fix(api): restore migrated endpoint compatibility

Author: TheodoreSpeaks

apps/docs/openapi-v2-workflows.json

@@ -4012,8 +4012,15 @@
                 "type": "object",
                 "properties": {
                   "contextId": {
-                    "type": "string",
-                    "description": "Resume context identifier for the earliest active pause point."
+                    "anyOf": [
+                      {
+                        "type": "string"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "Resume context identifier, or null while every pause point is mid-resume."
                   },
                   "pausedAt": {
                     "type": "string",

apps/sim/app/api/credentials/route.test.ts

@@ -143,6 +143,25 @@ describe('POST /api/credentials', () => {
         auditMetadata: { principalKind: 'tenant', principalId: 'acct_123' },
         principal: { kind: 'tenant', id: 'acct_123' },
       })
+      queueTableRows(credential, [])
+      queueTableRows(credential, [])
+      queueTableRows(credential, [
+        {
+          id: 'credential-1',
+          workspaceId: WORKSPACE_ID,
+          type: 'service_account',
+          displayName: 'Zoom account acct_123',
+          description: null,
+          providerId: 'zoom-service-account',
+          accountId: null,
+          envKey: null,
+          envOwnerUserId: null,
+          encryptedServiceAccountKey: 'encrypted-blob',
+          createdBy: 'user-1',
+          createdAt: new Date('2026-08-11T00:00:00.000Z'),
+          updatedAt: new Date('2026-08-11T00:00:00.000Z'),
+        },
+      ])
 
       const req = createMockRequest('POST', {
         workspaceId: WORKSPACE_ID,
@@ -154,8 +173,10 @@ describe('POST /api/credentials', () => {
       })
 
       const response = await POST(req)
+      const body = await response.json()
 
       expect(response.status).toBe(201)
+      expect(body.credential).not.toHaveProperty('encryptedServiceAccountKey')
       expect(mockVerifyAndBuildServiceAccountSecret).toHaveBeenCalledTimes(1)
       expect(mockVerifyAndBuildServiceAccountSecret).toHaveBeenCalledWith(
         'zoom-service-account',

apps/sim/app/api/credentials/route.ts

@@ -274,9 +274,18 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     )
   }
 
+  if (!result.credential) {
+    throw new Error('Credential creation succeeded without a credential')
+  }
+
+  const responseBody = createWorkspaceCredentialContract.response.schema.parse({
+    credential: {
+      ...result.credential,
+      createdAt: result.credential.createdAt.toISOString(),
+      updatedAt: result.credential.updatedAt.toISOString(),
+    },
+  })
+
   // An existing credential matched the source: an idempotent replay, not a create.
-  return NextResponse.json(
-    { credential: result.credential },
-    { status: result.created ? 201 : 200 }
-  )
+  return NextResponse.json(responseBody, { status: result.created ? 201 : 200 })
 })

apps/sim/app/api/knowledge/[id]/documents/route.ts

@@ -86,7 +86,7 @@ export const POST = defineInternalJsonRoute({
   rateLimit: internalRateLimits.none({
     reason: 'Preserve existing internal document-create behavior',
   }),
-  errorPolicy: internalKnowledgeErrorPolicies.documents,
+  errorPolicy: internalKnowledgeErrorPolicies.uploads,
   mapInput: ({ params, body }, { principal, request }) => {
     const documents = body.bulk ? body.documents : [body]
     return {

apps/sim/app/api/knowledge/migrated-routes.test.ts

@@ -114,12 +114,15 @@ vi.mock('@/lib/core/telemetry', () => ({
 
 vi.mock('@/lib/posthog/server', () => ({ captureServerEvent: mocks.capture }))
 
+import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { KnowledgeUsageLimitExceededError } from '@/lib/knowledge/application/billing'
 import {
   GET as listConnectorDocuments,
   PATCH as updateConnectorDocuments,
 } from '@/app/api/knowledge/[id]/connectors/[connectorId]/documents/route'
 import { PUT as updateDocument } from '@/app/api/knowledge/[id]/documents/[documentId]/route'
 import {
+  PATCH as bulkDocuments,
   POST as createDocuments,
   GET as listDocuments,
 } from '@/app/api/knowledge/[id]/documents/route'
@@ -360,6 +363,46 @@ describe('migrated internal Knowledge routes', () => {
     )
   })
 
+  it('preserves payment-required for document usage admission', async () => {
+    mocks.createDocuments.mockRejectedValueOnce(
+      new KnowledgeUsageLimitExceededError('Usage limit exceeded')
+    )
+
+    const response = await createDocuments(
+      createMockRequest('POST', {
+        bulk: false,
+        filename: document.filename,
+        fileUrl: document.fileUrl,
+        fileSize: document.fileSize,
+        mimeType: document.mimeType,
+      }),
+      { params: Promise.resolve({ id: 'knowledge-1' }) }
+    )
+
+    expect(response.status).toBe(402)
+    await expect(response.json()).resolves.toEqual({ error: 'Usage limit exceeded' })
+    expect(mocks.capture).not.toHaveBeenCalled()
+  })
+
+  it('returns not found when a bulk document selection has no active matches', async () => {
+    mocks.bulkDocuments.mockRejectedValueOnce(
+      new OrchestrationError('not_found', 'No valid documents found to update')
+    )
+
+    const response = await bulkDocuments(
+      createMockRequest('PATCH', {
+        operation: 'disable',
+        documentIds: ['document-1'],
+      }),
+      { params: Promise.resolve({ id: 'knowledge-1' }) }
+    )
+
+    expect(response.status).toBe(404)
+    await expect(response.json()).resolves.toEqual({
+      error: 'No valid documents found to update',
+    })
+  })
+
   it('rejects oversized document-create arrays at the contract boundary', async () => {
     const response = await createDocuments(
       createMockRequest('POST', {

apps/sim/app/api/mcp/serve/[serverId]/route.test.ts

@@ -974,6 +974,49 @@ describe('MCP Serve Route', () => {
     expect(body.result.isError).toBe(false)
   })
 
+  it('reports a human-in-the-loop pause as a successful tool result', async () => {
+    dbChainMockFns.limit
+      .mockResolvedValueOnce([
+        {
+          id: 'server-1',
+          name: 'Public Server',
+          workspaceId: 'ws-1',
+          isPublic: true,
+          createdBy: 'owner-1',
+        },
+      ])
+      .mockResolvedValueOnce([{ toolName: 'tool_a', workflowId: 'wf-1' }])
+      .mockResolvedValueOnce([{ workspaceId: 'ws-1', deploymentVersionId: 'deployment-1' }])
+
+    mockExecuteWorkflowService.mockResolvedValueOnce({
+      ok: true,
+      executionId: 'exec-paused',
+      workflowId: 'wf-1',
+      status: 'paused',
+      aborted: null,
+      output: { approvalRequired: true },
+      error: null,
+      hasResponseBlock: false,
+      resolvedSecretTraceProvenance: createResolvedSecretTraceProvenance('owner-1'),
+    })
+
+    const req = new NextRequest('http://localhost:3000/api/mcp/serve/server-1', {
+      method: 'POST',
+      body: JSON.stringify({
+        jsonrpc: '2.0',
+        id: 1,
+        method: 'tools/call',
+        params: { name: 'tool_a', arguments: { q: 'test' } },
+      }),
+    })
+    const response = await POST(req, { params: Promise.resolve({ serverId: 'server-1' }) })
+    const body = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(body.result.isError).toBe(false)
+    expect(body.result.content[0].text).toContain('approvalRequired')
+  })
+
   it('serializes failed runs with the structured error and child executionId', async () => {
     dbChainMockFns.limit
       .mockResolvedValueOnce([

apps/sim/app/api/mcp/serve/[serverId]/route.ts

@@ -938,7 +938,7 @@ async function handleToolsCall(
       )
     }
 
-    const isError = serviceResult.status !== 'completed'
+    const isError = serviceResult.status === 'failed' || serviceResult.status === 'cancelled'
     const toolOutput = isError
       ? {
           success: false,

apps/sim/app/api/mcp/servers/route.test.ts

@@ -1,11 +1,13 @@
 /**
  * @vitest-environment node
  */
-import { resetDbChainMock } from '@sim/testing'
+import { mcpServers } from '@sim/db/schema'
+import { queueTableRows, resetDbChainMock } from '@sim/testing'
 import type { NextRequest } from 'next/server'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockPerformDeleteMcpServer } = vi.hoisted(() => ({
+const { mockCanWrite, mockPerformDeleteMcpServer } = vi.hoisted(() => ({
+  mockCanWrite: vi.fn(),
   mockPerformDeleteMcpServer: vi.fn(),
 }))
 
@@ -21,6 +23,7 @@ vi.mock('@/lib/mcp/middleware', () => ({
           userName: string
           userEmail: string
           workspaceId: string
+          canWrite: boolean
           requestId: string
         }
       ) => Promise<Response>
@@ -31,6 +34,7 @@ vi.mock('@/lib/mcp/middleware', () => ({
         userName: 'Test User',
         userEmail: 'test@example.com',
         workspaceId: 'workspace-1',
+        canWrite: mockCanWrite(),
         requestId: 'request-1',
       }),
 }))
@@ -40,7 +44,13 @@ vi.mock('@/lib/mcp/orchestration', () => ({
   performDeleteMcpServer: mockPerformDeleteMcpServer,
 }))
 
-import { DELETE } from '@/app/api/mcp/servers/route'
+import { DELETE, GET } from '@/app/api/mcp/servers/route'
+
+function createListRequest() {
+  return new Request('http://localhost:3000/api/mcp/servers?workspaceId=workspace-1', {
+    method: 'GET',
+  }) as NextRequest
+}
 
 function createDeleteRequest(serverId = 'server-1') {
   return new Request(
@@ -87,3 +97,44 @@ describe('MCP servers DELETE route', () => {
     expect(body).toEqual({ success: false, error: 'Failed to delete MCP server' })
   })
 })
+
+describe('MCP servers GET route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+    mockCanWrite.mockReturnValue(false)
+    queueTableRows(mcpServers, [
+      {
+        id: 'server-1',
+        workspaceId: 'workspace-1',
+        name: 'Private server',
+        headers: { Authorization: 'Bearer secret-token' },
+        oauthClientSecret: 'oauth-secret',
+      },
+    ])
+  })
+
+  afterAll(() => {
+    resetDbChainMock()
+  })
+
+  it('does not expose authentication header values to read-only users', async () => {
+    const response = await GET(createListRequest())
+    const body = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(body.data.servers[0]).not.toHaveProperty('headers')
+    expect(body.data.servers[0]).not.toHaveProperty('oauthClientSecret')
+    expect(body.data.servers[0].hasOauthClientSecret).toBe(true)
+  })
+
+  it('retains configured headers for users who can manage the server', async () => {
+    mockCanWrite.mockReturnValue(true)
+
+    const response = await GET(createListRequest())
+    const body = await response.json()
+
+    expect(response.status).toBe(200)
+    expect(body.data.servers[0].headers).toEqual({ Authorization: 'Bearer secret-token' })
+  })
+})

apps/sim/app/api/mcp/servers/route.ts

@@ -27,7 +27,7 @@ export const dynamic = 'force-dynamic'
  * GET - List all registered MCP servers for the workspace
  */
 export const GET = withRouteHandler(
-  withMcpAuth('read')(async (request: NextRequest, { userId, workspaceId, requestId }) => {
+  withMcpAuth('read')(async (request: NextRequest, { workspaceId, canWrite, requestId }) => {
     try {
       logger.info(`[${requestId}] Listing MCP servers for workspace ${workspaceId}`)
 
@@ -36,8 +36,9 @@ export const GET = withRouteHandler(
         .from(mcpServers)
         .where(and(eq(mcpServers.workspaceId, workspaceId), isNull(mcpServers.deletedAt)))
 
-      const servers = rows.map(({ oauthClientSecret: _secret, ...rest }) => ({
+      const servers = rows.map(({ oauthClientSecret: _secret, headers, ...rest }) => ({
         ...rest,
+        ...(canWrite ? { headers } : {}),
         hasOauthClientSecret: !!_secret,
       }))
 

apps/sim/app/api/table/utils.test.ts

@@ -4,6 +4,7 @@
 import { describe, expect, it } from 'vitest'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { TableRowLimitError } from '@/lib/table/billing'
+import { TableRowNotFoundError } from '@/lib/table/rows/errors'
 import type { ColumnDefinition } from '@/lib/table/types'
 import { rootErrorMessage, rowWriteErrorResponse, tableFilterError } from '@/app/api/table/utils'
 
@@ -49,9 +50,7 @@ describe('rowWriteErrorResponse', () => {
   })
 
   it('answers the code the failure carries, not one derived from its wording', () => {
-    expect(
-      rowWriteErrorResponse(new OrchestrationError('not_found', 'Row not found'))?.status
-    ).toBe(404)
+    expect(rowWriteErrorResponse(new TableRowNotFoundError())?.status).toBe(404)
     // The phrase that used to force a 400 no longer decides anything.
     expect(
       rowWriteErrorResponse(new OrchestrationError('conflict', 'Row 3: must be unique'))?.status