That is a question for support. Nobody in the Community can be absolutely certain that they are up to date. I would expect that if they were wrong we would see absolute havoc given the number of people who use the API to update internal access control rules.
How are you implementing your access control? Do you have logs of blocked access that you can correlate with 522 errors?