Skip to content

Changelog

A record of changes to the SOPFlow REST API.

September 10, 2026 — User administration policy

API keys can no longer change user roles, status, or assigned nodes through PATCH /api/v1/users/:id. Valid write keys receive 403 human_admin_required. Use a signed-in administrator in the administration interface. User listing remains available with the read scope.

v1.1.0

May releaseMay 2026

Writes are out of preview, plus a hardening pass on every endpoint.

  • Added: write endpoints for nodes (POST / PATCH / move / DELETE), SOPs (create / delete / version transitions / phases / steps), users (PATCH role / status / assignedNodeId), and process flows (full CRUD on flows, nodes, edges).
  • Added: write scope. Existing keys keep their read-only behaviour; mutations require a key with the write scope (Settings → API keys).
  • Added: per-key rate limits — 600 req/min overall and 120 req/min on writes. Buckets are per-key, not per-org.
  • Added: Idempotency-Key header on POSTs. Replays of the same key + body return the cached response with Idempotent-Replay: true. Different bodies → 409 idempotency_conflict.
  • Added: Zod request validation. Bad input gets a flat 400 with the offending fields surfaced under details.issues.
  • Added: X-Request-Id header on every response. Quote it when reporting bugs.
  • Added: GET /api/v1/openapi.json — full machine-readable spec (OpenAPI 3.1).
  • Added: GET /api/v1/process-flows + /process-flows/:id, returning nodes and edges inline.
  • Changed: error envelope now includes requestId and (where applicable) a details field. Error code names are stable; status codes match the new HTTP table on Errors & Limits.

v1.0.1

May 2026

Hardening + fixes from a code audit.

  • Fixed: Bearer sk_live_… authentication. The middleware was looking up keys by a different prefix length than the issuer used, so all API key requests returned 401. Existing keys keep working.
  • GET /api/v1/users — invalid role or status query values now return 400 Bad Request with an `allowed` array (was 500).

v1.0.0

April 2026

Initial public release of the SOPFlow REST API.

  • GET /api/v1/organization — org name, slug, status, and plan
  • GET /api/v1/nodes — paginated flat list of org chart nodes
  • GET /api/v1/nodes/:id — single node lookup
  • GET /api/v1/sops — paginated SOPs with active version summary
  • GET /api/v1/sops/:id — full SOP with phases and steps
  • GET /api/v1/users — paginated user list with role/status filters
  • Bearer sk_live_… authentication with bcrypt key verification
  • Cursor-based pagination on all list endpoints
  • Tenant isolation: all queries scoped to the API key's organization

Planned

  • Write scope — POST/PATCH/DELETE endpoints for SOPs and nodes
  • Webhook delivery for SOP status transitions
  • API key expiration and IP allowlist
  • v2 with OpenAPI 3.1 spec and auto-generated SDKs

Review a release against your integration

Maintain a small list of endpoints, fields and permissions your integration relies on. When a release changes one, run the corresponding sample requests in your test environment and inspect both success and failure handling.

Keep your test date and results with the integration version. This documentation update adds practical recipes; it does not announce a new API version or change the endpoint contract.