Trumis / Developers / Changelog

Changelog

Every observable change to the API and embed, dated. Additive changes ship in place; breaking changes ship as a new version — the policy is at developers → versioning.

28 July 2026

• Exports. New GET /api/v1/complaints/{reference} returns the complete structured record as JSON — confirmed claims, established facts, passed grounds, urgency flags, the evidence manifest with content hashes, routing, the full document, and a record_integrity sha256. Add &format=pdf for the formal document.
• Register CSV. GET /api/v1/register?format=csv returns every matter as a spreadsheet row with regulator-facing column names, including response-due date, days remaining and legal-hold status.
• Offboarding archive. New GET /api/v1/export returns a ZIP of every record Trumis holds for you — all JSON, all PDFs, the register CSV and your deletion log.
• Webhooks. New complaint.finalised and register.event, signed with HMAC-SHA256 over {timestamp}.{raw body} in X-Trumis-Signature, with replay protection, retries at 1m/5m/30m/2h/6h, and per-partner delivery logs at GET /api/v1/webhooks. Fire a signed test event at your endpoint with POST /api/v1/webhooks {"action":"test"} and get the result back inline.
• Configurable retention. Organisation records are now retained to your regulatory schedule — 7 years by default for regulated sectors — with legal hold, logged expiry deletions, and a certificate of deletion on request.
• Correction. This page previously said there was no Trumis-side webhook "because the complaint is never on our side to push." That was true of the API integration path only, and is no longer true at all: complaints created through the embed do live on our side until you pull or we push them. The delivery section now describes all four routes.
• Spec. OpenAPI is at 1.1.0 with the new paths. All additive — nothing breaks.

12 July 2026

• Versioned paths. /api/v1/companion, /api/v1/evidence and /api/v1/health are now the canonical endpoints. The unversioned paths remain as permanent aliases — nothing breaks.
• Request ids. Every response carries X-Trumis-Request-Id for support correlation; 502 bodies include it as request_id.
• Structured errors everywhere. Malformed JSON now returns 400 {error: "invalid_json", message} instead of an empty body; 405s carry an Allow header and a message.
• Rate limits published. 30 requests/min per address (unauthenticated), 120/min per licensed key, with X-RateLimit-* headers on every response and 429 + Retry-After when spent.
• Partner tiers. New response field partner_tier: "licensed" | "pilot" in partner mode. Licensed keys resolve the organisation name from the server-side registry — body names can no longer differ from the licensed identity.
• Licensed embeds. New data-partner-id embed attribute and GET /api/embed-config: branding, complaints inbox and watermark removal now resolve server-side with page-origin verification. The page-supplied data-branded attribute is no longer honoured (it was client-side only); pilots are always watermarked.
• Destination transparency. Embedded widgets always show the person where their complaint will be sent.
• Health endpoint. GET /api/v1/health for monitors, backing the public status page.
• Compute pinned to Australia. API functions now run in Vercel's Sydney region.
• New: OpenAPI spec, this changelog, and site-wide security headers.

9 July 2026

• Partner mode. partner: {name} switches to organisation intake: policy framing, the organisation as receiver, and the narrative + confirmed-circumstance gate.
• One-line embed. embed.js widget with data-partner / data-email; “Powered by Trumis” pilot mark.
• Per-partner API keys (X-Trumis-Key) for production partners.

8 July 2026

• Evidence pipeline. POST /api/evidence: on-device OCR lines in, reconstructed correspondence out — deduplicated, stitched across scrolling captures, reviewed by the person before use; the approved record becomes the complaint's verbatim annex.
• Multilingual conversations. Deterministic language detection (中文, Tiếng Việt, العربية, Ελληνικά); confirm-card strings served in the person's language; documents stay in English with the person's narrative verbatim.

7 July 2026

• Launch. trumis.com.au, the web app, and the conversation conversation API: listening-first intake, deterministic merit gate, tick-to-confirm claims, receiver resolution with escalation routing and response clocks.