Catch deprecated APIs before they break production.
Vendors retire APIs, models, and auth methods on fixed dates - and most teams find out from a production outage. Arol finds every one your code uses, with the exact file and line, before your customers do.
This keeps happening
APIs die on a schedule
February 2026 alone: OpenAI deprecated GPT-4o, GPT-4.1, and o4-mini, and scheduled the Assistants API shutdown. These are the next sunsets on the calendar - pulled live from the same dataset the scanner runs on, not marketing copy.
Anthropic
Experimental prompt tools APIs
OpenAI
Assistants API
Google Gemini
Gemini 2.5 Flash Image
Google Gemini
Gemini 2.5 Pro / Flash / Flash-Lite
OpenAI
OpenAI models shut down October 23, 2026
OpenAI
OpenAI models shut down January 20, 2027
If your code references any of these, the countdown is yours too. npx arol-ai scan tells you in thirty seconds.
Coverage depth
What it catches
Whether your AI assistant wrote it last night or a teammate wrote it three years ago: dead model strings, removed SDK calls, sunset endpoints, legacy auth flows. Matched against real usage - imports, call sites, quoted model ids - not just your lockfile.
openai.ChatCompletion.createremoved call syntax"gpt-4-turbo", "claude-sonnet-4-…"retiring model stringsstripe.handleCardPayment()removed Stripe.js methodidCheckConfigurationName: "Phone Auth $"legacy DocuSign authaws-sdk (v2)end-of-support SDK linehubspot lead-status writessurface going read-onlyProcess
How it works
Scan
Run the scanner locally or in CI - your code never leaves your environment. It finds every third-party API, model id, and SDK surface you actually use.
Match
Usage is checked against a continuously updated deprecation dataset - every entry carries the vendor's own notice as evidence, and a human approves every change.
Gate
CI fails only on real upcoming breaks - high severity or sunsets inside your window - with the exact file and line. Everything else warns and exits clean.
CI-ready: npx arol-ai scan exits non-zero only for real upcoming breaks - high severity or sunsets inside your window. Warn-only findings never block a deploy.
The gap
Nothing else watches the wire
Dependabot watches the packages in your lockfile. Nothing watches the live APIs you call over the wire - the model that retires, the auth method that quietly loses its fallback, the endpoint that 404s on a Tuesday. That’s the gap that pages you at 2am, and it’s the one we close.
Assistants API
Sunsets Aug 26, 2026 · used in 3 files
Coverage, live
What we watch
- Deprecations
- 76
- Vendors
- 50
- Last updated
- 3 days ago
These numbers render from the scanner’s own dataset - the site can’t exaggerate them. Don’t see your vendor? Tell us; paying customers steer what gets added next.
- Tracked
- 13
- Notifications
- 2
Assistants API, Aug 26
All clear
files.upload retired
All clear
Legacy auth, Sep 30
All clear
All clear
All clear
The pipeline
Knowledge that ships itself
A deprecation scanner is only as good as yesterday’s data. Arol’s dataset maintains itself - and every entry carries its provenance.
Watch
A watcher diffs vendor changelogs, deprecation pages, and release notes every day. Silent doc edits don't stay silent.
Draft
When a page changes, an agent drafts the detection - dates, scope, patterns - with the vendor's own words quoted as evidence.
Review
A human approves every entry, and each one ships with tests proving it fires on real usage and never on the replacement API.
Learn
Your scanner picks up the new knowledge within 24 hours - no update, no new install, nothing to do.
Plans
The scanner is free. The vigilance is $99.
The full local scanner, free forever. Scan any repo, gate your CI on real upcoming breaks, auto-updated dataset included. No account required - your code never leaves the machine.
We remember your dependency inventory and email you when a new deprecation hits it - so you don’t have to re-scan to find out. Sign in, create a token, add --report to CI. Two minutes.
Free during early access - early users keep their pricing when billing starts.
FAQ
Fair questions
What leaves my machine?
By default, nothing. Scanning is fully local - the CLI only downloads one public JSON file (the deprecation dataset, like antivirus definitions), and even that is optional with --offline. Your source code never leaves your environment. If you opt into monitoring with a report token, the CLI uploads scan results and dependency inventory to your dashboard - still never your source.
How do you avoid false positives?
Detection keys on real usage, not package presence: patterns only fire in files that import the matching SDK, model ids only match inside quoted string literals, comments are stripped before matching, and findings that live only in test files are down-ranked and never fail CI.
Will it break my CI?
Only when something real is breaking. The exit code is non-zero solely for high-severity findings or sunsets inside your configured window (--within). Everything else prints as a warning and exits clean.
How fresh is the data?
A watcher diffs vendor lifecycle pages daily; changes become human-reviewed dataset entries with the vendor's notice quoted as evidence; your scanner picks them up within 24 hours of merge. The coverage numbers on this page render from that same dataset.
What's free vs paid?
Free forever: the local scanner, auto-updating dataset, and CI gating - no account required. Paid (will be $99/mo, free during early access): monitoring. We remember your inventory and email you when a new deprecation hits it, so you don't have to re-scan to find out.
One prevented incident pays for the year.
The scanner stays free forever. Monitoring will be $99/mo - free while in early access.