## New endpoints
- `GET /api/auth/tenants/{id}/statistics/`
- `GET /api/auth/tenants/{id}/organizations/statistics/`
## Breaking changes
### `GET /api/auth/tenants/` — pagination removed
- ⚠️ response body `type` changed from `object` to `array<object>` (status `200`)
- ⚠️ deleted the `query` request parameter `limit`
- ⚠️ deleted the `query` request parameter `page`
- ⚠️ removed the optional properties `count`, `next`, `previous`, `results` from the `200` response
### `GET /api/auth/tags/` — response schema flattened
- ⚠️ deleted the `query` request parameter `related`
- removed `#/components/schemas/Tag`, `#/components/schemas/TagLite` from the `results/items/` `oneOf` list (`200`)
- `results/items/` property `type` narrowed from `any` to `object` (`200`)
- added required properties to `results/items/`: `id`, `value`, `description`, `assets`, `assets_count`, `asset_groups`, `created_at`, `created_by`, `organization`
### `orgs/items/brand_image` now required in request bodies
Affects `application/json`, `multipart/form-data`, and `application/x-www-form-urlencoded` on:
- `POST /api/auth/users/import/csv`
- `POST /api/auth/users/{id}/deactivate`
- `PUT /api/auth/users/{id}/subscribe-mail`
- `POST /api/auth/users/{id}/{object_type}`
Nested org serializer leaking into request bodies — likely wants `read_only=True` rather than a real client-facing contract change.
## Additive changes
### Assets — new `is_topdomain` response property
- `GET /api/auth/assets/` (`results/items/`)
- `POST /api/auth/assets/` (`data/`, status `201`)
- `GET /api/auth/assets/v2/` (`results/items/`)
- `GET /api/auth/assets/{id}/`
- `PATCH /api/auth/assets/{id}/`
- `GET /api/auth/assets/export/json`
- `POST /api/auth/assets/ports`
### Assets — new optional `tag` query parameter
- `GET /api/auth/assets/`
- `GET /api/auth/assets/v2/`
- `GET /api/auth/assets/by-types`
- `GET /api/auth/assets/by-control-warning-impacted`
- `GET /api/auth/assets/criticalities`
- `GET /api/auth/assets/statistics`
### Users — new `orgs/items/brand_image` response property
- `GET /api/auth/user/current`
- `POST /api/auth/users/` (`201`)
- `GET /api/auth/users/{id}/`
- `POST /api/auth/users/{id}/`
- `PUT /api/auth/users/{id}/`
- `GET /api/auth/users/{id}/newpwd`
- `POST /api/auth/users/import/csv`
- `POST /api/auth/users/{id}/deactivate`
- `PUT /api/auth/users/{id}/subscribe-mail`
- `POST /api/auth/users/{id}/{object_type}`
## Components
- removed the schema `PaginatedTenantList`
- removed the schema `PaginatedTagListResponseList`
- removed the schema `TagListResponse`
- removed the schema `TagLite`
You can access the complete API documentation here.