Skip to content
Broodnet

API Changelog

← Back to /changelog

Last updated: 2026-07-08

v0.3.0 adds the API foundation for controlled outbound email. Operators can define outbound policies, manage recipient consent, and let agents send only to approved recipients while unauthorized outbound SMTP remains unavailable.

This release also expands webhook management and delivery logs, improves audit search and sorting, strengthens identity-aware rate limiting, and restores dynamic host controls for agent infrastructure.

Section titled “Outbound policy and recipient consent”
  • Added the API foundation for outbound policies, recipient consent, and mailbox-level consent checks.
  • Added database tables, repositories, DTOs, scopes, roles, and plan gates for outbound policy management.
  • Added consent request delivery through the postmaster mailbox, including the outbound consent email template.
  • Added daemon enforcement so agents can only send to recipients that are allowed by policy and consent state.
  • Added mailbox recipient helpers used to evaluate whether a mailbox may contact a recipient.

Webhooks

Section titled “Webhooks”
  • Added webhook CRUD API routes.
  • Added webhook delivery logs so operators can inspect delivery attempts and failures.
  • Added webhook dispatch, signing, encryption, and retry support.
  • Added webhook database tables, repositories, DTOs, RBAC, and plan enforcement.

Audit logs

Section titled “Audit logs”
  • Added audit search support.
  • Added audit event ordering and filtering improvements.
  • Added safeguards around audit query length.
  • Fixed audit sorting for event types.
  • Stopped emitting domain_verified audit entries when the domain verification cron finds no actual change.

Agent hosts and access control

Section titled “Agent hosts and access control”
  • Added dynamic host registration for autonomous agents.
  • Added host ownership and organization-admin guards.
  • Added host:delete scope and host role permissions.
  • Added hard-delete support for hosts scoped to an organization.
  • Re-enabled dynamic hosts.

Notifications and mail events

Section titled “Notifications and mail events”
  • Added database-level notification deduplication.
  • Added backend groundwork for Dovecot push notifications.

Internal API quality

Section titled “Internal API quality”
  • Replaced direct createHash usage with the shared sha256Hex utility.
  • Improved rate limiting with identity-aware buckets.
  • Regenerated the outbound policy migration.

Last updated: 2026-04-17

api v0.2.0

Section titled “api v0.2.0”

This release brings a major expansion to agent infrastructure — hosts, claiming, lifetime management, and audit logging are all now in place. Agents are significantly more capable and controllable.

  • adds support for agent hosts, including multi-organization host assignment and activity tracking
  • adds audit event logging across key actions
  • adds mailbox health indicators and a dedicated status endpoint
  • adds a notification system for in-app alerts
  • adds advanced plugin endpoints for extended agent integrations
  • adds pending approval discovery with the ability to deny requests
  • adds proxy token signing and verification for secure agent authentication
  • FIX: organization lookup no longer fails when the ID is null

Last updated: 2026-03-30

  • Add custom domain management features
  • Implement SMTP email sending functionality in CLI
  • Feature: agent_auth foundation

Last updated: 2026-03-24

API & Backend

Section titled “API & Backend”

Authentication

Section titled “Authentication”
  • Refactored auth to support multiple methods and guards
  • Social account linking

Mailboxes

Section titled “Mailboxes”
  • Enforced outbound mailbox recipient policy
  • Global recipient whitelist for SMTP policy daemon
  • Sender whitelist functionality
  • Inbound message size limit
  • Rspamd text attachment scanning enabled
  • Mailbox token rotation
  • Welcome email on mailbox creation
  • Updated storage limits and calculations for Free and Pro plans

API Keys

Section titled “API Keys”
  • API key management
  • Org-level key support
  • API key refactor and improvements

Custom Domains

Section titled “Custom Domains”
  • Custom domains — Paid plans organizations can now add their own domain (e.g. acme.com) for sending and receiving email. Includes DNS verification, DKIM key generation, and per-domain DNS setup guide.
  • Organization domain CRUD endpoints
  • DNS record generation (MX, SPF, DKIM, DMARC) per domain
  • Domain verification status tracking

Billing & Plans

Section titled “Billing & Plans”
  • Polar as full plan management system
  • Founder plan added
  • Pricing plan logic refactor
  • Limits update on plan change
  • Registration open to any valid email address

Account

Section titled “Account”
  • Account deletion flow
  • User data validation and legal consent on creation
  • User promotion/demotion

Policy Daemon

Section titled “Policy Daemon”
  • Fixed error handling and logging in Postfix policy daemon
  • Global recipient and sender whitelists

This draft was generated by script/release-draft.ts. Preview URL: https://github.com/we-are-singular/broodnet/releases/tag/api/v0.1.0