Changelog

Every change to the published API contract, pricing and SDKs. Generated from the committed contract itself, so it cannot drift from what the API actually does.

# Agent Mandate changelog

What changed in the public API — endpoints, request and response schemas,

authentication, error codes, plans, quotas and the base URL. Generated from

git history by npm run gen:changelog; edit the contract, never this file.

A commit that moved none of those things moved nothing you can observe, so it

gets no entry here.

Unreleased

Present in the working tree, not yet committed.

Endpoints

• Added GET /v1/subscription — Your current plan, billing window and available changes (dashboard session required) (no API key required)
• Added POST /v1/subscription/plan — Upgrade or downgrade to another plan (dashboard session required) (no API key required)
• Added POST /v1/subscription/cancel — Cancel this plan and end metered access (dashboard session required) (no API key required)
• Added GET /v1/invoices — Every invoice issued against this account, newest first (dashboard session required) (no API key required)
• Added GET /v1/payments — Every payment attempted against this account and how it went (dashboard session required) (no API key required)

2026-08-31 · 240f0bf

Customer account portal, key lifecycle, and the money path that never worked

Endpoints

• Added GET /v1/keys — List your API keys for this API
• Added POST /v1/keys/claim — Exchange an emailed claim token for the API key (no API key required)
• Added POST /v1/keys/{id}/revoke — Revoke one of your API keys
• Added POST /v1/keys/{id}/rotate — Replace one of your API keys with a new secret

Requests and responses

• POST /v1/keys request: added name.
• POST /v1/keys response: added status, email, expiresAt, next, message; removed apiKey, accountId, product, quotaPerPeriod, plan, warning, usage.

Base URL

• Base URL is now https://agentmandate-api.com (was https://web-production-d972a.up.railway.app).

SDKs

• Python client SDK updated.
• TypeScript client SDK updated.

Documentation

• POST /v1/keys summary and description revised.

2026-08-31 · 9ae7a8a

Add usage endpoint, docs playground, changelog, and a completeness audit

Endpoints

• Added GET /v1/usage — Your consumption and remaining allowance for this period

2026-08-31 · e413d6d

Make the site build self-contained, and set the real contact address

Plans and quotas

• Plans published. Billed per verified action.

| Plan | Per month | Included verified actions | Additional | Overage cap |

| --- | --- | --- | --- | --- |

| Developer | $299 | 10,000 | $0.06 each | $600 |

| Growth | $1,499 | 75,000 | $0.04 each | $3,000 |

| Scale | $4,999 | 400,000 | $0.02 each | $10,000 |

| Enterprise | $10,000 | 1,200,000 | $0.01 each | $20,000 |

2026-08-31 · 7704672

Stamp the deployed origin into the contract, and pin it with tests

Base URL

• The contract now names the deployed origin https://web-production-d972a.up.railway.app. Generated clients built from an earlier copy point at nothing.

2026-08-31 · c177fd7

Cleanup release: truthful docs, a twelve-spoke colour wheel, layout fixes

SDKs

• TypeScript client SDK updated.

2026-08-30 · 0ef7667

Point SDKs, README and Postman at the deployed host

SDKs

• Python client SDK updated.
• TypeScript client SDK updated.

2026-08-30 · 8d56651

Agent Mandate & Intent API: signed mandates, deny-by-default verification

Endpoints

• First published contract, 11 operations:
• GET /health — Liveness and deployed version (no API key required)
• GET / — Service index — endpoints, auth and error format (no API key required)
• POST /v1/mandates — Issue a signed mandate
• POST /v1/verify — Verify proposed actions against a mandate
• POST /v1/mandates/{id}/revoke — Revoke a mandate
• GET /v1/revocations — List the mandates you have revoked
• POST /v1/demo/verify — Public demo — issue and verify in one call, without a key (no API key required)
• GET /v1/violations — Every violation code the engine can return (no API key required)
• POST /v1/checkout — Start a hosted Square checkout for a paid tier (no API key required)
• POST /api/billing/webhook — Square billing events, forwarded by the shared hub (no API key required)
• POST /v1/keys — Create a free sandbox API key (no API key required)

Authentication

• Keys are sent as bearer authorization, or as the x-api-key header.

Errors

• Errors return a machine-readable error.code: invalid_api_key, missing_api_key, quota_exceeded, rate_limited, invalid_request, not_found, method_not_allowed, payload_too_large, conflict, internal_error.

Plans and quotas

• Free sandbox keys allow 500 verified actions per period, no card required.

SDKs

• Python client SDK published.
• TypeScript client SDK published.

Derived from the committed openapi.json, site/pricing.json, the

SANDBOX_QUOTA enforced in src/index.ts, and sdk/. Dates are commit dates.

Base-URL entries ignore loopback origins: those are written by the contract

generator when it runs without BASE_URL and were never addresses anyone

could call.