Skip to content
Back to skills

Procore Upgrade Migration

ASecurity

Migrate one Procore endpoint contract after a lifecycle, deprecation, version, or webhook payload change using observed traffic and dual-read evidence. Use when the changelog announces a replacement or Integration Health detects deprecated usage. Trigger with: "upgrade a Procore API version", "remove deprecated Procore endpoint", "migrate Procore webhook payload".

  • 2,719 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 21, 2026
ai-agentsapisecuritydocumentation

Works with

  • api

Security analysis

A100/100

Pro scans all 2 files and shows the line behind each finding

Scanned September 21, 2026

npx -y skills add jeremylongshore/claude-code-plugins-plus --skill procore-upgrade-migration --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Procore Upgrade Migration?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Procore Upgrade Migration
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/jeremylongshore-procore-upgrade-migration-558a5b97/badge)](https://www.skillsdirectory.com/skills/jeremylongshore-procore-upgrade-migration-558a5b97)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: procore-upgrade-migration
description: >-
  Migrate one Procore endpoint contract after a lifecycle, deprecation, version, or webhook payload change using observed traffic and dual-read evidence. Use when the changelog announces a replacement or Integration Health detects deprecated usage. Trigger with: "upgrade a Procore API version", "remove deprecated Procore endpoint", "migrate Procore webhook payload".
allowed-tools: Read, Grep, Write, Edit
version: 2.0.0
argument-hint: '[old-contract-and-replacement-contract]'
model: inherit
effort: high
license: MIT
author: Jeremy Longshore <jeremy@intentsolutions.io>
tags:
  - saas
  - procore
  - api-lifecycle
  - migration
compatibility: 'Requires current Procore API reference and changelog access plus route-level production traffic evidence.'
---

# Procore Endpoint Contract Cutover

## Overview

Migrate the concrete resource and operation named by provider evidence. Procore does not expose one universal pack-wide version transition, so never claim a generic v1-to-v1.1 upgrade without endpoint-specific documentation.

## Prerequisites

- Deprecated route, method, version, or payload format and documented replacement
- API Call Activity Report slice covering every deployed caller
- Old and new response contracts, test fixtures, rollout owner, and removal deadline

## Instructions

### Step 1: Prove affected traffic

Find the normalized deprecated route in production activity and search every service, scheduled job, event handler, and shared adapter for callers.

### Step 2: Diff contracts

Compare paths, headers, IDs, query parameters, request fields, response fields, pagination, permissions, status codes, webhook schema, and lifecycle phase.

### Step 3: Build a compatibility adapter

Isolate the new contract behind a resource-specific interface. Normalize only fields the business layer truly needs and preserve provider errors and metadata.

### Step 4: Verify side by side

For reads, compare sanitized result sets and state hashes. For writes, use sandbox fixtures or a provider-supported idempotent strategy; do not duplicate live mutations.

### Step 5: Roll out by cohort

Canary the new adapter, monitor error and rate signals, and keep an explicit rollback boundary while the old route remains supported.

### Step 6: Remove the old path

After traffic evidence reaches zero and the observation clears, remove compatibility code, fixtures, configuration, and documentation for the deprecated contract.

## Authentication

Both contracts use the intended OAuth 2.0 principal and company boundary. A migration must not widen DMSA permissions or switch grant types unless that separate security change is reviewed.

## Tool Discipline

Use Read and Grep to inspect changelogs, activity reports, adapters, and callers. Use Write or Edit only for the approved adapter, migration test, rollout configuration, or receipt; do not perform duplicate live writes.

## Output

- Provider evidence and complete caller inventory
- Contract diff, compatibility adapter, and equivalence tests
- Canary, rollback, zero-traffic, and removal receipt

Return the exact old and new contracts, affected volume, semantic differences, rollout status, and deletion evidence.

## Examples

A deprecated webhook route is still called by one monthly job. The team adds the documented scoped replacement, verifies payload and permission differences, canaries it, and removes the legacy route only after the API activity report shows no callers.

## Error Handling

| Failure | Response |
| --- | --- |
| Replacement is not documented | Stop and contact Procore API support rather than guessing a private route. |
| Read results diverge | Classify each delta and delay cutover until expected differences are approved. |
| New contract needs more permission | Review the manifest change separately and rerun negative-access tests. |
| Old traffic persists | Find the remaining caller; do not delete compatibility code. |

## Resources

- [First-party source notes](references/official-docs.md)
- [API lifecycle](https://developers.procore.com/documentation/rest-api-lifecycle)
- [API changelog](https://developers.procore.com/documentation/changelog)
- [Integration Health](https://developers.procore.com/documentation/integration-health)

Files in this skill

  • SKILL.md4.2 KB
  • references/official-docs.md993 B

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.