# Changelog Every change to the public API, newest first, each dated. Follow it as RSS at [`/changelog.xml`](/changelog.xml). How changes are made and announced is in [Versioning and deprecation](versioning.md). ## Our promise - We add fields and endpoints without notice. Write clients that ignore fields they don't know. - We never remove or rename a field, or change what it means, without **six months' notice** here. - Error `code` values never change. New ones may be added. ## Webhooks have one signature; page links keep your filters - **One webhook signature, `X-InfraNest-Signature-V2`.** Every request InfraNest sends to your endpoint — a test delivery, an event an endpoint is subscribed to, and an event sent by an automation, including the **Send everything to …** automation a new endpoint starts with — now carries the same headers: `X-InfraNest-Event`, `X-InfraNest-Delivery` (when there is a delivery), `X-InfraNest-Timestamp` and `X-InfraNest-Signature-V2`, the HMAC-SHA256 of `"."`. Verify that one header and refuse a timestamp more than five minutes from your clock. Until now an event sent by an automation was signed over the body alone, with no timestamp, so a receiver built against a test delivery rejected it. - **Deprecated: `X-InfraNest-Signature`.** It keeps exactly what it carried before — the timestamped form on test and subscription deliveries, the body-only form on events sent by an automation — until **30 April 2027**, and is then no longer sent. A receiver that verifies it should switch to `X-InfraNest-Signature-V2` before then. - **A failed delivery is retried five times**, the last one eight hours after the one before it (30 seconds, 5 minutes, 30 minutes, 2 hours, 8 hours). It was four: the eight-hour retry was listed and never made. - **`next_page_url`, `prev_page_url`, `first_page_url`, `last_page_url` and `links` keep the request's filters, `sort`, `dir` and `per_page`.** They carried only `page`, so following them returned the unfiltered list from page two on. Follow them as they are. ## First public version The InfraNest API and these docs are public. - **Read** your domains, DNS zones and records, servers, monitors, incidents, maintenance windows, status pages, certificates and audit log with an API token. - **Change** DNS records, monitors, incidents, maintenance windows, status page content, tags and custom fields, in organizations where API writes are switched on. - **Tokens** are scoped per area, work in the organization they were created in, and can never manage your account or order anything. They expire after 30 to 365 days and can be renewed without changing them. - **Safe changes:** an `Idempotency-Key` header makes a retried `POST` happen once, and `?dry_run=1` shows what a DNS change would do. See [Retries and dry runs](retries-and-dry-runs.md). - **Attribution:** audit log entries made through a token carry `via_token_id` and `via_token_name`, and `GET /audit-logs` takes `token_id`. See [Seeing what a token does](tokens-and-scopes.md#seeing-what-a-token-does). - **Settings and secrets are app-only:** single sign-on, notification settings, webhook addresses, plan previews, promo codes, saved payment details and the set-up screens of integrations and automations answer a token with [`session_only`](errors.md#session_only), and are no longer in the reference. Dashboards can be read with a token, but not changed. Invitation lists no longer include the acceptance token. - **Every endpoint is described** in plain language, written for this reference. - **Every endpoint shows a real answer**: the response samples, and the request bodies in the examples, are recorded from the API itself, reads and writes, so a field in an example is a field the API sends or accepts. - **Sandbox:** a free organization with sample data where test tokens (`in_test_…`) try every write and nothing reaches a provider or the internet. See [Sandbox](sandbox.md). - **Status and history:** `GET /status` answers whether everything is up in one call, `aggregates` gives a monitor's uptime and p50/p95 response times for any period, and monitoring results and server metrics take `from`, `to`, `resolution` and pages, refusing a range too long for the resolution with [`range_too_large`](errors.md#range_too_large). See [Status, uptime and history](recipes/status-and-uptime.md). - **AI assistants:** a read-only MCP server at `https://api.infranest.io/mcp` lets Claude, ChatGPT, Cursor and VS Code read your account. In claude.ai and ChatGPT, add it as a custom connector and **Connect with InfraNest** — no token to paste; editors use an API token. See [AI assistants](ai-assistants.md). - **OAuth (Connect with InfraNest):** an app can ask people to connect it to their InfraNest account. The authorization code flow with PKCE at `/oauth/authorize` and `/oauth/token`, one organization per connection, access tokens for an hour and rotating refresh tokens for 30 days, discovery at `/.well-known/oauth-authorization-server`, and self-registration for AI assistants. People remove an app under **My account → Authorized apps**. See [OAuth for integrations](oauth.md). - **Scopes** are the same for API tokens and OAuth apps, listed in the generated [scopes table](scopes.md). - **Rate limits** per token: 300 requests and 60 changes a minute, and 1,000 changes an hour, by default, reported in `X-RateLimit-*` headers on every response. - **Errors** carry a stable `code`, a hint and a reference. See [Errors](errors.md).