Does the Snyk API need an API key?

Yes for the 14 operations checked: an anonymous request was refused, on 2026-09-15. Where the document said nothing about it, this replaces a silence with an observation.

ERR-2026-1716, ERR-2026-1809, ERR-2026-1897, ERR-2026-1901, ERR-2026-1945, ERR-2026-2022, ERR-2026-2046, ERR-2026-2047, ERR-2026-2053, ERR-2026-2127, ERR-2026-2196, ERR-2026-2204

Why is my Snyk request rejected when I copied the example?

Because the document contradicts itself. 1 parameter in this specification declare one type and give an example, default or allowed value of another. Both statements are in the same file, so this needs no request to confirm.

ERR-2026-2269

Every record behind those answers

15 open records, observed 2026-09-10. Every claim below carries the command that disproves it. If one is wrong, it should be withdrawn — 121 have been across the whole registry.

credentials are required (observed) (14)

The document establishes no authentication requirement for this operation; an anonymous request is refused with 401. The requirement is now observed rather than unknown.

`ERR-2026-1716`	Get organization notification settings	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-1809`	Retrieve a single project	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-1897`	List all entitlements	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-1901`	List all organizations in a group	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-1945`	List Members	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2022`	List	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2046`	List all members in a group	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2047`	View group settings	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2053`	List all roles in a group	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2127`	Retrieve	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2196`	Get existing integration by type	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2204`	Get import job details	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2219`	Get an organization's entitlement value	HTTP 401	checked 2026-09-15, 2 times
`ERR-2026-2222`	List all tags in a group	HTTP 401	checked 2026-09-15, 2 times

Check it yourself:

curl -sS -o /dev/null -w '%{http_code}\n' https://api.snyk.io/api/v1/org/errata-probe-not-a-real-identifier/notification-settings

a default contradicts its own declared type (1)

Parameter 'includeGroupAdmins' (in query) declares type 'boolean' and its own default is "false". A caller copying it is refused.

ERR-2026-2269 List Members no runnable check checked 2026-09-15, 2 times

If a record here is wrong

Run its check. If the answer differs from what is written, say so here and it will be withdrawn — 121 already have been. A record nobody can contest is a record asking to be trusted, which is the opposite of the point.

What this page does not tell you

This is not a clean bill of health for anything not listed. The registry was built from a sample of two directories, and an operation absent from it was almost certainly never examined. Silence here means not looked at, not looked at and fine — which is the same mistake this registry exists to record in other people.

What this is

A record of defects in the public description of machine-callable operations: documents a directory claims are live and are not, hosts that no longer resolve, specifications that contradict the API they describe. It is not a ranking, not a review, and not a judgement about the service. No credential is ever sent to anything listed here.

The whole registry, machine-readable: errata.json. Index of subjects: index.html.

Built from registry errata-2026-09-10@b7cb54d3a847. If manifest.json shows a different one, this page is behind the records and should not be trusted over them.