API Changelog

Documentation and site updates (no API changes).

Changes

• Fixed: webhook threshold subscriptions now work end to end. Previously, threshold conditions (pass/block score cutpoints) could be stored corrupted, causing threshold-filtered deliveries to fail and threshold subscriptions to error on read.
• Spec correction: nullability is now annotated accurately across request and response schemas (response fields that can return null, and optional request fields such as notes and session label properties, are marked nullable).
• Schema documentation refactor: existing schema references (webhook threshold, subscription tier info) are wrapped in allOf so nullability can be attached. Wire shapes are unchanged; the automated differential showed the wrapping as field removals and additions.

Changes

• Webhook event payload schemas are now fully documented: botDetectedPayload, sessionAnomalyPayload, thresholdExceededPayload, alertTriggeredPayload, reportReadyPayload, sessionCorrelatedPayload, and writingSessionScoredPayload.
• API key header authentication (x-api-key) is now documented as an accepted alternative to Authorization: Bearer on every endpoint. Both methods have always been accepted; earlier specs documented only Bearer.
• Spec correction: webhook eventType and lastDeliveryStatus are documented as their string names (for example botDetected, delivered). The API has always sent strings; earlier specs misdocumented these fields as integers.
• Spec correction: required/optional flags and validation constraints now match server behavior exactly across request and response schemas (webhook url and eventType, error code/message/details, session label isBot, risk thresholds, notes length cap, timestamp formats). No server-side validation changed.
• Spec cleanup: removed the phantom jsonElement schema and its valueKind/item fields, a serializer artifact that never appeared on the wire and previously left webhook schemas unresolvable.
• The allowed values of the status filter on GET /v1/sessions and the enum/default semantics of the session label confidence field are now documented (both existed before; their constraints were unspecified).
• API description text updated (the spec no longer claims the API is read-only; it declares its write operations).

Minor fixes and improvements

Minor fixes and improvements

Minor fixes and improvements

Minor fixes and improvements

Minor fixes and improvements

Minor fixes and improvements

Initial release of the public API documentation for this environment.