Vision Developers

Changelog

This history is generated from the release source. Prelaunch entries are preserved and do not imply general API availability.

2026-11-03: Pages checked against live Vision

docs-0.6.1 · Prelaunch

Every published route was requested on live Vision without credentials and checked against the code live runs. This corrects what didn't match.

  • CRM HTTP 9.12.1: client-directory deals and won deals need crm:opportunities:read; directory matches and their commands need crm:settings:manage and list their 400, 401, 403, and 503 answers.
  • Environments: on live, CRM's API answers from the internet with a token required (401 without one); the other App APIs still answer 403.
  • Getting started and Authentication: on live, the only App permission a key you make can hold is CRM's lead intake (crm:intake:create). The People & Companies contract is linked.
  • API keys and Vision Core: Vision Core's /vision-core/v1 reads aren't open on live yet and answer 404.

2026-11-03: Contracts match what live Vision runs

docs-0.6.0 · Prelaunch

Publishes the contracts of the exact App versions live Vision runs after the 2026-11-02 release, and adds People & Companies. Publishing a contract is documentation only and does not make any API or MCP server available.

  • Vision Core 1.0.0-preview.8: POST /oauth/token documents the optional workspace_id for an app_service client with a module audience. No route or scope changes.
  • Accounting HTTP 0.32.0: 23 routes added, none removed: cash sales and repeat checks, command outcomes, receipt PDF and send receipt, undo payment, invoice remind, duplicate and connected history, paper invoice drafts, invoicing settings, record links, record-related contributions, and repeating invoices. No scope changes.
  • Calendar HTTP 1.20.0: 5 routes added, none removed: People contract, people agenda, person sharing commands, and record-related and widgets contributions.
  • CRM HTTP 9.12.0: 11 routes added, none removed: overview, open work, complete, agenda and others' agenda contributions, client directory, and directory matches.
  • To Do HTTP 1.9.0: 3 routes added, none removed: others' agenda, record-related and widgets contributions.
  • New: People & Companies API 1.5.0, restricted at runtime.

2026-11-02: API keys: confirming it's you

docs-0.5.1 · Prelaunch

The API keys page no longer gives a length for the fresh sign-in that creating, replacing, or revoking a key needs, matching Vision's own screens.

  • /credentials: "Confirm it's you" now says to sign in again, or enter your current password where Vision holds one, without a time limit.

2026-10-30: API and MCP contracts refreshed to match the Apps

docs-0.5.0 · Prelaunch

Updates the published contracts for Vision Core, Accounting, Calendar, CRM, and Todo to what the code declares today. Publishing a contract is documentation only and does not make any API or MCP server available.

  • Vision Core 1.0.0-preview.7: the host is now https://app.runonvision.com and paths are under /vision-core/v1 (the old /platform/v1 paths no longer exist), with the app tasks route, the OAuth server metadata route, and the notices key set added. Every protected operation declares its required scope.
  • Accounting HTTP 0.16.0: paths now include the /apps/accounting/v1 prefix and the host https://accounting.runonvision.com. Adds payments, refunds, billing agreements, credit notes, invoice approval and issue, pay links, Stripe connect, and widgets. Adds seven scopes. Accounting is not publicly reachable.
  • Accounting MCP 0.2.0: read-only capability inventory for Vision Core's preview endpoint on development and preview tiers only. Proposal and import capabilities move to planned and are not served.
  • Calendar HTTP 1.17.0: adds availability, the agenda widget, and calendar sync (connections, ICS subscriptions, conferencing, Google and Microsoft webhooks). Adds two scopes. Calendar MCP 1.0.1: removes list_event_attendees and corrects the workspace identifier pattern to CWS-.
  • CRM HTTP 9.6.0: adds intake submissions, timelines, Today triage, widgets, pipeline overview, access settings, and spreadsheet imports. Adds two scopes. Todo HTTP 1.5.0: adds agenda, daily list, and complete routes, list archive and restore commands, and optional all-day and move-on-delete fields.

2026-10-30: API keys and leads checked against the code

docs-0.4.3 · Prelaunch

Corrects what the API keys and Collect leads pages say about confirming it's you, two-step sign-in, phone numbers, and the honeypot, and replaces a link to a page that does not exist.

  • API keys: the 10-minute window applies to a fresh sign-in; with a password, you enter it each time. Two-step sign-in is needed to create a key or replace a secret on live Vision, not to revoke one.
  • Collect leads: the phone format is an optional leading + and then 7 to 32 characters; the honeypot field takes up to 200 characters and returns 204 only on an otherwise valid body; accepting a lead creates a company only if one was sent.
  • API availability: the link to the missing /audit page now goes to Environments. Sidebar section links on Collect leads, SDKs, and Platform architecture now match their headings.

2026-10-30: API keys from Settings → Developer

docs-0.4.2 · Prelaunch

Adds the API keys page and points every guide at the self-serve path in Settings → Developer instead of keys provisioned by the Vision team.

  • New page /credentials: connect a website form in one step, create a custom key (name, where it runs, what it can do), what is shown once, using the key, telling Apps, replacing a secret and revoking a key.
  • Collect leads from your website: one-time setup is now Settings → Developer → Connect a website form; the manual binding step is gone because Vision tells CRM about the key.
  • Authentication: Get credentials describes Settings → Developer and links to API keys.
  • The sitemap lists /credentials and /leads.

2026-10-28: Collect leads from your website

docs-0.4.1 · Prelaunch

Adds a guide for sending website form submissions into Vision CRM from a server with Vision API client credentials.

2026-10-28: Accurate hosts, per-App getting started, and MCP connection guide

docs-0.4.0 · Prelaunch

Replaces retired hostnames and paths with the running ones, documents each App's real conventions, corrects webhook signature verification, and adds an MCP connection guide with a token-refreshing bridge.

  • Production Vision Core is https://app.runonvision.com; retired vision.ivisionstudios.com and /platform/v1 references now point to /vision-core/v1.
  • Adds Environments and Getting started by App pages with origins, base paths, workspace formats, page sizes, idempotency and correlation headers per App.
  • Quickstart and Authentication show cURL, TypeScript and Python, real token endpoint errors, the resource parameter, identity classes and how to get credentials.
  • Corrects webhook verification: v1= HMAC-SHA256 over timestamp.deliveryId.body with vision-webhook-id, vision-webhook-timestamp and vision-webhook-signature headers.
  • Errors, idempotency, pagination and rate-limit pages now carry per-App matrices and current numeric token limits.
  • Adds the MCP server page and the Vision MCP bridge for Claude Code, Claude Desktop and other stdio clients.
  • Rewrites the version policy with compatible and breaking change rules, deprecation headers and changelog generation.

2026-09-15: Immutable producer contract factory foundation

docs-0.3.1 · Prelaunch

Adds generic compound-command references and immutable producer artifact validation without activating API, MCP, event, or production runtime surfaces.

  • Documents every semantically identified compound command variant with its own schema fields and cURL, JavaScript, and Python examples.
  • Adds the versioned producer-bundle declaration and fail-closed validation for explicitly declared APIs, commands, MCP tools, events, examples, changelog, provenance, and runtime evidence.
  • Adds deterministic content-addressed ingestion, artifact and aggregate SHA-256 receipts, baseline compatibility checks, path and symlink defenses, and atomic candidate writes.
  • Preserves bundle-less Apps and does not infer MCP tools, events, callable runtime availability, registry approval, deployment, or production release.

2026-09-13: To Do contracts and complete producer discovery

docs-0.3.0 · Prelaunch

Adds the missing To Do contract and makes missing producers visible without activating external API or MCP services.

  • Published generated To Do schemas for the implemented tasks, lists, board, task-detail, presentation and command operations; command access remains human-only.
  • Added source-discovery checks that report absent producer manifests and aggregate all contract drift instead of stopping at the first invalid module.
  • Updated supported framework and image dependencies; dependency audit reports no known vulnerabilities at release verification.
  • Automatic cross-repository publication, developer onboarding, external API activation and executable public MCP remain unverified and are not announced by this documentation release.

2026-09-12: Canonical branded developer domain

docs-0.2.1 · Prelaunch

Moves active developer documentation and discovery metadata to the approved developers.runonvision.com origin without changing API or MCP availability.

  • Updated canonical metadata, generated Markdown discovery links, sitemap, robots declaration, Atom feed, deployment configuration, and promotion receipts to developers.runonvision.com.
  • Retained the site-wide noindex policy and truthful no-public-MCP status.
  • Preserved approved checksum-pinned API contract issuer and audience literals pending a separately governed consumer migration.

2026-09-08: Developer documentation and AI discovery foundation

docs-0.2.0 · Prelaunch

Adds generated Markdown, AI discovery, release feeds, non-indexing controls, and freshness gates without changing API runtime availability.

  • Improved light-theme contrast for documentation links, HTTP method badges, scope labels, and search keyboard hints after browser accessibility testing.
  • Added generated Markdown guides for humans and AI systems.
  • Added llms.txt, sitemap.xml, robots.txt, JSON changelog, Atom feed, and publication evidence generated from reviewed sources.
  • Added a visible development banner and site-wide noindex policy.
  • Documented MCP connection status without inventing a public endpoint or registry listing.
  • Added CI gates that reject stale generated documentation or documentation changes without a release note.

2026-08-21: Calendar publication and API reference rebuild

Unversioned historical record · Prelaunch

Retrospective archive of the documentation changes recorded on 2026-08-21.

  • Published Calendar 1.4.0 with bounded availability-slot calculation under the approved Calendar scope and authority model.
  • Added a full-depth page for every approved HTTP operation from checksum-pinned OpenAPI snapshots.
  • Added request, response, authorization, operational, security, workflow, and contract-history context.
  • Preserved preview and restricted availability labels; documentation does not imply general API availability.

2026-08-20: Contract security declaration unification

Unversioned historical record · Prelaunch

Unified approved contract security metadata and corrected the Vision Core routed host.

  • Unified approved contracts on the visionBearer HTTP bearer security scheme.
  • Normalized scope declarations to x-required-scope while preserving CRM scope descriptions and Calendar claim metadata.
  • Corrected Vision Core's documented routed host; Accounting, CRM, and Calendar remain gateway-only.
  • No operations, parameters, or schemas changed.

2026-08-15: Initial access publication

Unversioned historical record · Prelaunch

Published the initial pre-v1 access, webhook, and contract documentation baseline.

  • Documented short-lived machine credentials, JWK discovery, installed-App context, publication lifecycle, and server-only integration guidance.
  • Documented signed webhooks, bounded retries, replay protection, rotation, revocation, and exhaustion evidence.
  • Recorded OpenAPI 3.1 and App API manifest validation.
  • Capabilities remain preview/pre-v1 pending separate staging and production acceptance.