Changelog

How v1 changes

Additive by default. New endpoints, new optional parameters and new response fields can appear at any time. Your client must ignore fields it does not recognise.

Error codes are stable strings. A code that appears in errors.md keeps its meaning for the life of v1. New codes may be added; existing ones are not renamed or repurposed.

Fields are never renamed within v1. If a field's name is wrong, a new one appears alongside it and the old one stays.

Removals are announced. Anything withdrawn gets an entry here first, with a notice period before it stops working. Nothing disappears from this pack without an entry below.

Breaking changes mean v2. A new major version would be served alongside v1, not in place of it.

Regenerate resync-api-v1.pdf whenever an entry is added here.

v1 · 2026-10-28 — wording

Wording only; no door, field, scope or behaviour changed.

• auth-and-scopes.md — "The two scope sets" is now "The scope sets": the three type sets in the table, find_or_create_types for find-or-create, and bind_systems (external systems, not types).
• endpoints.md — POST /v1/resources/:id/attestations and PATCH /v1/resources/:id/status say "Needs attest or operate scope", matching the scope page.
• README.md — ownership notes that a person can own a resource where personal modeling is on.

v1 · 2026-10-26 — initial surface

The first entry of v1: the surface below is what this pack documents, and every rule above applies from here on.

• Resources — list, search, read, change and contain: GET /v1/resources, GET /v1/resources/search, GET /v1/resources/:id, PATCH /v1/resources/:id, PATCH /v1/resources/:id/status, POST /v1/resources/find-or-create, GET /v1/resources/:id/members, POST /v1/resources/:id/members, POST /v1/resources/:id/exit, POST /v1/resources/:id/move, GET /v1/resources/:id/containers (endpoints.md, walkthrough-bid.md).
• History and requirements — GET /v1/resources/:id/events, GET /v1/resources/:id/advancement, GET /v1/resources/:id/capabilities, GET /v1/resources/:id/requirements, POST /v1/resources/:id/attestations.
• Ports and connections — GET /v1/resources/:id/ports, GET /v1/resources/:id/ports/:portId/legal-targets, POST /v1/resource-interactions, DELETE /v1/resource-interactions/:id.
• The model, read-only — GET /v1/resource-types, GET /v1/resource-types/:id, GET /v1/lifecycles, GET /v1/lifecycles/:id, GET /v1/lifecycles/:id/graph, GET /v1/state-transitions, GET /v1/statuses, GET /v1/attestation-event-types, GET /v1/property-keys, GET /v1/units, GET /v1/interaction-types.
• Aliases and identity claims — POST /v1/aliases/bind, GET /v1/aliases/resolve, POST /v1/identity-claims/redeem.
• Credentials — a key reads itself and its default view, GET /v1/api-keys/self, GET /v1/api-keys/self/view; scopes, the per-key rate limit and request ids (auth-and-scopes.md).
• Device credentials and the station plane — POST /v1/presence-sessions, GET /v1/presence-sessions/current, POST /v1/presence-sessions/current/touch, DELETE /v1/presence-sessions/current, POST /v1/alias-enrollments/redeem; the live-update stream GET /v1/live (auth-and-scopes.md).
• Sign in with ReSync — OpenID Connect, authorization code + PKCE, issuer https://auth.limnal.dev: GET /.well-known/openid-configuration, GET /.well-known/jwks.json, POST /oauth/token, GET /oauth/userinfo; the consent screen's GET /v1/oauth/clients/:id and POST /v1/oauth/authorize take a person's session only (sign-in.md).
• Errors, events, conventions — errors.md, events.md, conventions.md.