# Tandom API changelog

All notable changes to the public Tandom API surface, in reverse-chronological order. This file is published at:

- `https://docs.tandom.ai/api/changelog` — the canonical URL.
- `docs/api/CHANGELOG.md` — the source-of-truth in the repo.

The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the API itself follows [Semantic Versioning](https://semver.org). The current spec version lives in `openapi.yaml` under `info.version`.

Sections used:

- **Added** — new endpoints / response fields / capabilities.
- **Changed** — backwards-compatible behavioral changes.
- **Deprecated** — features still working but slated for removal; surfaces with `Sunset` / `Deprecation` HTTP headers.
- **Removed** — features that no longer exist (only after the deprecation grace window expires).
- **Fixed** — bug fixes that customers may notice.
- **Security** — security-relevant changes; we list these even when the underlying issue wasn't customer-exploitable.

---

## [Unreleased]

> Pre-launch. Spec version `0.1.0` in `openapi.yaml`. Items below land before v1.0 GA.

### Added

- **Initial pre-release public surface (`/v1/*`)** — free, fair-use access to the duty, AD/CVD screening and reporting, HTS, PGA, Chapter 99, regulatory-status, and MCP operations included in the public OpenAPI projection. Account-only, closed-beta, and internal operations are excluded from public artifacts.
- **Bearer-token authentication** — issue a read-scoped key from the Tandom account area and send it as `Authorization: Bearer tk_live_...`. Test keys use the `tk_test_...` prefix where fixture-backed test mode is supported.
- **Read-only public MCP catalog** — the authenticated MCP endpoint exposes the 13 operations in the runtime public allowlist. Write-capable, private, and closed-beta tools are denied by default.
- **AI-readable reference surfaces** — filtered `llms.txt`, `llms-full.txt`, OpenAPI JSON/YAML, Postman, and per-operation Markdown artifacts generated from the same public projection.
- **Vendored pre-release clients** — TypeScript and Python clients live under `sdks/` for source-based testing. They are not yet published to npm or PyPI.
- **Fair-use safeguards** — API access is free; operation-specific rate and abuse protections may apply. The reference for each operation is the source of truth for its current method, inputs, and availability.

### Deprecated

- `POST /api/hts/expand-s301` and `POST /api/hts/expand-ch99-scope` — return **410 Gone** with `Sunset: Wed, 02 Nov 2026 00:00:00 GMT`. Successor: `/v1/hts/search` and `/v1/chapter99/applicable` respectively. ARCH-0311a removed the need for up-front expansion (matching is done at query time). Removal scheduled 2026-11-02.

---

## How to consume this file programmatically

The changelog is served as raw Markdown at `https://docs.tandom.ai/api/changelog`. AI agents and changelog watchers can fetch it directly:

```bash
curl https://docs.tandom.ai/api/changelog
```

Each `## [Version]` heading marks a release. Use the `[Unreleased]` section to track work-in-progress changes that will land in the next version.

When v1.0.0 ships, the `[Unreleased]` section is renamed to `[1.0.0] — YYYY-MM-DD` and a fresh `[Unreleased]` is added on top for the next cycle. Subsequent releases follow [SemVer](https://semver.org/) versioning rules:

- **MAJOR** — backwards-incompatible API changes (e.g., changing a response field's type, removing a required parameter).
- **MINOR** — backwards-compatible additions (new endpoints, new optional fields).
- **PATCH** — backwards-compatible bug fixes.

The API and vendored clients remain pre-release. Do not assume a `1.x`
compatibility guarantee until a versioned release is recorded above.