API Changelog

Last updated: 2026-07-19

Added webhook CRUD and delivery APIs with events for email activity, mailbox lifecycle, and outbound-consent changes. Deliveries use Standard Webhooks HMAC-SHA256 signatures, support encrypted destination credentials, reject unsafe endpoints, retry failures automatically, and expose delivery status, response codes, errors, payloads, and attempt history.

Features

Dashboard webhook management: create and manage organization-wide and mailbox-scoped subscriptions, choose event types, and configure destination endpoints.
Secure delivery: signed webhook deliveries with configurable authentication headers and signing-secret rotation.
Delivery inspection: view, filter, and replay delivery history with status and retry metadata.
Mailbox improvements: mailbox-scoped webhook controls and ordered pagination for mailbox lists.
Developer features: standard webhook contracts, delivery-event tracking with UUIDs, and persisted destination credentials.

Fixes

Clarified managed webhook header ordering and overall delivery behavior.
Rejected empty mailbox IDs for mailbox-scoped webhooks to prevent invalid scopes.
Made public consent decisions terminal where applicable.
Miscellaneous validation and stability improvements to webhook delivery and configuration.

Last updated: 2026-07-08

v0.3.0 adds the API foundation for controlled outbound email. Operators can define outbound policies, manage recipient consent, and let agents send only to approved recipients while unauthorized outbound SMTP remains unavailable.

This release also expands webhook management and delivery logs, improves audit search and sorting, strengthens identity-aware rate limiting, and restores dynamic host controls for agent infrastructure.

Added the API foundation for outbound policies, recipient consent, and mailbox-level consent checks.
Added database tables, repositories, DTOs, scopes, roles, and plan gates for outbound policy management.
Added consent request delivery through the postmaster mailbox, including the outbound consent email template.
Added daemon enforcement so agents can only send to recipients that are allowed by policy and consent state.
Added mailbox recipient helpers used to evaluate whether a mailbox may contact a recipient.

Webhooks

Added webhook CRUD API routes.
Added webhook delivery logs so operators can inspect delivery attempts and failures.
Added webhook dispatch, signing, encryption, and retry support.
Added webhook database tables, repositories, DTOs, RBAC, and plan enforcement.

Audit logs

Added audit search support.
Added audit event ordering and filtering improvements.
Added safeguards around audit query length.
Fixed audit sorting for event types.
Stopped emitting domain_verified audit entries when the domain verification cron finds no actual change.

Agent hosts and access control

Added dynamic host registration for autonomous agents.
Added host ownership and organization-admin guards.
Added host:delete scope and host role permissions.
Added hard-delete support for hosts scoped to an organization.
Re-enabled dynamic hosts.

Notifications and mail events

Added database-level notification deduplication.
Added backend groundwork for Dovecot push notifications.

Internal API quality

Replaced direct createHash usage with the shared sha256Hex utility.
Improved rate limiting with identity-aware buckets.
Regenerated the outbound policy migration.

Last updated: 2026-04-17

api v0.2.0

This release brings a major expansion to agent infrastructure — hosts, claiming, lifetime management, and audit logging are all now in place. Agents are significantly more capable and controllable.

adds support for agent hosts, including multi-organization host assignment and activity tracking
adds audit event logging across key actions
adds mailbox health indicators and a dedicated status endpoint
adds a notification system for in-app alerts
adds advanced plugin endpoints for extended agent integrations
adds pending approval discovery with the ability to deny requests
adds proxy token signing and verification for secure agent authentication
FIX: organization lookup no longer fails when the ID is null

Last updated: 2026-03-30

Add custom domain management features
Implement SMTP email sending functionality in CLI
Feature: agent_auth foundation

Last updated: 2026-03-24

API & Backend

Authentication

Refactored auth to support multiple methods and guards
Social account linking

Mailboxes

Enforced outbound mailbox recipient policy
Global recipient whitelist for SMTP policy daemon
Sender whitelist functionality
Inbound message size limit
Rspamd text attachment scanning enabled
Mailbox token rotation
Welcome email on mailbox creation
Updated storage limits and calculations for Free and Pro plans

API Keys

API key management
Org-level key support
API key refactor and improvements

Custom Domains

Custom domains — Paid plans organizations can now add their own domain (e.g. acme.com) for sending and receiving email. Includes DNS verification, DKIM key generation, and per-domain DNS setup guide.
Organization domain CRUD endpoints
DNS record generation (MX, SPF, DKIM, DMARC) per domain
Domain verification status tracking

Billing & Plans

Polar as full plan management system
Founder plan added
Pricing plan logic refactor
Limits update on plan change
Registration open to any valid email address

Account

Account deletion flow
User data validation and legal consent on creation
User promotion/demotion

Policy Daemon

Fixed error handling and logging in Postfix policy daemon
Global recipient and sender whitelists

This draft was generated by script/release-draft.ts. Preview URL: https://github.com/we-are-singular/broodnet/releases/tag/api/v0.1.0