Policy: breaking changes ship under a new path version. Removals are announced at least 90 days ahead with a sunset date. Additive changes (new fields, new endpoints) may land at any time. See the conventions.
2026-10-14
- Changed
One error envelope: RFC 9457 Problem Details
snapshots · upgrades · tax · wasm · faucet · account
Every error now answers application/problem+json with type, title, status, detail, a stable code, instance and request_id.
The old error and success members are still present as aliases of detail and false so existing clients keep working.
Sunset 2027-04-01
- Added
X-Request-Id on every API response
all
Send your own id (8 to 128 characters of letters, digits, '.', '_' or '-') and it is echoed; otherwise one is minted. The id appears in the error body and in our logs.
- Added
Standard rate-limit headers
snapshots · upgrades · faucet
Limited endpoints send RateLimit and RateLimit-Policy (IETF draft structured fields) alongside the older X-RateLimit-* trio. A 429 or a 503 always carries Retry-After.
- Added
Personal API keys with scopes
account · faucet
Create keys under Account, send them as Authorization: Bearer blk_... Each key carries only the scopes it was created with and can be rotated or revoked. Usage is shown on the account page and at GET /api/account/usage.
- Added
Idempotency-Key on faucet requests
faucet
POST /api/networks/v1/faucet/{chain}/request accepts an Idempotency-Key. A retry with the same key and body replays the first answer for 24 hours instead of asking the faucet twice.
- Changed
Faucet refusals for faucet-wide limits collapse to busy
faucet
When the faucet as a whole is over its hourly or daily allowance the code is busy with retry_after, instead of naming the limit. Per-requester codes (address_limit, ip_limit, subnet_limit, identity_limit, pow_required) are unchanged.
- Added
JSON 404 for unknown API paths
all
A path under /api that does not exist answers a route_not_found problem instead of the HTML not-found page.
- Deprecated
Legacy snapshots auth endpoints
snapshots
POST /api/snapshots/v1/auth/login, /logout and /token have answered 410 since the unified sign-in. They now also send Deprecation and Sunset headers and will be removed on the sunset date. Use /api/auth/* or an API key.
Sunset 2027-04-01
- Added
Faucet API published
faucet
Status, recent payouts, challenge and request endpoints at /api/networks/v1/faucet/{chain}, documented at /faucets/api-docs.
- Security
security.txt, security page and status page
all
/.well-known/security.txt (RFC 9116) and /security describe how to report a vulnerability and how the platform is run. /status shows live checks and 30-day availability, also as JSON at /api/meta/v1/status.