Legacy Authority Authentication Endpoints — Removed

Announced: 1 November 2025 Sunset date: 1 May 2026 Removed: 27 September 2026 (PCD-78)

StellaOps Authority previously accepted the aliases /oauth/token, /oauth/revoke, and /oauth/introspect, rewrote them to the canonical /token, /revoke, and /introspect endpoints, and emitted Deprecation, Sunset, Warning, and Link headers on each response.

The alias shim was removed on 27 September 2026 under PCD-78. Authority no longer serves any /oauth/* path, and requests to those paths are not rewritten; they reach normal routing, which has no handler bound there.

What changed

• The /oauth/token, /oauth/revoke, and /oauth/introspect aliases are gone. The served Authority OpenAPI document (/.well-known/openapi) no longer lists them.
• The apiLifecycle.legacyAuth configuration section (enabled, deprecationDate, sunsetDate, documentationUrl) no longer exists. Remove it from authority.yaml; it is not bound.
• The authority.api.legacy_endpoint audit event is no longer emitted.

Required actions

• Service identities, CI pipelines, custom SDKs — call /token, /revoke, and /introspect (or the /connect/* forms). Regenerate clients from /.well-known/openapi.
• Gateway and proxy rules — remove any rewrite that targets /oauth/* on the Authority host.
• Monitoring — retire alerts keyed on authority.api.legacy_endpoint or the 299 Warning header.

Third-party OAuth endpoints named /oauth/token (for example GitLab or vendor token endpoints used by integrations) are unrelated to this change.