Skip to content

New API version release#3380

Open
brunol95 wants to merge 15 commits into
mainfrom
bruno/user-5311-latest-api-version
Open

New API version release#3380
brunol95 wants to merge 15 commits into
mainfrom
bruno/user-5311-latest-api-version

Conversation

@brunol95

@brunol95 brunol95 commented May 18, 2026

Copy link
Copy Markdown
Contributor

🔎 Previews:

What does this solve? What changed?

In the next API version, metadata updates through the user update method are disallowed. This PR documents the API version page along with sdk changes to support the new version.

Todos

Deadline

  • 05/26

@brunol95 brunol95 requested a review from a team as a code owner May 18, 2026 20:38
@vercel

vercel Bot commented May 18, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
clerk-docs Ready Ready Preview Jun 10, 2026 3:19pm

Request Review

@brunol95 brunol95 marked this pull request as draft May 18, 2026 20:38
@brunol95 brunol95 marked this pull request as ready for review May 20, 2026 17:46
…m type name

- Correct del/ins line ranges in the 2026-05-12 and Core 3 metadata
  examples so closing braces highlight correctly
- Use > [!NOTE] callouts on the native mobile user pages
- Align updateUserMetadata() param type with @clerk/backend (UserMetadataParams)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@manovotny

Copy link
Copy Markdown
Contributor

Pushed some review fixes directly in 3414da8.

  • Fixed the del/ins line ranges in the metadata examples so the diff highlighting is correct: the backend example in the 2026-05-12 guide now highlights replaceUserMetadata()'s closing line, and the frontend user.update() examples (in both the 2026-05-12 guide and the Core 3 accordion) now account for the 6-line block instead of treating it as 5.
  • Switched the native iOS/Android > Note: blockquotes to > [!NOTE] callouts to match the other native-mobile pages.
  • Renamed the updateUserMetadata() params type from UpdateUserMetadataParams to UserMetadataParams so it matches @clerk/backend and the new replaceUserMetadata() page.

Have a look, and let me know if anything looks off. I also updated the todo list in the PR description with a few more items.

| Python | TBD |
| Remix | TBD |
| Ruby | TBD |
| Vue | TBD |

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Leaving a comment to flag that TBDs need to be fixed before merge. From @brunol95:

On the day of the release - my plan is to update the docs with all the latest version once the sdk PRs are merged/released

@SarahSoutoul

Copy link
Copy Markdown
Contributor

@brunol95 left a docs review with some small fixes:

  • Made consistent the phrase future major API version across the changes as some were using future major version
  • Made consistent all of the deprecated properties changes to be consistent with rest of docs.
  • Improved the wording of some of the text.

I noticed there was still a mention of client.users.updateUser() but from my understanding, it's fine to keep it as is cause we're not updating any publicMetadata or the other metadata properties. Is that correct?

Screenshot 2026-05-26 at 12 00 17 pm

Comment thread docs/reference/native-mobile/user.mdx Outdated
- updateUser() metadata param deprecation points to both
  updateUserMetadata() (partial/merge) and replaceUserMetadata()
  (full replacement) so migrators relying on replace semantics
  aren't silently switched to merge
- Drop "API" from "future major API version" — these are SDK
  deprecations, not bound to a future API version date
- Move the deprecation > [!NOTE] callout to the top of the
  "Update user metadata" section on the native iOS/Android pages

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@manovotny

Copy link
Copy Markdown
Contributor

Pushed re-review fixes directly in 0886311.

  • Expanded the deprecation guidance on updateUser()'s publicMetadata/privateMetadata/unsafeMetadata params to point to both updateUserMetadata() (partial/deep-merge) and replaceUserMetadata() (full replacement). The previous wording only mentioned the merge path, which would silently change behavior for anyone relying on updateUser()'s replace semantics.
  • Dropped "API" from "future major API version" in update-user.mdx, core-3.mdx, and objects/user.mdx. These are SDK-level deprecations — they'll be removed in a future major SDK release (per clerk/javascript#8587) — and "API version" risked conflating that with the dated API versions documented elsewhere in this PR.
  • Moved the > [!NOTE] deprecation callout to the top of the "Update user metadata" section on both user.ios.mdx and user.mdx, per Sarah's thread.

@brunol95

Copy link
Copy Markdown
Contributor Author

I noticed there was still a mention of client.users.updateUser() but from my understanding, it's fine to keep it as is cause we're not updating any publicMetadata or the other metadata properties. Is that correct?

yep! client.users.updateUser() is still a valid method just can't be used for updating metadata.

- Fix ins line ranges in the 2026-05-12 organization example so the
  replaceOrganizationMetadata() closing line highlights
- Correct the guide intro: PATCH metadata endpoints deep-merge, PUT
  endpoints replace in full
- Align updateOrganization() deprecation wording with updateUser()
  (bold format, partial vs full replacement paths, no "API" in
  "future major version")
- Unify org metadata params type as OrganizationMetadataParams across
  both org metadata reference pages
- Add the replace TIP to updateOrganizationMetadata(), mirroring
  updateUserMetadata()

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@manovotny

Copy link
Copy Markdown
Contributor

Pushed re-review fixes for the Organizations expansion directly in 2007d70.

  • Fixed the ins line ranges on the organization example in the 2026-05-12 guide so replaceOrganizationMetadata()'s closing line highlights (same off-by-one as the user example fixed earlier).
  • Corrected the guide intro — it claimed the dedicated metadata endpoints "provide deep-merge semantics," but the guide documents both PATCH (deep-merge) and PUT (full replace) endpoints. It now says which does which.
  • Aligned updateOrganization()'s metadata deprecation wording with the updateUser() equivalents: bold format, both migration paths (updateOrganizationMetadata() for partial updates, replaceOrganizationMetadata() for full replacement), and "future major version" without "API."
  • Unified the org metadata params type name as OrganizationMetadataParams on both org metadata reference pages — the new replace page and the existing update page had invented two different names for the same shape (clerk/javascript#8787 uses one type for both methods, matching how the user pages share UserMetadataParams).
  • Added the full-replace TIP to updateOrganizationMetadata(), mirroring the one on updateUserMetadata().

Verified the org endpoint changes against clerk/clerk_go#18806 (metadata rejection on org PATCH at 2026-05-12) and the SDK claims against clerk/javascript#8787, clerk-ios#415, and clerk-android#650. Build and lint pass.

Comment on lines +106 to +116
- Update an organization's data or metadata
- `PATCH /v1/organizations/{organization_id}`, `PATCH /v1/organizations/{organization_id}/metadata`, and `PUT /v1/organizations/{organization_id}/metadata`

10 requests per 10 seconds per organization

---

- Update an organization membership's data or metadata
- `PATCH /v1/organizations/{organization_id}/memberships/{user_id}` and `PATCH /v1/organizations/{organization_id}/memberships/{user_id}/metadata`

10 requests per 10 seconds per organization membership

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All five endpoints check out in clerk_go, but I couldn't find where the 10-requests-per-10-seconds buckets for Organizations and memberships are defined.

Where do these values come from?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These values are defined within our terraform infrastructure

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dug through terraform-app-infra to confirm. The user limit is there — "Block user update with same user_id (10reqs/10s)" in the clerk.dev zone — but it only matches PATCH today; the PUT coverage sits on bruno/user-5280-user-metadata-put-rate-limit, which is unmerged with no open PR. For the Organization and membership rows I can't find anything: no merged rule, no branch, and no open PR matching those paths. Is that infra change still to come?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I will get the infra changes in when we release. I'll link the PRs here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants