Axuz Docs

Changelog

What changed in the Axuz platform and API that matters to people who use the product or integrate with it, organised by date, starting on 22 October 2026.

This is the history of what actually changed, written from the services’ commit history. Axuz does not publish API version numbers: the API evolves continuously and this record is by date. Only changes that matter to people who use the product or integrate with it are included; internal refactors, tests and infrastructure tweaks are left out.

Each item carries a label: New, Change (behaviour you may notice), Fix or Security. When a change affects the contract, the API reference already describes the new state.

2026-10-22

  • New: documentation sites. docs.axuz.net (product guides) and developers.axuz.net (the API for integrators) go live, in Portuguese and English, with search. The first path for developers is the quickstart; after it come Errors, Pagination and Rate limits.
  • New: OpenAPI specification. The API reference is now generated from an OpenAPI specification produced from the services’ live route inventory, with the access class of each operation (public, authenticated, team member, team admin, by permission or scope). An automated check blocks publication if the spec drifts from the code. In this first version some parameters and bodies are not typed in the spec yet; the operation description is the source in those cases.
  • New: public board link and external assignees. The workspace service gains routes to assign tasks to external assignees (people without an account) and to share a board through a public link, with a public route that needs no login and a per-IP limit. The contract is in the spec; see the integrations page.
  • New: tasks and posts, routes restored in the workspace service. Reordering, batch operations, dependencies, subtasks, sharing, labels, custom fields, watchers, recurrence, view preferences, saved filters and task templates; time entries per task, mention candidates and AI-assisted replies; versions, votes and revisions of timeline posts. A recurring task is now materialised by a dedicated worker.
  • New: attachments on Timeline posts. The files service lets you attach and detach files on Timeline posts.
  • Change: custom fields. Changing the type of a custom field that already holds incompatible values is now refused with 409 and {"error": "field_has_values"}.
  • Change: realtime events. Mutations of tasks, channel posts, reactions, polls, edits and removals now record the event transactionally (outbox) and reach the WebSocket through a bridge with a sequence number (seq) and deduplication. Task and feed events also carry board_id, timeline_id and feed_id.
  • Fix: empty lists no longer come out as null. The main, workspace, authentication, files, calendar and forms services normalise empty lists to []. Keep defensive handling of null on the client anyway (see Pagination).
  • Fix: GET /me/dms now returns the members of each direct conversation.
  • Security: stricter social login. Google id_token validation uses JWKS, GitHub login uses PKCE, only verified e-mail is accepted, state is single-use and linking a social account requires fresh authentication.
  • Security: allowed IPs for operators. The platform operator routes now honour an allowlist of IPs, answering an opaque 404 to anyone outside it. It does not affect ordinary clients and integrators.

2026-10-21

  • Security: argon2id passwords. New passwords use argon2id and old ones are rewritten on the next successful login. The maximum password size is now 1024 bytes.
  • Fix: e-mail code sending limit is now counted per code purpose, instead of in a single bucket.

2026-10-20

  • Security: stricter roles and scopes. Several routes now require the right scope or role, and you may see 403 where the call used to go through: writing forms requires forms:write; reading and writing files requires the role’s files:read and files:write; only the resource owner (or an admin) changes someone else’s file and manages a public link; only whoever created an event adds attendees; a guest (guest) never approves a bill payable; tax simulation requires tax:calculation:read; editing or deleting a wiki page requires more than read access. Members gain the calendar:* set and guests calendar:event:read.
  • Security: revoked sessions. An access token from an already revoked session is now rejected. Changing the password ends the other sessions.
  • Fix: database errors are no longer echoed. Sign-up stops returning the raw driver text in a 500.
  • Fix: file.shared webhook stops publishing the shared link’s token.
  • Change: reserved internal e-mail domain. Signing up with a reserved internal domain gets 400 with internal_domain_reserved.

In progress

These items are being built and are not yet part of the stable contract. The matching pages, where they exist, carry the “soon” badge.

  • Integrations and bots. The integrations API (installations, axz_bot_... integration tokens scoped to a team) is being completed. The security scheme already appears in the spec marked as “soon”.
  • Webhooks with a delivery identifier. Signed delivery with an identifier per attempt (Delivery-Id) so receivers can deduplicate.
  • OAuth 2.1 with PKCE for third-party applications. The “Sign in with Axuz” flow and per-resource scopes are described in the spec, but opening it to third parties is not finished yet.
  • Complete spec typing. Part of the services still has bodies and parameters described only in text; typing is being completed.

Updated