Discord API Changes 2026: What's New for Bots in v10

You run a Discord bot and want to know which Discord API changes in 2026 mean editing your code. Discord lists every change in its developer change log, but the entries are short and spread over the year. Here are the ones that matter for bots, newest first, with the code change each one asks for, checked against the change log on 3 November 2026.

Quick answer: API v10 is still the version to build on in 2026. The newest Discord API changes, from 28 to 30 October 2026, are four endpoints that return a member's or role's computed permissions (the channel ones apply implicit permission masking unless you pass implicit=false), voice channel status without CONNECT for anyone already in the channel, two audit log events for reordering (CHANNEL_POSITION_UPDATE 16 and ROLE_POSITION_UPDATE 33), and documented content scanning flags on attachments, embeds and media. discord.js 14.28.0 came out on 30 October. The next deadline is 16 November 2026, when channel obfuscation becomes mandatory for all bots.

What's new in the Discord API: 28 to 30 October 2026

30 October: permission endpoints and implicit=false

Discord's entry: "You can now get a member or role's permissions for a guild or channel without calculating them yourself." And: "The channel endpoints apply implicit permission masking by default. Set implicit=false to skip this masking."

GET /guilds/{guild.id}/permissions/member/{user.id}
GET /guilds/{guild.id}/permissions/role/{role.id}
GET /channels/{channel.id}/permissions/member/{user.id}
GET /channels/{channel.id}/permissions/role/{role.id}

Each returns {"permissions": "..."}, a stringified bitfield. The role versions combine only that role and @everyone, without other roles or member overwrites. The channel versions need View Channel for your bot in that channel, plus Connect for voice and stage channels, and threads use their parent's overwrites.

Implicit permissions are Discord's rule that a member without View Channel cannot use the channel's other permissions, even when a role grants them. The implicit parameter covers a missing View Channel, or a missing Connect in voice and stage channels. On the channel member endpoint, Discord never applies the masking when the member you ask about is a bot.

The one change: if your bot adds up roles and overwrites itself, ask Discord. Keep the default to learn what a member can really do; pass implicit=false in an audit tool that shows what the configuration grants. Note that permissionsFor() in discord.js 14.28.0 combines cached roles and overwrites without implicit masking, so it can show Send Messages for a member who cannot see the channel.

discord.js has no helper for these routes yet. The latest stable discord-api-types on 3 November, 0.38.57, does not have them; they were merged on 2 November (PR 1855). Call the path directly:

const { PermissionsBitField, PermissionFlagsBits } = require('discord.js');

async function channelPermissions(client, channelId, userId, implicit = true) {
  const { permissions } = await client.rest.get(
    `/channels/${channelId}/permissions/member/${userId}`,
    { query: new URLSearchParams({ implicit: String(implicit) }) },
  );
  return new PermissionsBitField(permissions);
}

async function explainSendMessages(client, channel, member) {
  const real = await channelPermissions(client, channel.id, member.id);
  const granted = await channelPermissions(client, channel.id, member.id, false);
  const send = PermissionFlagsBits.SendMessages;
  if (granted.has(send) && !real.has(send)) {
    return `${member} gets Send Messages from a role, but cannot view ${channel}.`;
  }
  return real.has(send) ? 'Can post here.' : 'Cannot post here.';
}

29 October: voice channel status without CONNECT

The entry: "Users already connected to a voice channel can now set the channel's status with the SET_VOICE_CHANNEL_STATUS permission even if they do not have CONNECT. Previously, a denied CONNECT implicitly removed SET_VOICE_CHANNEL_STATUS. Users not connected to the channel still need MANAGE_CHANNELS as well."

This matters for music and radio bots that show the current track as the voice channel status. The one change: if your code refuses to set the status when Connect is denied, remove that check for the channel the bot is in. Set Voice Channel Status takes a status of up to 500 characters:

const { PermissionFlagsBits } = require('discord.js');

async function setNowPlaying(voiceChannel, text) {
  const me = voiceChannel.guild.members.me;
  const perms = voiceChannel.permissionsFor(me);
  const inChannel = me.voice.channelId === voiceChannel.id;
  // No Connect check any more: since 29 October it is not needed while the bot is in the channel.
  if (!perms.has(PermissionFlagsBits.SetVoiceChannelStatus)) return false;
  if (!inChannel && !perms.has(PermissionFlagsBits.ManageChannels)) return false;
  await voiceChannel.client.rest.put(`/channels/${voiceChannel.id}/voice-status`, {
    body: { status: text.slice(0, 500) },
  });
  return true;
}

29 October: audit log events 16 and 33

The entry adds CHANNEL_POSITION_UPDATE (16) "for reordering channels" and ROLE_POSITION_UPDATE (33) "for reordering roles". It also documents entry merging: requests by the same user in quick succession "update the data of the original entry, rather than always creating a new one", only the first reason is kept, and later updates "currently do not fire a Gateway event". Merging applies to both new events and to MESSAGE_DELETE, MESSAGE_BULK_DELETE, MEMBER_DISCONNECT and MEMBER_MOVE.

The one change: handle 16 and 33 in your audit log handler, and never count Gateway events for these actions. The total sits in the entry's options.count. In discord.js 14.28.0 the AuditLogEvent enum has no names for 16 and 33 and entry.extra stays null for them, so compare the number and fetch the count over REST. The event needs the Guild Moderation intent and View Audit Log.

const { Events, Routes } = require('discord.js');

const REORDER = { 16: 'Channels reordered', 33: 'Roles reordered' };

client.on(Events.GuildAuditLogEntryCreate, (entry, guild) => {
  const label = REORDER[entry.action];
  if (label) console.log(`${guild.name}: ${label} by ${entry.executorId}`);
});

// Later, when you build the report: the merged total of the newest entry.
async function lastReorderCount(client, guildId, actionType) {
  const log = await client.rest.get(Routes.guildAuditLog(guildId), {
    query: new URLSearchParams({ action_type: String(actionType), limit: '1' }),
  });
  return log.audit_log_entries[0]?.options?.count;
}

28 October: content scanning flags

The entry documents the flags Discord sets "when its content scanning flags media as explicit, gore, or self-harm, so your app can check media before acting on it, like reposting an uploaded image to another channel."

The message docs add the catch: "Content scanning can run after the message is sent", so the flags "can be added later in a Message Update event". Attachments in an interaction's resolved data never carry them. The one change for starboards and media relays: check the flags on the message your bot sent and again on its later updates, and delete it when flagged. discord-api-types 0.38.57 has no names for these bits yet, so use the numbers. Your bot's own messages include their attachments without the Message Content intent; you do need the Guild Messages intent for the updates.

const { Events } = require('discord.js');

const SCANNED = (1 << 4) | (1 << 6) | (1 << 7); // explicit, gore, self-harm

function isFlagged(message) {
  return (
    message.attachments.some((file) => (file.flags.bitfield & SCANNED) !== 0) ||
    message.embeds.some((embed) => ((embed.data.flags ?? 0) & SCANNED) !== 0)
  );
}

async function repost(target, url) {
  const sent = await target.send({ files: [url] });
  if (isFlagged(sent)) await sent.delete();
}

client.on(Events.MessageUpdate, async (_old, message) => {
  if (message.author?.id !== client.user.id) return;
  if (isFlagged(message)) await message.delete().catch(() => {});
});

discord.js 14.28.0 (30 October)

discord.js 14.28.0 adds permissions and appPermissions on channels picked in an interaction, a fileTypes filter for attachment command options, and the invite target user endpoints. It does not wrap the 28 to 30 October entries yet, hence the plain paths and numbers above. Update with npm install discord.js@14.28.0 (the package needs Node.js 18 or newer); on npm, v15 exists only as dev builds. For an appPermissions example, see the discord.js 14.28.0 section of our channel obfuscation guide.

Next deadline: channel obfuscation on 16 November 2026

From 16 November, GET /guilds/{guild.id}/channels leaves out channels your bot cannot view, and the Gateway sends them named ___hidden___ with the CHANNEL_OBFUSCATED flag (1 << 17). Discord's change log says this "becomes mandatory for all bots on November 16, 2026." It affects bots that mirror or audit a server's full channel list or calculate permissions across every channel. Our channel obfuscation guide has the code changes. The change log shows no other dated deadline after that one.

Discord bot changes earlier in 2026

Discord API version in 2026: why v10

Discord's API versioning table lists v10 and v9 as available, v6 to v8 as deprecated, and v3 to v5 as discontinued, which "will fail and return 400 Bad Request". A request without a version goes to the default, which is still v6, so always put the version in the path: https://discord.com/api/v10/.... discord.js v14 sends v10 unless you change it. If you still use old examples pinned to v6 or v9, our v9 to v10 migration guide covers the move.

Privileged intents and the message content intent

GUILD_MEMBERS, GUILD_PRESENCES and MESSAGE_CONTENT are privileged. Since 10 June 2026 the review threshold is 10,000 unique users who can see your bot across all its servers, no longer 100 servers. Once you pass it, Discord notifies you and you have 90 days to apply; approved apps reapply every year, again within 90 days of the notice. App Verification, which is still required at 100 servers, is now a separate process.

Without MESSAGE_CONTENT, content, embeds, attachments, components and poll arrive empty, except in your bot's own messages, DMs with it, messages that mention it, and messages a message context menu command is used on. Prefix commands and text filters need the intent; slash commands and components do not. An intent you request but have not enabled closes the Gateway connection with code 4014.

Is it a Discord change or your bot?

Before you blame a change log entry, rule out the usual suspects in this order:

1. Discord Status for an ongoing API incident.
2. The HTTP status and Discord's JSON error code in your logs: 401 is the token, 403 with 50013 is a missing permission (see our 50013 fix), 429 is a rate limit (see rate limits explained), and a new 400 right after an entry like the 15 September shard change points to the API.
3. Gateway close codes: 4014 means a privileged intent that is not enabled or approved.
4. Your own process: crashes, restarts and memory, which point to your code or your host.

Log every failed request with its route, status and error code.

Maintenance checklist

1. Read the change log once a month and the release notes of your library before upgrading. On 3 November 2026 the latest versions were discord.js 14.28.0, discord.py 2.7.1, Pycord 2.8.1, nextcord 3.2.0 and JDA 6.7.0.
2. Upgrade on a test branch and a second test bot first. A small plan on our Discord bot hosting runs Node.js, Python or Java with no sleep mode, which suits a test bot.
3. Check the privileged intents in the Developer Portal and remove the ones you no longer use.
4. Confirm slash commands still register and every interaction gets its first response within 3 seconds; defer slow work, then finish within the 15 minute token window.
5. Graph your 429 responses and Gateway resumes.
6. Keep a copy of your last working deployment and rehearse a token rotation.

FAQ

What changed in the Discord API in October 2026?

Four endpoints for computed member and role permissions (30 October), voice channel status without CONNECT for users in the channel (29 October), audit log events 16 and 33 for reordering channels and roles (29 October), and documented content scanning flags (28 October).

What Discord API version should I use in 2026?

v10. Discord lists v10 and v9 as available and v6 to v8 as deprecated, and a request without a version still goes to v6.

What does implicit=false do on the new permission endpoints?

It skips implicit permission masking for a missing View Channel, or a missing Connect in voice and stage channels. You then get what the member's roles and overwrites grant, not what they can actually use.

Do I need to update discord.js for the October changes?

Not to use them: the new routes work through client.rest, and the audit log events and scan flags work as plain numbers. Update to 14.28.0 for appPermissions on picked channels and file type filters on attachment options.

What is the next Discord API deadline?

16 November 2026, when channel obfuscation becomes mandatory for all bots. The change log lists no dated deadline after it.

Why did my bot stop seeing message content?

The Message Content intent is not enabled in the Developer Portal, or your app passed 10,000 users and did not apply for review within 90 days, so Discord removed its access. Without it, message text, embeds and attachments arrive empty.

Sources

All opened on 3 November 2026:

• Discord change log: all entries, source of the entries
• Discord docs: Get Guild Member Permissions, Get Guild Role Permissions, Get Channel Member Permissions, Get Channel Role Permissions, Set Voice Channel Status, implicit permissions
• Discord docs: audit log events and merging, Guild Audit Log Entry Create, attachment flags, embed flags, content scan metadata
• Discord docs: API versioning, Gateway intents and message content intent, privileged intent review, interaction response timing, error and close codes, Discord Status
• discord.js: 14.28.0 release, PR 11577, PR 11580, PR 11590, GuildAuditLogsEntry.js, GuildChannel.js, npm
• discord-api-types: npm, PR 1855
• Other libraries: discord.py, Pycord, nextcord, JDA 6.7.0