# Security Startups API versioning and deprecation

Stable REST uses a major version in the path, starting at `/api/v1/`.

- Unversioned `/api/search` and `/api/startups.json` are aliases of the v1 handlers and stay.
- Backward-compatible fields may be added inside v1.
- A breaking change requires `/api/v2/`.
- If a version is retired, responses will carry RFC 8594 `Sunset` and RFC 9745 `Deprecation` headers, and this document will name the retirement date at least 90 days ahead.

Unknown `/api/*` paths return HTTP 404 `application/json` `{error:{code,message,docs}}`.

See https://securitystartups.com/openapi.json and https://securitystartups.com/for-agents.