/availability/search`
- `POST` `/v2/bookings/bulk-retrieve`
- `GET` `/v2/bookings/business-booking-profile`
- `GET` `/v2/bookings/custom-attribute-definitions`
- `POST` `/v2/bookings/custom-attribute-definitions`
- `DELETE` `/v2/bookings/custom-attribute-definitions/{key}`
- `GET` `/v2/bookings/custom-attribute-definitions/{key}`
- `PUT` `/v2/bookings/custom-attribute-definitions/{key}`
- `POST` `/v2/bookings/custom-attributes/bulk-delete`
- `POST` `/v2/bookings/custom-attributes/bulk-upsert`
- `GET` `/v2/bookings/location-booking-profiles`
- `GET` `/v2/bookings/location-booking-profiles/{location_id}`
- `GET` `/v2/bookings/team-member-booking-profiles`
- `POST` `/v2/bookings/team-member-booking-profiles/bulk-retrieve`
- `GET` `/v2/bookings/team-member-booking-profiles/{team_member_id}`
- `GET` `/v2/bookings/{booking_id}`
- `PUT` `/v2/bookings/{booking_id}`
- `POST` `/v2/bookings/{booking_id}/cancel`
- `GET` `/v2/bookings/{booking_id}/custom-attributes`
- `DELETE` `/v2/bookings/{booking_id}/custom-attributes/{key}`
- `GET` `/v2/bookings/{booking_id}/custom-attributes/{key}`
- `PUT` `/v2/bookings/{booking_id}/custom-attributes/{key}`
- `GET` `/v2/cards`
- `POST` `/v2/cards`
- `GET` `/v2/cards/{card_id}`
- `POST` `/v2/cards/{card_id}/disable`
- `GET` `/v2/cash-drawers/shifts`
- `GET` `/v2/cash-drawers/shifts/{shift_id}`
- `GET` `/v2/cash-drawers/shifts/{shift_id}/events`
- `POST` `/v2/catalog/batch-delete`
- `POST` `/v2/catalog/batch-retrieve`
- `POST` `/v2/catalog/batch-upsert`
- `POST` `/v2/catalog/images`
- `PUT` `/v2/catalog/images/{image_id}`
- `GET` `/v2/catalog/info`
- `GET` `/v2/catalog/list`
- `POST` `/v2/catalog/object`
- `DELETE` `/v2/catalog/object/{object_id}`
- `GET` `/v2/catalog/object/{object_id}`
- `POST` `/v2/catalog/search-catalog-items`
- `POST` `/v2/catalog/update-item-modifier-lists`
- `POST` `/v2/catalog/update-item-taxes`
… and 266 more


</details>

**Missing** (7)

- No Customers API at all (create/list/retrieve customers)
- Catalog is search-only; no upsert, batch-retrieve, list, or info endpoints
- No Invoices, Terminal, Loyalty, Gift Cards, Bookings, or Team APIs
- No POST /v2/payments/{id}/cancel for authorized payments
- No /oauth2/revoke or token access-check; only the exchange exists
- No webhook subscription endpoints; the delivery sink is stunt config
- No orders list (GET /v2/orders) or POST /v2/orders/search

**Deviations** (2)

- DELETE /v2/payments/{id} and DELETE /v2/orders/{id} are stunt extensions, not real Square
- Square-Version header is required (400 when absent); real Square defaults it

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/oauth2/token` — body, stateful, clock
- `GET` `/v2/payments` — query, stateful, paginate, filter, clock
- `POST` `/v2/payments` — body, stateful, webhooks, clock
- `GET` `/v2/payments/{id}` — params, stateful, clock
- `DELETE` `/v2/payments/{id}` — params, stateful, clock
- `POST` `/v2/payments/{id}/complete` — params, stateful, webhooks, clock
- `POST` `/v2/payments/{id}/capture` — params, stateful, webhooks, clock
- `GET` `/v2/refunds` — query, stateful, paginate, filter, clock
- `POST` `/v2/refunds` — body, stateful, webhooks, clock
- `GET` `/v2/locations` — query, stateful, paginate, clock
- `POST` `/v2/catalog/search` — body, stateful, clock
- `POST` `/v2/orders` — body, stateful, clock
- `POST` `/v2/orders/calculate` — body, stateful, clock
- `GET` `/v2/orders/{id}` — params, stateful, clock
- `PUT` `/v2/orders/{id}` — body, params, stateful, clock
- `DELETE` `/v2/orders/{id}` — params, stateful, clock
- `POST` `/v2/orders/{id}/pay` — body, params, stateful, webhooks, clock
- `POST` `/v2/orders/{id}/complete` — params, stateful, clock

</details>

### stripe-style

**Covered** — 158 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/tokens` |
| GET | `/v1/events` |
| GET | `/v1/events/{id}` |
| POST | `/v1/test_clocks` |
| GET | `/v1/test_clocks` |
| POST | `/v1/test_clocks/{id}/advance` |
| GET | `/v1/test_clocks/{id}` |
| DELETE | `/v1/test_clocks/{id}` |
| POST | `/v1/test_helpers/test_clocks` |
| GET | `/v1/test_helpers/test_clocks` |
| POST | `/v1/test_helpers/test_clocks/{id}/advance` |
| GET | `/v1/test_helpers/test_clocks/{id}` |
| DELETE | `/v1/test_helpers/test_clocks/{id}` |
| POST | `/v1/charges` |
| GET | `/v1/charges/{id}` |
| GET | `/v1/charges` |
| POST | `/v1/charges/{id}/capture` |
| POST | `/v1/charges/{id}/refund` |
| POST | `/v1/payment_intents` |
| POST | `/v1/payment_intents/{id}/confirm` |
| POST | `/v1/payment_intents/{id}/capture` |
| GET | `/v1/payment_intents/{id}` |
| GET | `/v1/payment_intents` |
| POST | `/v1/payment_methods` |
| POST | `/v1/payment_methods/{id}/attach` |
| POST | `/v1/payment_methods/{id}/detach` |
| GET | `/v1/payment_methods/{id}` |
| GET | `/v1/payment_methods` |
| POST | `/v1/refunds` |
| GET | `/v1/refunds/{id}` |
| GET | `/v1/refunds` |
| POST | `/v1/refunds/{id}/cancel` |
| POST | `/v1/customers` |
| GET | `/v1/customers/{id}` |
| GET | `/v1/customers` |
| POST | `/v1/customers/{id}` |
| DELETE | `/v1/customers/{id}` |
| POST | `/v1/products` |
| GET | `/v1/products` |
| GET | `/v1/products/{id}` |
| POST | `/v1/products/{id}` |
| DELETE | `/v1/products/{id}` |
| POST | `/v1/prices` |
| GET | `/v1/prices` |
| GET | `/v1/prices/{id}` |
| POST | `/v1/prices/{id}` |
| POST | `/v1/subscriptions` |
| GET | `/v1/subscriptions` |
| GET | `/v1/subscriptions/{id}` |
| POST | `/v1/subscriptions/{id}` |
| POST | `/v1/subscriptions/{id}/cancel` |
| GET | `/v1/subscription_items` |
| POST | `/v1/subscription_items` |
| POST | `/v1/subscription_items/{id}` |
| DELETE | `/v1/subscription_items/{id}` |
| POST | `/v1/subscription_items/{id}/usage_records` |
| GET | `/v1/subscription_items/{id}/usage_records` |
| POST | `/v1/invoices` |
| GET | `/v1/invoices` |
| GET | `/v1/invoices/upcoming` |
| GET | `/v1/invoices/{id}` |
| POST | `/v1/invoices/{id}` |
| DELETE | `/v1/invoices/{id}` |
| POST | `/v1/invoices/{id}/finalize` |
| POST | `/v1/invoices/{id}/pay` |
| POST | `/v1/invoices/{id}/send` |
| POST | `/v1/invoices/{id}/void` |
| POST | `/v1/invoices/{id}/mark_uncollectible` |
| GET | `/v1/invoices/{id}/lines` |
| POST | `/v1/invoice_items` |
| GET | `/v1/invoice_items` |
| GET | `/v1/invoice_items/{id}` |
| POST | `/v1/invoice_items/{id}` |
| DELETE | `/v1/invoice_items/{id}` |
| POST | `/v1/credit_notes` |
| GET | `/v1/credit_notes` |
| GET | `/v1/credit_notes/preview` |
| GET | `/v1/credit_notes/{id}` |
| POST | `/v1/credit_notes/{id}` |
| POST | `/v1/credit_notes/{id}/void` |
| POST | `/v1/coupons` |
| GET | `/v1/coupons` |
| GET | `/v1/coupons/{id}` |
| POST | `/v1/coupons/{id}` |
| DELETE | `/v1/coupons/{id}` |
| POST | `/v1/promotion_codes` |
| GET | `/v1/promotion_codes` |
| GET | `/v1/promotion_codes/{id}` |
| POST | `/v1/promotion_codes/{id}` |
| POST | `/v1/tax_rates` |
| GET | `/v1/tax_rates` |
| GET | `/v1/tax_rates/{id}` |
| POST | `/v1/tax_rates/{id}` |
| DELETE | `/v1/tax_rates/{id}` |
| GET | `/v1/balance` |
| GET | `/v1/balance_transactions` |
| GET | `/v1/balance_transactions/{id}` |
| GET | `/v1/disputes` |
| GET | `/v1/disputes/{id}` |
| POST | `/v1/disputes/{id}` |
| POST | `/v1/disputes/{id}/close` |
| GET | `/v1/application_fees` |
| GET | `/v1/application_fees/{id}` |
| GET | `/v1/application_fees/{id}/refunds` |
| POST | `/v1/application_fees/{id}/refunds` |
| POST | `/v1/application_fees/{id}/refund` |
| POST | `/v1/checkout/sessions` |
| GET | `/v1/checkout/sessions` |
| GET | `/v1/checkout/sessions/{id}/line_items` |
| POST | `/v1/checkout/sessions/{id}/expire` |
| GET | `/v1/checkout/sessions/{id}` |
| GET | `/c/pay/{id}` |
| POST | `/v1/setup_intents` |
| GET | `/v1/setup_intents` |
| POST | `/v1/setup_intents/{id}/confirm` |
| POST | `/v1/setup_intents/{id}/cancel` |
| GET | `/v1/setup_intents/{id}` |
| POST | `/v1/setup_intents/{id}` |
| POST | `/v1/webhook_endpoints` |
| GET | `/v1/webhook_endpoints` |
| GET | `/v1/webhook_endpoints/{id}` |
| POST | `/v1/webhook_endpoints/{id}` |
| DELETE | `/v1/webhook_endpoints/{id}` |
| POST | `/v1/files` |
| GET | `/v1/files` |
| GET | `/v1/files/{id}` |
| POST | `/v1/file_links` |
| GET | `/v1/file_links` |
| GET | `/v1/file_links/{id}` |
| POST | `/v1/file_links/{id}` |
| POST | `/v1/accounts` |
| GET | `/v1/accounts/{id}` |
| POST | `/v1/accounts/{id}` |
| GET | `/v1/accounts` |
| POST | `/v1/accounts/{id}/persons` |
| GET | `/v1/accounts/{id}/persons` |
| GET | `/v1/accounts/{id}/persons/{person_id}` |
| POST | `/v1/accounts/{id}/persons/{person_id}` |
| DELETE | `/v1/accounts/{id}/persons/{person_id}` |
| GET | `/v1/persons/{id}` |
| POST | `/v1/persons/{id}` |
| POST | `/v1/accounts/{id}/external_accounts` |
| GET | `/v1/accounts/{id}/external_accounts` |
| GET | `/v1/accounts/{id}/external_accounts/{ea_id}` |
| DELETE | `/v1/accounts/{id}/external_accounts/{ea_id}` |
| POST | `/v1/accounts/{id}/login_links` |
| POST | `/v1/account_links` |
| POST | `/v1/transfers` |
| GET | `/v1/transfers/{id}` |
| GET | `/v1/transfers` |
| POST | `/v1/transfers/{id}/reversals` |
| GET | `/v1/transfers/{id}/reversals` |
| GET | `/v1/transfers/{id}/reversals/{tr_id}` |
| POST | `/v1/payouts` |
| GET | `/v1/payouts` |
| GET | `/v1/payouts/{id}` |
| POST | `/v1/payouts/{id}` |
| POST | `/v1/payouts/{id}/cancel` |

</details>

**Provider surface** — derived from sdk stripe-node @ 22.5.0 (floor): 568 real routes · 138 covered · 24% · 430 not implemented

<details><summary>not implemented (430)</summary>

- `POST` `/oauth/deauthorize`
- `POST` `/oauth/token`
- `GET` `/v1/account`
- `POST` `/v1/account_sessions`
- `GET` `/v1/accounts/{accountId}/capabilities/{id}`
- `POST` `/v1/accounts/{accountId}/capabilities/{id}`
- `POST` `/v1/accounts/{accountId}/external_accounts/{id}`
- `DELETE` `/v1/accounts/{id}`
- `GET` `/v1/accounts/{id}/capabilities`
- `POST` `/v1/accounts/{id}/reject`
- `POST` `/v1/accounts/{id}/unreject`
- `GET` `/v1/apple_pay/domains`
- `POST` `/v1/apple_pay/domains`
- `DELETE` `/v1/apple_pay/domains/{id}`
- `GET` `/v1/apple_pay/domains/{id}`
- `GET` `/v1/application_fees/{feeId}/refunds/{id}`
- `POST` `/v1/application_fees/{feeId}/refunds/{id}`
- `GET` `/v1/apps/secrets`
- `POST` `/v1/apps/secrets`
- `POST` `/v1/apps/secrets/delete`
- `GET` `/v1/apps/secrets/find`
- `GET` `/v1/balance_settings`
- `POST` `/v1/balance_settings`
- `GET` `/v1/billing/alerts`
- `POST` `/v1/billing/alerts`
- `GET` `/v1/billing/alerts/{id}`
- `POST` `/v1/billing/alerts/{id}/activate`
- `POST` `/v1/billing/alerts/{id}/archive`
- `POST` `/v1/billing/alerts/{id}/deactivate`
- `GET` `/v1/billing/credit_balance_summary`
- `GET` `/v1/billing/credit_balance_transactions`
- `GET` `/v1/billing/credit_balance_transactions/{id}`
- `GET` `/v1/billing/credit_grants`
- `POST` `/v1/billing/credit_grants`
- `GET` `/v1/billing/credit_grants/{id}`
- `POST` `/v1/billing/credit_grants/{id}`
- `POST` `/v1/billing/credit_grants/{id}/expire`
- `POST` `/v1/billing/credit_grants/{id}/void`
- `POST` `/v1/billing/meter_event_adjustments`
- `POST` `/v1/billing/meter_events`
- `GET` `/v1/billing/meters`
- `POST` `/v1/billing/meters`
- `GET` `/v1/billing/meters/{id}`
- `POST` `/v1/billing/meters/{id}`
- `POST` `/v1/billing/meters/{id}/deactivate`
- `GET` `/v1/billing/meters/{id}/event_summaries`
- `POST` `/v1/billing/meters/{id}/reactivate`
- `GET` `/v1/billing_portal/configurations`
- `POST` `/v1/billing_portal/configurations`
- `GET` `/v1/billing_portal/configurations/{id}`
… and 380 more


</details>

**Missing** (7)

- No POST /v1/payment_intents/{id}/cancel
- No Payment Links API (/v1/payment_links)
- No Stripe Tax calculation, settings, or registration endpoints
- No Quotes, Identity, Radar, or Issuing APIs
- No Terminal, Financial Connections, Reporting, or Sigma surfaces
- No /v1/billing/meters or meter event stream endpoints
- No ephemeral keys or Apple Pay domain endpoints

**Deviations** (5)

- Test clocks are one global time offset shared by all objects, not per-object clocks
- No proration lines on item changes; proration_behavior accepted but treated as none
- Checkout hosted page auto-completes 3DS/SCA cards instead of issuing a challenge
- Webhooks go to one sink; registered endpoints gate event types, not per-endpoint URLs
- Lifecycles compressed: refunds settle at +3s, payouts at +60s, disputes in 1 day

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/tokens` — body, auth, stateful, errors, clock
- `GET` `/v1/events` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/events/{id}` — params, auth, stateful, errors
- `POST` `/v1/test_clocks` — body, auth, stateful, errors, clock
- `GET` `/v1/test_clocks` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/test_clocks/{id}/advance` — body, params, auth, stateful, errors, clock
- `GET` `/v1/test_clocks/{id}` — params, auth, stateful, errors
- `DELETE` `/v1/test_clocks/{id}` — params, auth, stateful, errors
- `POST` `/v1/test_helpers/test_clocks` — body, auth, stateful, errors, clock
- `GET` `/v1/test_helpers/test_clocks` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/test_helpers/test_clocks/{id}/advance` — body, params, auth, stateful, errors, clock
- `GET` `/v1/test_helpers/test_clocks/{id}` — params, auth, stateful, errors
- `DELETE` `/v1/test_helpers/test_clocks/{id}` — params, auth, stateful, errors
- `POST` `/v1/charges` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/charges/{id}` — params, auth, stateful, errors
- `GET` `/v1/charges` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/charges/{id}/capture` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/charges/{id}/refund` — body, params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/payment_intents` — body, auth, stateful, webhooks, errors, clock
- `POST` `/v1/payment_intents/{id}/confirm` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/payment_intents/{id}/capture` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/payment_intents/{id}` — params, auth, stateful, errors
- `GET` `/v1/payment_intents` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/payment_methods` — body, auth, stateful
- `POST` `/v1/payment_methods/{id}/attach` — body, params, auth, stateful, errors
- `POST` `/v1/payment_methods/{id}/detach` — params, auth, stateful, errors
- `GET` `/v1/payment_methods/{id}` — params, auth, stateful, errors
- `GET` `/v1/payment_methods` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/refunds` — body, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/refunds/{id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/refunds` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `POST` `/v1/refunds/{id}/cancel` — params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/customers` — body, auth, stateful
- `GET` `/v1/customers/{id}` — params, auth, stateful, errors
- `GET` `/v1/customers` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/customers/{id}` — body, params, auth, stateful, errors
- `DELETE` `/v1/customers/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/products` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/products` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/products/{id}` — params, auth, stateful, errors
- `POST` `/v1/products/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/products/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/prices` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/prices` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/prices/{id}` — params, auth, stateful, errors
- `POST` `/v1/prices/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/subscriptions` — body, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/subscriptions` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `GET` `/v1/subscriptions/{id}` — params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/subscriptions/{id}` — body, params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/subscriptions/{id}/cancel` — body, params, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/subscription_items` — query, auth, stateful, paginate, errors
- `POST` `/v1/subscription_items` — body, auth, stateful, webhooks, errors, clock
- `POST` `/v1/subscription_items/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/subscription_items/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/subscription_items/{id}/usage_records` — body, params, auth, stateful, filter, errors, clock
- `GET` `/v1/subscription_items/{id}/usage_records` — query, params, auth, stateful, paginate, filter, errors
- `POST` `/v1/invoices` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/invoices` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/invoices/upcoming` — query, auth, stateful, filter, errors, clock
- `GET` `/v1/invoices/{id}` — params, auth, stateful, errors
- `POST` `/v1/invoices/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/invoices/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/invoices/{id}/finalize` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/invoices/{id}/pay` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/invoices/{id}/send` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/invoices/{id}/void` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/invoices/{id}/mark_uncollectible` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/invoices/{id}/lines` — query, params, auth, stateful, paginate, errors
- `POST` `/v1/invoice_items` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/invoice_items` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/invoice_items/{id}` — params, auth, stateful, errors
- `POST` `/v1/invoice_items/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/invoice_items/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/credit_notes` — body, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/credit_notes` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/credit_notes/preview` — body, query, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/credit_notes/{id}` — params, auth, stateful, errors
- `POST` `/v1/credit_notes/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/credit_notes/{id}/void` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/coupons` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/coupons` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/coupons/{id}` — params, auth, stateful, errors
- `POST` `/v1/coupons/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/coupons/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/promotion_codes` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/promotion_codes` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/promotion_codes/{id}` — params, auth, stateful, errors
- `POST` `/v1/promotion_codes/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/tax_rates` — body, auth, stateful, webhooks, errors, clock
- `GET` `/v1/tax_rates` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/tax_rates/{id}` — params, auth, stateful, errors
- `POST` `/v1/tax_rates/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/tax_rates/{id}` — params, auth, stateful, errors
- `GET` `/v1/balance` — auth, stateful
- `GET` `/v1/balance_transactions` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/balance_transactions/{id}` — params, auth, stateful, errors
- `GET` `/v1/disputes` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `GET` `/v1/disputes/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/disputes/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/disputes/{id}/close` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/application_fees` — query, auth, stateful, paginate, filter, errors
- `GET` `/v1/application_fees/{id}` — params, auth, stateful, errors
- `GET` `/v1/application_fees/{id}/refunds` — params, auth, stateful, errors
- `POST` `/v1/application_fees/{id}/refunds` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/application_fees/{id}/refund` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/checkout/sessions` — body, auth, stateful, errors, clock
- `GET` `/v1/checkout/sessions` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `GET` `/v1/checkout/sessions/{id}/line_items` — query, params, auth, stateful, paginate, webhooks, errors, clock
- `POST` `/v1/checkout/sessions/{id}/expire` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/checkout/sessions/{id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/c/pay/{id}` — query, params, stateful, webhooks, errors, clock
- `POST` `/v1/setup_intents` — body, auth, stateful, webhooks, clock
- `GET` `/v1/setup_intents` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/setup_intents/{id}/confirm` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/setup_intents/{id}/cancel` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/setup_intents/{id}` — params, auth, stateful, errors
- `POST` `/v1/setup_intents/{id}` — body, params, auth, stateful, errors
- `POST` `/v1/webhook_endpoints` — body, auth, stateful, errors, clock
- `GET` `/v1/webhook_endpoints` — query, auth, stateful, paginate, errors
- `GET` `/v1/webhook_endpoints/{id}` — params, auth, stateful, errors
- `POST` `/v1/webhook_endpoints/{id}` — body, params, auth, stateful, errors
- `DELETE` `/v1/webhook_endpoints/{id}` — params, auth, stateful, errors
- `POST` `/v1/files` — auth, stateful, filter, errors, clock
- `GET` `/v1/files` — query, auth, stateful, paginate, filter, errors, clock
- `GET` `/v1/files/{id}` — params, auth, stateful, filter, errors, clock
- `POST` `/v1/file_links` — body, auth, stateful, errors, clock
- `GET` `/v1/file_links` — query, auth, stateful, paginate, filter, errors, clock
- `GET` `/v1/file_links/{id}` — params, auth, stateful, errors, clock
- `POST` `/v1/file_links/{id}` — body, params, auth, stateful, errors, clock
- `POST` `/v1/accounts` — body, auth, stateful, filter, webhooks, clock
- `GET` `/v1/accounts/{id}` — params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/accounts/{id}` — body, params, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/accounts` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `POST` `/v1/accounts/{id}/persons` — body, params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/accounts/{id}/persons` — query, params, auth, stateful, paginate, filter, errors
- `GET` `/v1/accounts/{id}/persons/{person_id}` — params, auth, stateful, errors
- `POST` `/v1/accounts/{id}/persons/{person_id}` — body, params, auth, stateful, webhooks, errors, clock
- `DELETE` `/v1/accounts/{id}/persons/{person_id}` — params, auth, stateful, webhooks, errors, clock
- `GET` `/v1/persons/{id}` — params, auth, stateful, errors
- `POST` `/v1/persons/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/accounts/{id}/external_accounts` — body, params, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/accounts/{id}/external_accounts` — query, params, auth, stateful, paginate, filter, errors
- `GET` `/v1/accounts/{id}/external_accounts/{ea_id}` — params, auth, stateful, errors
- `DELETE` `/v1/accounts/{id}/external_accounts/{ea_id}` — params, auth, stateful, filter, webhooks, errors, clock
- `POST` `/v1/accounts/{id}/login_links` — params, auth, stateful, errors, clock
- `POST` `/v1/account_links` — body, auth, stateful, errors
- `POST` `/v1/transfers` — body, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/transfers/{id}` — params, auth, stateful, filter, errors
- `GET` `/v1/transfers` — query, auth, stateful, paginate, filter, errors
- `POST` `/v1/transfers/{id}/reversals` — body, params, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/transfers/{id}/reversals` — query, params, auth, stateful, paginate, filter, errors
- `GET` `/v1/transfers/{id}/reversals/{tr_id}` — params, auth, stateful, errors
- `POST` `/v1/payouts` — body, auth, stateful, filter, webhooks, errors, clock
- `GET` `/v1/payouts` — query, auth, stateful, paginate, filter, webhooks, errors, clock
- `GET` `/v1/payouts/{id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/payouts/{id}` — body, params, auth, stateful, webhooks, errors, clock
- `POST` `/v1/payouts/{id}/cancel` — params, auth, stateful, webhooks, errors, clock

</details>

### tenderly-style

**Covered** — 5 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/api/v1/account/{account}/project/{project}/simulate` |
| POST | `/api/v1/account/{account}/project/{project}/simulate-bundle` |
| GET | `/api/v1/account/{account}/project/{project}/simulations` |
| GET | `/api/v1/account/{account}/project/{project}/simulations/{id}` |
| GET | `/api/v1/networks` |

</details>

**Missing** (3)

- No contracts endpoints (import/verify/update contracts per project)
- No alerts or notification-rules API
- No transaction lookup/list endpoints (transactions by hash)

**Deviations** (4)

- gas_used is derived from input length, not real EVM execution; status defaults to true
- An explicit revert:true body flag forces the revert path; real API has no such switch
- Bearer auth where real Tenderly uses the X-Access-Key header
- Responses mix camelCase where Tenderly is snake_case and nests simulation.id

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/api/v1/account/{account}/project/{project}/simulate` — body, params, auth, stateful, clock
- `POST` `/api/v1/account/{account}/project/{project}/simulate-bundle` — body, params, auth, stateful, errors, clock
- `GET` `/api/v1/account/{account}/project/{project}/simulations` — params, auth, stateful, clock
- `GET` `/api/v1/account/{account}/project/{project}/simulations/{id}` — params, auth, stateful, errors, clock
- `GET` `/api/v1/networks` — query, auth, stateful, paginate, clock

</details>

### thegraph-style

**Covered** — 1 routes · GraphQL schema

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/subgraphs/id/{subgraphId}/graphql` |

</details>

**Missing** (3)

- No subgraph deployment/management surface; the two seeded ids are fixed
- No indexing-status queries beyond _meta (no /status endpoint)
- No GraphQL subscriptions over websockets; HTTP queries only

**Deviations** (2)

- One merged schema serves Uniswap and ENS entities; real Graph serves one per deployment
- _meta.block.number advances per query; the real head is block-height driven

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/subgraphs/id/{subgraphId}/graphql` — params, auth, stateful, clock

</details>

### threads-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/oauth/authorize` |
| POST | `/oauth/access_token` |
| GET | `/v1.0/me` |
| GET | `/v1.0/{container_id}` |
| GET | `/v1.0/{id}/insights` |
| POST | `/v1.0/{id}/threads_publish` |
| POST | `/v1.0/{id}/threads` |
| GET | `/v1.0/{id}/threads` |

</details>

**Missing** (3)

- Only TEXT media containers; no image or video media types or uploads
- No reply or quote-post creation; inbox replies are synthetic
- No user-level insights; only 4 per-media metrics

**Deviations** (6)

- Container processing is a fixed ~3s clock-derived window; text needs no real poll
- simulate_fail=true on container create is a simulator-only failure switch
- Refresh-grant response omits the rotated refresh_token; only the code exchange returns one
- /me is a static profile shared by every token; the path user is never validated against the bearer
- The refresh response omits the rotated refresh_token, so each token refreshes only once
- Republishing a container mints duplicate media

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/oauth/authorize` — query, stateful, errors
- `POST` `/oauth/access_token` — body, stateful, errors, clock
- `GET` `/v1.0/me` — auth, stateful, clock
- `GET` `/v1.0/{container_id}` — query, params, auth, stateful, errors, clock
- `GET` `/v1.0/{id}/insights` — query, params, auth, stateful, errors, clock
- `POST` `/v1.0/{id}/threads_publish` — query, params, auth, stateful, errors, clock
- `POST` `/v1.0/{id}/threads` — body, params, auth, stateful, errors, clock
- `GET` `/v1.0/{id}/threads` — params, auth, stateful, filter, clock

</details>

### twilio-style

**Covered** — 6 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/2010-04-01/Accounts/{account_sid}/Messages.json` |
| GET | `/2010-04-01/Accounts/{account_sid}/Messages.json` |
| GET | `/2010-04-01/Accounts/{account_sid}/Messages/{sid}` |
| POST | `/2010-04-01/Accounts/{account_sid}/Calls.json` |
| POST | `/v2/Services/{service_sid}/Verification` |
| POST | `/v2/Services/{service_sid}/VerificationCheck` |

</details>

**Provider surface** — derived from sdk twilio-node @ 6.1.0 (floor): 197 real routes · 4 covered · 2% · 193 not implemented

<details><summary>not implemented (193)</summary>

- `GET` `/2010-04-01/Accounts.json`
- `POST` `/2010-04-01/Accounts.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Addresses.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Addresses.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Addresses/{addressSid}/DependentPhoneNumbers.json`
- `DELETE` `/2010-04-01/Accounts/{accountSid}/Addresses/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Addresses/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Addresses/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Applications.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Applications.json`
- `DELETE` `/2010-04-01/Accounts/{accountSid}/Applications/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Applications/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Applications/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AuthorizedConnectApps.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AuthorizedConnectApps/{connectAppSid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/Local.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/MachineToMachine.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/Mobile.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/National.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/SharedCost.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/TollFree.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/AvailablePhoneNumbers/{countryCode}/Voip.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Balance.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Events.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Notifications.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Notifications/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Payments.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Payments/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Recordings.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Recordings.json`
- `DELETE` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Recordings/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Recordings/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Recordings/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Siprec.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Siprec/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Streams.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Streams/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Transcriptions.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/Transcriptions/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/UserDefinedMessageSubscriptions.json`
- `DELETE` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/UserDefinedMessageSubscriptions/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{callSid}/UserDefinedMessages.json`
- `DELETE` `/2010-04-01/Accounts/{accountSid}/Calls/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Calls/{sid}.json`
- `POST` `/2010-04-01/Accounts/{accountSid}/Calls/{sid}.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Conferences.json`
- `GET` `/2010-04-01/Accounts/{accountSid}/Conferences/{conferenceSid}/Participants.json`
… and 143 more


</details>

**Missing** (6)

- No message redact/cancel or scheduled-send endpoints
- Calls are create-only: no GET /Calls list, GET /Calls/{Sid}, or recordings
- No Messaging Services, Phone Numbers, or Addresses management
- No Verify services CRUD, verification listing, or attempts endpoints
- No Media resource for MMS attachments (list/content fetch)
- Call Url is never fetched; no TwiML execution is modeled

**Deviations** (4)

- Message status derives from the clock on read: sent at +1s, delivered at +3s after send
- Verify codes are deterministic: last 6 digits of the To number, not a random SMS code
- simulate_fail:true in the POST body is a simulator extension forcing undelivered (30007)
- PageSize omitted returns all messages in one page; real Twilio defaults to 50

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/2010-04-01/Accounts/{account_sid}/Messages.json` — body, params, auth, stateful, clock
- `GET` `/2010-04-01/Accounts/{account_sid}/Messages.json` — query, params, auth, stateful, paginate, filter, webhooks, errors, clock
- `GET` `/2010-04-01/Accounts/{account_sid}/Messages/{sid}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/2010-04-01/Accounts/{account_sid}/Calls.json` — body, params, auth, stateful
- `POST` `/v2/Services/{service_sid}/Verification` — body, params, auth, stateful
- `POST` `/v2/Services/{service_sid}/VerificationCheck` — body, params, auth, stateful, errors

</details>

### twitter-style

**Covered** — 9 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/2/oauth2/token` |
| GET | `/2/users/me` |
| GET | `/2/users/by/username/{username}` |
| GET | `/2/users/{id}` |
| POST | `/2/tweets` |
| GET | `/2/tweets/{id}` |
| GET | `/2/tweets` |
| DELETE | `/2/tweets/{id}` |
| GET | `/2/users/{id}/timelines/reverse_chronological` |

</details>

**Provider surface** — derived from spec X API v2 openapi (published at the API origin) @ 2.167: 178 real routes · 8 covered · 4% · 170 not implemented

<details><summary>not implemented (170)</summary>

- `GET` `/2/account_activity/subscriptions/count`
- `GET` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all`
- `POST` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all`
- `GET` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all/list`
- `DELETE` `/2/account_activity/webhooks/{webhook_id}/subscriptions/{user_id}/all`
- `GET` `/2/activity/stream`
- `DELETE` `/2/activity/subscriptions`
- `GET` `/2/activity/subscriptions`
- `POST` `/2/activity/subscriptions`
- `DELETE` `/2/activity/subscriptions/{subscription_id}`
- `PUT` `/2/activity/subscriptions/{subscription_id}`
- `POST` `/2/articles/draft`
- `POST` `/2/articles/{article_id}/publish`
- `GET` `/2/broadcasts`
- `GET` `/2/broadcasts/scheduled`
- `POST` `/2/broadcasts/scheduled`
- `DELETE` `/2/broadcasts/scheduled/{id}`
- `GET` `/2/broadcasts/scheduled/{id}`
- `PUT` `/2/broadcasts/scheduled/{id}`
- `POST` `/2/broadcasts/scheduled/{id}/live`
- `GET` `/2/broadcasts/{id}`
- `GET` `/2/broadcasts/{id}/chat`
- `POST` `/2/broadcasts/{id}/chat`
- `POST` `/2/broadcasts/{id}/chat/mutes`
- `DELETE` `/2/broadcasts/{id}/chat/mutes/{user_id}`
- `DELETE` `/2/broadcasts/{id}/chat/{message_id}`
- `GET` `/2/chat/conversations`
- `POST` `/2/chat/conversations/group`
- `POST` `/2/chat/conversations/group/initialize`
- `GET` `/2/chat/conversations/{id}`
- `GET` `/2/chat/conversations/{id}/events`
- `POST` `/2/chat/conversations/{id}/keys`
- `POST` `/2/chat/conversations/{id}/members`
- `POST` `/2/chat/conversations/{id}/messages`
- `POST` `/2/chat/conversations/{id}/messages/delete`
- `POST` `/2/chat/conversations/{id}/read`
- `POST` `/2/chat/conversations/{id}/typing`
- `POST` `/2/chat/media/upload/initialize`
- `POST` `/2/chat/media/upload/{id}/append`
- `POST` `/2/chat/media/upload/{id}/finalize`
- `GET` `/2/chat/media/{id}/{media_hash_key}`
- `GET` `/2/communities/search`
- `GET` `/2/communities/{id}`
- `GET` `/2/compliance/jobs`
- `POST` `/2/compliance/jobs`
- `GET` `/2/compliance/jobs/{id}`
- `DELETE` `/2/connections`
- `GET` `/2/connections`
- `DELETE` `/2/connections/all`
- `DELETE` `/2/connections/{endpoint_id}`
… and 120 more


</details>

**Missing** (6)

- No tweet search (/2/tweets/search/recent or /all) endpoints
- No likes, reposts, bookmarks, or quote/reply tweet operations
- No follows, blocks, mutes, or follower-list endpoints
- No media upload, polls, or long-form (note) tweet support
- No spaces, lists, DMs, or compliance surfaces
- No filtered or sample stream endpoints

**Deviations** (5)

- Auth is mock and not enforced; any or no Authorization header is accepted everywhere
- POST /2/oauth2/token always succeeds, minting a fake token (no PKCE or client creds)
- GET /2/tweets list-all is a simulator extension; the real API has no such list endpoint
- Bare GET /2/tweets/{id} returns the full stored doc, not v2's id+text default
- since_id/until_id are not honored on the timeline

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/2/oauth2/token` — —
- `GET` `/2/users/me` — query, stateful
- `GET` `/2/users/by/username/{username}` — query, params, stateful, errors
- `GET` `/2/users/{id}` — query, params, stateful, errors
- `POST` `/2/tweets` — body, stateful, errors, clock
- `GET` `/2/tweets/{id}` — query, params, stateful, errors
- `GET` `/2/tweets` — query, stateful, paginate, errors
- `DELETE` `/2/tweets/{id}` — params, stateful, errors
- `GET` `/2/users/{id}/timelines/reverse_chronological` — query, stateful, paginate, filter, errors

</details>

### walletconnect-style

**Covered** — 7 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v1/pairings` |
| POST | `/v1/sessions` |
| GET | `/v1/sessions` |
| POST | `/v1/sessions/{topic}/approve` |
| POST | `/v1/sessions/{topic}/request` |
| POST | `/v1/sessions/{topic}/extend` |
| DELETE | `/v1/sessions/{topic}` |

</details>

**Missing** (3)

- No WebSocket relay; the real IRN protocol is WSS JSON-RPC pub/sub, not HTTP REST
- No session update, ping, or event emission (chainChanged/accountsChanged)
- No pairing list, expire, or ping operations

**Deviations** (5)

- Pairing, session approve, and JSON-RPC requests are auto-approved (no wallet device)
- personal_sign and eth_sendTransaction return synthetic hashes; nothing is signed
- Any non-empty projectId passes the gate — no validation against a project registry
- Expiry fields are TTL constants, not absolute unix timestamps; extend persists nothing
- Unacknowledged sessions serve JSON-RPC requests immediately (no approval gate)

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v1/pairings` — body, query, auth, stateful, errors
- `POST` `/v1/sessions` — body, query, auth, stateful, errors
- `GET` `/v1/sessions` — body, query, auth, stateful, paginate, errors
- `POST` `/v1/sessions/{topic}/approve` — body, query, params, auth, stateful, errors
- `POST` `/v1/sessions/{topic}/request` — body, query, params, auth, stateful, errors
- `POST` `/v1/sessions/{topic}/extend` — body, query, params, auth, stateful, errors
- `DELETE` `/v1/sessions/{topic}` — body, query, params, auth, stateful, errors

</details>

### whatsapp-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| POST | `/v21.0/{phone_number_id}/messages` |
| POST | `/v21.0/{phone_number_id}/register` |
| POST | `/v21.0/{phone_number_id}/media` |
| GET | `/v21.0/{media_id}/content` |
| GET | `/v21.0/{waba_id}/message_templates` |
| POST | `/v21.0/{waba_id}/message_templates` |
| GET | `/v21.0/{resource_id}` |
| POST | `/v21.0/{template_id}` |

</details>

**Missing** (5)

- Only text and template message types; no image, video, document, or interactive
- No mark-as-read (status=read) or message reaction sends
- No business profile, flows, or commerce surfaces
- No template delete or conversation analytics endpoints
- No inbound customer-message webhook simulation

**Deviations** (7)

- 24-hour customer service window not enforced; free-form sends never fail with 470
- delivered is clock-derived at a fixed +3s after send, not real carrier delivery
- simulate_fail:true on send is a simulator extension forcing terminal failed status
- Template review is client-driven: POST {template_id} flips PENDING to APPROVED/REJECTED
- mark-as-read is unmodeled: a status=read body falls into the send path
- register on an unknown phone id still answers success
- created_at is a fixed constant, not clock-derived

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `POST` `/v21.0/{phone_number_id}/messages` — body, params, auth, stateful, webhooks, clock
- `POST` `/v21.0/{phone_number_id}/register` — body, params, auth, stateful, clock
- `POST` `/v21.0/{phone_number_id}/media` — body, params, auth, stateful, clock
- `GET` `/v21.0/{media_id}/content` — params, auth, stateful, errors, clock
- `GET` `/v21.0/{waba_id}/message_templates` — query, params, auth, stateful, paginate, clock
- `POST` `/v21.0/{waba_id}/message_templates` — body, auth, stateful, clock
- `GET` `/v21.0/{resource_id}` — params, auth, stateful, webhooks, errors, clock
- `POST` `/v21.0/{template_id}` — body, params, auth, stateful, errors, clock

</details>

### workday-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/wbs/v40.0/staffing/workers` |
| GET | `/wbs/v40.0/staffing/workers/{id}` |
| GET | `/wbs/v40.0/compensation/workers/{id}/compensation` |
| GET | `/wbs/v40.0/payroll/pay_components` |
| GET | `/wbs/v40.0/human_resources/positions` |
| GET | `/wbs/v40.0/financials/accounts` |
| GET | `/ccx/v1/{tenant}/RaaS/Custom_Report` |
| POST | `/ccx/v1/{tenant}/staffing/Create_Worker` |

</details>

**Missing** (4)

- SOAP interface not implemented (REST-equivalent endpoints only)
- No worker update, delete, or other writes; only Create_Worker exists
- RaaS serves only the seeded Custom_Report, not arbitrary named reports
- No absence, talent, recruiting, or benefits service domains

**Deviations** (3)

- Auth validates only Authorization header presence; any bearer/basic value passes
- Compensation is a static shelf keyed to seeded worker ids — runtime workers read empty, unknown ids 200
- RaaS custom reports return static rows that never reflect created workers

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/wbs/v40.0/staffing/workers` — query, auth, stateful
- `GET` `/wbs/v40.0/staffing/workers/{id}` — params, auth, stateful
- `GET` `/wbs/v40.0/compensation/workers/{id}/compensation` — params, auth
- `GET` `/wbs/v40.0/payroll/pay_components` — query, auth, stateful
- `GET` `/wbs/v40.0/human_resources/positions` — query, auth, stateful
- `GET` `/wbs/v40.0/financials/accounts` — query, auth, stateful
- `GET` `/ccx/v1/{tenant}/RaaS/Custom_Report` — auth
- `POST` `/ccx/v1/{tenant}/staffing/Create_Worker` — body, auth, stateful

</details>

### x-articles-style

**Covered** — 8 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/2/oauth2/authorize` |
| POST | `/2/oauth2/token` |
| POST | `/2/articles/draft` |
| POST | `/2/articles/{id}/publish` |
| GET | `/2/articles/{id}` |
| POST | `/2/media/upload` |
| POST | `/2/tweets` |
| GET | `/2/tweets/{id}` |

</details>

**Provider surface** — derived from spec X API v2 openapi (published at the API origin) @ 2.167: 178 real routes · 5 covered · 2% · 173 not implemented

<details><summary>not implemented (173)</summary>

- `GET` `/2/account_activity/subscriptions/count`
- `GET` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all`
- `POST` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all`
- `GET` `/2/account_activity/webhooks/{webhook_id}/subscriptions/all/list`
- `DELETE` `/2/account_activity/webhooks/{webhook_id}/subscriptions/{user_id}/all`
- `GET` `/2/activity/stream`
- `DELETE` `/2/activity/subscriptions`
- `GET` `/2/activity/subscriptions`
- `POST` `/2/activity/subscriptions`
- `DELETE` `/2/activity/subscriptions/{subscription_id}`
- `PUT` `/2/activity/subscriptions/{subscription_id}`
- `GET` `/2/broadcasts`
- `GET` `/2/broadcasts/scheduled`
- `POST` `/2/broadcasts/scheduled`
- `DELETE` `/2/broadcasts/scheduled/{id}`
- `GET` `/2/broadcasts/scheduled/{id}`
- `PUT` `/2/broadcasts/scheduled/{id}`
- `POST` `/2/broadcasts/scheduled/{id}/live`
- `GET` `/2/broadcasts/{id}`
- `GET` `/2/broadcasts/{id}/chat`
- `POST` `/2/broadcasts/{id}/chat`
- `POST` `/2/broadcasts/{id}/chat/mutes`
- `DELETE` `/2/broadcasts/{id}/chat/mutes/{user_id}`
- `DELETE` `/2/broadcasts/{id}/chat/{message_id}`
- `GET` `/2/chat/conversations`
- `POST` `/2/chat/conversations/group`
- `POST` `/2/chat/conversations/group/initialize`
- `GET` `/2/chat/conversations/{id}`
- `GET` `/2/chat/conversations/{id}/events`
- `POST` `/2/chat/conversations/{id}/keys`
- `POST` `/2/chat/conversations/{id}/members`
- `POST` `/2/chat/conversations/{id}/messages`
- `POST` `/2/chat/conversations/{id}/messages/delete`
- `POST` `/2/chat/conversations/{id}/read`
- `POST` `/2/chat/conversations/{id}/typing`
- `POST` `/2/chat/media/upload/initialize`
- `POST` `/2/chat/media/upload/{id}/append`
- `POST` `/2/chat/media/upload/{id}/finalize`
- `GET` `/2/chat/media/{id}/{media_hash_key}`
- `GET` `/2/communities/search`
- `GET` `/2/communities/{id}`
- `GET` `/2/compliance/jobs`
- `POST` `/2/compliance/jobs`
- `GET` `/2/compliance/jobs/{id}`
- `DELETE` `/2/connections`
- `GET` `/2/connections`
- `DELETE` `/2/connections/all`
- `DELETE` `/2/connections/{endpoint_id}`
- `POST` `/2/dm_conversations`
- `GET` `/2/dm_conversations/media/{dm_id}/{media_id}/{resource_id}`
… and 123 more


</details>

**Missing** (4)

- No article update, delete, or unpublish endpoints
- No article list or search; only single-article GET
- No chunked media upload (INIT/APPEND/FINALIZE) or processing status
- Tweet surface is create/get only; no delete, likes, or timeline

**Deviations** (4)

- PKCE is relaxed: code_verifier must be non-empty but the S256 hash match is not verified
- No v2 errors[] envelope — articles/media use flat {error: ...} shapes a reference client is built against
- PKCE S256 is presence-checked only; a wrong-but-present verifier passes
- Republishing mints a fresh post_id with no already-published guard

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/2/oauth2/authorize` — query, stateful, errors
- `POST` `/2/oauth2/token` — body, auth, stateful, errors
- `POST` `/2/articles/draft` — body, stateful, errors
- `POST` `/2/articles/{id}/publish` — params, stateful, errors
- `GET` `/2/articles/{id}` — params, stateful, errors
- `POST` `/2/media/upload` — stateful
- `POST` `/2/tweets` — body, stateful, errors
- `GET` `/2/tweets/{id}` — params, stateful, errors

</details>

### xero-style

**Covered** — 15 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/connections` |
| GET | `/api.xro/2.0/Contacts` |
| PUT | `/api.xro/2.0/Contacts` |
| GET | `/api.xro/2.0/Contacts/{id}` |
| PUT | `/api.xro/2.0/Contacts/{id}` |
| GET | `/api.xro/2.0/Invoices` |
| PUT | `/api.xro/2.0/Invoices` |
| GET | `/api.xro/2.0/Invoices/{id}` |
| DELETE | `/api.xro/2.0/Invoices/{id}` |
| POST | `/api.xro/2.0/Invoices/{id}/Payments` |
| GET | `/api.xro/2.0/Accounts` |
| GET | `/api.xro/2.0/BankTransactions` |
| GET | `/api.xro/2.0/Items` |
| GET | `/api.xro/2.0/TrackingCategories` |
| POST | `/webhooks` |

</details>

**Provider surface** — derived from spec Xero-OpenAPI xero_accounting @ 17.0.0: 235 real routes · 10 covered · 4% · 211 not implemented

<details><summary>not implemented (211)</summary>

- `PUT` `/api.xro/2.0/Accounts`
- `DELETE` `/api.xro/2.0/Accounts/{AccountID}`
- `GET` `/api.xro/2.0/Accounts/{AccountID}`
- `POST` `/api.xro/2.0/Accounts/{AccountID}`
- `GET` `/api.xro/2.0/Accounts/{AccountID}/Attachments`
- `GET` `/api.xro/2.0/Accounts/{AccountID}/Attachments/{AttachmentID}`
- `POST` `/api.xro/2.0/Accounts/{AccountID}/Attachments/{FileName}`
- `PUT` `/api.xro/2.0/Accounts/{AccountID}/Attachments/{FileName}`
- `POST` `/api.xro/2.0/BankTransactions`
- `PUT` `/api.xro/2.0/BankTransactions`
- `GET` `/api.xro/2.0/BankTransactions/{BankTransactionID}`
- `POST` `/api.xro/2.0/BankTransactions/{BankTransactionID}`
- `GET` `/api.xro/2.0/BankTransactions/{BankTransactionID}/Attachments`
- `GET` `/api.xro/2.0/BankTransactions/{BankTransactionID}/Attachments/{AttachmentID}`
- `POST` `/api.xro/2.0/BankTransactions/{BankTransactionID}/Attachments/{FileName}`
- `PUT` `/api.xro/2.0/BankTransactions/{BankTransactionID}/Attachments/{FileName}`
- `GET` `/api.xro/2.0/BankTransactions/{BankTransactionID}/History`
- `PUT` `/api.xro/2.0/BankTransactions/{BankTransactionID}/History`
- `GET` `/api.xro/2.0/BankTransfers`
- `POST` `/api.xro/2.0/BankTransfers`
- `PUT` `/api.xro/2.0/BankTransfers`
- `GET` `/api.xro/2.0/BankTransfers/{BankTransferID}`
- `POST` `/api.xro/2.0/BankTransfers/{BankTransferID}`
- `GET` `/api.xro/2.0/BankTransfers/{BankTransferID}/Attachments`
- `GET` `/api.xro/2.0/BankTransfers/{BankTransferID}/Attachments/{AttachmentID}`
- `POST` `/api.xro/2.0/BankTransfers/{BankTransferID}/Attachments/{FileName}`
- `PUT` `/api.xro/2.0/BankTransfers/{BankTransferID}/Attachments/{FileName}`
- `GET` `/api.xro/2.0/BankTransfers/{BankTransferID}/History`
- `PUT` `/api.xro/2.0/BankTransfers/{BankTransferID}/History`
- `GET` `/api.xro/2.0/BatchPayments`
- `POST` `/api.xro/2.0/BatchPayments`
- `PUT` `/api.xro/2.0/BatchPayments`
- `GET` `/api.xro/2.0/BatchPayments/{BatchPaymentID}`
- `POST` `/api.xro/2.0/BatchPayments/{BatchPaymentID}`
- `GET` `/api.xro/2.0/BatchPayments/{BatchPaymentID}/History`
- `PUT` `/api.xro/2.0/BatchPayments/{BatchPaymentID}/History`
- `GET` `/api.xro/2.0/BrandingThemes`
- `GET` `/api.xro/2.0/BrandingThemes/{BrandingThemeID}`
- `GET` `/api.xro/2.0/BrandingThemes/{BrandingThemeID}/PaymentServices`
- `POST` `/api.xro/2.0/BrandingThemes/{BrandingThemeID}/PaymentServices`
- `GET` `/api.xro/2.0/Budgets`
- `GET` `/api.xro/2.0/Budgets/{BudgetID}`
- `GET` `/api.xro/2.0/ContactGroups`
- `PUT` `/api.xro/2.0/ContactGroups`
- `GET` `/api.xro/2.0/ContactGroups/{ContactGroupID}`
- `POST` `/api.xro/2.0/ContactGroups/{ContactGroupID}`
- `DELETE` `/api.xro/2.0/ContactGroups/{ContactGroupID}/Contacts`
- `PUT` `/api.xro/2.0/ContactGroups/{ContactGroupID}/Contacts`
- `DELETE` `/api.xro/2.0/ContactGroups/{ContactGroupID}/Contacts/{ContactID}`
- `POST` `/api.xro/2.0/Contacts`
… and 161 more


</details>

**Missing** (6)

- No Credit Notes, Quotes, or standalone Payments endpoints
- No Journals, Bank Transfers, Employees, or Expense Claims
- No Organisations, Currencies, or TaxRates endpoints
- Accounts, Items, TrackingCategories, BankTransactions are read-only (GET only)
- No attachments or history/notes endpoints
- No invoice update, email, or repeating-invoice endpoints

**Deviations** (5)

- No tax-rate registry; line tax is the given TaxAmount, not computed from TaxType
- Responses carry a sim-only nextPage field; real Xero signals the last page by item count
- GET /connections wraps entries in {connections:[...]} with tenantName; real Xero returns a bare array without it
- Malformed page falls back to page 1; real Xero answers 400
- nextPage envelope field is a simulator extension; 401 ErrorNumber is the string TokenExpired, not numeric

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/connections` — query, stateful, paginate, clock
- `GET` `/api.xro/2.0/Contacts` — query, stateful, paginate, filter, clock
- `PUT` `/api.xro/2.0/Contacts` — body, stateful, clock
- `GET` `/api.xro/2.0/Contacts/{id}` — params, stateful, clock
- `PUT` `/api.xro/2.0/Contacts/{id}` — body, params, stateful, clock
- `GET` `/api.xro/2.0/Invoices` — query, stateful, paginate, filter, clock
- `PUT` `/api.xro/2.0/Invoices` — body, stateful, clock
- `GET` `/api.xro/2.0/Invoices/{id}` — params, stateful, clock
- `DELETE` `/api.xro/2.0/Invoices/{id}` — params, stateful, clock
- `POST` `/api.xro/2.0/Invoices/{id}/Payments` — body, params, stateful, clock
- `GET` `/api.xro/2.0/Accounts` — query, stateful, paginate, filter, clock
- `GET` `/api.xro/2.0/BankTransactions` — query, stateful, paginate, filter, clock
- `GET` `/api.xro/2.0/Items` — query, stateful, paginate, filter, clock
- `GET` `/api.xro/2.0/TrackingCategories` — query, stateful, paginate, filter, clock
- `POST` `/webhooks` — —

</details>

### youtube-style

**Covered** — 14 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/o/oauth2/auth` |
| POST | `/o/oauth2/token` |
| POST | `/upload/youtube/v3/videos` |
| PUT | `/upload/youtube/v3/videos/{upload_id}` |
| DELETE | `/upload/youtube/v3/videos/{upload_id}` |
| GET | `/youtube/v3/videos` |
| POST | `/youtube/v3/videos` |
| DELETE | `/youtube/v3/videos` |
| GET | `/youtube/v3/channels` |
| POST | `/youtube/v3/playlists` |
| GET | `/youtube/v3/playlists` |
| DELETE | `/youtube/v3/playlists` |
| POST | `/youtube/v3/playlistItems` |
| DELETE | `/youtube/v3/playlistItems` |

</details>

**Provider surface** — derived from sdk google-api-go-client @ v0.293.0: 83 real routes · 9 covered · 10% · 74 not implemented

<details><summary>not implemented (74)</summary>

- `POST` `/youtube/v3/abuseReports`
- `GET` `/youtube/v3/activities`
- `DELETE` `/youtube/v3/captions`
- `GET` `/youtube/v3/captions`
- `POST` `/youtube/v3/captions`
- `PUT` `/youtube/v3/captions`
- `GET` `/youtube/v3/captions/{id}`
- `POST` `/youtube/v3/channelBanners/insert`
- `DELETE` `/youtube/v3/channelSections`
- `GET` `/youtube/v3/channelSections`
- `POST` `/youtube/v3/channelSections`
- `PUT` `/youtube/v3/channelSections`
- `PUT` `/youtube/v3/channels`
- `GET` `/youtube/v3/commentThreads`
- `POST` `/youtube/v3/commentThreads`
- `DELETE` `/youtube/v3/comments`
- `GET` `/youtube/v3/comments`
- `POST` `/youtube/v3/comments`
- `PUT` `/youtube/v3/comments`
- `POST` `/youtube/v3/comments/markAsSpam`
- `POST` `/youtube/v3/comments/setModerationStatus`
- `GET` `/youtube/v3/i18nLanguages`
- `GET` `/youtube/v3/i18nRegions`
- `DELETE` `/youtube/v3/liveBroadcasts`
- `GET` `/youtube/v3/liveBroadcasts`
- `POST` `/youtube/v3/liveBroadcasts`
- `PUT` `/youtube/v3/liveBroadcasts`
- `POST` `/youtube/v3/liveBroadcasts/bind`
- `POST` `/youtube/v3/liveBroadcasts/cuepoint`
- `POST` `/youtube/v3/liveBroadcasts/transition`
- `DELETE` `/youtube/v3/liveChat/bans`
- `POST` `/youtube/v3/liveChat/bans`
- `DELETE` `/youtube/v3/liveChat/messages`
- `GET` `/youtube/v3/liveChat/messages`
- `POST` `/youtube/v3/liveChat/messages`
- `GET` `/youtube/v3/liveChat/messages/stream`
- `POST` `/youtube/v3/liveChat/messages/transition`
- `DELETE` `/youtube/v3/liveChat/moderators`
- `GET` `/youtube/v3/liveChat/moderators`
- `POST` `/youtube/v3/liveChat/moderators`
- `DELETE` `/youtube/v3/liveStreams`
- `GET` `/youtube/v3/liveStreams`
- `POST` `/youtube/v3/liveStreams`
- `PUT` `/youtube/v3/liveStreams`
- `GET` `/youtube/v3/members`
- `GET` `/youtube/v3/membershipsLevels`
- `DELETE` `/youtube/v3/playlistImages`
- `GET` `/youtube/v3/playlistImages`
- `POST` `/youtube/v3/playlistImages`
- `PUT` `/youtube/v3/playlistImages`
… and 24 more


</details>

**Missing** (7)

- No search endpoint (/youtube/v3/search)
- No comments or commentThreads endpoints
- No video update (PUT), rate, or reportAbuse endpoints
- Channels supports mine=true only; no list by id/forUsername or update
- No playlist update or playlistItems list endpoints
- No captions, thumbnails set, videoCategories, or i18n endpoints
- No subscriptions, activities, or live streaming surfaces

**Deviations** (2)

- GET /youtube/v3/videos without id lists all user videos; real API requires id or chart
- maxResults omitted returns everything; real API defaults to 5 per page

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/o/oauth2/auth` — query, stateful, errors
- `POST` `/o/oauth2/token` — body, stateful, errors, clock
- `POST` `/upload/youtube/v3/videos` — body, query, auth, stateful, clock
- `PUT` `/upload/youtube/v3/videos/{upload_id}` — query, params, stateful, clock
- `DELETE` `/upload/youtube/v3/videos/{upload_id}` — query, params, stateful, errors
- `GET` `/youtube/v3/videos` — query, auth, stateful, paginate, filter, errors, clock
- `POST` `/youtube/v3/videos` — body, query, auth, stateful, clock
- `DELETE` `/youtube/v3/videos` — query, auth, stateful, errors, clock
- `GET` `/youtube/v3/channels` — auth, stateful, clock
- `POST` `/youtube/v3/playlists` — body, auth, stateful, clock
- `GET` `/youtube/v3/playlists` — query, auth, stateful, paginate, filter, errors, clock
- `DELETE` `/youtube/v3/playlists` — query, auth, stateful, errors, clock
- `POST` `/youtube/v3/playlistItems` — body, auth, stateful, errors, clock
- `DELETE` `/youtube/v3/playlistItems` — query, auth, stateful, errors, clock

</details>

### zendesk-style

**Covered** — 37 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/api/v2/tickets.json` |
| POST | `/api/v2/tickets.json` |
| POST | `/api/v2/tickets/{id}/comments.json` |
| GET | `/api/v2/tickets/{id}/comments.json` |
| POST | `/api/v2/tickets/{id}/tags.json` |
| GET | `/api/v2/tickets/{id}.json` |
| PUT | `/api/v2/tickets/{id}.json` |
| DELETE | `/api/v2/tickets/{id}.json` |
| GET | `/api/v2/users.json` |
| GET | `/api/v2/organizations.json` |
| GET | `/api/v2/groups.json` |
| GET | `/api/v2/requests.json` |
| GET | `/api/v2/views.json` |
| GET | `/api/v2/triggers.json` |
| GET | `/api/v2/webhooks.json` |
| POST | `/api/v2/webhooks.json` |
| DELETE | `/api/v2/webhooks/{id}.json` |
| GET | `/api/v2/suspended_tickets.json` |
| GET | `/api/v2/tickets` |
| POST | `/api/v2/tickets` |
| POST | `/api/v2/tickets/{id}/comments` |
| GET | `/api/v2/tickets/{id}/comments` |
| POST | `/api/v2/tickets/{id}/tags` |
| GET | `/api/v2/tickets/{id}` |
| PUT | `/api/v2/tickets/{id}` |
| DELETE | `/api/v2/tickets/{id}` |
| GET | `/api/v2/users` |
| GET | `/api/v2/organizations` |
| GET | `/api/v2/groups` |
| GET | `/api/v2/search.json` |
| GET | `/api/v2/requests` |
| GET | `/api/v2/views` |
| GET | `/api/v2/triggers` |
| GET | `/api/v2/webhooks` |
| POST | `/api/v2/webhooks` |
| DELETE | `/api/v2/webhooks/{id}` |
| GET | `/api/v2/suspended_tickets` |

</details>

**Missing** (8)

- No ticket metrics, audits, fields, or forms endpoints
- No ticket create_many/update_many or import endpoints
- No macros, SLA policies, or satisfaction ratings endpoints
- No incremental exports (incremental/tickets, incremental/users)
- No attachments/uploads API
- Users, orgs, groups, views, triggers list-only; no create/update/delete
- No request create/update endpoints (GET /api/v2/requests is list-only)
- No webhook update (PUT/PATCH) or /webhooks/{id}/test endpoint

**Deviations** (5)

- Search is substring-only over ticket subject/description; empty query returns all tickets
- GET /api/v2/suspended_tickets always returns an empty list
- Webhook deliveries use the {type, payload} envelope, not Zendesk placeholder bodies
- Webhook signing_secret is caller-supplied (omitted falls back to a public mock secret)
- per_page <= 0 disables cursor paging: all records returned, links.next null

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/api/v2/tickets.json` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/v2/tickets.json` — body, auth, stateful, webhooks, clock
- `POST` `/api/v2/tickets/{id}/comments.json` — body, params, auth, stateful, webhooks, clock
- `GET` `/api/v2/tickets/{id}/comments.json` — query, params, auth, stateful, paginate, clock
- `POST` `/api/v2/tickets/{id}/tags.json` — body, params, auth, stateful, clock
- `GET` `/api/v2/tickets/{id}.json` — params, auth, stateful, clock
- `PUT` `/api/v2/tickets/{id}.json` — body, params, auth, stateful, webhooks, clock
- `DELETE` `/api/v2/tickets/{id}.json` — params, auth, stateful, clock
- `GET` `/api/v2/users.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/organizations.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/groups.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/requests.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/views.json` — query, auth, stateful, paginate, clock
- `GET` `/api/v2/triggers.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/webhooks.json` — query, auth, stateful, paginate, clock
- `POST` `/api/v2/webhooks.json` — body, auth, stateful, clock
- `DELETE` `/api/v2/webhooks/{id}.json` — params, auth, stateful, clock
- `GET` `/api/v2/suspended_tickets.json` — query, auth, stateful, paginate, clock
- `GET` `/api/v2/tickets` — query, auth, stateful, paginate, filter, clock
- `POST` `/api/v2/tickets` — body, auth, stateful, webhooks, clock
- `POST` `/api/v2/tickets/{id}/comments` — body, params, auth, stateful, webhooks, clock
- `GET` `/api/v2/tickets/{id}/comments` — query, params, auth, stateful, paginate, clock
- `POST` `/api/v2/tickets/{id}/tags` — body, params, auth, stateful, clock
- `GET` `/api/v2/tickets/{id}` — params, auth, stateful, clock
- `PUT` `/api/v2/tickets/{id}` — body, params, auth, stateful, webhooks, clock
- `DELETE` `/api/v2/tickets/{id}` — params, auth, stateful, clock
- `GET` `/api/v2/users` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/organizations` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/groups` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/search.json` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/requests` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/views` — query, auth, stateful, paginate, clock
- `GET` `/api/v2/triggers` — query, auth, stateful, paginate, filter, clock
- `GET` `/api/v2/webhooks` — query, auth, stateful, paginate, clock
- `POST` `/api/v2/webhooks` — body, auth, stateful, clock
- `DELETE` `/api/v2/webhooks/{id}` — params, auth, stateful, clock
- `GET` `/api/v2/suspended_tickets` — query, auth, stateful, paginate, clock

</details>

### zuora-style

**Covered** — 20 routes

<details><summary>Routes</summary>

| Method | Route |
|---|---|
| GET | `/v1/accounts` |
| POST | `/v1/accounts` |
| GET | `/v1/accounts/{accountKey}` |
| POST | `/v1/subscriptions` |
| POST | `/v1/subscriptions/{subscriptionKey}/cancel` |
| PUT | `/v1/subscriptions/{subscriptionKey}` |
| GET | `/v1/subscriptions/{subscriptionKey}` |
| POST | `/v1/usage` |
| GET | `/v1/usage` |
| GET | `/v1/invoices/{invoiceId}` |
| GET | `/v1/payments` |
| POST | `/v1/payments` |
| POST | `/v1/payments/{paymentId}/unapply` |
| GET | `/v1/payments/{paymentId}` |
| POST | `/v1/payment-methods/credit-cards` |
| POST | `/v1/transactions/billing/preview` |
| POST | `/v1/action/query` |
| POST | `/v1/webhooks` |
| GET | `/v1/webhooks` |
| DELETE | `/v1/webhooks/{id}` |

</details>

**Missing** (8)

- No Orders API (POST /v1/orders, /v1/orders/preview)
- No product catalog endpoints (/v1/catalog/products, rate plans)
- No credit or debit memo endpoints (/v1/creditmemos, /v1/debitmemos)
- No refunds endpoints (POST /v1/refunds, GET /v1/refunds/{id})
- No bill runs or payment runs (/v1/bill-runs, /v1/payment_runs)
- No subscription list by account (GET /v1/subscriptions/account/{key})
- No invoice list endpoint (GET /v1/transactions/invoices)
- No other /v1/action endpoints (queryMore, create, update, delete)

**Deviations** (5)

- ZOQL is pattern-matched: only SELECT fields FROM Object [WHERE Id = value] is supported
- Synthetic calendar anchored at 2024-01-01; term and due dates track real time
- Webhook reg via /v1/webhooks (real: Notifications UI only); deliveries JSON not form-encoded
- List filter[] applies a single condition per request; multiple filters cannot be ANDed
- Subscriptions become Active immediately on create; no Pending Activation state

<details><summary>Derived behavior tags (static — from scripts/*.star, not SDK-verified)</summary>

- `GET` `/v1/accounts` — body, query, auth, stateful, paginate, filter, clock
- `POST` `/v1/accounts` — body, auth, stateful, webhooks, clock
- `GET` `/v1/accounts/{accountKey}` — body, params, auth, stateful, clock
- `POST` `/v1/subscriptions` — body, auth, stateful, webhooks, clock
- `POST` `/v1/subscriptions/{subscriptionKey}/cancel` — body, params, auth, stateful, webhooks, clock
- `PUT` `/v1/subscriptions/{subscriptionKey}` — body, params, auth, stateful, webhooks, clock
- `GET` `/v1/subscriptions/{subscriptionKey}` — body, params, auth, stateful, webhooks, clock
- `POST` `/v1/usage` — body, auth, stateful, clock
- `GET` `/v1/usage` — body, query, auth, stateful, paginate, filter, clock
- `GET` `/v1/invoices/{invoiceId}` — body, params, auth, stateful, clock
- `GET` `/v1/payments` — body, query, auth, stateful, paginate, filter, clock
- `POST` `/v1/payments` — body, auth, stateful, webhooks, clock
- `POST` `/v1/payments/{paymentId}/unapply` — body, params, auth, stateful, webhooks, clock
- `GET` `/v1/payments/{paymentId}` — body, params, auth, stateful, clock
- `POST` `/v1/payment-methods/credit-cards` — body, auth, stateful, clock
- `POST` `/v1/transactions/billing/preview` — body, auth, stateful, clock
- `POST` `/v1/action/query` — body, auth, stateful, webhooks, clock
- `POST` `/v1/webhooks` — body, auth, stateful, clock
- `GET` `/v1/webhooks` — body, auth, stateful, clock
- `DELETE` `/v1/webhooks/{id}` — body, params, auth, stateful, clock

</details>

---

Maintenance: add deviations to `conformance/matrix.yaml`; new `Record(...)`
calls and `// =====` sections appear here automatically on regeneration; SDK
version bumps flow from `go.mod`/`package.json` with no edit here. A new
adapter without a sidecar entry fails generation, so it cannot ship
uncurated.