There doesn't seem to be a place that describes the policy. That API-object, documentation page would be perfect for it.
However, a lead Stack Exchange developer has stated that anything that reveals voting patterns will be hidden or private.
Another Stack Exchange employee explains how user deletions and post deletions are kept private-ish, but experimental observation shows that this may not carry over into what the API treats as private. (post_deleted
is private, while user_deleted
is public, for example.)
Here are the reputation event types and their private (need to be authenticated and visible only to the user in question) status, as experimentally determined:
Reputation History Type Public/Private?
-------------------------------- ---------------
answer_accepted public
answer_unaccepted public
arbitrary_reputation_change public**
asker_accepts_answer public
asker_unaccept_answer public
association_bonus public
bounty_cancelled probably public?
bounty_earned public
bounty_given public
post_deleted private
post_downvoted public
post_flagged_as_offensive probably private?
post_flagged_as_spam probably private?
post_migrated probably private?
post_undeleted does not appear?***
post_undownvoted public
post_unupvoted public
post_upvoted public
suggested_edit_approval_received public
user_deleted public
vote_fraud_reversal probably private?
voter_downvotes private
voter_undownvotes private
Notes:
- ** In at least one case, anyway -- the special private beta bonus for this site.
- *** Looked in a couple of cases where rep changed due to undeletion, but this event did not appear in either the public or private API routes.
- The events with (?) could not be found by me. I don't recommend attempting spam or vote fraud to test those, either. ;)