inti project

docs/api-deprecations.md

@@ -0,0 +1,18 @@
+# API Deprecations
+
+Deprecated endpoints must include:
+
+- replacement route
+- behavior differences
+- removal target
+- `Deprecation: true` header
+- `Sunset` header
+- `Link: <replacement>; rel="successor-version"` header
+
+Initial Phase 8 targets:
+
+| Deprecated Pattern | Replacement | Reason |
+|---|---|---|
+| filename-only payment file download | `/api/v2/finance/payments/{payment}/file` | Payment files must be payment-scoped and authorized. |
+| bulk send without preview | `/api/v2/communication/recipient-previews` then `/api/v2/communication/bulk-sends` | Bulk sends must use recipient snapshots and confirmation tokens. |
+| report export built in controller | `/api/v2/reporting/exports` | Exports require authorization, audit, safe filename, and retention policy. |