Dated, newest first
Changelog
Dated entries, newest first. An entry names a route as live only when the build that generated this page could see it in the API description.
2026-09-08
- Agreements before sign-in: GET /v1/legal/documents lists three documents, the beta terms, the acceptable use policy and the privacy notice, each with a version and a content hash; POST /v1/auth/request-otp records an acceptance of each before a code is sent (live in this build).
- Seats: GET /v1/seats reports capacity, used and remaining; capacity is 40 as of this entry; a new address is refused a code with 423 seats_full when none remain, and existing accounts are unaffected (live in this build).
- Free period: thirty days from an account's first key. GET /v1/billing/status reports the end date and POST /v1/billing/transition-request records a request for continued access; seven days after the period ends, a write from an account with no request is refused with 402 and reads keep working (live in this build).
- Inquiries: POST /v1/inquiries takes a message from anybody, account or not, five an hour per address (live in this build).
- Operator view: accounts, inquiries, continued-access requests, the seat count and a digest preview under /v1/admin, operator-only (live in this build).
- Verification keys: GET /v1/delegations/service-pubkeys lists every service signing key with its key id and validity window, so a token signed before a rotation still verifies offline (live in this build).
- Skill text: GET /v1/skill serves the agent skill as markdown with no key, and the hosted MCP tool afa_skill returns the same text (live in this build).
- Keys minted from this build read afa-beta-<body>-<check>. Keys minted earlier still authenticate.
2026-09-07
- One MCP transport: the remote endpoint over HTTP. The local transport is withdrawn and no file is offered for it.
- Nothing is downloadable. The local ledger schema is printed in full on its own page and the skill text is served as markdown for the console to read.
- MCP scopes narrowed: any key of the account may initialize and list tools; each tool needs the capability of the route it wraps (live in this build).
- Tool descriptions on the MCP page are read from the served registry rather than from a name list.
2026-09-01
- Documentation site at https://app.afaprotocol.com/docs/, generated from the API description with a how-to per operation.
- Remote MCP endpoint POST /v1/mcp (live in this build).
- GET /v1/surfaces (live in this build).
- Per-key capability scopes: POST /v1/me/api-keys accepts scopes; a limited key is refused 403 scope_missing outside its list.
- Usage counting: GET /v1/usage/summary and GET /v1/usage/export (live in this build). Metered, not billed.
- Anchor receipts: GET /v1/anchors and POST /v1/anchors/run (live in this build).
2026-08-31
- Hosted API at https://api.afaprotocol.com answering from durable storage. GET /v1/health reports storage: postgres.
- Webhook delivery: endpoints and the queue persisted; drain every two minutes with bounded retry.
- Delegation tokens carry chain_pubkey and a service binding; GET /v1/delegations/service-pubkey for offline verification.
- Sub-agent grants: containment of a child grant by its parent, metered use (POST /v1/grants/{grant_id}/use), pushed revocation.
2026-08-30
- Console at app.afaprotocol.com served by the API host. Email sign-in, keys, records, grants, notifications.
- Sub-agent grant routes mounted: create, list, status, revoke.