Changelog

This page records changes that may affect an integration. Developer API v1 is currently in Preview.

2026-10-04

Breaking

POST /v1/files accepts PNG, JPEG, GIF, WebP, PDF, DOCX, XLSX, CSV and TXT. Other image types (including SVG and HEIC) now return UNSUPPORTED_FILE_TYPE.
The file's contents must match its type: a file whose leading bytes do not match its extension returns UNSUPPORTED_FILE_TYPE.

Behavioral

The file type comes from the filename extension, not the declared Content-Type. A .csv sent as application/vnd.ms-excel is accepted as CSV. Files without an extension still fall back to Content-Type.

Breaking

API keys now end with a checksum (ac_<public-id>_<secret><checksum>). Keys created before this date were revoked; create a replacement in the Admin Panel.
Replaying a completed idempotent request returns 200 with Idempotent-Replayed: true instead of 202.
Message pages return object, first_id, and last_id; next_after was removed. Pass last_id as after.
RateLimit-Reset is now the number of seconds until the window resets, not a Unix timestamp.

Behavioral

Rate limits apply per assistant across all its keys and use a sliding one-minute window. Enterprise plans have higher limits.
Every /v1 error, including authentication and validation failures, returns the documented shape with a registry code and retryable. SSE error events use the same codes.
Idempotency-Key is limited to 255 characters.

Additive

GET /v1/responses/{response_id} retrieves a finished response.
DELETE /v1/users/{external_user_id} with the new users:delete scope erases an end user's data.
Rotation can keep the old key working for 1 hour, 24 hours, or 7 days.
New error codes: IP_NOT_ALLOWED, FILE_UPLOAD_DISABLED, VOICE_DISABLED, ACTOR_CONFLICT, MESSAGE_NOT_FOUND, FILE_NOT_FOUND, RESPONSE_NOT_FOUND, INVALID_CURSOR, VALIDATION_ERROR, UNSUPPORTED_FILE_TYPE, FILE_TOO_LARGE, CONTEXT_TOO_LARGE, RATE_LIMIT_UNAVAILABLE, INTERNAL_SERVER_ERROR.

Published OpenAPI 3.1 and AsyncAPI 3.1 as the canonical machine-readable contracts.
Added standard + auto turn detection to the Voice API.
Clarified the backend integration flow, identity mapping, and production checklist.

Breaking: a client that correctly implements the contract must change its code.
Behavioral: the contract is unchanged, but timing, ordering, limits, or retry behavior changes materially.
Additive: a backwards-compatible optional field, event, or operation is added.
Documentation: clarification only; runtime behavior is unchanged.