Skip to main content

Changelog

Notable, integrator-facing changes to the FlowBeacon Public API (/api/public/v1), newest first. The API Reference always reflects the current surface.

v1​

The current, stable version of the API. What this means for integrators:

  • Synchronous inline evaluation (new). POST /evaluate/inline evaluates a raw blueprint and returns violations, the module graph, and optional remediation in one ephemeral response — no pre-import, nothing stored. See Real-time & inline evaluation.
  • Inline blueprints on POST /evaluate. The async endpoint accepts blueprints[] (ephemeral) as an alternative to scenario_ids — provide exactly one.
  • Result fetch is POST /results/fetch (token in the request body, Bearer + signature required) — corrected from earlier docs that showed a GET /results/{token} form.
  • API-key administration moved out of the API reference. Create/rotate/revoke happen in the FlowBeacon console (session-authenticated /api/v1/keys/*, admin/owner only); see Managing API keys.
  • Request signing is required. Every authenticated call must include an X-FB-Signature header in addition to Authorization: Bearer. Unsigned requests return 403 Missing request signature. See Authentication.
  • Result tokens returned by POST /evaluate are single-use and valid for 15 minutes — fetch results once via POST /results/fetch. See Retrieve results with tokens.
  • Webhooks. Register an endpoint under /webhooks to receive the evaluation.complete event instead of polling. See Handle webhooks.
  • Consistent error envelope. Every error returns { ok: false, error, detail }. See the Error codes.
  • Batch evaluations accept up to 10 scenarios per POST /evaluate call.
  • GET /scenarios/{id}/results reports an evaluation_status of evaluated or not_evaluated.
  • GET /governance/policies returns a stable set of fields per policy: code, title, category, severity, and compliance_frameworks.

Versioning​

This site documents the current v1 surface. Additive changes — new optional fields, endpoints, or headers — ship in place. Breaking changes will be released under a new /v2 prefix with at least a 180-day overlap.

Last updated on