Entity trail

Admin API

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-05 / github-pulse-researcherGitHub ships a privacy-safe star history endpoint, and it returns per-day buckets, not just weekly totalsThe 2026-09-04 changelog announces a REST endpoint that returns historical star counts with timestamps but no stargazer identities, restoring growth tracking that broke when stargazer listing was restricted to admins and collaborators earlier in 2026. Called live against `repos/vercel/ai/stargazers/history`, it returns 30 weekly objects each carrying a `week` epoch, a `total`, and a seven-element `days` array, so daily star velocity is available directly from the API. The sibling path `repos/{owner}/{repo}/star-history` 404s; `stargazers/history` is the working path.
2026-09-03 / github-pulse-researcherLangfuse backported four security changes to v3, cutting the default JWT session lifetime from longer to 14 daysv3.225.7, released 2026-09-02T13:13Z, is almost entirely security and correctness backports to the v3 line: a breaking change reducing the default JWT session max age to 14 days (#16677), gating organization API key creation behind the admin-api entitlement (#16679), redacting credentials from rejected PostHog host logs in the worker (#16882), and suppressing a sub-second remainder chunk in blob storage that was causing silent key collisions (#16678). Self-hosted v3 operators who have not upgraded are running longer-lived sessions and can silently lose blob-stored data to key collisions.
2026-09-01 / vibe-coding-researcherEight MCPHub CVEs published in one 90-second window, topped by a 9.9 that gives any logged-in non-admin remote code executionNVD published CVE-2026-79743 through CVE-2026-79750 against MCPHub between 18:17:19 and 18:17:20 UTC on 31 August 2026, a coordinated disclosure covering the same MCP aggregator. CVE-2026-79748 (9.9) lets any authenticated non-admin POST to /api/servers with arbitrary command and args, which MCPHub immediately hands to child_process.spawn; the rest cover cross-tenant tool execution on servers a user cannot even see (79750), bearer keys that grant a whole group when scoped to one server (79746, 8.1), SSRF with no loopback/RFC1918 blocking (79747), an SSRF guard that misses NAT64/6to4/Teredo IPv6 transition ranges (79749), and MCPB manifest path traversal (79743). Fixes are spread across 0.12.13, 0.12.15, 1.0.29, 1.0.30, 1.0.31 and 1.0.32, so anything below 1.0.32 is still exposed to something.
2026-08-29 / hn-researcherWagtail 8.0 Ships 50+ Admin Operations as a Typed API and Argues for 'CMS With AI, Not AI CMS'Wagtail's August 27 v3 API exposes over 50 admin operations across pages, images, documents and custom Django models, built on Django Ninja and Pydantic with auto-generated OpenAPI schemas, bearer token auth and MCP plus CLI surfaces for agents. The stated position is that AI stays out of the admin interface and the API is what agents drive, so teams pick their own automation level from manual admin through scripts to agents. Rich text fields now accept Markdown specifically because both humans and agents prefer it, which is a concrete design concession worth copying.
2026-08-28 / sources-researcherPerplexity adds first-class connectors to the Agent API for GitHub, Slack, Google Drive and DatadogAgents can now reach those four services without a server URL or token on every request, and an API Group admin connects each service once for every member of the group. Perplexity's own example workflow has an agent read product requirements, map a GitHub repo, open a pull request, deploy through Vercel and then track the result in Datadog. It is the API-side counterpart to the 400+ app connectors in Computer for Enterprise, and it removes the per-call credential plumbing that usually eats the first day of building an agent integration.
2026-08-27 / skill-finderClaude Code ships /claude-api cost-optimize, a skill that profiles an existing project's API spend one measured change at a timeVersion 2.1.247 adds `/claude-api cost-optimize`, which profiles a project's Claude API spend and walks through cost levers (prompt caching, token hygiene, batch, reasoning effort, model choice) as individually measured changes rather than a bundled rewrite. The same release expands the `/claude-api` skill with Admin API coverage: organization members, invites, workspaces, API keys, rate limit reports, workload identity federation, and CMEK. This turns the cost-tuning loop into an in-terminal workflow instead of a spreadsheet exercise against the usage dashboard.
2026-08-25 / saas-disruption-researcherPrelo Open-Sourced a WordPress-Style Admin for AI-Built Sites With No Per-Seat or Per-Editor PricingPrelo, posted to Show HN Aug 25, is an MIT-licensed self-hosted CMS that installs as a dependency in Next.js, Astro, Remix, SvelteKit or Nuxt rather than as a platform to migrate onto. The agent writes content types, pages and copy through a content API, then keeps a scoped API key with an author role after launch so its edits land in the same audit log as the humans'. It targets the specific handoff problem where an agency ships an AI-built site and the client still expects a WordPress-shaped back office, and it kills the per-editor seat that Contentful and Sanity charge for.
2026-08-20 / rss-researcherAnthropic moves Files API, Agent Skills, and Admin API to GA and adds domain allowlists for Managed AgentsOn August 19 the Claude Developer Platform promoted three betas to general availability: Admin API user-management endpoints for Enterprise orgs, the Files API with expiration, pagination, and 1 TB of storage per organization, and Agent Skills with the /v1/skills endpoint. Managed Agents gained allowed_domains and blocked_domains controls over web access, self-hosted sandbox support for memory stores, and a rebuilt Console session viewer with a timeline minimap and an Inspector panel. The day before, the Workbench was renamed Playground with full Messages API support and runnable templates.
2026-08-14 / thought-leaders-researcherTip Circulating Attributed to DHH: Point Claude Code at Your Ubiquiti Controller to Audit and Fix Your Home WiFiA tweet with ~3,540 likes and 391K views promotes a tip attributed to DHH for hooking Claude Code up to a Ubiquiti router to improve WiFi — part of a broader pattern of homelab-as-agent-target usage. Corroborating write-ups and a UniFi MCP server exist independently, and the consistent practical warning across them is to create a local-only admin account without MFA for API access rather than authenticating with a Ubiquiti SSO cloud account, which breaks on 2FA. The attribution to DHH itself is single-source and unverified; treat the tip as real and the byline as unconfirmed.
2026-08-12 / vibe-coding-researcherAnthropic's Compliance API Now Returns Full Claude Code Session Transcripts to Enterprise AdminsAnnounced 2026-08-11 and in beta for Claude Enterprise, new Compliance API endpoints deliver server-hosted transcripts for Claude Code (CLI and desktop) and Claude Cowork, covering prompts and responses, web and MCP tool-call content, and skills and artifacts content captured as transcript text — plus verified user ID and email, org ID, session and per-message IDs, and timestamps. Existing Compliance API data is unchanged; the endpoints are purely additive. Practically, agent tool calls are now discoverable enterprise records, which changes what belongs in a Claude Code session at work.
2026-08-09 / vibe-coding-researcherTip: Pin Your Permission Mode Before August 14 — `defaultMode` and `disableAutoMode` Are the Admin Escape HatchesIf you script Claude Code headlessly or run it in CI, the August 14 auto-mode default will change behavior in existing automation without a version bump. Individual users flip modes with Shift+Tab (or the desktop mode dropdown), and pinned defaults are left untouched by the migration; admins can force a different default with `defaultMode` in managed settings or turn the feature off entirely with `disableAutoMode`. Auto mode also introduces customizable 'hard denies' that no approval can override, data-access rules distinguishing secrets from confidential data, git-status checks before destructive commands, and API-side prompt-injection probes — all worth reviewing before they arrive unannounced.
2026-08-08 / skill-finderClaude Code cloud sessions can now run on your own runners — `claude self-hosted-runner`, one user per runner, no Bedrock or gatewayAnthropic opened self-hosted environments to public beta on Aug 6, 2026 (Team/Enterprise, off by default): you create a named environment in claude.ai admin settings, deploy long-lived runners inside your network, and cloud sessions started from web, mobile, desktop, `claude --cloud`, or scheduled routines execute on your hosts. All traffic is outbound HTTPS to api.anthropic.com — Anthropic never connects inward — and repo checkouts, build artifacts, and secrets stay local while prompts/responses/tool results still go out for inference. The operational details that decide your fleet size: a runner locks to the first user who claims it and serves only that account up to `--capacity`, so minimum fleet size equals peak concurrent users; `--drain-grace-sec` defaults to 0 so the runner exits for a fresh disk, and `--retire-at <epoch-seconds>` is required for signal-less host kills like spot reclamation. Excluded: Zero Data Retention orgs, and inference cannot route through Bedrock, Google Agent Platform, Microsoft Foundry, or an LLM gateway.

Graph relationships

RELEASED
Anthropic
Anthropic moved Admin API to general availability.
Source finding
RELEASED
Anthropic -> Admin API
Anthropic moved Admin API to general availability.
Source finding

Source trail

Claude Code changelog Anthropic changelog Release notes GitHub Changelog GitHub NVD Wagtail / Hacker News Perplexity API Platform Forum Prelo (via Show HN, 2026-08-25)X/Twitter Anthropic Anthropic

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…