Developer changelog

API

1. Org API 1.8 · gateway headers2026-10-21
   • Every answer through passkey-x.com/api carries RateLimit-Limit, -Remaining, -Reset and -Policy, X-Request-Id, Cache-Control: no-store and a JSON Content-Type.
   • Errors always read { error: { code, message, request_id, docs } }; docs links to the error's row in this reference.
   • ETag on every JSON read with If-None-Match → 304; Link rel="next" on lists; Idempotency-Key replays on every API; Deprecation and Sunset on offset= paging.
   • Webhooks 2: event catalog 2026-10-21 (26 more events), two signatures while a secret rotates (overlap 0–72 hours), dead letters with replay, and a delivery log filtered by event and result.
2. Org API 1.7
   • Controller and Remote endpoints, personal API keys, IP allowlists and one-hour test keys.
3. Org API 1.6
   • Signing API, webhook event catalog and webhooks managed through the API.

Organization API releases

1. 1.8Webhooks 2 and consistent headers
   • Every answer through passkey-x.com/api carries the same headers (X-Request-Id, RateLimit-Limit / -Remaining / -Reset / -Policy, Cache-Control: no-store, ETag with If-None-Match, Link rel="next", Idempotency-Key replays, Deprecation and Sunset) and errors read { error: { code, message, request_id, docs } }. Webhooks: event catalog 2026-10-21 with 26 more events, POST /v1/webhooks/{id}/rotate-secret with overlap_hours (two signatures while you deploy the new secret), dead letters (PATCH dead_letter_after, GET /v1/webhooks/{id}/dead-letters, POST …/dead-letters/{n}/replay) and a delivery log filtered by event and status, with response codes and excerpts.
2. 1.7Controller and Remote, personal API keys, IP allowlists and test keys
   • Controller endpoints for your IT tools: GET /v1/controller (computers, groups, actions), POST /v1/controller/jobs (scan, lock, message, sync or update computers; signed actions stay in the admin console) and GET /v1/controller/jobs/{id} with a result per computer. Remote endpoints for your helpdesk: GET /v1/remote (seats, devices, sessions), invite links (GET, POST and DELETE /v1/remote/invites) and POST /v1/remote/sessions/{id}/end. New scopes: controller:read, controller:write, remote:read and remote:write, and 21 more webhook events for the Controller and Remote. Personal API keys (pxu_…) for the Customer API: scoped (vault, sync, workspaces, access), expiring, revocable, made in Passkey-X → Developers, with GET /v1/me, /v1/api-keys and each key's activity. Personal and organization keys can be limited to IP addresses (403 ip_not_allowed elsewhere) and one-hour read-only test keys are one click away. Every call with a key is logged, and the owner is emailed the first time a key is used from a new IP address. Calls through passkey-x.com/api carry the caller's real, signed IP address.
3. 1.6Signing API, webhook events and webhooks through the API
   • GET /v1/signature-requests (who still has to sign), POST /v1/documents/{id}/cancel, proof summaries (quantum-safe, passkey, read before signing, offline) on GET /v1/documents/{id}, a new document.signed event, the webhook event catalog (GET /v1/webhooks/events) with exact event subscriptions, and webhooks managed through the API: create, change events, pause, rotate the secret, test, delivery log and replay. New scopes: signatures:write, webhooks:read and webhooks:write.
4. 1.5Logs, company devices and safer automation
   • GET /v1/logs (audit events, sign-ins, API calls, emails and alerts with filters and cursor pages), the company profile, company devices and device codes, setting and stopping policies, blocking and unblocking members, cursor pages on every list, Idempotency-Key on writes and rate-limit headers. Every API call is now recorded in the organization's Logs.
5. 1.4Security center
   • Sign-in risk, incidents and device trust for your SIEM, SOAR or GRC tool. Needs the security:read scope.
6. 1.3Storage, insights and documents
   • The storage pool and Runway forecast, the Trust Index, the document register with Seal Chain verification, and the company group report.
7. 1.2Business automation
   • Onboarding, member security, external-sharing approvals, access handover, item timelines and policies.

Webhook event catalog

1. 2026-10-21
   • 26 more events: Controller quarantine, compliance, scheduled and cancelled actions; Remote recording retention; organization suspension, blocking, closing and domains; signer reminders; webhook pauses and dead letters; notification rule changes. Deliveries carry X-PasskeyX-Event-Catalog and two signatures while a secret rotates.
2. Org API 1.7
   • Controller and Remote events.
3. Org API 1.6
   • First catalog: documents, members, access, security, vaults, company devices, API keys and webhooks, with exact-event subscriptions.

Every event: event catalog.

SDK

1. 1.1.0
   • Reads the gateway headers: px.rateLimit from RateLimit-* (or X-RateLimit-*), responseMeta(body) and px.lastResponse with request id, ETag, Link, Deprecation, Sunset and replayed.
   • paginate / .iterate() follow next_cursor, or Link rel="next" when a body has none.
   • cache: true keeps GET answers with their ETag and revalidates with If-None-Match; onDeprecation is called on Deprecation / Sunset (otherwise one warning per route).
   • A 409 idempotency_in_progress is retried; writes keep the same Idempotency-Key on every retry.
   • Webhooks 2: rotateSecret with overlap_hours (verifyWebhook accepts two secrets), deadLetters and replayDeadLetter.
2. 1.0.0
   • One client for the Customer, Organization and Agent APIs, with retries, timeouts, Idempotency-Key on writes, If-Match revisions, typed errors and verifyWebhook.

Deprecations

Deprecations are announced here and in the answers themselves, with Deprecation (RFC 9745) and Sunset (RFC 8594) headers, before anything stops working. Additive changes (new fields, endpoints, events and headers) need no new version: ignore fields you don’t know. offset= paging on the Organization API is deprecated in favour of cursors (pagination).