# Changelog

> Changes to the Checkbox API, SDKs, CLI, MCP server and legal catalog. API versions are dates; breaking changes only ship in a new version.

API versions are dates (`Checkbox-Version`). Backwards-compatible changes — new endpoints, new optional parameters, new
fields, new event types, new error codes — ship continuously; breaking changes only in a new version. Legal catalog
updates are announced as [law updates](https://checkbox.site/docs/api/law-updates) and the `law.changed` webhook.

Current API version: `2026-10-30`.

## 2026-10-31 {#2026-10-31}

Backwards-compatible additions and fixes from the first agent usability test and security review.

- Every `next_action` that names an `operation_id` also names its `mcp_tool`. New MCP tool `update_site`;
  `setup_checkbox` applies the facts and runs the first checks in the call that receives the keys.
- Plans: `blocked_on`, `closed_reason`, `coverage`; `change.type: "needs_facts"` instead of patches with placeholders;
  `change.operation_id` / `endpoint` for config changes; a `stripe_checkout_params` task from registered Checkout params;
  a notice sent outside its window is an agent task, not a human question; answers that attest a legal fact need the
  human's confirmation (`ask_human_to_confirm`).
- Setup sessions: `merchant_name`; test keys only see sessions created in test mode. The summary email goes out when the
  setup is finished (every check passes, or `completeSetupSession`), not right after setup starts.
- Emails: `charge_notice` kind in `checkEmail` / `verifyTask`; `trial_ending` accepted as an alias; unresolved
  placeholders in a checked email are reported (`unresolved_placeholders`); inbound emails honour a `+kind`
  plus-address or the `X-Checkbox-Kind` header.
- Consents: browser-claimed references are `client_reference`; `customer_reference` is set by secret keys only.
- Test mode only scans, monitors, fetches and test-runs local hosts and verified domains (plus a small daily scan
  budget for others): new error codes `test_mode_domain_unverified`, `test_mode_scan_budget_exhausted`.
- CLI: `checkbox answer`; `checkbox init --merchant-name`, `--plan`, `--account-url`, and facts are remembered across
  a resumed login.

## 2026-10-30 {#2026-10-30}

The first public version of the API.

- **API v1** at `https://app.checkbox.site/v1`: secret, restricted and publishable keys; an isolated test mode for
  every account; live mode by domain verification; prefixed ids, cursor pagination, `Idempotency-Key`, dated
  versions, `expand[]`, errors with stable codes and `next_action`. OpenAPI 3.1 at `/v1/openapi.json`.
- **Agent setup:** `checkbox init` with device-authorization login (one browser approval), setup sessions, Terms
  and policy checks.
- **Preflight checks** for disclosure text, Stripe Checkout Sessions and Payment Links, lifecycle emails, checkout
  HTML and notice schedules; also offline in the CLI.
- **Compliance plans:** ordered tasks with exact changes, verification and human questions.
- **Test runs:** synthetic subscriptions in Stripe test mode with test clocks.
- **Checkbox Elements:** the `<checkbox-disclosure>` web component and consent records.
- **Webhooks** for findings, scores, scans, plans, verifications, test runs, consents, certificates, notices and law
  changes.
- **MCP server** at `https://app.checkbox.site/mcp`; Node and Python SDKs (pre-release).
- **Free to start:** no plan limits on compliance features; fair-use limits apply.