# Changelog

Changes to the Kapi Works API and these docs, newest first.

Each entry names the contract revision it brought. Follow the [RSS feed](https://docs.kapiworks.com/changelog/rss.xml) to hear about new entries.

## API 1.2: live sessions on certificates

*12 October 2026*

Certificates finished at a Kapi live session say when, how long and who taught it.

Contract revision 1.2.0. Clients that follow the 1.1 contract keep working.

**New**

* Certificates finished by attending a Kapi live session in full carry the session: `live_session_id`, `live_session_format`, `live_session_starts_at`, `live_session_ends_at`, `live_session_minutes` and `live_session_marked_by`. With `people:read` they also carry `trainer_name`. See [Training evidence](https://docs.kapiworks.com/guides/training-evidence).
* Records packs add the same columns to the certificate register.

## API 1.1 and the developer docs

*10 October 2026*

A snapshot check, rate-limit headers, safer keys, error pages and these docs.

Contract revision 1.1.0. Clients that follow the 1.0 contract keep working, except that a cursor from 1.0 is refused: start a new pull.

**New**

* [`GET /v1/snapshot`](https://docs.kapiworks.com/reference/get-snapshot) answers "has anything changed?" in one call, with any scope.
* Draft IETF `RateLimit` and `RateLimit-Policy` headers on each accepted call, and `Retry-After` on 429 and 503 that says exactly how long to wait.
* `HEAD` on every endpoint.
* Keys can be limited to networks, and owners and admins are told when a key is used from a new network.
* Error `type` links to the code's page on these docs, and new codes [`key_in_url`](https://docs.kapiworks.com/errors/key_in_url), [`ip_not_allowed`](https://docs.kapiworks.com/errors/ip_not_allowed) and [`upstream_unavailable`](https://docs.kapiworks.com/errors/upstream_unavailable).
* Example responses for every operation, and tags in the contract.
* These docs, with Markdown pages, llms.txt and a docs MCP server. `/v1/docs` on the API now redirects here.
* A [sandbox company](https://docs.kapiworks.com/guides/sandbox) with fictional people, for building an integration before you connect a real company.
* When Kapi erases a person at the company's instruction, the people register shows `access_state` `erased` and open records end with `source_removed`. See [Training evidence](https://docs.kapiworks.com/guides/training-evidence).
* While a company's contract is ending, answers carry a `Sunset` header with the day Kapi deletes the company's data, and a `Link` to [When a company's contract ends](https://docs.kapiworks.com/guides/company-ends).

**Changed**

* Calls the API refuses no longer count against the rate limits.
* A key sent in a web address is revoked, and its company is told.
* Creating a key needs two-step sign-in.
* A `limit` above 200 is treated as 200 instead of being refused.
* Timeouts answer 504 with `read_timeout`, and an unreachable records service 503 with `upstream_unavailable`.
* Responses carry only the fields the contract publishes, and fields that list values are open, so new values can appear.
* Cursors are sealed. Cursors from 1.0 are refused with `invalid_cursor`.

## Kapi Works API 1.0

*8 October 2026*

Read employee training evidence from your own server, with company API keys and an OpenAPI 3.1 contract.

The first release of the read-only Kapi Works API, contract revision 1.0.1:

* Five registers: training records at a moment, training records over a period, certificates, people and courses.
* Company API keys created by owners and admins in Works Studio, with the scopes `training:read`, `certificates:read` and `people:read`, an expiry of at most one year and at most ten active keys a company.
* Pinned snapshots and cursors, so every page of a pull agrees.
* Errors as RFC 9457 problem details with stable codes, and limits of 60 calls a minute for each key, 120 for each company and 2 at once for each company.
* The contract at `/v1/openapi.json`.