Changelog

Every change to the published API contract, pricing and SDKs. Generated from the committed contract itself, so it cannot drift from what the API actually does.

# Vendor Evidence Drift changelog

What changed in the public API — endpoints, request and response schemas,

authentication, error codes, plans, quotas and the base URL. Generated from

git history by npm run gen:changelog; edit the contract, never this file.

A commit that moved none of those things moved nothing you can observe, so it

gets no entry here.

Unreleased

Present in the working tree, not yet committed.

Endpoints

• Added GET /v1/keys — List your API keys for this API
• Added POST /v1/keys/claim — Exchange an emailed claim token for the API key (no API key required)
• Added POST /v1/keys/{id}/revoke — Revoke one of your API keys
• Added POST /v1/keys/{id}/rotate — Replace one of your API keys with a new secret

Requests and responses

• POST /v1/keys request: added name.
• POST /v1/keys response: added status, email, expiresAt, next, message; removed apiKey, accountId, product, quotaPerPeriod, plan, warning, usage.

Base URL

• Base URL is now https://vendorevidence-api.com (was https://web-production-e514b.up.railway.app).

Documentation

• POST /v1/keys summary and description revised.

2026-08-31 · 40e5069

Add usage endpoint, docs playground, changelog, and a completeness audit

Endpoints

• Added GET /v1/usage — Your consumption and remaining allowance for this period

2026-08-31 · 98cb8b3

Make the site build self-contained, and set the real contact address

Plans and quotas

• Plans published. Billed per evidence check.

| Plan | Per month | Included evidence checks | Additional | Overage cap |

| --- | --- | --- | --- | --- |

| Developer | $499 | 2,500 | $0.30 each | $1,000 |

| Growth | $1,999 | 12,000 | $0.22 each | $4,000 |

| Scale | $5,000 | 40,000 | $0.16 each | $10,000 |

| Enterprise | $10,000 | 120,000 | $0.10 each | $20,000 |

2026-08-31 · bda8a06

Stamp the deployed origin into the contract, and pin it with tests

Base URL

• The contract now names the deployed origin https://web-production-e514b.up.railway.app. Generated clients built from an earlier copy point at nothing.

2026-08-31 · d8543d1

Cleanup release: truthful docs, a twelve-spoke colour wheel, layout fixes

SDKs

• TypeScript client SDK updated.

2026-08-31 · dbd1021

Vendor Evidence Drift API: compliance evidence drift mapped to controls

Endpoints

• First published contract, 8 operations:
• GET /health — Liveness and deployed version (no API key required)
• GET / — Service index — endpoints, auth and error format (no API key required)
• POST /v1/checks — Compare two evidence snapshots and return drift, controls and risk
• POST /v1/demo/check — Public demo — compare one pair of snapshots without a key (no API key required)
• GET /v1/drift-types — Every drift code, severity, control mapping and scoring constant (no API key required)
• POST /v1/checkout — Start a hosted Square checkout for a paid tier (no API key required)
• POST /api/billing/webhook — Square billing events, forwarded by the shared hub (no API key required)
• POST /v1/keys — Create a free sandbox API key (no API key required)

Authentication

• Keys are sent as bearer authorization, or as the x-api-key header.

Errors

• Errors return a machine-readable error.code: invalid_api_key, missing_api_key, quota_exceeded, rate_limited, invalid_request, not_found, method_not_allowed, payload_too_large, conflict, internal_error.

Plans and quotas

• Free sandbox keys allow 150 evidence checks per period, no card required.

SDKs

• Python client SDK published.
• TypeScript client SDK published.

Derived from the committed openapi.json, site/pricing.json, the

SANDBOX_QUOTA enforced in src/index.ts, and sdk/. Dates are commit dates.

Base-URL entries ignore loopback origins: those are written by the contract

generator when it runs without BASE_URL and were never addresses anyone

could call.