## Description
Adds public documentation for `GET /v2/auditlogs/governance/{org_name}`
and aligns the guide and OpenAPI reference with merged data-platform
main (`66bc70971`), including
[docker/data-platform#2711](https://github.com/docker/data-platform/pull/2711)
and
[docker/data-platform#2712](https://github.com/docker/data-platform/pull/2712).
- Documents raw Organization Access Token authentication and the View
audit logs permission.
- Covers the 25-event default, 100-event page cap, 30-day request
window, and cursor-preserved time bounds. Text search can use the
default window.
- Documents the API and gateway organization limits of 5 requests per
second and the gateway limit of 600 requests per minute per source IP.
Clients and tokens share the organization limits, and each pagination
request counts.
- Updates the structured application 429 example to `limit: 5`,
`window_seconds: 1`, and `retry_after_seconds: 1`.
- Keeps Retry-After optional: application responses include it when the
reset time is known, while gateway responses can omit it and use a
different body. The chart-owned Lua policy was removed in
[docker/data-platform#2725](https://github.com/docker/data-platform/pull/2725);
these docs do not promise gateway header translation.
- Covers request deadlines, search timeouts, and retryable dependency
failures, with links to the audit record reference and
subscription/access-token pages.
## Release status
The production route and gateway policies are enabled in the merged
configuration. One unauthenticated GET to
`https://api.docker.com/v2/auditlogs/governance/vonwig?page_size=1`
returned HTTP 401 with `{"error":"missing or malformed Authorization
header"}`, confirming public routing and missing-token rejection.
Before publishing, confirm the OAT View audit logs permission is
available in Docker Home and record authorized production
query/pagination, organization/IP throttling, retry behavior, and
monitoring validation. No authenticated request or rate-limit load test
was performed in this update. Merged configuration and a 401 response do
not establish those outcomes.
## Validation
- Scoped rumdl and Vale checks: passed with 0 errors, warnings, or
suggestions.
- Prettier check for the OpenAPI YAML: passed.
- OpenAPI 3.0 validation: passed using @apidevtools/swagger-parser
10.1.0.
- Public server and application 429 example checked against the merged
production values.
- `git diff --check`: passed.
- Full Hugo rendering and rendered link validation were not run; PR CI
and the deploy preview still need review.
## Summary
Refresh the vendored Sandboxes cookbook and OpenAPI reference from
upstream.
Removes standalone MCP gateway start/stop documentation, imports
upstream authentication and timeout examples, auto-resume readback
guidance, and network-policy selector updates, and regenerates the API
presentation data.
@netlify /ai/sandboxes-api/cookbook/give-a-sandbox-an-mcp-gateway/
Generated by Codex
API generation introduced in #26048 added roughly five minutes to site
builds: median successful main-branch build-workflow duration rose from
4m 05s to 8m 48s across September 3–25. The pre-build command took 4m
41s–4m 53s in each of four jobs on the merge commit.
Vendor the generated presentation model in `data/api-reference.json`,
mark it as generated, and let Docker, Netlify, and local Hugo builds
consume it directly. Keep the existing rendered-output checks.
Move generator tests, strict spec validation, and a byte-for-byte
regeneration check into `docker buildx bake validate-api-reference`,
inheriting the shared Docker base stage. The target uses the pinned
Vacuum release binary with Dockerfile ADD checksum verification and
archive extraction instead of compiling Vacuum from source. The existing
build workflow runs this target alongside the other validation matrix
entries. Only this matrix entry is advisory; its failures do not block
site builds or deployment.
Validated locally with the Docker target, rejection of deliberately
stale data, repeatable generation across directories, a production Hugo
build and verification of 453 API HTML/Markdown page pairs, workflow
syntax checks, and scoped documentation lint. The prebuilt-binary CI
check passed in 1m 40s, down from 5m 15s with source compilation. Remote
layer-cache settings were subsequently removed; local Go cache mounts
remain.
Generated by Codex
Craig Osterhout
Brian Refsdal
Maria Ines Parnisari
Alexa KristensenandCursor
David Karlsson