Changelog

Dates are the platform build that shipped the change.

2026-09-04 — v3.1.321 · Outbound webhooks

• webhooks family: register endpoints, four events, HMAC-signed deliveries, retries, delivery log.

2026-09-04 — v3.1.320 · MCP

• Seven tools: list_hubs, get_hub, get_hub_stats, list_articles, get_article, get_identity, list_brandings (21 total).
• Tool results never include user-authored bodies (*_chars in their place).
• support scope profile; it is the default grant.
• OAuth server accepts every API scope family.

2026-09-03 — v3.1.319 · API contract

• Pagination on every list: ?limit (≤200) and ?cursor, meta.next_cursor.
• Per-key IP allowlist (opt-in; empty = any).
• Per-key rate limit honoured (60/120/300/600 per minute).
• Idempotency-Key on POST, 24-hour memo.
• 5xx responses carry a reference instead of internal text.

2026-09-02 — v3.1.283 · Hubs

• Preview keys retired. POST /hubs/{id}/preview opens a timed preview window on the live key (publishing.write).
• Header fields are single-value; multi-value refused (400).

2026-09-02 — v3.1.274

• Timed preview graded as publishing.write, not hubs.write.

2026-09-02 — v3.1.260

• API keys refused from browser origins (403 browser_origin).
• Request bodies capped at 1 MB by bytes read.

2026-09-02 — v3.1.259

• identity, media, folders families added.
• Hubs scope split into hubs / articles / publishing / subscribers / ai.
• Hub delete and identity delete withheld from the API.