API changelog

Every change to the REST API, the MCP tool set and the offer schema, newest first. info.version in /openapi.json is the newest release below.

Releases

added: OpenAPI 3.1 document at /openapi.json, generated from the route and tool registries the servers dispatch from.
added: Sandbox: POST /sandbox/agents issues a sandbox token with test credits; every /v1 route and the MCP endpoint answer it against the synthetic corpus.
added: GET /v1/search, GET /v1/reports/{digest}, GET /v1/trust/{subject} and GET /v1/errata as REST twins of their MCP tools.
added: GET /v1/orders/{order_id}/compliance-bundle: a signed bundle of the order, its report, the judge version and key id.
added: Mandate judge filters: min_judge_version and reject_open_judge_errata, refused with judge_version_rejected.
added: Offer documents carry the judge version and hash of the report they offer.
added: GET /.well-known/report-keys on the web origin: the public report-signing key, for offline signature checks.
changed: REST errors are always the typed error object { code, message, remediation, retryable, docs_url }, including authentication failures (previously wrapped in a JSON-RPC envelope).

added: Commerce: POST /v1/orders, GET /v1/orders, subscriptions, POST /v1/topups, GET /v1/balance, GET /v1/ledger, GET /v1/payouts.
added: Device sync under /api/sync/* for cf sync, and the OAuth device grant (/oauth/device_authorization) that issues its tokens.

added: Event outbox: GET /v1/events and POST /v1/events/{id}/redeliver; signed webhooks.
added: OAuth 2.1 authorization server with dynamic client registration, PKCE and token exchange.

Nothing is deprecated.

Version 1, updated 2026-10-11.