REFERENCE

Changelog

This page tracks notable, user-visible changes to the Decision Receipt API. It is a human summary, not the source of truth — for the exact current state, read the version headers on any response and the live OpenAPI spec.

v0.1.0 — spec 1.0 current

The capabilities available in the current published version. These are described in full in the API reference; this is the at-a-glance surface.

• Keys & tiers. Self-serve signup (POST /v1/signup), account info (GET /v1/account), and three tiers — free (100 req/hr), pilot (10,000 req/hr), enterprise (unlimited) — with a 1-hour sliding rate-limit window surfaced in X-RateLimit-* headers.
• Evaluation. POST /v1/evaluate — the core flow: a claim with typed, provenanced evidence is judged against a policy, checked for replay determinism, and returned as a signed Decision Receipt with verdict ALLOWED ESCALATED BLOCKED.
• Verification. POST /v1/verify (schema, hash integrity, and Ed25519 signature checks) and GET /v1/keys/server for offline, independent verification against the published public key.
• Simulation. POST /v1/simulate — dry-run a policy without persisting a receipt.
• Ledger & insight. /v1/ledger, /v1/ledger/stats, /v1/receipts/search, /v1/receipts/timeline, /v1/receipts/compare, /v1/receipts/diff, plus /v1/repos, /v1/agents, /v1/overview, and Prometheus /v1/metrics.
• Policies. GET /v1/policies and POST /v1/policies for built-in and custom policy configurations; GET /v1/templates for common claim shapes.
• Webhooks. Inbound POST /v1/webhook/github (auto-evaluates PRs, signature-authenticated) and outbound POST /v1/webhooks/outbound for receipt.created events.
• Spec. GET /v1/openapi.json and the interactive Swagger UI at /docs.

Versioning & compatibility

All endpoints are prefixed /v1. The implementation version is returned in X-DecRec-Version on every response; the spec version in X-DecRec-Spec. The API allows cross-origin requests (default origin *; methods GET, POST, OPTIONS; preflight 204). New capabilities are introduced under /v1 additively where possible; any breaking change would move the version.

Watching for changes

Because this summary trails the implementation, the reliable way to track changes is mechanical: diff the OpenAPI spec and watch X-DecRec-Version. New endpoints and field changes will always appear there and in these docs first. (Note: the receipt.created outbound webhook delivers receipts, not release notes — it is a data feed, not a changelog feed.)