Trumis / Developers / Changelog

Changelog

Every observable change to the API and embed, dated. Additive changes ship in place; breaking changes ship as a new version — the policy is at developers → versioning.

12 July 2026

• Versioned paths. /api/v1/companion, /api/v1/evidence and /api/v1/health are now the canonical endpoints. The unversioned paths remain as permanent aliases — nothing breaks.
• Request ids. Every response carries X-Trumis-Request-Id for support correlation; 502 bodies include it as request_id.
• Structured errors everywhere. Malformed JSON now returns 400 {error: "invalid_json", message} instead of an empty body; 405s carry an Allow header and a message.
• Rate limits published. 30 requests/min per address (unauthenticated), 120/min per licensed key, with X-RateLimit-* headers on every response and 429 + Retry-After when spent.
• Partner tiers. New response field partner_tier: "licensed" | "pilot" in partner mode. Licensed keys resolve the organisation name from the server-side registry — body names can no longer differ from the licensed identity.
• Licensed embeds. New data-partner-id embed attribute and GET /api/embed-config: branding, complaints inbox and watermark removal now resolve server-side with page-origin verification. The page-supplied data-branded attribute is no longer honoured (it was client-side only); pilots are always watermarked.
• Destination transparency. Embedded widgets always show the person where their complaint will be sent.
• Health endpoint. GET /api/v1/health for monitors, backing the public status page.
• Compute pinned to Australia. API functions now run in Vercel's Sydney region.
• New: OpenAPI spec, this changelog, and site-wide security headers.

9 July 2026

• Partner mode. partner: {name} switches to organisation intake: policy framing, the organisation as receiver, and the narrative + confirmed-circumstance gate.
• One-line embed. embed.js widget with data-partner / data-email; “Powered by Trumis” pilot mark.
• Per-partner API keys (X-Trumis-Key) for production partners.

8 July 2026

• Evidence pipeline. POST /api/evidence: on-device OCR lines in, reconstructed correspondence out — deduplicated, stitched across scrolling captures, reviewed by the person before use; the approved record becomes the complaint's verbatim annex.
• Multilingual conversations. Deterministic language detection (中文, Tiếng Việt, العربية, Ελληνικά); confirm-card strings served in the person's language; documents stay in English with the person's narrative verbatim.

7 July 2026

• Launch. trumis.com.au, the web app, and the conversation conversation API: listening-first intake, deterministic merit gate, tick-to-confirm claims, receiver resolution with escalation routing and response clocks.