Install
$ agentstack add skill-getsentry-skills-document-api-endpoint ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Document & Type a Sentry API Endpoint
Add or fix OpenAPI docs for a Sentry endpoint with drf-spectacular. Full reference is at https://develop.sentry.dev/backend/api/public/, the most useful section to you will be https://develop.sentry.dev/backend/api/public/#5-method-decorator. This skill captures the non-obvious lessons on top of it. Most of the work is making the declared schema match what the endpoint actually returns. Before documenting, identify which endpoint class serves the route and what it does; the MCP tool that calls it is usually the fastest way to confirm its behavior. Promoting a PRIVATE/EXPERIMENTAL endpoint to PUBLIC is one application (see below).
Workflow
- Class-level
@extend_schema(tags=[...])— use the closest existingOPENAPI_TAGSentry. - Method-level
@extend_schema(operation_id=..., parameters=[...], responses={...}, examples=...). - Reuse
src/sentry/apidocs/parameters.pyandexamples/*.py; ensureowner = ApiOwner.is set. - If a legacy
api-docs/paths/**/*.jsoncovers the path, remove it (see lesson 4). - Validate, then verify against the live endpoint (lesson 1).
Lessons
1. Carefully compare what the code does vs declared types
Ideally, hit the live endpoint with a real token and diff the keys and types against your TypedDict. Serializers are sometimes inaccurate. Look out for counts coming back as floats instead of integers, IDs declared int emitted as strings, nested types declaring the wrong number of fields. Correct the declared type to match runtime.
curl -s -H "Authorization: Bearer $TOKEN" "https://us.sentry.io/api/0/" | jq 'keys'
2. Reuse the canonical response type
Match the codebase's XxxResponseOptional(TypedDict, total=False) mixin (main class declares required fields). Nullable-vs-absent: T | None = key always present, value may be null; NotRequired[T] = key only set under a condition (e.g. an expand query param). Reuse the existing canonical type instead of re-declaring a second or third copy in a *_types.py. If there's no clean canonical type to reuse (e.g. a payload proxied from another service like vroom/profiling), type it dict[str, Any] rather than inventing a new mirror, and confirm the shape from the owning service's repo, not just the serializer.
3. Infer the type. Avoid cast and # type: ignore
When a serializer returns a base type plus extra fields, refactor the producing code so the response type is inferred rather than forced.
4. Legacy doc migration is all-or-nothing per path
Delete the api-docs/paths/**/*.json file AND its $ref in api-docs/openapi.json. drf-spectacular's APPEND_PATHS does not merge HTTP methods, so once any method on a path uses @extend_schema, all legacy methods on that path vanish — migrate every method on the path in one commit.
Promoting to PUBLIC
Do the workflow above, then on the concrete endpoint only (leave siblings PRIVATE):
- Bump
publish_status[]→PUBLICand setowner = ApiOwner.. - Remove the method from
API_OWNERSHIP_ALLOWLIST_DONT_MODIFYin the same change as the flip. - If the endpoint is redundant or being renamed, delete or deprecate the old version in its own change first, then stack the publish on top.
- Note in the PR if scopes widen (
event:read→event:{admin,read,write}) — that's drf-spectacular regenerating frompermission_classes, documentation-only.
The change reaches the @sentry/api SDK / MCP only after sentry-api-schema regenerates downstream.
Validate
make build-api-docs
pnpm run validate-api-examples
.venv/bin/pytest -q --reuse-db tests/apidocs/endpoints//test_.py
.venv/bin/prek run -q --files
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: getsentry
- Source: getsentry/skills
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.