Resources

Changelog

Notable changes to the platform and its API.

This page lists changes that affect people who use the API. Entries are added when a change ships.

2026-10

Added

  • Billing: a configurable price book, a wallet ledger, plans, monthly invoices and wallet top-ups behind a payment-provider interface.
  • Messaging: SMS and WhatsApp behind one provider interface, a message log, and a send_sms function tool.
  • A do-not-disturb registry check that uses an uploaded list.
  • Idempotency-Key on the endpoints that create or spend.
  • X-Request-Id on every response, GET /ready, and dead-letter lists for background jobs and webhook deliveries.
  • A second OpenAPI document for the extensions, at /openapi.sonic.json.
  • Team members with roles, invitations, two-factor login, session management and a security log.
  • The browser voice test.
  • The compliance toolkit: calling hours, do-not-call list, consent, a daily cap per number, AI disclosure and redaction.
  • Graph agents with keypad steps, and a graph validation endpoint.
  • The setup assistant with a template gallery.
  • Website lead forms and a Leads list.

Changed

  • Call costs are now minutes multiplied by per-minute rates from the price book for every component. The fields on an execution are unchanged; totals differ from earlier builds.
  • A batch at zero balance now pauses and resumes after a top-up, instead of ending every row balance-low.
  • Browser access (CORS) is limited to configured origins, methods and headers.
  • Request bodies over 2 MB are refused with 413 outside the upload routes.
  • New workspaces start on the trial plan.
  • The inbound-call webhook verifies the telephony provider's signature when telephony is live (Twilio and Plivo). Unsigned requests answer 403.
  • GET /sub-accounts/all returns the real api_key only to admins, owners and API keys, and logs each such read. Members and viewers get it masked, with api_key_masked: true. The operator can mask it for everyone.
  • GET /user/model/all no longer returns the address of the platform's own language model: base_url is null and hosted_by_platform is true.
  • Malformed input (wrong types, NUL characters, numbers out of range, a body that is not an object) answers 400 in the standard error shape on every route, where some routes answered 500.
  • Refusals for owner-only actions now read correctly, for example Your role (admin) can't delete the workspace. It needs owner access; ask an owner of the workspace.
  • The optional open-source engine has the id oss. The earlier id is still accepted.
  • GET /assistants/ask/sessions replaces an earlier path, which still answers.
  • /openapi.sonic.json now describes every operation in full, and its query parameters are generated from the server code. The filters of GET /leads are kind, status, date_from, date_to and search.

Added (later in the month)

  • currency on GET /user/me, on executions, on usage reports and next to every number price, with price_minor_units for number prices. The existing price fields are unchanged.
  • platform_owned on the buy-number response.
  • verb on each rule of GET /team/permissions.
  • A setting, SUB_ACCOUNT_KEYS_VISIBLE, for the sub-account key list.

Earlier

Changes before this page was started are not listed.