CheckboxDocs
More

Changelog

View as Markdown Open in Claude

Changes to the Checkbox API, SDKs, CLI, MCP server and legal catalog. API versions are dates; breaking changes only ship in a new version.

API versions are dates (Checkbox-Version). Backwards-compatible changes — new endpoints, new optional parameters, new fields, new event types, new error codes — ship continuously; breaking changes only in a new version. Legal catalog updates are announced as law updates and the law.changed webhook.

Current API version: 2026-10-30.

2026-10-31

Backwards-compatible additions and fixes from the first agent usability test and security review.

  • Every next_action that names an operation_id also names its mcp_tool. New MCP tool update_site; setup_checkbox applies the facts and runs the first checks in the call that receives the keys.
  • Plans: blocked_on, closed_reason, coverage; change.type: "needs_facts" instead of patches with placeholders; change.operation_id / endpoint for config changes; a stripe_checkout_params task from registered Checkout params; a notice sent outside its window is an agent task, not a human question; answers that attest a legal fact need the human's confirmation (ask_human_to_confirm).
  • Setup sessions: merchant_name; test keys only see sessions created in test mode. The summary email goes out when the setup is finished (every check passes, or completeSetupSession), not right after setup starts.
  • Emails: charge_notice kind in checkEmail / verifyTask; trial_ending accepted as an alias; unresolved placeholders in a checked email are reported (unresolved_placeholders); inbound emails honour a +kind plus-address or the X-Checkbox-Kind header.
  • Consents: browser-claimed references are client_reference; customer_reference is set by secret keys only.
  • Test mode only scans, monitors, fetches and test-runs local hosts and verified domains (plus a small daily scan budget for others): new error codes test_mode_domain_unverified, test_mode_scan_budget_exhausted.
  • CLI: checkbox answer; checkbox init --merchant-name, --plan, --account-url, and facts are remembered across a resumed login.

2026-10-30

The first public version of the API.

  • API v1 at https://app.checkbox.site/v1: secret, restricted and publishable keys; an isolated test mode for every account; live mode by domain verification; prefixed ids, cursor pagination, Idempotency-Key, dated versions, expand[], errors with stable codes and next_action. OpenAPI 3.1 at /v1/openapi.json.
  • Agent setup: checkbox init with device-authorization login (one browser approval), setup sessions, Terms and policy checks.
  • Preflight checks for disclosure text, Stripe Checkout Sessions and Payment Links, lifecycle emails, checkout HTML and notice schedules; also offline in the CLI.
  • Compliance plans: ordered tasks with exact changes, verification and human questions.
  • Test runs: synthetic subscriptions in Stripe test mode with test clocks.
  • Checkbox Elements: the <checkbox-disclosure> web component and consent records.
  • Webhooks for findings, scores, scans, plans, verifications, test runs, consents, certificates, notices and law changes.
  • MCP server at https://app.checkbox.site/mcp; Node and Python SDKs (pre-release).
  • Free to start: no plan limits on compliance features; fair-use limits apply.

Checkbox is compliance software, not a law firm; nothing in these docs is legal advice (details). For AI agents: every page is available as Markdown at the same URL plus .md; the index is /llms.txt.