Documentation menu

Changelog and version

Changes to the API contract, behavior and limits, newest first. Limit and pricing changes apply only going forward.

On this page

Which version am I using?

  • Contract: the API reference shows the OpenAPI contract version (currently 0.1.0) and its SHA-256, generated from the same document the API is built and checked against. The running API serves it at /openapi.json.
  • Running build: GET /version returns the deployed commit, build ID and build time.

Coming next

Draft — lands with P1 increment 2 Planned; not available on the current API.

Accounts. Email sign-in; self-service API keys; quotas, deadlines and automatic deletion; claiming a trial into an account.

Draft — lands with P1 increment 3 Planned; not available on the current API.

Public beta. These pages on the Sess domains, connected to the account console.

October 2026: interactive Sessions, webhooks and the trial

  • Signed webhooks: one HTTPS endpoint per workspace (PUT/GET /v1/webhook), verified by a signed challenge (POST /v1/webhook/verify, valid 30 days), Standard Webhooks v1 signatures with 24-hour dual-signing rotation (POST /v1/webhook/secrets/rotate), at-least-once delivery with up to 12 attempts within 24 hours, a delivery log (GET /v1/sessions/{id}/deliveries) and redelivery (POST /v1/sessions/{id}/events/{event_id}/redeliver).
  • Interactive Sessions (mode: interactive, source.kind: sess_surface) with heading, text, record and field components, and up to 5 actions per revision.
  • Revision-bound submission from the person's page; one accepted response per revision; a stale submission is refused with SESSION_REVISION_CONFLICT and the new revision is shown with the person's draft values.
  • Typed results on GET /v1/sessions/{id}; next revisions with PATCH /v1/sessions/{id} and completion with POST /v1/sessions/{id}/complete, both requiring a strong If-Match and accepting Idempotency-Key.
  • The Event log (GET /v1/sessions/{id}/events) and exact revision readback (GET /v1/sessions/{id}/surfaces/{revision}).
  • Signed decision receipts (Ed25519 JWS) on every accepted response, verifiable with /.well-known/sess-receipt-keys.json.
  • The no-signup trial: POST /v1/trial/sessions returns a management credential once; GET /v1/trial/sessions/{id} reads the result. See trial limits.
  • The API serves its generated contract at /openapi.json.
  • Automatic deletion of owner-key Sessions: 30 days after a Session is completed or its human link expires, whichever comes first, its content, accepted results and receipts are deleted and outstanding deliveries are cancelled. Receipts stay verifiable until then. This applies to Sessions created from this release on; earlier Sessions are not deleted automatically. See Retention.

October 2026: first preview

  • Create a display Session with POST /v1/sessions and read it with GET /v1/sessions/{id}, authenticated with an owner key.
  • Read-only human page at a private 256-bit link: headings, text, records and tables, with no-store, no-referrer and noindex headers and a strict Content Security Policy.
  • Human links expire 30 days after creation and can be revoked individually.
  • Health (/health/live, /health/ready) and build (/version) endpoints.
  • The OpenAPI contract is generated from code and checked for drift on every change.