# API changelog

Every change to the REST API, the MCP tool set and the offer schema, newest first.
`info.version` in [/openapi.json](/openapi.json) is the newest release below.

## Releases

### 1.0.0 (2026-10-11)

- **added**: OpenAPI 3.1 document at /openapi.json, generated from the route and tool registries the servers dispatch from.
- **added**: Sandbox: POST /sandbox/agents issues a sandbox token with test credits; every /v1 route and the MCP endpoint answer it against the synthetic corpus.
- **added**: GET /v1/search, GET /v1/reports/{digest}, GET /v1/trust/{subject} and GET /v1/errata as REST twins of their MCP tools.
- **added**: GET /v1/orders/{order_id}/compliance-bundle: a signed bundle of the order, its report, the judge version and key id.
- **added**: Mandate judge filters: min_judge_version and reject_open_judge_errata, refused with judge_version_rejected.
- **added**: Offer documents carry the judge version and hash of the report they offer.
- **added**: GET /.well-known/report-keys on the web origin: the public report-signing key, for offline signature checks.
- **changed**: REST errors are always the typed error object { code, message, remediation, retryable, docs_url }, including authentication failures (previously wrapped in a JSON-RPC envelope).

### 0.9.0 (2026-10-11)

- **added**: Commerce: POST /v1/orders, GET /v1/orders, subscriptions, POST /v1/topups, GET /v1/balance, GET /v1/ledger, GET /v1/payouts.
- **added**: Device sync under /api/sync/* for cf sync, and the OAuth device grant (/oauth/device_authorization) that issues its tokens.

### 0.5.0 (2026-07-18)

- **added**: Event outbox: GET /v1/events and POST /v1/events/{id}/redeliver; signed webhooks.
- **added**: OAuth 2.1 authorization server with dynamic client registration, PKCE and token exchange.

## Deprecated now

Nothing is deprecated.

Version 1, updated 2026-10-11.