Changelog

Changes that affect what you can call, configure or see. Dates are release dates of the early-access build.

Unreleased

• Added: AIVA generate in the Flow builder. The sparkle tile on the palette (and on mobile, next to clear/erase) opens a prompt. POST /v1/aiva/generate returns a tile chain you can edit; an empty flow name is filled from the suggested title, and any warnings stay in the dialog. This does not save or run the flow. Where AIVA is turned off the dialog says so (503). Ask-AIVA chat is not in this build.

• Added: userKey on POST /v1/flows/{id}/run (tenant/admin). An ownerless flow run from a tenant session has no user identity, so weather/series adapters that need userKey used to fail. Pass the user’s tenantKey (the same value as adapter Test). User sessions still send their own key and must not send this field.

• Added: Flows map colours and tile tooltips. Opening a flow paints its bound sources with the last run’s Engine colour (trigger / reset settings, or the probability gradient when that is on). Click a polygon or marker to see the tile values. Embedded hosts also receive a targets-status iframe message with the same snapshot so their own map can match. That message is sent only while a flow is open on the Flows tab; Create and edit send flow: null so the host can show the full catalog again.

• Changed (2026-09-02): deleting a user pauses their flows. A deleted user’s flows, sources, contacts and lists still survive as tenant-owned (they are not deleted with the person), but their active flows are now paused first, so nothing keeps running on schedule or alerting their contacts after they are gone. Reassign the rows with ownerUserKey and re-activate, or use POST /v1/users/{id}/disable when you only mean to revoke access.

• Changed (2026-09-02): limits on platform-sent SMS and voice. When you have not registered a comms adapter, alert texts and calls go out on Soiltech’s account, and those are now capped per tenant and per recipient per hour and restricted to +1 destinations by default. A refused send is recorded on the delivery as skippedQuota or skippedCountry rather than dropped. Register a comms adapter to send through your own provider with no platform budget, or ask your operator to widen the country list. Verification codes use the same budget.

• Added (2026-09-02): per-tenant record ceilings. 500 flows, 5000 sources, 5000 contacts, 500 contact lists and 1000 users per tenant; creating past one is a 409 that names the setting (maxFlows, maxSources, …) an operator can raise for your account. Existing data over a ceiling keeps working; only new records are refused.

• Fixed (2026-09-02): scheduled report runs count against maxRunsPerHour. Time-mode report schedules forced a run per flow per hour without consulting the cap; they now respect it and record a skipped report event explaining why when it trips.

• Added (2026-09-02): GET / DELETE /v1/sessions, tenant-wide session administration. An API key (users:read / users:write) can now list every live session in its tenant, user and tenant alike, and revoke one; /v1/auth/sessions still exists but is self-service and needs a cookie, so a key could never end a session it had minted. Revocation takes effect on the next request.

• Changed (2026-09-02): POST /v1/session-tokens needs an API key. Minting a tenant session token from an existing tenant session is now 403. Such a token recorded no minting key, so the session could renew itself indefinitely and survive revocation of the key that started the chain. Keep using the cookie you have, or mint from the key.

• Fixed (2026-09-02): Idempotency-Key is scoped to your credential, and no longer bypasses rate limits. A stored response is now keyed to the API key that produced it, so another key in the same tenant presenting the same value gets a normal, freshly executed response instead of yours; keys need only be unique per credential. Session cookies ignore the header. Routes that mint a one-time secret (POST /v1/tenants, POST /v1/keys, both session-tokens routes, POST /v1/webhooks, …/rotate-secret, …/reports/send-now) are exempt: a repeat mints a second credential rather than re-serving the first one’s plaintext, so retry those deliberately and revoke what you do not keep. Sending the header no longer suppresses the 429 from the per-credential rate limit.

• Changed (2026-08-28): abuse controls and hardening. Rate limits are enforced (600 per minute per credential, 60 per minute per address on unauthenticated routes, 60 per minute per tenant on session-token mints, verifications and run-now) with RateLimit-* headers and 429 + Retry-After; Idempotency-Key now replays stored responses; bodies over 1 MB are 413; maxRunsPerHour applies to manual runs. Adapter allowedHosts must be public hosts (422 otherwise). POST /v1/adapters/{id}/test returns 202 and the result appears on lastTest. A key can only grant scopes it holds. Webhook URLs must use the default https port. Moving a source or contact list that a flow references is 409.

• Changed (2026-08-26): flows, sources, contacts and contact lists belong to a user. A signed-in user sees and edits only their own records; everything they create is theirs. Tenant keys and tenant sessions see all records, filter lists with ?userKey=, and assign an owner with ownerUserKey (records without an owner are private to the tenant and hidden from users). Responses carry ownerUserId / ownerUserKey. A flow’s sources and contact lists, and a list’s contacts, must share the flow’s owner. tenantKey is now unique per owner. The hourly targets sync runs once per user. A user session can start and confirm verification of its own contacts (POST /v1/contacts/{id}/verifications). See who owns what.

• Available (2026-08-26): outbound webhooks. Register https endpoints under /v1/webhooks (webhooks:manage) for run.completed, flow.triggered, flow.reset, alert.sent, report.generated, user.verified, contact.verified, sources.synced or *. Deliveries are signed (X-GrowthEngine-Signature), retried at 1 m / 5 m / 30 m / 2 h / 8 h, then dead-lettered in a queryable log with redelivery; the signing secret is shown once (rotate any time); seven days of continuous failure disables the subscription. See Webhooks.

• Available (2026-08-26): Flows More Actions. The three-dot menu on a selected flow is More Actions: Export Flow (JSON of the definition), Simulate (run as of a chosen date and time via POST /v1/flows/{id}/run { now }, alerts suppressed) and Inspect (past runs, tile-output chart, CSV of runs and chart data). Upload reads that JSON (and classic Growth Lab {name, model} exports) back as a draft. See Workspace.

• Available (2026-08-25): toolbar Help. Help opens a short map of the workspace (Flows, Create, Flow settings, Settings) and a link to these docs.

• Improved (2026-08-25): sensor type on Sources. Sensor type is only offered on non-area sources (it drives averaging groups). The field suggests soil-probe and types already in your catalog.

• Changed (2026-08-25): flow colours and units on Create and Edit. Flow settings sits next to Draft / Active / Paused on the Flow wizard step. It writes colours, temperature units and per-flow report branding into the draft; Create flow / Save flow persist them. Toolbar Settings is contacts, account branding and adapters only.

• Changed (2026-08-24): contacts live in Settings. Settings → Contacts is where you add people and assign them to lists. The Alerts and Reports steps only pick which lists a flow uses.

• Changed (2026-08-24): toolbar flow shortcuts removed. Create / save / run live on the Flows and Create tabs; the toolbar keeps Settings, theme, sign-in and Help.

• Available (2026-08-24): report PDF download. The public /report/{token} page has Download PDF (brand, per-target tiles, daily-values table, optional map). See Reports.

• Available (2026-08-24): alert verification in the GUI, Run opt-in. The Alerts step shows verified / unverified badges, warns when a selected list has unverified channels, and sends the email link or SMS code from Edit contact. Run on a flow asks whether to send alerts (suppressAlerts: false); scheduled runs always send. See Alerts.

• Available (2026-08-24): Adapters in Settings. Sign in as tenant, then Settings → Adapters to register and edit adapters (script, write-only env, allow-list, Test, targets Sync). See Workspace and Adapters.

• Available (2026-08-24): targets adapters. An adapter can supply your source catalog itself (typed entries with hint, sensorType and geometry, keyed by your own ids); the Engine syncs it into /v1/sources hourly and on POST /v1/adapters/{id}/sync. Sources that disappear upstream are disabled, never deleted. See Adapters.

• Available (2026-08-24): sourceKeys in adapter requests. series / events requests carry each source’s tenantKey beside the Engine sourceIds, so your adapter can look upstream data up by the id your system knows. New canonical metric moisture.percentAvailable (0–100 %).

• Available (2026-08-24): run results chart. Latest analysis has Run results: trigger bands, tile values, the combined flow trigger and the run-window marker. Area targets list the sensors that were averaged.

• Available (2026-08-24): reports. Flows can schedule reports (settings.reports): time mode (calendar, forces a fresh run) and event mode (on trigger, 6-hour throttle), plus POST /v1/flows/{id}/reports/send-now. The Engine freezes the payload, emails a 7-day link (opt-in, verified recipients only) and logs every attempt (GET /v1/flows/{id}/reports); the payload is public JSON at GET /reports/{token} and the GUI renders it at /report/{token}. See Reports.

• Available (2026-08-24): comms adapters. Register a comms-facet adapter to send alert and report messages through your own email / SMS / voice provider. Default emails are brand-resolved ("{brand} Report: …", "{brand} Alert").

• Available (2026-08-21): tenant sessions. POST /v1/session-tokens mints a session token with no user, so the GUI can sign in as the tenant for adapter and branding management. The session is frozen to the minting key’s scopes; GET /v1/auth/me returns kind: "user" | "tenant" with a nullable user.

• Available (2026-08-21): branding profile. The tenant brand has name and logo beside the skin (PUT /v1/branding); tenants can grant users canOverrideBranding to set a personal brand (PUT /v1/branding/me). GET /v1/branding/theme returns the caller-resolved {name, logo, colorSchemes, shape}. See Branding.

• Available (2026-08-21): area sensor averaging. An area target averages the series of same-sensorType sensors located inside its boundary (new sensorType field on sources); sensors outside any area remain their own targets. See Flows & Runs.

• Available (2026-08-21): Source catalog editing in the GUI. The wizard Sources step can add, edit, disable and delete sources; click the map for a point or draw a ring for a boundary. List-only sources (no geometry) remain valid.

• Available (2026-08-21): °C / °F display. Flow settings temperature units convert tile parameters, summaries and run values in the GUI; stored values and tile math stay Celsius.

• Available (2026-08-21): flow settings dialog. Temperature units, trigger / reset colours, optional probability gradient and band notes, and per-flow report name / logo. Colours persist as settings.colors.

• Improved (2026-08-21): stale-data protection for alerts. A target’s previous trigger state carries forward when a run fetches no newer sensor or scout samples, so a quiet sensor cannot flip a triggered flow to reset. The now override on POST /run is honoured by queued runs.

• Available (2026-08-21): alerts and contacts. Manage recipients (/v1/contacts, /v1/contact-lists), verify their addresses (email link / SMS code; the Engine never sends to an unverified address) and configure per-flow alerts (settings.alerts: trigger / reset modes, per-target cooldowns, aggregation). Alerts evaluate after each scheduled run (manual runs opt in with {"suppressAlerts": false}); every send and skip is recorded. See Alerts & contacts.

• Available (2026-08-20): Tenant Skins. Brand the GUI with your colours: light and dark palettes plus optional corner radii, set via PUT /v1/branding/skin and served merge-ready at GET /v1/branding/theme. See Tenant Skins.

• Contract change (2026-08-20): runs are always asynchronous. POST /v1/flows/{id}/run returns 202 with the queued run; poll GET /v1/runs/{id} until status is terminal.

• Contract change (2026-08-20): lastRun. The flat lastRun* fields on a flow are now a nested read-time lastRun object ({id, status, trigger, finishedAt, triggered, probability, color}).

• Available (2026-08-20): scheduling and parallel runs. Give a flow scheduleMinutes (≥ 5) and it runs automatically while active; targets execute in parallel. Overlapping runs of the same flow are skipped (409 on run-now); a per-tenant maxRunsPerHour cap (default 120) applies.

• Breaking rename (2026-08-20): the identity pair. Every record you supply carries displayName (GUI label) plus a stable tenantKey (your own id): sources (name → displayName, externalId → tenantKey), adapters and flows (name → displayName, tenantKey added), tiles (name → displayName; key remains the stable reference). Adapter requests include userKey, the tenantKey of the user behind the run.

• Available (2026-08-20): adapters; the Engine stores no telemetry. Sensor series, weather and scout events are fetched at run time from your adapters and never persisted. Push ingestion is not offered; the ingest:write / weather:write / events:write scopes are replaced by adapters:manage. /v1/adapters is live (per-facet script, encrypted write-only env, egress allow-list, test endpoint) and dataSource: adapter on data tiles works. See Adapters.

• Available (2026-08-19): Sources. POST/GET/PATCH/DELETE /v1/sources: one generic record with a hint (area, sensor, weather-station or your own), optional boundary / location and tenantKey. Flows bind targets by sourceId; the Engine resolves name, geometry and timezone per run. The GUI Sources step draws satellite polygons and markers from the catalog. Scopes are sources:read|write. See Glossary.

• Available (2026-08-19): the GUI runs on the Engine. Flows are stored in the Engine (/v1/flows), the Create palette is built from GET /v1/tiles, tile settings dialogs are generated from each tile’s spec, and Run shows per-tile results.

• Available (2026-08-19): flow engine. Seven built-in tiles (gdd, ch, bv, wv, acc, tw, se) with self-describing specs (GET /v1/tiles, /{id}, /{id}/spec); flow CRUD (/v1/flows, params validated against each tile’s schema, tile versions pinned); manual runs on generated demo data (every data tile has dataSource: generate | adapter); run history (/v1/flows/{id}/runs, /v1/runs/{id}). See Flows & Runs.

• Available (2026-08-18): tenancy and access. Tenant API keys (/v1/keys), users (/v1/users, by-key, disable / enable), session tokens (mint / list / revoke), auth (/v1/auth/session|me|logout|sessions), cursor pagination and q search on every list, RFC 7807 errors with requestId, X-Request-Id. Every route declares a gate (admin / tenant / user, hierarchical) with tenant-key scopes on top. Tenancy is flat (Tenant → Users): you manage user hierarchy in your own platform and register users with your own tenantKey; there is no username / password login, GUI sessions come from tenant-minted session tokens; email and phone addresses must be verified by the Engine before use.

• Available (2026-08-18): GUI shell. Iframe bridge v1 (lab-ready, origin-allow-listed init handshake, token exchange) and the two-tab workspace (Flows and the Create wizard). Standalone /session?token= bootstrap.

• Docs: this site.