Added value: +{
+  "description": "Optional, type=oauthClientCredentials.",
+  "type": "string"
+}

Added value: +{
+  "description": "type=oauthClientCredentials only. How client credentials are sent to the token URL: basic (Authorization header, default) or post (request body).",
+  "enum": [
+    "basic",
+    "post"
+  ],
+  "type": "string"
+}

Added value: +{
+  "description": "Required when type=oauthClientCredentials.",
+  "type": "string"
+}

Added value: +{
+  "description": "Required when type=oauthClientCredentials. Never returned on reads.",
+  "type": "string"
+}

Added value: +{
+  "description": "Optional, type=oauthClientCredentials. Space-separated scopes.",
+  "type": "string"
+}

Added value: +{
+  "description": "Required when type=oauthClientCredentials. An https URL.",
+  "type": "string"
+}

Previous value: -[
-  "none",
-  "bearer",
-  "basic",
-  "apiKeyHeader",
-  "apiKeyQuery",
-  "publicPrivateKey"
-]New value: +[
+  "none",
+  "bearer",
+  "basic",
+  "apiKeyHeader",
+  "apiKeyQuery",
+  "publicPrivateKey",
+  "oauthClientCredentials"
+]

Added value: +{
+  "additionalProperties": false,
+  "description": "Required when scheme is custom-hmac, refused for the other schemes. Describes how the sender signs.",
+  "properties": {
+    "algorithm": {
+      "description": "HMAC hash algorithm.",
+      "enum": [
+        "sha256",
+        "sha512",
+        "sha1"
+      ],
+      "type": "string"
+    },
+    "encoding": {
+      "description": "How the signature is written in the header.",
+      "enum": [
+        "hex",
+        "base64"
+      ],
+      "type": "string"
+    },
+    "header": {
+      "description": "Request header carrying the signature, for example X-Shopify-Hmac-Sha256. 1 to 64 bytes of header-name characters (a-z, 0-9 and !#$%&'*+-.^_`|~, case-insensitive). Not authorization, cookie, host, content-length, transfer-encoding, connection or x-api-key.",
+      "type": "string"
+    },
+    "message": {
+      "description": "What is signed. At most 256 bytes. Placeholders: {body} (exactly once) and {timestamp} (at most once); any other { is invalid. Default {body}.",
+      "type": "string"
+    },
+    "prefix": {
+      "description": "Text in front of the signature in the header, for example v0=. At most 32 bytes. Default empty.",
+      "type": "string"
+    },
+    "secretEncoding": {
+      "description": "How the stored secret is read as the HMAC key. Default utf8.",
+      "enum": [
+        "utf8",
+        "base64"
+      ],
+      "type": "string"
+    },
+    "timestampHeader": {
+      "description": "Header carrying the timestamp. Required when message contains {timestamp}, otherwise null or omitted. Same name rules as header.",
+      "type": [
+        "string",
+        "null"
+      ]
+    }
+  },
+  "required": [
+    "header",
+    "algorithm",
+    "encoding"
+  ],
+  "type": "object"
+}

Previous value: -"How the sender signs: github, stripe or standard-webhooks."New value: +"How the sender signs: github, stripe, standard-webhooks, or custom-hmac (then `custom` is required)."

Previous value: -[
-  "github",
-  "stripe",
-  "standard-webhooks"
-]New value: +[
+  "github",
+  "stripe",
+  "standard-webhooks",
+  "custom-hmac"
+]

Added value: +{
+  "additionalProperties": false,
+  "description": "Verify the sender's signature. When set, the endpoint accepts only requests signed by the sender (for example GitHub or Stripe) and no longer needs your API key. `credentialId` is a credential of type signingSecret (create_credential). Set to null to turn verification off. Omit on update_endpoint to leave it unchanged.",
+  "properties": {
+    "credentialId": {
+      "description": "UUID of the signingSecret credential holding the sender's secret.",
+      "type": "string"
+    },
+    "scheme": {
+      "description": "How the sender signs: github, stripe or standard-webhooks.",
+      "enum": [
+        "github",
+        "stripe",
+        "standard-webhooks"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "scheme",
+    "credentialId"
+  ],
+  "type": [
+    "object",
+    "null"
+  ]
+}

Added value: +{
+  "description": "Returned on reads. Send it back unchanged to update that target and keep its stored secrets. Targets are matched by id; without one, by the same name and targetUrl; without either, a patch to the target in the same position keeps its secrets, as long as the list keeps its length, the patch does not change both its name and targetUrl, and a changed targetUrl stays on the same host. Any other target is new and must carry its own secrets.",
+  "type": "string"
+}

Added value: +{
+  "description": "Signs the body delivered to this target — separate from auth above, which authenticates OUTBOUND to the target. Shape: \"whsec_\" followed by base64 of 32 random bytes. Omit to leave unchanged; set to null to disable signing; set to your own whsec_-shaped value to use it verbatim (rejected otherwise, including an empty string — you hold this secret, so only you can supply it). On reads, a configured secret is redacted to \"***\" — round-trip that sentinel to keep the stored secret.",
+  "type": [
+    "string",
+    "null"
+  ]
+}

Added value: +{
+  "description": "Pushed once this target's delivery reaches a terminal status — see get_receipts' callbackState. Must be https. Meaningful for async targets only — refused on sync/stream. Cannot point back into this project (the same relay-loop rule as targetUrl) and must be inside the project's outbound host allowlist when one is set. Unset = the customer polls the receipt instead.",
+  "format": "uri",
+  "type": "string"
+}

Previous value: -"The conditional form of answerMapping, for a target whose answers do not all share one shape: one mapping per reply instead of one for every reply. Requires \"distinguishBy\" naming the single thing that tells them apart ({\"source\":\"status\"}, {\"source\":\"header\",\"name\":…} or {\"source\":\"bodyField\",\"path\":…}), \"variants\" as an object keyed by the value it matches — an exact status like \"429\", a class like \"4XX\", or \"default\" — each holding a tree in the same grammar as answerMapping, and \"onNoMatch\", which has no default and must be either \"passthrough\" (hand the vendor's answer back untouched) or \"fail\" (answer 422 naming the value that matched nothing). Mutually exclusive with answerMapping on this target, and refused on a stream target for the same reason answerMapping is. A variant whose tree does not compile is refused when the line is published, not silently dropped. null = no reshaping."New value: +"The conditional form of answerMapping, for a target whose answers do not all share one shape: one mapping per reply instead of one for every reply. Requires \"distinguishBy\" naming the single thing that tells them apart ({\"source\":\"status\"}, {\"source\":\"header\",\"name\":…} or {\"source\":\"bodyField\",\"path\":…}), \"variants\" as an object keyed by the value it matches — an exact status like \"429\", a class like \"4XX\", or \"default\" — each holding a tree in the same grammar as answerMapping — or, where the caller should be answered with a status of your own, an object {\"mapping\": <tree>, \"replyStatus\": 402} — and \"onNoMatch\", which has no default and must be either \"passthrough\" (hand the vendor's answer back untouched) or \"fail\" (answer 422 naming the value that matched nothing). A replyStatus is what the caller sees and never what the delivery is measured or charged as; it must be a status that can carry a body (200–599, excluding 204, 205 and redirects), and setting one drops the vendor's own response headers, which describe the answer it replaced. A variant keyed on a status that carries no body (204, 205, 304) is reachable only when it sets one. Mutually exclusive with answerMapping on this target, and refused on a stream target for the same reason answerMapping is. A variant whose tree does not compile is refused when the line is published, not silently dropped. null = no reshaping."

Added value: +{
+  "description": "Only meaningful for in=query or in=path. blocked (default): validated, never sent to the target. forwardInPlace: sent to the target in the same location — a query attribute as a query parameter, a path attribute as a path segment. A path attribute forwards only when its name is its own zero-based segment position (\"0\" for the first segment after the endpoint URL, \"1\" for the next, …) — path segments are matched positionally, not by name. To carry a value into the body or a header instead, leave this blocked and add a field mapping on the target sourced from this attribute.",
+  "enum": [
+    "blocked",
+    "forwardInPlace"
+  ],
+  "type": "string"
+}

Added value: +{
+  "description": "The conditional form of answerMapping, for a target whose answers do not all share one shape: one mapping per reply instead of one for every reply. Requires \"distinguishBy\" naming the single thing that tells them apart ({\"source\":\"status\"}, {\"source\":\"header\",\"name\":…} or {\"source\":\"bodyField\",\"path\":…}), \"variants\" as an object keyed by the value it matches — an exact status like \"429\", a class like \"4XX\", or \"default\" — each holding a tree in the same grammar as answerMapping, and \"onNoMatch\", which has no default and must be either \"passthrough\" (hand the vendor's answer back untouched) or \"fail\" (answer 422 naming the value that matched nothing). Mutually exclusive with answerMapping on this target, and refused on a stream target for the same reason answerMapping is. A variant whose tree does not compile is refused when the line is published, not silently dropped. null = no reshaping.",
+  "type": [
+    "object",
+    "null"
+  ]
+}

Added value: +{
+  "description": "Optional: an answer payload, shaped as one a target would actually return. Drives answerMapping the same way, as answerMappingEvaluation. It cannot be inferred from sample — the two travel in opposite directions.",
+  "type": [
+    "object",
+    "array",
+    "string",
+    "number",
+    "boolean",
+    "null"
+  ]
+}

Added value: +{
+  "description": "Optional: a request payload, shaped as one a caller would actually send, passed as JSON rather than as a string containing JSON. Every target carrying an outgoingMapping is evaluated against it and the verdict is attached to that target as outgoingMappingEvaluation.",
+  "type": [
+    "object",
+    "array",
+    "string",
+    "number",
+    "boolean",
+    "null"
+  ]
+}

Added value: +{
+  "description": "Reshapes this target's answer into what the caller receives — a tree of typed nodes conforming to the same published grammar as outgoingMapping. Refused on a stream target (deliveryMode=stream) — a stream's response is proxied straight through and never reshaped. null = no reshaping, the answer reaches the caller verbatim; paths, types and cycles are checked server-side.",
+  "type": [
+    "object",
+    "null"
+  ]
+}

Added value: +{
+  "description": "Reshapes the request into what this target expects — a tree of typed nodes conforming to the published grammar at \"https://schemas.echorelay.dev/transform/mapping/v1.json\" (its own $schema key must name that value). Mutually exclusive with mapping and transformers on this target, and with the endpoint's own transformers — the write is rejected if both are set. null = no reshaping (today's behaviour, and the only value this schema itself can validate; paths, types and cycles are checked server-side).",
+  "type": [
+    "object",
+    "null"
+  ]
+}

Previous value: -"Async retry policy. Ignored unless deliveryMode=async. Leave it unset (null) and the platform's own default ladder applies instead — it is not expressible through this schema and runs considerably longer than any maxAttempts you can set here, so a target left on defaults can sit quietly for a long time before anything reaches the DLQ. Set it explicitly — a low maxAttempts included — for a retry ladder you can predict and observe. get_endpoint reports which is in effect: this object when set, null when the platform default applies."New value: +"Async retry policy. Ignored unless deliveryMode=async. Leave it unset (null) and the platform default applies, which behaves the same as maxAttempts at its maximum. get_endpoint reports which is in effect: this object when set, null when the platform default applies."

Added value: +"How sharply the gap between tries widens. Higher spends the same attempts over a longer stretch. Defaults to 2.0."

Previous value: -"Including the initial attempt. Only takes effect when retryPolicy itself is set — see its description for what an unset retryPolicy uses instead."New value: +"Total delivery attempts, counting the first. 1 fails fast: one try, then the dead-letter queue. Higher values keep retrying with a widening gap between tries — at the default backoffMultiplier, roughly under a minute at 4, a few minutes at 7, about an hour at 10, a few hours at 14. Anything still undelivered lands in the dead-letter queue. Defaults to 14."

Previous value: -10New value: +14

Previous value: -"Async retry policy. Ignored unless deliveryMode=async."New value: +"Async retry policy. Ignored unless deliveryMode=async. Leave it unset (null) and the platform's own default ladder applies instead — it is not expressible through this schema and runs considerably longer than any maxAttempts you can set here, so a target left on defaults can sit quietly for a long time before anything reaches the DLQ. Set it explicitly — a low maxAttempts included — for a retry ladder you can predict and observe. get_endpoint reports which is in effect: this object when set, null when the platform default applies."

Previous value: -"Including the initial attempt."New value: +"Including the initial attempt. Only takes effect when retryPolicy itself is set — see its description for what an unset retryPolicy uses instead."

Added value: +{
+  "description": "Request transformation pipeline applied to this target before delivery. Empty array = no transformation.",
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "params": {
+        "additionalProperties": false,
+        "description": "Only the keys the chosen type reads are accepted; see the type description above.",
+        "properties": {
+          "field": {
+            "description": "Target field — removeField / mapValue.",
+            "type": "string"
+          },
+          "from": {
+            "description": "mergeFields (all sources) / renameField (first element is the source).",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "mapping": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Value lookup table — mapValue.",
+            "type": "object"
+          },
+          "maxSizeMB": {
+            "description": "Max upload size in MB — binaryToUrl.",
+            "minimum": 1,
+            "type": "integer"
+          },
+          "separator": {
+            "description": "Join separator — mergeFields (default \" \").",
+            "type": "string"
+          },
+          "to": {
+            "description": "Destination field — mergeFields / renameField / addField.",
+            "type": "string"
+          },
+          "ttlSeconds": {
+            "description": "Temp file lifetime in seconds — binaryToUrl.",
+            "minimum": 1,
+            "type": "integer"
+          },
+          "value": {
+            "description": "Constant value to set — addField.",
+            "type": "string"
+          }
+        },
+        "type": [
+          "object",
+          "null"
+        ]
+      },
+      "type": {
+        "description": "mergeFields: from+to(+separator). renameField: from+to. removeField: field. addField: to+value. mapValue: field+mapping. binaryToUrl: ttlSeconds?+maxSizeMB? (both clamped server-side — omit for the server default).",
+        "enum": [
+          "mergeFields",
+          "renameField",
+          "removeField",
+          "addField",
+          "mapValue",
+          "binaryToUrl"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "type"
+    ],
+    "type": "object"
+  },
+  "type": "array"
+}

Added value: +{
+  "description": "Endpoint-level request transformation pipeline, applied before any target-level transformers. Set to null to remove the override and inherit the line default (if the line has one); set to an empty array to explicitly apply no transformation even when the line has a default. Omit on update_endpoint to leave the existing value unchanged.",
+  "items": {
+    "additionalProperties": false,
+    "properties": {
+      "params": {
+        "additionalProperties": false,
+        "description": "Only the keys the chosen type reads are accepted; see the type description above.",
+        "properties": {
+          "field": {
+            "description": "Target field — removeField / mapValue.",
+            "type": "string"
+          },
+          "from": {
+            "description": "mergeFields (all sources) / renameField (first element is the source).",
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          },
+          "mapping": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Value lookup table — mapValue.",
+            "type": "object"
+          },
+          "maxSizeMB": {
+            "description": "Max upload size in MB — binaryToUrl.",
+            "minimum": 1,
+            "type": "integer"
+          },
+          "separator": {
+            "description": "Join separator — mergeFields (default \" \").",
+            "type": "string"
+          },
+          "to": {
+            "description": "Destination field — mergeFields / renameField / addField.",
+            "type": "string"
+          },
+          "ttlSeconds": {
+            "description": "Temp file lifetime in seconds — binaryToUrl.",
+            "minimum": 1,
+            "type": "integer"
+          },
+          "value": {
+            "description": "Constant value to set — addField.",
+            "type": "string"
+          }
+        },
+        "type": [
+          "object",
+          "null"
+        ]
+      },
+      "type": {
+        "description": "mergeFields: from+to(+separator). renameField: from+to. removeField: field. addField: to+value. mapValue: field+mapping. binaryToUrl: ttlSeconds?+maxSizeMB? (both clamped server-side — omit for the server default).",
+        "enum": [
+          "mergeFields",
+          "renameField",
+          "removeField",
+          "addField",
+          "mapValue",
+          "binaryToUrl"
+        ],
+        "type": "string"
+      }
+    },
+    "required": [
+      "type"
+    ],
+    "type": "object"
+  },
+  "type": [
+    "array",
+    "null"
+  ]
+}

Previous value: -"HTTP method callers must use."New value: +"HTTP method callers must use. GET endpoints cannot declare a body attribute (see attributes[].in)."

Previous value: -"References a saved credential (see list_credentials/create_credential) instead of inline auth — the auth field above is ignored when this is set. Must belong to the same project."New value: +"References a saved credential (see list_credentials/create_credential) instead of inline auth — the auth field above is ignored when this is set. Must belong to the same project. The credential is bound to a destination when it is created: targetUrl must be https and its host must match that credential's destinationHost, or the write is rejected."

Previous value: -"Outbound auth applied to the request. On reads, secrets are redacted to \"***\" — round-trip the sentinel to keep the stored secret."New value: +"Outbound auth applied to the request. On reads, secrets are redacted to \"***\" — round-trip the sentinel to keep the stored secret. Ignored when credentialVaultEntryId is set."

Added value: +{
+  "description": "Required when type=apiKeyHeader.",
+  "type": "string"
+}

Added value: +{
+  "description": "Required when type=apiKeyHeader or type=apiKeyQuery or type=publicPrivateKey.",
+  "type": "string"
+}

Added value: +{
+  "description": "Required when type=apiKeyQuery.",
+  "type": "string"
+}

Added value: +{
+  "description": "Required when type=publicPrivateKey.",
+  "type": "string"
+}

Previous value: -[
-  "none",
-  "bearer",
-  "basic"
-]New value: +[
+  "none",
+  "bearer",
+  "basic",
+  "apiKeyHeader",
+  "apiKeyQuery",
+  "publicPrivateKey"
+]

Added value: +{
+  "description": "References a saved credential (see list_credentials/create_credential) instead of inline auth — the auth field above is ignored when this is set. Must belong to the same project.",
+  "type": "string"
+}

Previous value: -"Outbound auth applied to the request. On reads, secrets are redacted to \"***\" — round-trip the sentinel to keep the stored secret. Ignored when credentialVaultEntryId is set."New value: +"Outbound auth applied to the request. On reads, secrets are redacted to \"***\" — round-trip the sentinel to keep the stored secret."

Removed value: -{
-  "description": "Required when type=apiKeyHeader.",
-  "type": "string"
-}

Removed value: -{
-  "description": "Required when type=apiKeyHeader or type=apiKeyQuery or type=publicPrivateKey.",
-  "type": "string"
-}

Removed value: -{
-  "description": "Required when type=apiKeyQuery.",
-  "type": "string"
-}

Removed value: -{
-  "description": "Required when type=publicPrivateKey.",
-  "type": "string"
-}

Previous value: -[
-  "none",
-  "bearer",
-  "basic",
-  "apiKeyHeader",
-  "apiKeyQuery",
-  "publicPrivateKey"
-]New value: +[
+  "none",
+  "bearer",
+  "basic"
+]

Removed value: -{
-  "description": "References a saved credential (see list_credentials/create_credential) instead of inline auth — the auth field above is ignored when this is set. Must belong to the same project.",
-  "type": "string"
-}

Previous value: -"Outbound auth applied to the request. On reads, secrets are redacted to \"***\" — round-trip the sentinel to keep the stored secret."New value: +"Outbound auth applied to the request. On reads, secrets are redacted to \"***\" — round-trip the sentinel to keep the stored secret. Ignored when credentialVaultEntryId is set."

Added value: +{
+  "description": "Required when type=apiKeyHeader.",
+  "type": "string"
+}

Added value: +{
+  "description": "Required when type=apiKeyHeader or type=apiKeyQuery or type=publicPrivateKey.",
+  "type": "string"
+}

Added value: +{
+  "description": "Required when type=apiKeyQuery.",
+  "type": "string"
+}

Added value: +{
+  "description": "Required when type=publicPrivateKey.",
+  "type": "string"
+}

Previous value: -[
-  "none",
-  "bearer",
-  "basic"
-]New value: +[
+  "none",
+  "bearer",
+  "basic",
+  "apiKeyHeader",
+  "apiKeyQuery",
+  "publicPrivateKey"
+]

Added value: +{
+  "description": "References a saved credential (see list_credentials/create_credential) instead of inline auth — the auth field above is ignored when this is set. Must belong to the same project.",
+  "type": "string"
+}