# Tandom API changelog All notable changes to the public Tandom API surface, in reverse-chronological order. This file is published at: - `https://docs.tandom.ai/api/changelog` — the canonical URL. - `docs/api/CHANGELOG.md` — the source-of-truth in the repo. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the API itself follows [Semantic Versioning](https://semver.org). The current spec version lives in `openapi.yaml` under `info.version`. Sections used: - **Added** — new endpoints / response fields / capabilities. - **Changed** — backwards-compatible behavioral changes. - **Deprecated** — features still working but slated for removal; surfaces with `Sunset` / `Deprecation` HTTP headers. - **Removed** — features that no longer exist (only after the deprecation grace window expires). - **Fixed** — bug fixes that customers may notice. - **Security** — security-relevant changes; we list these even when the underlying issue wasn't customer-exploitable. --- ## [Unreleased] > Pre-launch. Spec version `0.1.0` in `openapi.yaml`. Items below land before v1.0 GA. ### Added - **Initial pre-release public surface (`/v1/*`)** — free, fair-use access to the duty, AD/CVD screening and reporting, HTS, PGA, Chapter 99, regulatory-status, and MCP operations included in the public OpenAPI projection. Account-only, closed-beta, and internal operations are excluded from public artifacts. - **Bearer-token authentication** — issue a read-scoped key from the Tandom account area and send it as `Authorization: Bearer tk_live_...`. Test keys use the `tk_test_...` prefix where fixture-backed test mode is supported. - **Read-only public MCP catalog** — the authenticated MCP endpoint exposes the 13 operations in the runtime public allowlist. Write-capable, private, and closed-beta tools are denied by default. - **AI-readable reference surfaces** — filtered `llms.txt`, `llms-full.txt`, OpenAPI JSON/YAML, Postman, and per-operation Markdown artifacts generated from the same public projection. - **Vendored pre-release clients** — TypeScript and Python clients live under `sdks/` for source-based testing. They are not yet published to npm or PyPI. - **Fair-use safeguards** — API access is free; operation-specific rate and abuse protections may apply. The reference for each operation is the source of truth for its current method, inputs, and availability. ### Fixed - **AD/CVD internal product readers (task 8876; measured with synthetic route fixtures)** — `/api/adcvd/rate-history` paginates `adcvd_rate_rows` and returns stable row `id`, `sourceVersion` (stored extraction timestamp), producer/exporter names, review-period endpoints and `isCurrent` selected per stored entity/producer/exporter identity among applicable cash-deposit intervals, using the existing source precedence, latest effective date and stored extraction timestamp. Unbounded older rows remain in history without a current label. The product adapter consumes those fields instead of marking the first history row current or splitting ISO dates. - **Order detail (measured with synthetic route fixtures)** — `/api/adcvd/orders/[caseNumber]` reads `rate_percent` from paginated `adcvd_deposit_rates`, returns source and producer/exporter-pair identity, and reports read failures as errors. Undated legacy manufacturer rows carry `missingData: ["effective_date"]`; they are not dated deposit-rate decisions. Order and catalog detail expose `rateEffectiveDate`, `rateSourceType` and `rateSourceVersion` (the materialized order's verification timestamp). These readers issue ordinary database reads without an application TTL or manual refresh. Source versions identify stored provenance; they are not a global feed version. - **Dated AD/CVD RPCs (measured in PostgreSQL fixtures)** — coverage lookup retains bounded superseded scope and pre-revocation orders for their entry dates, excludes future orders, and defaults omitted dates to today. Rate-row lookup applies the stored effective interval before choosing the existing source rank. Current-only views and runtime flags are unchanged. Superseded records lacking an end date remain excluded; the reader does not invent their historical interval. ### Deprecated - `POST /api/hts/expand-s301` and `POST /api/hts/expand-ch99-scope` — return **410 Gone** with `Sunset: Wed, 02 Nov 2026 00:00:00 GMT`. Successor: `/v1/hts/search` and `/v1/chapter99/applicable` respectively. ARCH-0311a removed the need for up-front expansion (matching is done at query time). Removal scheduled 2026-11-02. --- ## How to consume this file programmatically The changelog is served as raw Markdown at `https://docs.tandom.ai/api/changelog`. AI agents and changelog watchers can fetch it directly: ```bash curl https://docs.tandom.ai/api/changelog ``` Each `## [Version]` heading marks a release. Use the `[Unreleased]` section to track work-in-progress changes that will land in the next version. When v1.0.0 ships, the `[Unreleased]` section is renamed to `[1.0.0] — YYYY-MM-DD` and a fresh `[Unreleased]` is added on top for the next cycle. Subsequent releases follow [SemVer](https://semver.org/) versioning rules: - **MAJOR** — backwards-incompatible API changes (e.g., changing a response field's type, removing a required parameter). - **MINOR** — backwards-compatible additions (new endpoints, new optional fields). - **PATCH** — backwards-compatible bug fixes. The API and vendored clients remain pre-release. Do not assume a `1.x` compatibility guarantee until a versioned release is recorded above. - Tariff calculator GET/POST now pass `exporterName` to the shared dated AD/CVD resolver (GET also accepts `manufacturerName`). `/api/v1` wrappers inherit the same contract. `adcvdCases` adds selected rate source document/version, missing-data labels and respondent identity; the check route adds `applicableDate`/`exporterName` and the same selected-rate provenance. Existing TTLs and runtime flags remain unchanged. See `docs/engines/adcvd/audit/regulatory-product-readers.md` for capture and release ownership.