Changelog

Every change to the Anlyon API contract, with the date it took effect and a migration note.

Every change to the API contract is listed here with a migration note. The newest entry is at the top. Dates are UTC.

2026-10-05

A plan counts environments, and every workspace starts with Production

Breaking, billing responses. limits.maxEnvironments and betaAllowances.environments are one number, or the string "unlimited". They were objects keyed by development, staging and production.

Affected responses:

• GET /api/v2/billing/plan
• GET /api/v2/billing/plans
• GET /api/v2/public/pricing-policy

What else changed with it:

• A new workspace gets a default environment of kind production, named Production, with protection on. Existing environments keep their kind, name and slug.
• A workspace creates environments of kind development, staging and production inside one total. PATCH /api/v2/workspaces/{workspaceId}/environments/{environmentId} changes kind with no plan check.
• A create over the total returns 429 QUOTA_EXCEEDED.
• Early Beta Access includes environment protection, promotion between environments and the email notification channel. Email is capped at 500 emails per workspace per UTC month. features.protectedProduction and features.controlledPromotion are true there.
• The message of PAID_PLANS_UNAVAILABLE reads “Paid plans arrive after the beta. Nothing was charged. Your workspace keeps its Early Beta allowances.” The message of HTTPS_REQUIRED reads “HTTPS is required.” Codes and statuses are unchanged.

Migration note.

• Read maxEnvironments and betaAllowances.environments as a number or the string "unlimited". A client that read maxEnvironments.production, or summed the three keys, reads the one value.
• @anlyonhq/sdk types BillingPlanLimits.maxEnvironments and BetaAllowances.environments as number | 'unlimited'. Update the package and fix the type errors it reports.
• Deleting a secret or a schedule in a protected environment needs confirmProtected: true. That now applies to the default environment of a new workspace.
• A client that matched on the old message text of PAID_PLANS_UNAVAILABLE or HTTPS_REQUIRED matches on the code.

The Stripe refund adapter accepts a live or a test key

The stripe.refund adapter config names mode: "live" or mode: "test". The credential must be a Stripe key of that mode, and the payment intent must belong to that mode. A mismatch is refused before anything is sent. The fault drill runs with mode: "test".

Migration note. An action created with mode: "test" keeps working with its test key. To refund live payments, create an action with mode: "live" and store a live key as its secret.

2026-10-03

Notification routes are split into read, write and manage

Security fix, breaking. Every method on /api/v2/notifications used to need notifications:read. A key with that scope could change the alert webhook, the email recipients and send a test webhook.

• notifications:write is in the default API key scope set.
• notifications:manage is privileged. No key receives it by default.
• A member mutes notification types for themselves with /preferences/me. A muted type is still raised and still delivered to every channel and every other member.
• An API key has no user and answers 403 USER_IDENTITY_REQUIRED on /preferences/me.

Migration note.

• An OAuth client connected before 2026-10-03 must re-consent before it can mark notifications read, dismiss them or change notification settings.
• An API key with an explicit scope list needs notifications:write added to mark read or dismiss, and notifications:manage to change workspace notification settings. Until then those calls answer 403.

A third adapter, resend.email_send

Additive. POST /api/v2/actions and PATCH /api/v2/actions/{ref} accept adapter.type: resend.email_send with the config { domain, fromAddresses? }.

• Impact is counted in emails, one per recipient across to, cc and bcc.
• succeeded means Resend accepted the send and returned an email id. A read-back that matches grades the effect confirmed. Neither grade means the email was delivered.
• A replay is offered for 24 hours, the time Resend keeps an idempotency key.

Migration note. None. Existing actions are unchanged.

Any action can be governed, and every effect returns a grade

An action may carry impact, verify or governed: true. Such an action is governed: each invocation creates an effect, binds its approval to the exact request, reserves its declared quantity against every applicable impact limit before dispatch, and returns a receipt. An action with no declaration and no adapter is unchanged.

Additions:

• Action and ActionVersion return governed, impact and verify.
• Effect returns grade: confirmed, acknowledged, unknown, failed, refused, denied or pending. GET /api/v2/actions/effects accepts grade as a filter.
• ImpactLimit returns unit, and POST /api/v2/impact-limits accepts a declared unit as dimension.
• Changing or removing what a governed action declares needs the actions:govern scope.

Breaking for typed clients. dimension on ImpactQuantity, ImpactLimit and CreateImpactLimitRequest is no longer a closed enum of money and resource_mutations. A workspace that declares a unit, such as emails, sees that unit name there.

Migration note. Treat dimension as a string. A workspace that declares no unit sees the same two values as before. Handle an unrecognised grade value as you would unknown.