[markdennis22]

Why?

The 2.17 spec for the custom object instance endpoints didn't match the API. The two delete operations had each other's operationIds, the create request typed every custom attribute as a string, and several error responses were missing. The Preview spec had the same problems, and the next version is cut from Preview, so it needs the same fixes.

How?

Corrects the custom object instance endpoints and their request schema to match the API's current behaviour, and adds the OAuth scopes each endpoint accepts to its description. The same changes go into the Preview spec, keeping content that only applies to Preview, such as the {id} path parameter name.

Risks

The Preview SDKs are generated from this spec, so these changes affect generated Preview types:

Change	Could SDK code stop compiling?	Did that code work before?
The two delete operationIds swap, so each matches its path: deleteCustomObjectInstancesById takes id instead of external_id, and deleteCustomObjectInstancesByExternalId the reverse	Yes	Yes. Each method deleted through the endpoint it called; only the names were swapped
Create request: custom_attributes values become a new CreateOrUpdateCustomObjectInstanceRequestCustomAttributesValue union of string, integer, number, boolean and array of strings	In Java, yes: a value typed as a string has to be wrapped in the union. TypeScript, Python and PHP still accept strings	Only for string attributes
List custom object instances returns a new ListCustomObjectInstancesResponse union of the list, a single instance and the not-found body, instead of CustomObjectInstancesPaginatedList	Yes, because the return type becomes a union	Only without external_id. With it, the API already returned a single object
New 400 errors on create and list	No	—

Notes for reviewers

• fern check shows 0 errors and the same 317 warnings as main. There are no new dangling refs, and the only operationId change is the delete swap.

_{Generated with Claude Code}