cd /news/developer-tools/additive-vercel-4-new-request-proper… · home › topics › developer-tools › article
[ARTICLE · art-162542] src=driftwatch.et ↗ pub= topic=developer-tools verified=true sentiment=· neutral

[Additive] Vercel: 4 new request properties

Vercel expanded the set of values returned by its request properties, adding new event types such as "ai-security-review", "firewall-conditional-bypass-updated", "integration-secret-rotated", "messageboard-channel-created" and "response_code", plus new project-git-credential attestation events. The change touches 18 locations, including the condition type fields under GET /v1/security/firewall/config and GET /v1/security/firewall/config/{configVersion}, and Vercel labels it additive even though it breaks exhaustive switches, strict parsers and generated client enums that lack a branch for the new values. The new "response_code" condition type appears in firewall config condition groups, so code with a default branch that throws on unexpected types will fail until it handles the added values.

read1 min views1 publishedNov 1, 2026
[Additive] Vercel: 4 new request properties
Image: Driftwatch (auto-discovered)

Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.

can now return "ai-security-review", "firewall-conditional-bypass-updated", "integration-previous-secret-revoked", "integration-secret-rotated", "team-runtime-cache-updated", "vercel-agent-security-finding-created"

Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.

can now return "project-git-credential-attestation-created", "project-git-credential-attestation-deleted", "project-git-credential-grant-attestation-revoked", "project-git-credential-grant-attested"

Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.

can now return "messageboard-private-project-granted", "messageboard-private-project-revoked", "messageboard-project-granted", "messageboard-project-revoked"

Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.

can now return "messageboard-channel-created", "messageboard-channel-updated", "messageboard-private-channel-created", "messageboard-private-channel-updated"

Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.

can now return "response_code"

18 places: GET /v1/security/firewall/config · active.rules[].conditionGroup[].conditions[].type, GET /v1/security/firewall/config · active.rulesets[].conditionGroup[].conditions[].type, GET /v1/security/firewall/config · draft.rulesets[].conditionGroup[].conditions[].type, GET /v1/security/firewall/config · versions[].rules[].conditionGroup[].conditions[].type, GET /v1/security/firewall/config · versions[].rulesets[].conditionGroup[].conditions[].type, GET /v1/security/firewall/config/{configVersion} · conditions[].conditionGroup[].conditions[].type +12 more

Code that breaks

switch (response.active.rules[0].conditionGroup[0].conditions[0].type) {
  // existing branches …
  // no branch for "response_code"
  default:
    throw new Error("unexpected type");
}

Breakingdirection flip: their tools call this safe

── more in #developer-tools 4 stories · sorted by recency
── more on @vercel 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/additive-vercel-4-ne…] indexed:0 read:1min 2026-11-01 · —