API Changelog

This file is the customer-facing changelog for public API behavior.

Compatibility expectations for stable and preview operations are defined in the API stability policy.

Every public API change should add an entry before release:

  • new endpoints or operation families
  • new request or response fields
  • new error codes
  • billing or credit behavior changes
  • rate limit, pagination, idempotency, or lifecycle changes
  • preview to stable transitions
  • deprecations and sunset dates

Changes

  • 2026-11-13: 26 new data tools, all through the same API, hosted MCP and CLI: Google News, Images, search suggestions, AI Mode and YouTube (search, video details, transcript, comments); keywords for a website, competitors, keyword overlap, top pages, backlink history, keyword trends (with Google Trends), technologies of a website, websites that use a technology, page speed (Lighthouse), brand mentions and WHOIS (paid-only); Google reviews of a business, which finishes in about a minute. See Data tools. Chab CLI 0.1.5 starts any of them with chab operations start <operation-key> --input.

  • 2026-11-13: Chab CLI 0.1.4. Tool commands such as chab search web wait for the result (up to 90 seconds) and print it in the same output, under result with --json. Longer work keeps running and the output says how to get the result. --wait waits up to 10 minutes; --wait=false returns right away. Update by running the installer again.

  • 2026-11-13: Results in one call. Every start accepts ?wait= (up to 30 seconds); when the operation finishes in time, the reply includes a result object shaped like the result endpoint. The hosted MCP tool chab_operation_start waits 20 seconds by default (wait_seconds), and its idempotency_key is optional: the same tool and input within 10 minutes is the same run. New hosted MCP tool chab_tool_describe returns a tool's input fields and an example.

  • 2026-11-13: Credit packs without a plan (pay as you go). Teams without a subscription can buy packs at half size: 500, 2,500 and 5,000 credits for $39, $179 and $329. While they have bought credits they can use every tool, research included. GET /v1/billing/packages lists the sizes for the caller's team. contacts.domain_search is no longer covered by free credits.

  • 2026-11-13: POST /v1/research/deep needs a paid plan. Free credits (the guest trial and the signup bonus) no longer cover research; a free start returns operation_not_available_on_free. Research stays listed in the tool catalog and in hosted MCP.

  • 2026-11-13: POST /v1/contacts/email-verify checks the domain in DNS first. An address on a domain that does not exist, has no mail server or accepts no email is invalid without a mailbox check, with the new optional verification field reason (no_mail_server or domain_accepts_no_mail).

  • 2026-11-12: Bing web search answers are checked against the query. When Bing returns results for a different search, Chab asks once more and then falls back to Yahoo, which uses Bing's index; the result then has "engine": "yahoo", a new requested_engine field and a provider_degraded warning. If no engine answers the query, the operation fails with provider_unavailable at no charge. Repeated results are dropped, search.web now bills on the unique results returned (still 1 credit per started 10, at least 2, never above the reservation), and a Google result row never carries a Google redirect in url (it is null when Google shows no address). See Search Endpoints.

  • 2026-11-12: POST /v1/search/serp accepts screenshot: true for a PNG of the Google results page as people in that country or city see it, in that language (artifact role serp_screenshot, result field screenshot). It adds 2 credits, which are not charged when the screenshot cannot be taken. See Search Endpoints.

  • 2026-11-12: Google web search and SERP results no longer hand out bare Google redirect links. Google started hiding result links behind google.com/goto redirects in late October; Chab now follows them, top results first. Google answers only a few in quick succession, so a link Chab could not follow keeps the site address in url with availability.url: "partial" and Google's link in the new redirect_url field, plus a partial_results warning. partial is a new FieldAvailability value. See Search Endpoints.

  • 2026-11-12: City search. POST /v1/search/web and POST /v1/search/serp accept location.city (Google only) and location.region, and POST /v1/business/search now searches the requested city itself for any city Google lists, in local or English spelling. An unknown city is rejected with validation_failed; before, it silently searched the whole country. Results name the place searched in location.resolved_name. See Search Endpoints and Business Endpoints.

  • 2026-11-12: POST /v1/contacts/email-verify accepts emails, a list of up to 100 addresses, as an alternative to email. The result lists each address with its verdict and a count per verdict. Each address costs 2 credits; addresses that could not be checked are returned with checked: false and are not charged. See Contact Endpoints.

  • 2026-11-12: POST /v1/convert/file and file uploads accept more formats: Word 97 (DOC), OpenDocument (ODT, ODS, ODP), RTF, Excel (XLSX, XLS), PowerPoint (PPTX, PPT), CSV, TSV and EPUB. Spreadsheets become one table per sheet, slide decks one section per slide. CSV and TSV uploads now have their own source format (csv, tsv) instead of txt and convert to a table. Text and CSV files cost 5 credits, Office, OpenDocument, RTF and EPUB files

    1. See Convert Endpoints.
  • 2026-11-12: New SEO tools. POST /v1/seo/domains/keywords lists up to 1,000 Google keywords a domain ranks for, with position, ranking URL, search volume, CPC, difficulty and estimated traffic (4 credits plus 4 per started 100 keywords). POST /v1/seo/domains/traffic returns the estimated organic Google traffic of a domain with up to 24 months of monthly history (55 credits). seo.domains.backlinks accepts group: "referring_domains" for one row per linking domain, ranked by each linking site's own authority (40 credits, like the backlinks group), and the backlinks_desc order. The domain overview now fills visibility.organic_traffic and visibility.organic_keywords. search.web accepts limit up to 100, priced at 1 credit per started 10 results with a minimum of 2, so requests of up to 20 results keep their price. See SEO Domain Endpoints and Search Endpoints.

  • 2026-10-29: Paid plans and credit packs are open. Starter $29, Pro $99 and Scale $299 a month (or yearly with two months free); credit packs of 1,000, 5,000 and 10,000 credits for $39, $179 and $329. Every verified signup now gets 100 bonus credits. See Credits and Billing.

  • 2026-10-29: New prices for five tools so each one covers what it costs to run: contact domain search 80 credits (was 8), email finder 8 (was 4), email verification 2 (was 1), domain overview 35 (was 15) and domain backlinks 40 (was 25). Operations that were already accepted keep their reserved price.

  • 2026-10-29: Chab is publicly available at https://www.chab.ai. Anyone can try all 19 tools without signing up: the guest trial gives 50 one-off credits for 7 days. Account registration is open, and verifying your email adds bonus credits. Agents can sign a person up by email with POST /v1/signup or the hosted MCP chab_sign_up tool. The REST API, the CLI (installed from https://www.chab.ai/install.sh or install.ps1), local MCP and hosted MCP all reach the same tools. Paid plans and credit packs are coming soon. Credit, signup and plan errors in REST and MCP now include user_action, next_step, signup_url or upgrade_url where they apply. See Getting Started.

  • 2026-10-29: Simpler operation starts. A tool can start when it is switched on, its family is not paused by the automatic circuit breaker, a provider is ready and you have credits; free credits also need room under the daily free-use limit. A tool without a ready provider returns the retryable provider_unavailable while every other tool keeps working. GET /v1/health family states are now healthy, degraded, disabled and unknown; covered_operation_keys is always a list of the operations that can start now, and the overall status covers all 19 public tools. operation_family_degraded and operation_family_disabled details now contain family and remediation. See Service Health.

  • 2026-10-16: Migrate preview research.deep to supported research execution behind its existing public API. Paid quick, standard and comprehensive requests now need larger conservative credit holds for bounded provider work; paid dry runs check that hold before accepting. Free and guest research counts toward the daily free-use limit. An output-limited response with a usable cited report now returns a partial_results warning. Request, artifact and actual-usage settlement shapes are otherwise unchanged. See Research Endpoints.

  • 2026-10-02: Hosted MCP artifact output now supports bounded PNG/JPEG images, UTF-8 text paging and short-lived download links for both guest and account connections. Transfers use a zero-credit transfer allowance with hourly transfer and daily byte limits. Account bytes remain metered. Download links expire within five minutes, allow at most three downloads, and stop working when their connection loses authority. See Hosted MCP.

  • 2026-10-02: Guests and verified free accounts can use all 19 tools. Guest balances remain one-off. The homepage demonstrates two operations; API/CLI and local or hosted MCP expose all of them. Guest compatibility remediation links for signup and exhausted credits now point to the browser-trial guide. The Chab support address is [email protected].

  • 2026-09-29: Hosted MCP consent describes the full public tool catalog and research reservations. Newly approved connections use displayed rolling-day limits of 25 credits for guests and 1,000 for accounts, always bounded by their eligible balance. Eligible new trials receive 50 one-off credits; existing grants and previously approved connection limits are unchanged.

  • 2026-09-28: Free credits now work with all 19 tools instead of two, with own-file helpers for conversion and model discovery. Availability still depends on service health, credentials, policies, scopes and individual allowances. Private integrations and account administration require their own account authorization. All paid plans include the public tools within their existing credits and plan quotas.

  • 2026-09-28: Free provider work shares a daily free-use limit, separate from customer credits. When it is reached, free starts pause for a while with promotional_budget_exhausted; paid-credit work is not affected. See Free credits and limits.

  • 2026-09-28: Document the public CLI release, local MCP, hosted browser OAuth and downloadable skill at the single www origin. Installation is version pinned and updates remain manual. Check live compatibility and health before starting work.

  • 2026-09-25: Chab uses one origin: https://www.chab.ai/ for the app, /v1 for the API, /mcp for hosted MCP, and /docs for customer documentation. Fresh CLI profiles default to that app/API pair; explicitly saved destinations are not silently moved.

  • 2026-09-24: Hosted MCP OAuth code and refresh-token exchanges now reject malformed, oversized, or unknown grants before expensive token processing. Newly issued grants keep the same OAuth format and are recognized quickly, so unknown grants do not slow down valid users. Repeated use of one grant or a busy source can return HTTP 429 with Retry-After. Existing connection ownership is unchanged.

  • 2026-09-24: A dispatched billable provider operation now retains its credit reservation when cancellation, access revocation, or a timeout leaves actual provider cost unknown. Chab checks an existing search provider task for up to 24 hours or 120 polls before operator review. An unresolved hold remains unavailable but is not charged; support may need the provider's records to close it. No new provider start is made merely to reconcile cost. A provider-accepted search task can settle its fixed cost after customer cancellation or revocation, even without delivering its result. Chab-caused failures are waived; an email-verification outcome that cannot be confirmed is written off only after review.

  • 2026-09-24: When enabled, hosted MCP now offers browser-bound guest OAuth for the free trial, distinct from the guest REST bearer credential. The compatibility response advertises hosted_mcp.guest_oauth_enabled; clients should check the live flag. Mutating /v1 responses now mark released or durably settled idempotency claims with X-Chab-Idempotency-Outcome, so an uncertain 429 can be reconciled using the same key and body. Signed-out account holders can choose to sign in from host authorization. An expired guest browser verification pauses new starts and queued dispatch, while existing read/cancel access remains available until the access token expires. Refresh returns invalid_grant; same-client browser re-consent rotates credentials while retaining that connection's earlier results.

  • 2026-09-15: Free-mode balance and compatibility payloads now expose free_credit_policy.monthly_refresh: false for verified-free and guest trial promotional credits. Free promotional credits are one-off grants and do not refresh monthly.

  • 2026-09-15: CLI compatibility now advertises local MCP guest trial support separately from hosted MCP. Local MCP guest tools use the same guest bearer credentials, REST /v1 route allowlist, promotional credit pool, idempotency, risk pauses, expiry, revocation, and account-claim boundary as guest API/CLI calls. This described the initial local-MCP-only rollout; hosted MCP guest authorization is now separately available when its guest OAuth rollout is enabled. Hosted OAuth credentials are distinct from the guest REST bearer credential.

  • 2026-09-15: Browser-trial visitors can issue 24-hour guest trial API credentials from the active trial browser session. Credentials are returned once, stored hashed, limited to 3 active credentials per guest, revocable from the same browser trial, and scoped to the guest trial's existing promotional grant. Guest credentials can call /v1/me, /v1/credits, search.web, contacts.email_verify, and guest-scoped status, result, cancel, and artifact routes, but cannot access team resources, management APIs, connected accounts, paid-only routes, hosted MCP operation transport, or operation history listing. Unsupported guest credential routes return operation_not_available_on_free. CLI compatibility now advertises the guest credential issue/revoke URLs, TTL, scopes, route allowlist, operations, remediation URLs, and separate issuance/spend enablement state.

  • 2026-09-15: Browser-trial account creation now claims active eligible guest identities into the new account before email verification, preserving remaining trial value, active holds, and accepted operation history. Claimed guest cookies can no longer start trial work or read guest-scoped results, while verified signup-bonus issuance remains separate and once-only.

  • 2026-09-15: Browser-trial operation starts now enforce guest risk controls before operation creation or provider work, including daily free-use caps, IP-prefix velocity pauses, verification prompts after a reset, retryable challenge-provider outages, unavailable verification runtime pauses, and guest promotional spend ceilings. Accepted browser-trial starts are protected by a per-start retry key so duplicate browser retries return the same operation instead of consuming risk counters or reserving credits again. challenge_required responses include the verification response field for retrying the same free request.

  • 2026-09-15: Added a cookie-backed browser trial on the public homepage for search.web and contacts.email_verify. Browser-trial operations use guest promotional credits only, expose guest-scoped status/result/cancel URLs, and cannot be accessed through /v1 bearer routes, CLI credentials, hosted MCP, or another guest cookie.

  • 2026-09-15: Free promotional balances now expose supported free operations, remediation hints, and customer-safe lifecycle transactions. /v1/credits and /api/credits/balance include free_operations and free_remediation; /v1/credits/transactions includes additive free-credit issuance, expiry, and exhaustion fields. Free/billing error envelopes now include error.user_action for upgrade or purchase remediation codes, and CLI compatibility exposes the same remediation hints plus hosted MCP guidance.

  • 2026-09-15: Verified free accounts can create bounded API keys and CLI device credentials for search.web, search.serp, business.details, and contacts.email_verify. These starts spend signup-bonus free credits only. API keys and CLI device credentials share the same signup-bonus balance. Free starts do not support one-off operation callbacks and may temporarily return promotional_budget_exhausted when the daily free-use limit is reached. CLI compatibility now advertises the free operation keys/scopes. At that initial rollout, hosted MCP required a verified account and exposed no operation transport; the 2026-09-24 entry above supersedes that boundary when guest OAuth is enabled.

  • 2026-09-14: Added durable free-credit lot accounting for promotional funding. Customer credit surfaces now expose promotional value through explicit free_credits and operation free-usage fields, including /v1/credits/transactions, while paid balances and purchased-package listings remain unchanged.

  • 2026-09-14: Added the coarse free_mode.state field to GET /v1/health so API, CLI, and MCP clients can distinguish disabled, enabled, and degraded free promotional funding without exposing operator-only thresholds or risk diagnostics.

  • 2026-09-14: Added stable free-mode operation denial codes and documented that promotional/free funding does not automatically fall back to paid credit reservation. Free-mode denials happen before provider work and paid credit holds.

  • 2026-09-13: Uploaded files are now scoped to the API credential that uploaded them even when they are attached to a project. Listing, metadata, download, deletion receipts, conversion file_id sources, and Drive upload/replacement file_id sources require both the uploading credential identity and any applicable current project grant.

  • File scanning quarantines compressed documents that exceed its aggregate scan or processing limits. Upload size limits still apply separately. File downloads recheck the download permission before reserving transfer credits.

  • New operation and download credit reservations honor a revocation or spending restriction that commits while the request is waiting. Existing billing history survives credential removal, and cancellation settlement uses the current reserved amount after a concurrent estimate increase.

  • 2026-09-13: CLI browser sign-in can request supported operation permissions, with explicit project access, spending limits, and expiry. Consent explains which permissions may spend credits and selects only basic permissions by default. Existing pending approvals recheck current client compatibility. The retained project and credit aliases now enforce Chab key lifecycle, IP, scope, and project restrictions, including older settings retained after an upgrade. Keys with project access none see an empty project list; an owner can review their project settings in Team -> API Tokens. Chab keys receive 403 from /api/user; use /v1/me to check key identity.

  • 2026-09-07: Added six Preview connected-drive mutation endpoints and the independent api:drive:write scope. Upload/replacement reuses scanned files and drive-export artifacts with source holds. Mutations support dry runs, current revisions, idempotency, and non-billable operation tracking. Source acceptance now rechecks availability under the deletion lock; artifact cleanup waits for active source holders.

  • 2026-08-16: Added advisory operation estimates, strict bulk cancellation, reusable scanned files, explicit backlink exports, CLI device authorization, compatibility metadata, usage/billing/project/token management APIs, one-time management approvals, and persistent customer webhooks with replay. Existing tokens that already hold the default api:credits:read or api:projects:read scope can use the new matching /v1 read routes immediately; no token abilities were changed.

  • 2026-08-16: Made operation-estimate readiness provider-neutral, documented its safe and intentionally omitted checks, and limited credit transaction operation IDs to operations the calling key can still read.

  • 2026-08-16: Webhook attempts now reauthorize the source operation's current connected-data capability, and replay eligibility ends exactly at event retention expiry.

  • 2026-08-16: File conversion now accepts scanned file_id sources in addition to reusable artifact_id sources. Oversized conversion inputs now return the stable source_too_large code instead of a field-only validation_failed response.

  • 2026-08-15: Added Preview project-connected Drive API setup, read, download, and native-document export workflows for Google Drive, Microsoft 365, and Dropbox. Added the independent callable api:drive:read scope, explicit source selection, opaque item/revision IDs, dedicated direct-read rate limits, protected export artifacts, and redacted drive audit events. The registered api:drive:write vocabulary remains unassignable and has no callable routes in this release.

  • 2026-08-15: Added 16 preview project-connected Mail API routes for connection, folder, persona, thread, search, sanitized body, direct attachment, API-owned draft, artifact attachment, send, and message-state workflows. Added the independent callable api:mail:read, api:mail:write, and api:mail:send scopes; separate plan flags for API mail; 15-minute bound cursors; 24-hour attachment staging; durable ambiguous-send reconciliation; and nonbillable byte accounting for attachment downloads. Path-targeted mutations now scope idempotency by normalized resource identifiers while pathless operations keep their existing operation-level scope. Shared mailbox links now fail closed when delegated backing is unavailable, and ambiguous-send reconciliation revalidates current access before provider submission while completing public projections and token-attributed audit after acceptance.

  • 2026-08-15: Added project-local Connections summaries and management, redirect authorization with 10-minute expiry and safe replay/recovery, explicit disconnect and stewardship recovery, exact mail/drive capability composition, per-effect operation reauthorization, and the connected-data error catalog. Drive API endpoints remain unpublished.

  • 2026-08-15: Added atomic API key feature, IP, spending, project, expiration, and lifecycle controls with one shared policy revision; added planned mail and drive scope vocabulary; added per-key allowance settlement and authorized download egress; added current project-grant enforcement for operations, artifacts, queued work, and callbacks; expanded /v1/me; and added stable IP and spending-policy error codes.

  • 2026-08-14: Added the signed-in API Overview, same-origin browser Playground, owner/admin team operation history and detail, customer artifact downloads, safe replay projections, and placeholder-only curl export. The console does not persist API tokens or request drafts and does not yet provide saved examples or a CLI workflow.

  • 2026-07-15: Added preview POST /v1/research/deep, made api:research:write callable, added always-async cited research operations with dry run, one-off callbacks, explicit source_budget and max_credit_budget, budgeted actual-usage settlement, research_report and research_sources_export artifacts, Scale-only comprehensive mode, and research errors research_budget_exhausted, research_timeout, and citation_extraction_failed.

  • 2026-07-14: Added preview POST /v1/translate, made api:translate:write callable, added structure-preserving translation for inline text-like content and reusable operation artifacts, documented translation-standard dynamic token pricing, max_credit_budget, max_output_characters, translated_output artifacts, glossary and placeholder validation, and translation errors unsupported_format, source_too_large, structure_validation_failed, placeholder_integrity_failed, and repair_exhausted.

  • 2026-07-14: Added preview GET /v1/llm/models, POST /v1/llm/generate, and POST /v1/llm/embeddings; made api:llm:read and api:llm:write callable; added provider-neutral public model aliases, dynamic token pricing, embedding pricing, max_credit_budget, encrypted worker-only prompt/input storage, structured-output validation with one repair attempt, declared tool-call validation, and LLM-specific errors.

  • 2026-07-14: Added preview POST /v1/contacts/domain-search, POST /v1/contacts/email-finder, and POST /v1/contacts/email-verify operation endpoints, made api:contact:write callable, added fixed contact pricing at 8, 4, and 1 credits, documented closed request schemas without callbacks or dry-run fields, and added normalized contact, no-result, verification, and warning result semantics. Duplicate candidates merge missing fields with field-level conflict warnings, while terminal provider failures release the full hold. Domain inputs normalize case and a trailing dot, and email-finder names and company values normalize surrounding and repeated whitespace. Domain-level organization and pattern facts now populate the contact evidence field, detailed verification status takes precedence over a legacy coarse result, split-name finder requests stay split at the provider, and rate-cap versus usage-exhaustion failures follow their distinct retry behavior. Prevented SMTP checks no longer imply an invalid address, and malformed domain-search, finder, or verifier data fails without charge. Mixed other/unknown filters are enforced locally without narrowing away eligible contacts at the provider, the public limit is applied after filtering and deduplication, and evidence.matched_pattern is true only for addresses that actually match the known company pattern.

  • 2026-07-14: Added preview POST /v1/convert/file for reusable operation artifact sources, made api:convert:write callable, added dry-run validation with no operation side effects, priced file conversion by trusted artifact source category at 5 credits for text/Markdown/HTML, 15 for DOCX, and 20 for PDF with extractable text, stored converted output as a protected operation artifact with role converted_output, and documented conversion errors unsupported_file_type, unsupported_conversion_pair, unsupported_file_content, conversion_timeout, and conversion_failed.

  • 2026-07-14: Added preview POST /v1/screenshots/url, made api:screenshot:write callable, added dry-run validation with no operation side effects, added screenshot pricing at 10 credits for viewport/element capture and 15 credits for full-page capture, stored screenshots as protected operation artifacts with role screenshot, and documented capture errors selector_not_found, capture_timeout, capture_failed, and artifact_creation_failed.

  • 2026-07-13: Added preview POST /v1/scrape/markdown and POST /v1/scrape/dom operation endpoints, made api:scrape:read callable, added scrape pricing at 2 direct-fetch credits and 10 browser rendering credits, documented closed scrape request fields, markdown and DOM result shapes, customer-visible scrape artifacts, and target/extraction error codes.

  • 2026-06-29: Added preview POST /v1/seo/domains/overview and POST /v1/seo/domains/backlinks operation endpoints for Pro and Scale teams. Domain overview costs 15 credits and returns a bounded inline authority, backlink, referring-domain, anchor, page, and competitor snapshot. Domain backlinks costs 25 credits, supports filters and sort, returns an inline sample, and exports large backlink/referring-domain sets as protected JSONL artifacts with separately metered download egress. Both endpoints use structured warnings and explicit field availability.

  • 2026-06-29: Added preview POST /v1/business/search and POST /v1/business/details operation endpoints, made api:business:read callable, added fixed business pricing at 8 and 4 credits, and documented Pro/Scale-only access, the google engine, area and radius local search, opaque business_ref details lookup, fallback identity lookup, and sparse/stale/duplicate/confidence result semantics. The generated OpenAPI document includes the business request and result schemas with representative business status/result examples.

  • 2026-06-29: Hardened preview Business details lookup so opaque business_ref references carry the private lookup context needed for reliable single-business lookup. Business search now also returns a structured warning when an unmapped requested city or postal code falls back to broader regional or country coverage.

  • 2026-06-28: Added preview POST /v1/seo/keywords/ideas and POST /v1/seo/keywords/metrics operation endpoints, made api:seo:read callable, added fixed keyword pricing at 10 and 8 credits, and documented Pro/Scale-only access, batched input, explicit partial metric availability, and structured keyword warnings.

  • 2026-06-28: Added preview POST /v1/search/web and POST /v1/search/serp operation endpoints, made api:search:read callable, added fixed search pricing at 2 and 5 credits, and changed public operation warnings to structured objects. Preview search serves live search data; preview means the contract may still evolve, not that results are sample output.

  • 2026-06-28: Added operation artifact metadata and download endpoints, customer-initiated single and bulk cancellation, artifact/result retention cleanup, oversized-result artifact references, and artifact egress behavior.

  • 2026-06-27: Added provider retry/backoff behavior for operations, scheduled provider status polling hints, one-off operation callbacks with signed deliveries, and redacted provider diagnostics. No new public /v1 route was added.

  • 2026-06-26: Added provider-neutral operation error codes provider_unavailable, provider_error, and provider_response_invalid.

  • 2026-06-26: Added durable operation storage, async execution, operation list/status/result endpoints, long-polling, polling hints, terminal result retention, timed_out lifecycle status, and operation_result_not_ready.

  • 2026-06-25: Added operation-aware rate limits, daily/monthly quotas, concurrency-limit errors, spend-threshold errors, provider throttling errors, usage-limit headers, and usage-limit visibility on Credits & Billing.

  • 2026-06-25: Added the billable operation credit lifecycle: estimates, credit holds before work starts, exactly-once settlement, no-cost release, partial cancellation settlement, and operation credit visibility in usage.

  • 2026-06-24: Corrected the generated OpenAPI echo request schema and public error-catalog example to match runtime behavior.

  • 2026-06-24: Added the generated OpenAPI reference (openapi/chab-v1.yaml) and freshness checks covering the foundation endpoints.

  • 2026-06-23: Added callable /v1 foundation endpoints for health, current key identity, the public error catalog, and the idempotent example echo request.

  • 2026-06-23: Published the /v1 success, operation, and error envelopes, request IDs, baseline rate-limit headers, idempotency behavior, and foundation error catalog.

  • 2026-06-23: Documented team API key scopes, team-token-only /v1 authentication, API key revocation, and authentication/scope error codes.

  • Initial end-user documentation structure created.