Changelog

12 October 2026

API 1.2: live sessions on certificates

Contract revision 1.2.0. Clients that follow the 1.1 contract keep working.

New

• Certificates finished by attending a Kapi live session in full carry the session: live_session_id, live_session_format, live_session_starts_at, live_session_ends_at, live_session_minutes and live_session_marked_by. With people:read they also carry trainer_name. See Training evidence.
• Records packs add the same columns to the certificate register.

10 October 2026

API 1.1 and the developer docs

Contract revision 1.1.0. Clients that follow the 1.0 contract keep working, except that a cursor from 1.0 is refused: start a new pull.

New

• GET /v1/snapshot answers "has anything changed?" in one call, with any scope.
• Draft IETF RateLimit and RateLimit-Policy headers on each accepted call, and Retry-After on 429 and 503 that says exactly how long to wait.
• HEAD on every endpoint.
• Keys can be limited to networks, and owners and admins are told when a key is used from a new network.
• Error type links to the code's page on these docs, and new codes key_in_url, ip_not_allowed and upstream_unavailable.
• Example responses for every operation, and tags in the contract.
• These docs, with Markdown pages, llms.txt and a docs MCP server. /v1/docs on the API now redirects here.
• A sandbox company with fictional people, for building an integration before you connect a real company.
• When Kapi erases a person at the company's instruction, the people register shows access_state erased and open records end with source_removed. See Training evidence.
• While a company's contract is ending, answers carry a Sunset header with the day Kapi deletes the company's data, and a Link to When a company's contract ends.

Changed

• Calls the API refuses no longer count against the rate limits.
• A key sent in a web address is revoked, and its company is told.
• Creating a key needs two-step sign-in.
• A limit above 200 is treated as 200 instead of being refused.
• Timeouts answer 504 with read_timeout, and an unreachable records service 503 with upstream_unavailable.
• Responses carry only the fields the contract publishes, and fields that list values are open, so new values can appear.
• Cursors are sealed. Cursors from 1.0 are refused with invalid_cursor.

8 October 2026

Kapi Works API 1.0

The first release of the read-only Kapi Works API, contract revision 1.0.1:

• Five registers: training records at a moment, training records over a period, certificates, people and courses.
• Company API keys created by owners and admins in Works Studio, with the scopes training:read, certificates:read and people:read, an expiry of at most one year and at most ten active keys a company.
• Pinned snapshots and cursors, so every page of a pull agrees.
• Errors as RFC 9457 problem details with stable codes, and limits of 60 calls a minute for each key, 120 for each company and 2 at once for each company.
• The contract at /v1/openapi.json.