# Changelog

What the engine gained, newest first, and a plain list of what the previous documentation got wrong and no longer claims.

There is no dated API versioning today, and no `Sidaxis-Version` header. Dated versioning is on the [roadmap](/roadmap).

## Newest first

- Documentation corrected to the real `/functions/v1` contract — every path, header and field name in these docs now matches a call that answers.
- Hosted sessions: `hosted-session-create` and `hosted-session-consume`, a single-use token minted by the merchant's server and exchanged once by ours.
- Merchant themes: `merchant-theme-get`, 22 appearance tokens on capture and 19 on mandate, with the Sidaxis theme served when a merchant has not customised.
- Alias availability: `alias-availability` with format rules, reserved names, deterministic suggestions and a short reservation.
- Document as a verified fact: `403 DOCUMENT_REQUIRED`, once per identity, with `liveness_reusable: false` — liveness is always of the moment, a document expires on its own date.
- Mandate assurance: a mandate issued from a capture that included a verified document is born `face_voice_doc`.
- Agent identity on mandates: `agent_display_name` and `agent_descriptor`, frozen at issuance and shown on authorisation, revocation and receipts.
- Scope vocabulary v2: eight canonical scopes, exact matching, `task` requires constraints.
- Assurance on receipts: `face`, `face_voice`, `face_voice_doc`, derived at the act and frozen — receipts written before assurance existed say the strength was not recorded.
- Mandates: issue, check, consume, get, revoke, scopes, with an outbox worker delivering five signed events every minute.

## Corrections

If you integrated against the earlier documentation, these are the claims that were wrong and are no longer made:

| The old text said | The engine |
| --- | --- |
| mandate-check consumes the ceiling and is idempotent | Check is advisory and moves nothing. mandate-consume is the only call that moves a ceiling — mandates/consume |
| Authorization: Bearer sk_live_… | x-sidaxis-api-key — authentication |
| A sandbox host | Sandbox is the merchant plus the key prefix — sandbox |
| FaceToken as the identifier | The auth.users UUID, minted by the engine |
| Twelve MCP tools | Nine, each mapped onto a live endpoint — MCP |
| Cursor pagination, next_cursor | mandate-get lists by effective status — mandates/get |
| Sidaxis-Version, Sidaxis-RateLimit-* | Nothing emits them — roadmap |