Document createdById document filter and remove internal users.updateEmail

[tommoor]

Updates the OpenAPI spec to reflect public API changes merged in outline/outline over the last day.

Changes

• Add createdById to the DocumentFilter field enum. outline/outline#13988 added createdById to documentFilterFields, so documents.list (and the other endpoints sharing DocumentFilter) now accept a createdById filter. Like userId and documentId, it only supports the eq and in operators, so the operator note was updated accordingly.
• Remove /users.updateEmail. outline/outline#13980 changed both the POST and GET handlers to auth({ type: AuthenticationType.APP }). The endpoint no longer accepts API key authentication (API-key callers now receive a 403), making it an internal endpoint that should not appear in the public API documentation.

Reviewed but not documented

Other PRs merged in the window did not alter the public API input schema or output shape:

• #13987 (recently viewed) — behavioral only, no schema/presenter change
• #13990 (gate group sync behind entitlement) — internal policy/authorization only
• #13989 (expose skills over MCP) — MCP server only, not the REST API
• #13982, #13983, #13986, #13978, #13981, #13970, #13969, #13988 (client-side part) — editor/perf/frontend, no public API surface change
• Dependabot PRs — ignored per task guidance

Both spec3.yml and the generated spec3.json are updated; Spectral lint, operation-id, and sort checks pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_013H4mnSfoh7ZBHWSFs4WVns

---

Generated by Claude Code