## API changelog

Current tool contract: `v1.3` on `/mcp/v1`; REST on `/api/v1`. Every MCP call event carries `toolsVersion`.

### v1.3 · 2026-10-29

Second post-freeze change (Q-DT-10b). Additive only; the endpoint stays /mcp/v1 and v1.2 clients keep working unchanged.

- resolve_attention gains a confirm_deleted action: it records that the user deleted the post in the platform's app, closing a delete_manual destination whose platform gives no read-back (Telegram) as deleted — human-attested, never read-back verified. It needs the publish scope, the destination_id and acknowledge=true; read-back routes and destinations not waiting on a manual delete are refused.
- The attention feed carries the same exit: a delete_manual item on a no-read-back route lists confirm_deleted among its exits, with the platform's delete risk notice shown verbatim.

### v1.2 · 2026-10-29

First post-freeze change. Additive only; the endpoint stays /mcp/v1 and v1.1 clients keep working unchanged.

- Four read-only analytics tools (leg 7, held out of the freeze): get_post_engagement, get_engagement_rollup, get_best_times, get_engagement_coverage — the same views as the REST engagement endpoints; unavailable metrics are excluded and named, never zero-filled.
- get_platform_schema: the platform argument now accepts discord and telegram (Q-DT-7); every other frozen-22 schema is unchanged.
- The directory listing icon is the 512x512 PNG at /brand/directory-icon-512.png (it replaces the /favicon.svg reference, which no route served).

### v1.1 · 2026-10-29

The freeze (leg 6). Additive only; the endpoint stays /mcp/v1 and /api/v1.

- Five MCP tools complete the frozen 22: get_delivery_digest, create_upload_link, get_upload_status, pause_workspace, unpublish_post.
- Every mutating MCP tool accepts an optional idempotency_key (durable per workspace, tool and key).
- upload_media is titled “Import media from a link”; its behaviour and schema are unchanged.
- OAuth: Client ID Metadata Documents are accepted alongside dynamic client registration; discovery advertises both.
- REST: post revisions and autosave (/posts/{id}/revisions, /posts/{id}/autosave), a 409 stale_revision answer on edits that name an old revision, the delivery digest (/digest, /digests), the in-app inbox, per-user notification preferences, upload links, per-token MCP usage.
- Behaviour: editing an approved or pending post now returns it to pending_approval with the approval bound to the new revision (one rule across web, API and MCP).

### v1 · 2026-10-28

First directory-grade surface (leg 3).

- MCP endpoint /mcp/v1 with 17 tools, strict schemas, readOnly/destructive/idempotent annotations and the {code, reason, fix_hint} error contract.
- OAuth 2.0 authorization server: discovery, dynamic client registration, authorization code + PKCE S256, refresh rotation, revocation, protected-resource metadata.
- Per-token MCP rate limit; per-tool call, error and latency metrics (R-35); toolsVersion on every call event.

## Deprecation policy

- Within a version, changes are additive only: new routes, new tools, new optional fields. Nothing is renamed, removed or made stricter in place.

- A breaking change ships as a new version (`/api/v2`, `/mcp/v2`) running alongside the old one.

- An old version keeps working for at least **12 months** after its successor ships, and removal is announced at least **90 days** ahead: on this page, with `Deprecation` and `Sunset` headers on the affected responses, and by email to the owners of workspaces whose tokens used the affected routes in the previous 30 days.

- The MCP tool list, annotations and schemas are frozen at `v1.3`: no change ships while a directory listing is under review.

---
HTML version: https://a1lane.ai/docs/changelog