# Legacy Authority Authentication Endpoints — Deprecation Guidance

**Announced:** 1 November 2025  
**Sunset (removal no earlier than):** 1 May 2026

## Summary

StellaOps Authority previously exposed OAuth 2.1 endpoints at `/oauth/token`, `/oauth/revoke`, and `/oauth/introspect` to ease migration from early previews. Those aliases are now **deprecated** in favour of the canonical paths (`/token`, `/revoke`, `/introspect`). All responses from the legacy routes include:

- `Deprecation` — RFC 7231 HTTP-date set to 1 November 2025.  
- `Sunset` — HTTP-date advertising the planned removal on 1 May 2026.  
- `Warning` — RFC 7234 `299` warning describing the migration requirement.  
- `Link` — `rel="sunset"` URI pointing back to this guidance.

No new features (DPoP nonces, audit upgrades, policy scopes) will ship on the legacy routes. After 1 May 2026 the aliases will return `410 Gone` and be removed in the next major release.

## Required Actions

- **Service identities / CI pipelines** – Update token, revocation, and introspection calls to target the canonical `/token`, `/revoke`, and `/introspect` endpoints. Regenerate OpenAPI clients if they relied on the deprecated paths.  
- **Gateway / proxy rules** – Remove explicit rewrites that target `/oauth/*` so traffic flows directly to the canonical paths.  
- **Custom SDKs** – Regenerate against the refreshed Authority OpenAPI spec (`/.well-known/openapi`) which marks legacy operations as `deprecated: true`.  
- **Monitoring** – Alert on the `authority.api.legacy_endpoint` audit event or the `299` Warning header to verify migrations are complete.

## Timeline & Support

| Date | Milestone |
|------|-----------|
| 1 Nov 2025 | Deprecation headers emitted, documentation published |
| Jan–Apr 2026 | Observability dashboards highlight remaining usage; support assists with migrations |
| 1 May 2026 | Legacy routes return HTTP 410 and will be removed in the next major release |

Questions? Contact the **Authority Core** guild or open a ticket with the **API Governance Guild** referencing AUTH-OAS-63-001.