Skip to content
Broodnet

api v0.3.0

Last updated: 2026-07-08

v0.3.0 adds the API foundation for controlled outbound email. Operators can define outbound policies, manage recipient consent, and let agents send only to approved recipients while unauthorized outbound SMTP remains unavailable.

This release also expands webhook management and delivery logs, improves audit search and sorting, strengthens identity-aware rate limiting, and restores dynamic host controls for agent infrastructure.

Section titled “Outbound policy and recipient consent”
  • Added the API foundation for outbound policies, recipient consent, and mailbox-level consent checks.
  • Added database tables, repositories, DTOs, scopes, roles, and plan gates for outbound policy management.
  • Added consent request delivery through the postmaster mailbox, including the outbound consent email template.
  • Added daemon enforcement so agents can only send to recipients that are allowed by policy and consent state.
  • Added mailbox recipient helpers used to evaluate whether a mailbox may contact a recipient.

Webhooks

Section titled “Webhooks”
  • Added webhook CRUD API routes.
  • Added webhook delivery logs so operators can inspect delivery attempts and failures.
  • Added webhook dispatch, signing, encryption, and retry support.
  • Added webhook database tables, repositories, DTOs, RBAC, and plan enforcement.

Audit logs

Section titled “Audit logs”
  • Added audit search support.
  • Added audit event ordering and filtering improvements.
  • Added safeguards around audit query length.
  • Fixed audit sorting for event types.
  • Stopped emitting domain_verified audit entries when the domain verification cron finds no actual change.

Agent hosts and access control

Section titled “Agent hosts and access control”
  • Added dynamic host registration for autonomous agents.
  • Added host ownership and organization-admin guards.
  • Added host:delete scope and host role permissions.
  • Added hard-delete support for hosts scoped to an organization.
  • Re-enabled dynamic hosts.

Notifications and mail events

Section titled “Notifications and mail events”
  • Added database-level notification deduplication.
  • Added backend groundwork for Dovecot push notifications.

Internal API quality

Section titled “Internal API quality”
  • Replaced direct createHash usage with the shared sha256Hex utility.
  • Improved rate limiting with identity-aware buckets.
  • Regenerated the outbound policy migration.