Sunsetting removes an API or endpoint from production after its deprecation window expires. Deprecation warns consumers and encourages migration; sunset makes the resource unavailable, typically producing a 404 Not Found response. Because removal is a breaking change, publish support durations and sunset dates so consumers can plan upgrades. section 4.11.3
A practical sunset workflow combines consumer notice with an explicit exception in automated breaking-change checks:
- Document the stable-version schedule and the length of API support, giving consumers time to test and migrate. section 4.11.3
- Mark the operation, parameter, or schema as deprecated with the OpenAPI deprecated field, then communicate the planned sunset date. section 4.11.3
- Remove the deprecated endpoint from the later API definition when the deprecation window closes. section 4.4
- Use Tufin/oasdiff to compare definitions and detect ordinary breaking changes; an unannounced path removal produces an error such as api-path-removed-without-deprecation. section 4.4
- Add an x-sunset date to the deprecated operation so oasdiff ignores endpoints whose sunset date has passed when checking planned removals. section 4.4
Sunsetting a catalog endpoint
A deprecated GET /v1/catalog/categories operation can be represented with deprecated: true and x-sunset: "2022-08-30". Compare the deprecated definition with the version that removes the path using oasdiff breaking apiv1-dep.yaml apiv2.yaml. The sunset marker lets the planned removal avoid failing the automated breaking-change check. section 4.4
Figure 4.7 API deprecation and sunset dates. After the deprecation date, an API isn’t recommended for use. But after the sunset date, the API is unavailable.
Timeline figure contrasting the deprecation date, when use is discouraged, with the sunset date, when the API becomes unavailable. section 4.11.3
