# API Deprecations

Deprecated endpoints must include:

- replacement route
- behavior differences
- removal target
- `Deprecation: true` header
- `Sunset` header
- `Link: <replacement>; rel="successor-version"` header

Initial Phase 8 targets:

| Deprecated Pattern | Replacement | Reason |
|---|---|---|
| filename-only payment file download | `/api/v2/finance/payments/{payment}/file` | Payment files must be payment-scoped and authorized. |
| bulk send without preview | `/api/v2/communication/recipient-previews` then `/api/v2/communication/bulk-sends` | Bulk sends must use recipient snapshots and confirmation tokens. |
| report export built in controller | `/api/v2/reporting/exports` | Exports require authorization, audit, safe filename, and retention policy. |