API changelog

upgrades · snapshots · tax

Upgrade webhooks (list, create, change, delete, test, delivery history), favorite chains and GET /api/upgrades/users/me accept an API key with the upgrades:webhooks scope; before, the scope existed but every route asked for the site session.

Custom snapshots (request, list, visibility, quota) accept a key with the new snapshots:request scope. Snapshot downloads and latest accept a key with snapshots:download, which ties the URL to the account and reaches its own custom snapshots; anonymous downloads are unchanged.

GET/POST /api/tax/entities, PATCH/DELETE /api/tax/entities/{id} and GET/PUT /api/tax/preferences accept a key with tax:read or tax:write. GET /api/snapshots/v1/auth/me accepts any valid key and names the account it belongs to.

The snapshots:read and wasm:read scopes are retired: no route ever checked them, because the data they named is public. Keys can no longer be created with them.

Still browser only, on purpose: creating, rotating and revoking keys, linking a wallet or email, profile changes, deleting the account, and Ask Tia history.

tia

POST /api/tia/v1/session starts a voice or text conversation with Tia (an ElevenLabs agent) and returns a single-use credential. Limited per connection and site-wide; 429 rate_limited or tia_busy when exceeded, 503 tia_voice_budget when the month's voice time is used up.

Tia can pass feature requests, problem reports, service questions, and messages to Dan. They are screened (scope, abuse, duplicates add a vote) and reviewed before anything reaches the issue tracker. The tool and inbox endpoints under /api/tia/v1 are internal and need their own secrets.

tax

New POST /api/tax/reports/{id}/tags/bulk tags every transaction that matches an events type filter (and/or a list of hashes) in one call, with fill or overwrite modes and a dry run. Needs tax:write.

GET /api/tax/v1/tags now carries `defaults`: what each kind of row is before any tag (staking income, fee, record only, receipt, disposal, swap and NFT legs) and how Form 1040, 1120-S, retirement accounts and non-US regimes treat it, so an agent does not tag rows that are already classified.

The events type filter gained ibc (in and out), delegations (principal only) and nfts.

tax

The backend labels reward and commission receipts "staking" (delegation principal is "staking-deposit" and "staking-withdrawal"), but the rewards filter only looked for the word reward, so type=rewards returned zero rows. It now returns reward and commission receipts; type=staking still returns rewards plus principal moves.

type=transfers, ibc_in and ibc_out now also match the transfer-in and transfer-out labels.

tax

GET/POST /api/tax/reports and GET/PATCH/DELETE /api/tax/reports/{id} now accept an API key as well as the site session. New scopes: tax:read (list and read your saved reports) and tax:write (create and change them).

New PATCH /api/tax/reports/{id}/tags merges single tags ({set, clear}) and PUT replaces the whole map, so an agent can tag transactions (internal_transfer, payment, income, gift, airdrop, protocol_deposit, expense, spam, lost) without the browser. GET returns the tags with the vocabulary.

Errors on these routes are now RFC 9457 problems with stable codes (invalid_tags, invalid_asset_decisions, duplicate_report_name, not_found).

snapshots · upgrades · tax · wasm · faucet · account

Every error now answers application/problem+json with type, title, status, detail, a stable code, instance and request_id.

The old error and success members are still present as aliases of detail and false so existing clients keep working.

Sunset 2027-04-01

all

Send your own id (8 to 128 characters of letters, digits, '.', '_' or '-') and it is echoed; otherwise one is minted. The id appears in the error body and in our logs.

snapshots · upgrades · faucet

Limited endpoints send RateLimit and RateLimit-Policy (IETF draft structured fields) alongside the older X-RateLimit-* trio. A 429 or a 503 always carries Retry-After.

account · faucet

Create keys under Account, send them as Authorization: Bearer blk_... Each key carries only the scopes it was created with and can be rotated or revoked. Usage is shown on the account page and at GET /api/account/usage.

faucet

POST /api/networks/v1/faucet/{chain}/request accepts an Idempotency-Key. A retry with the same key and body replays the first answer for 24 hours instead of asking the faucet twice.

faucet

When the faucet as a whole is over its hourly or daily allowance the code is busy with retry_after, instead of naming the limit. Per-requester codes (address_limit, ip_limit, subnet_limit, identity_limit, pow_required) are unchanged.

all

A path under /api that does not exist answers a route_not_found problem instead of the HTML not-found page.

snapshots

POST /api/snapshots/v1/auth/login, /logout and /token have answered 410 since the unified sign-in. They now also send Deprecation and Sunset headers and will be removed on the sunset date. Use /api/auth/* or an API key.

Sunset 2027-04-01

faucet

Status, recent payouts, challenge and request endpoints at /api/networks/v1/faucet/{chain}, documented at /faucets/api-docs.

all

/.well-known/security.txt (RFC 9116) and /security describe how to report a vulnerability and how the platform is run. /status shows live checks and 30-day availability, also as JSON at /api/meta/v1/status.