---
title: API changelog
description: Every change that affects integrations through the REST API, GraphQL and webhooks since release 6.0, newest first, with the breaking changes first and what to do about them.
canonical: https://developers.coevera.com/changelog/api/
section: changelog
verification: behaviour
lastVerified: 2026-10-16
publisher: Coevera
---

# API changelog

**Answer:** This changelog lists each change that affects integrations through the REST API, GraphQL and webhooks since release 6.0, grouped by release, newest first. Each release lists its breaking changes first, each with the action an integration needs, then what was deprecated, removed, changed, added or changed for security, and the fixes. The API version stays v100.

Changes that affect integrations built on the REST API, GraphQL and webhooks, since release 6.0.
Each release lists its breaking changes first, with what to do about them; product features are
in Coevera's [release notes](https://www.coevera.com/crm/release-notes/), and MCP server versions
in the [MCP changelog](/ai/mcp-changelog/).

> **Breaking changes:** A **Breaking** change may need a change in existing code, and its **Action** says which. There is
> no fixed deprecation period, and a removal without one says so. Policy:
> [Versioning and deprecation](/changelog/versioning-and-deprecation/).

## Change types

| Type           | Meaning                                                       |
| -------------- | ------------------------------------------------------------- |
| **Deprecated** | Still works, and will be removed.                             |
| **Removed**    | No longer available.                                          |
| **Changed**    | Existing behaviour that now works differently.                |
| **Added**      | Something new that integrations can use.                      |
| **Security**   | A change made for security, and what an integration now gets. |
| **Fixed**      | A request that failed now works, or fails with a clear error. |

Subscribe to new entries with the [RSS feed](/changelog/feed.xml).

## Release 6.6

6.6.0 (2026-10-29)

### Breaking changes

#### App-only mutations removed from the public schema

**Removed** · GraphQL

`markEmailsAsReadEmail`, `markEmailsAsUnreadEmail`, `updateEmailThreadContentShareModeEmail`,
`bulkDeleteEmailFromMailboxEmail`, `createImageCloudObjectTemplate`, `purchasePhone` and
`syncFromCpPhone` serve only the Coevera apps and were never documented for integrations. They
are removed without a deprecation period, and a call fails with `Cannot query field`.

**Action:** Remove these calls from your integration.

#### `getByIdsFor…` queries removed from `cloudObjectTemplate`

**Removed** · GraphQL

`getByIdsForProcess`, `…ForEmailSequence`, `…ForReportSchedule`, `…ForApprovalProcess` and
`…ForFieldMapping` are gone from the `cloudObjectTemplate` repository, without a deprecation
period. The queries of the same names on `cloudObject` are unchanged.

**Action:** Remove calls to these queries on `cloudObjectTemplate`.

#### Three repository queries return a different shape

**Changed** · GraphQL

- `entityScoring.getByEntityType` returns a list, in configured order, instead of one record.
- `entitySettings.getForEntity` returns one record or `null` instead of a list.
- `leadType.getByLeadProcess` requires `leadProcessId`.

**Action:** Update how you read these results, and pass `leadProcessId`.

#### At most 200 mutations and 500 aliases per operation

**Changed** · GraphQL

A larger operation is refused with HTTP `400` before any of it runs. Aliases inside a fragment
count every time the fragment is spread.

**Action:** Split large operations, or write many records with one `bulkUpdate…` mutation.

#### `merge` validates `master` like an update

**Changed** · REST

`POST /entities/Accounts/merge` and `/entities/Contacts/merge` refuse read-only or unknown
fields in `master` with code `117`, and nothing is merged.

**Action:** Send only fields that `PATCH` accepts.

#### Saving a process or sequence checks template and document access

**Changed** · REST, GraphQL

The caller needs read access to the e-mail templates and documents that the save adds.
Otherwise the save fails with code `50`.

**Action:** Give the API application at least **Read Only Access** to **Emails** and **Documents**.

#### OpenAPI tags renamed, and related records' `id` is a UUID

**Changed** · REST

The tags become `API Access` (was `Api`), `Field` (`Data`, `Type`), `Online Form` (`Online`)
and `Text Message` (`Text`, `Unsubscribed`), related records' `id` is a UUID instead of a URI,
and request bodies declare `application/json` correctly. Every operation and field now has a
description, and the API itself behaves as before.

**Action:** If you generate a client from the spec, expect renamed classes when you regenerate.

### Changed

#### Opportunity `value` follows its line items when auto-calculated

**Changed** · REST, GraphQL

When `is_value_auto_calculate` is `true`, creating, updating or deleting a line item recalculates
the opportunity's `value`, as the app does. The flag defaults to `false` for opportunities
created through the API.

#### `created` and `modified` in the future are ignored

**Changed** · REST, GraphQL

A value more than one day in the future is dropped on write; past dates, used to import history,
are still stored. Set `validation-level` bit `8` to store the value anyway.

#### A mass e-mail cannot be unlinked from its recipient

**Changed** · REST, GraphQL

Deleting the `MessageRelations` row that links a mass e-mail to the contact or account it was
sent to fails with code `2002`. Relations that e-mail sync adds later can still be deleted.

#### Picture fields accept only images

**Changed** · REST, GraphQL

A picture field, such as `Account.picture_id`, refuses a cloud object that is not an image with
code `117`, at every `validation-level`. Before, skipping validation let it through.

#### The Pipelines permission covers quote processes

**Changed** · REST, GraphQL

An API key or OAuth token with the Pipelines permission can now access quote processes
(`QuoteProcess`).

### Added

#### E-mail visibility settings on roles

**Added** · REST, GraphQL

`MasterRights` have `access_entity_email_access_level`, which limits which e-mails users of the
role see on records (at level `1`, to the users and units in `access_entity_email_allowed`), and
three `access_entity_email_link_to_*` settings for linking e-mails to accounts and contacts.

#### Step checklist e-mails can go to a lookup field's record

**Added** · REST, GraphQL

`send_email_lookup_field_id` takes the recipient from a Contact or Account lookup field. Empty
means the primary contact or account, as before.

#### Webhooks can have a name

**Added** · Webhooks

A webhook's `options` take `name`, a label that does not change delivery. A value that is not a
string is refused with code `117`.

### Security

#### Files from a storage URL must belong to your space

**Security** · REST, GraphQL

A `CloudObject` created with a `url` on Coevera's file storage is kept only when the file belongs
to the caller's space; any other storage path is refused with code `117`. `getSignedUrls` leaves
out paths with dot segments.

### Fixed

- REST, GraphQL: Input the API cannot store (`NaN`, `Infinity`, NUL characters, unpaired surrogates, over-long indexed text, deep nesting) returns code `117` instead of a server error.
- GraphQL: `convert…` mutations apply their `validationLevel`.
- GraphQL: `restoreLead`, `restoreOpportunity` and `restoreQuote` return the record when it was not deleted, instead of `null`.
- GraphQL: `reactivateLeadOppty` and `bulkReactivateOpportunity` keep the closing date when none is sent, and `bulkReactivateQuote` keeps the expiration date.
- REST: The OpenAPI document no longer lists `validation-level` on `DELETE`, `batch-delete` and `batch-restore`, which never accepted it.
- REST: `PATCH /entities/FieldMappings/{id}`, `batch-delete` of folders and project objectives, and `batch-modify` of targets work instead of failing with a server error.
- REST: `batch-modify` finds IDs written in upper case, and answers code `143` for a record the caller cannot see instead of a server error.
- REST: A query string that is not UTF-8 and a malformed `AppointmentSchedules` body answer HTTP `400` instead of a server error.
- REST: `WebResources` with an unknown entity answer code `117`, and a `Phones` update with an unknown ID code `143`, instead of a server error.
- REST: `TextMessages` and `TextMessageConversations` answer `DELETE` and `batch-delete` with code `171` and `batch-modify` with `116`, instead of a server error.
- REST: `EntityFitnessIndicators` without `settings` answer `ERROR_PARAMETER_MISSING`, and `ProfileRelations` and `ClientFavorites` need exactly one target, instead of a server error.

## Release 6.5

6.5.3 (2026-10-15) · 6.5.2 (2026-10-08) · 6.5.1 (2026-10-02) · 6.5.0 (2026-10-01)

### Breaking changes

#### `EmailMailboxRelations` are read-only

**Removed** · REST, GraphQL · 6.5.3

Create, update and delete are gone from both APIs without a deprecation period, because Coevera
writes these rows itself when it sends or syncs e-mail. REST answers code `116`, GraphQL no
longer has the mutations, and reads are unchanged.

**Action:** Stop writing `EmailMailboxRelations`.

#### `validation-level` refuses internal bits, and `-1`

**Security** · REST · 6.5.3

A REST create, update or `batch-modify` whose `validation-level` sets either of two internal bits
is refused with code `117`, and nothing is written. `-1`, which sets every bit, is refused too.

**Action:** Send the bits or member names in [Validation](/concepts/validation/) instead of `-1`.

#### Steps cannot be deleted through REST

**Removed** · REST · 6.5.2

`DELETE /entities/Steps/{id}` and `batch-delete` answer code `171`, without a deprecation
period. Deleting a step used to leave its records on a deleted step.

**Action:** Remove the step from its pipeline or process instead, which moves its records to another step.

#### `fitness` is nullable and only computed in `getById`

**Changed** · GraphQL · 6.5.2

`LeadEntity.fitness`, `OpportunityEntity.fitness` and their `fitnessDescription` are nullable,
and `null` outside `getById`. Selecting them in a list used to fail.

**Action:** Handle `null`, or read single records with `getById`.

#### Custom fields cannot be created on `LeadOppty` or `Activity`

**Changed** · REST, GraphQL · 6.5.0

`POST /entities/Fields`, `createField` and `createDraftField` refuse an abstract entity, such as
`LeadOppty` or `Activity`, with code `117`. Such a field used to be created but could never be
published.

**Action:** Create the field on `Lead`, `Opportunity`, `Task` or `Appointment` and share it with `mapDependency`.

### Changed

#### Scoring and target filters must start from their own entity

**Changed** · REST, GraphQL · 6.5.2

An `EntityScorings` filter must start from the scored entity, and a `Targets` filter from `Lead`
or `LeadOppty`, depending on the target type. Otherwise the write is refused with code `117`.

#### Every e-mail has a `thread_id`

**Changed** · REST, GraphQL · 6.5.0

`Email.thread_id` is never `null`: an e-mail created without one gets its own `id`. A standalone
e-mail can now be moved into another thread; changing any other `thread_id` is still refused
with code `2002`.

#### Single-currency plans cannot add currencies

**Changed** · REST, GraphQL · 6.5.0

In a space whose subscription supports only its base currency, creating or restoring a currency
is refused with code `50`. When a space moves to such a plan, its other currencies are deleted
and amounts stay in the base currency without conversion.

### Added

#### E-mail labels

**Added** · REST, GraphQL · 6.5.0

`EmailLabels` and `EmailLabelRelations` hold a user's personal labels and the conversations they
are on, and `EmailMailboxRelations` have `label_ids`. An API application needs its e-mail
permission for them.

#### E-mails record the account that sent them

**Added** · REST, GraphQL · 6.5.0

`Email.sender_email_account_id` is the personal e-mail account that sent the e-mail, or `null`;
GraphQL can also filter on it.

#### Validate and compare settings payloads against their JSON Schemas

**Added** · REST · 6.5.0

`POST /api/v100/rest/schemas/{RootType}/validate` returns the violations of a settings payload,
and `…/diff` compares two payloads. Neither needs authentication, and each accepts 60 requests
per minute per IP address.

#### Products list their price lists and schedules

**Added** · REST, GraphQL · 6.5.0

`Product.price_lists` and `Product.price_schedules` are read-only lists of `{id, name}`: the
active price lists and schedules that price the product.

### Security

#### `plain_password` is no longer returned to integrations

**Security** · REST, GraphQL · 6.5.2

For a migrated API access, `plain_password` reads `null` for requests made with an API key or an
OAuth token. The value returned when the access is created is unchanged.

#### Files created from a URL are fetched only from public addresses

**Security** · REST, GraphQL · 6.5.1

When a `CloudObject` is created with a `url`, Coevera fetches only `http` and `https` URLs whose
host and redirects resolve to public addresses. Other URLs are refused with code `117`.

#### OAuth authorization errors redirect only to registered URIs

**Security** · REST · 6.5.0

An error for an unsupported `response_type` is redirected only to a `redirect_uri` registered
for the client. For any other URI it is shown without a redirect.

### Fixed

- 6.5.2 · REST, GraphQL: Unknown paging cursors and sorts through a relation to the same entity (`parent_account.name`) return code `117`, and a `picture` without `url` code `119`, instead of a server error.
- 6.5.2 · REST, GraphQL: Merging a record into itself is refused with code `117`; it used to delete the only copy of the record.
- 6.5.0 · REST, GraphQL: Malformed `settings`, tag, filter, `orderBy`, `duration` and `meeting_url` input returns code `117` instead of a server error.
- 6.5.0 · REST: `PATCH` with `validation-level` on draft-and-publish entities (`Fields`, the record types, `Translations` …) no longer fails with a server error.
- 6.5.0 · REST, GraphQL: A task or appointment with `project_relations: null` is saved with no project relations.
- 6.5.0 · REST, GraphQL: An appointment created by an integration with a Microsoft Teams or Zoom `meeting_url` and no join URL gets its meeting created for its owner.

## Release 6.4

6.4.7 (2026-09-24) · 6.4.6 (2026-09-17) · 6.4.5 (2026-09-09) · 6.4.4 (2026-09-03) · 6.4.2 (2026-09-01) · 6.4.0 (2026-08-27)

### Breaking changes

#### AI-applied dates can no longer be sorted on in GraphQL

**Removed** · GraphQL · 6.4.4

`lastAiAccountHierarchyApplied` and `lastAiOrgChartApplied` (accounts) and
`lastAiBuyingCenterApplied` (leads and opportunities) are gone from the order-by inputs, without
a deprecation period. They can still be read and filtered on, in REST and GraphQL.

**Action:** Remove these fields from `orderBy`.

### Changed

#### Record type forms keep their required and forbidden fields

**Changed** · REST · 6.4.6

A write of `form_edit` or `form_lost` on a record type entity, such as `TaskTypes`, is refused
with code `117` when it places a field that cannot be on the form, or leaves out one that must
be, such as a task's due date and status.

#### `batch-modify` merges `validation-level` lists with OR

**Changed** · REST · 6.4.5

A comma-separated `validation-level` on `batch-modify` is merged with OR, as on every other
route: `6,2` means `6`. Before, `batch-modify` added the values, and read `6,2` as `8`.

#### Deleting an e-mail deletes its unsent draft replies

**Changed** · REST, GraphQL · 6.4.4

`DELETE /entities/Emails/{id}`, `batch-delete` and `deleteEmail` also delete the drafts that
reply to the e-mail, in every mailbox. Before, the drafts stayed and pointed at a deleted e-mail.

#### Filters on multi-select fields match an option

**Changed** · REST, Webhooks · 6.4.0

`filter[<field>]=<option id>` on a multi-select checkbox field returns the records with that
option checked, and a webhook's `options.filter` reads it the same way. Operators other than the
default and `ieq` are refused with code `117`; before, every operator failed with a server error.

#### Last Contacted Date can be based on a field

**Changed** · REST, GraphQL · 6.4.0

An admin can base **Last Contacted Date** on a Date or DateTime field, stored in the settings of
its field record as `LastContactedDateProperty`. A field write that makes the definition depend
on itself is refused with code `2026`.

#### Advanced formula errors name the field and list every problem

**Changed** · REST, GraphQL · 6.4.0

A field write with an invalid advanced formula is still refused with code `117`, and the message
now names the field and lists every problem, joined by `; `.

### Added

#### Who last modified a record, on the KPI entities

**Added** · REST, GraphQL · 6.4.0

`AccountKPIs`, `ContactKPIs`, `QuoteKPIs`, `LeadOpptyKPIs`, `ActivityKPIs` and `ProjectKPIs`
record a record's last change as a `LastModified` row (`kpi` `5`; `9` on `LeadOpptyKPIs`, `3`
on `ActivityKPIs` and `ProjectKPIs`) with the user (`client_id`) or API application
(`application_id`) and the time. The records themselves have no Modified By field in the API.

#### JSON Schemas for settings payloads

**Added** · REST · 6.4.0

`GET /api/v100/rest/schemas` lists a JSON Schema for each of the 20 settings payloads, such as
those of online forms, processes and reports, and `GET /api/v100/rest/schemas/{RootType}.json`
returns one. Neither needs authentication.

#### Solutions and solution templates

**Added** · REST, GraphQL · 6.4.0

`Solutions` group the automations, e-mail sequences, online forms and e-mail templates of one
business process, and `SolutionTemplates` hold their templates. The space needs the Solutions
item of the Automation Hub.

#### E-mails have `bcc` and can be drafts

**Added** · REST, GraphQL · 6.4.0

`Emails` have `bcc` and `is_draft`, and `draft_parent_email_id` names the e-mail a draft replies
to.

#### Create a task or appointment from an e-mail

**Added** · GraphQL · 6.4.0

`task.autoPrefillFromEmail(emailId:, mailboxId:)` and `appointment.autoPrefillFromEmail` return
an unsaved record filled from the e-mail's conversation. Nothing is written until you create it.

#### Task and appointment types by user role

**Added** · REST, GraphQL · 6.4.0

`MasterRights` have `access_entity_task_types` and `access_entity_appointment_types`, with the
selected types in `AllowedTaskTypes` and `AllowedAppointmentTypes`. They limit the types the apps
offer; API writes are not checked against them.

### Fixed

- 6.4.7 · REST, GraphQL: A wrong `rollup` definition on a new field returns `ERROR_INVALID_ROLLUP_CONFIGURATION` (code `2019`) instead of a server error.
- 6.4.6 · REST, GraphQL: With `validation-level` bit `16`, a relation to a record that does not exist returns `ERROR_RELATIONS_DOESNT_EXIST` (code `120`) instead of a server error.
- 6.4.6 · REST, GraphQL: Step checklist items can be created without `sort_order`, and are added at the end of their step; it used to fail with a server error.
- 6.4.2 · REST, GraphQL: Responses are compressed with `br`, `gzip` or `deflate` as `Accept-Encoding` allows; 6.4.0 and 6.4.1 could answer with `zstd`, sometimes without a `Content-Encoding` header.
- 6.4.0 · GraphQL: `getPublished` on draft-and-publish repositories, such as `field`, accepts `limit` and `offset`; it used to fail with them.

## Release 6.3

6.3.7 (2026-08-20) · 6.3.5 (2026-08-05) · 6.3.3 (2026-07-16) · 6.3.2 (2026-07-09) · 6.3.0 (2026-07-01)

### Breaking changes

#### Too many failed sign-ins answer HTTP 429 instead of 401

**Changed** · REST, GraphQL · 6.3.0

After too many failed sign-ins (about 10 per API key, or 100 per IP address, in 5 minutes), a
request is answered with HTTP `429` and code `182`, without a `Retry-After` header, where it
was answered with HTTP `401`. In GraphQL the body is
`{"status": 429, "message": …, "errorcode": 182}`, not an `errors` list, and code `182` raised
after sign-in is answered with `429` instead of `400`.

**Action:** Treat HTTP `429` with code `182` as a lockout: stop signing in and wait before retrying.

#### Country is a managed list, checked when custom values are off

**Changed** · REST, GraphQL · 6.3.0

The country of accounts and contacts comes from a managed list, `CountryCrms`, and when an admin
turns off the field's `enable_custom_values` (on by default), a write that sets a new country
must use a name from that list or a value another record of the entity already has. Otherwise
it is refused with code `117`, `Selected value does not exist`; API writes are checked too, and
values already stored are not checked again.

**Action:** Send country names from `CountryCrms`, or handle code `117` on the country field.

#### `replyBody` and `forwardBody` can be `null`

**Changed** · GraphQL · 6.3.0

`EmailEntity.replyBody` and `forwardBody` are nullable (`String` instead of `String!`).

**Action:** Handle `null` in `replyBody` and `forwardBody`.

#### Scheduled e-mail settings name the sending account by ID

**Changed** · GraphQL · 6.3.0

In `SendEmailService` (`EmailEntity.scheduleSettings` and report schedules), `personalAccount`
is replaced by `personalAccountId` (a UUID) and `personalAccountClientId` is renamed
`clientPersonalEmailAccountId`. Removed without a deprecation period: a query that selects the
old fields fails validation.

**Action:** Select `personalAccountId` and `clientPersonalEmailAccountId` instead.

#### JSON values are validated on every write

**Changed** · REST, GraphQL · 6.3.0

JSON fields, such as the `settings` of forecasts and processes, price list `rules`, e-mail
`schedule_settings` and `CloudObject.params`, are checked on REST writes as on GraphQL ones, and
a value of the wrong shape is refused with code `117` (`9001` for an online form type's
`form_edit`). The public GraphQL schema describes the types of these payloads.

**Action:** Send JSON values in the shape the public GraphQL schema describes.

### Changed

#### Creating a user with an unknown ID answers 404

**Changed** · REST, GraphQL · 6.3.2

`POST /entities/Clients` and `createClient` with an `id` that is not a user of the team space
answer code `143` (HTTP `404` in REST), `TeamSpaceClient with id <id> doesn't exist`. Before,
they answered HTTP `400` with code `2002`.

### Added

#### E-mails per mailbox

**Added** · REST, GraphQL · 6.3.0

`EmailMailboxRelations` link an e-mail to each mailbox it is in, with its thread, direction,
type, scheduling and tracked events (`event_types`). `CompanyEmail.mailbox_id` gives a company
mailbox's ID.

#### Tags on quotes and custom-entity records

**Added** · REST, GraphQL · 6.3.0

Quotes and custom-entity records have `tags`, and `TagRelations` have `quote_id` and
`custom_entity_id`. A tag for them sets the `supported_entities` flag `512` (Quote) or `1024`
(CustomEntity), and a custom-entity tag names its entity in `entity_api_name` (code `117`
otherwise).

#### Dates of the last AI suggestions applied

**Added** · REST, GraphQL · 6.3.0

Accounts have `last_ai_org_chart_applied` and `last_ai_account_hierarchy_applied`, and leads and
opportunities `last_ai_buying_center_applied`: date-times that can be read, filtered on and
written. Roles have `access_ai_record_enrichment`.

### Fixed

- 6.3.7 · REST, GraphQL: Creating a field of a rollup type without a `rollup` object is refused with code `117` instead of a server error.
- 6.3.7 · REST, GraphQL: Creating a field that has no source type works instead of failing with a server error.
- 6.3.7 · GraphQL: `quote.autoPrefill` prefills from the first quote process that has a quote type, or from the process of the type in `targetEntityTypeId`, instead of failing when the space's first quote process has none.
- 6.3.5 · GraphQL: `advancedFormula` on a field draft (`field.getDrafts`, `field.getDraftById`) returns the draft's own formula, or `null`, instead of the published one.
- 6.3.3 · REST: `GET /entities/CustomEntityRelationDatas` and other lists that read custom-entity relations no longer fail now and then with HTTP `500`; in the rare case that caused it, `revision` is `null`.
- 6.3.2 · REST, GraphQL: Completing a recurring task, or moving its due date with `applyRecurrence`, creates the next task even when it would fail the space's form rules, instead of refusing the update with code `40000`.
- 6.3.2 · REST, GraphQL: A list that filters on a relation and sorts by the same relation, such as `filter[product.name]` with `order-by=product.name`, returns its records instead of a server error.
- 6.3.2 · REST, GraphQL: Reading e-mails no longer fails now and then with a server error for users of company or shared mailboxes.
- 6.3.0 · REST, GraphQL: An API application whose e-mail permission is Read gets the `subject`, `body`, `bodySummary`, `sentiment` and `documents` of e-mails, which were empty unless it had Write.
- 6.3.0 · REST, GraphQL: A product line (`OpptyProductRelations`) without `oppty_id`, `quote_id` or `online_form_id` is refused with code `119` instead of a server error.
- 6.3.0 · REST, GraphQL: Updating a relation record onto a pair that exists as a deleted row is refused with code `2002` instead of a server error.
- 6.3.0 · REST: `batch-delete` of several product lines and `POST /entities/ApprovalProcesses` no longer fail with a server error.

## Release 6.2

6.2.3 (2026-06-17) · 6.2.1 (2026-06-04) · 6.2.0 (2026-05-28)

### Breaking changes

#### `access_voyager_ai` removed from roles

**Removed** · REST, GraphQL · 6.2.0

`MasterRights` no longer have `access_voyager_ai` (`accessVoyagerAi`): REST answers code `118`
to a `load-only` that names it, and a GraphQL query that selects it fails validation. Removed
without a deprecation period.

**Action:** Stop reading and writing `access_voyager_ai`.

### Changed

#### Links to the former domain in notes read as `coevera.com`

**Changed** · REST, GraphQL · 6.2.0

Links to the company's former domain in notes are returned with `coevera.com` in their place on
every API host. The stored note is unchanged.

### Added

#### Accounts show when AI org charts and hierarchies were last applied

**Added** · GraphQL · 6.2.1

`AccountEntity` has `lastAiOrgChartApplied` and `lastAiAccountHierarchyApplied`, read-only
date-times of the last AI org chart and account hierarchy applied to the account, or `null`.

#### Roles can enforce e-mail notification settings

**Added** · REST, GraphQL · 6.2.0

`MasterRights` have `access_email_notification_enforcement` (a Boolean, `false` by default) and
`access_email_notification_settings` (GraphQL type `NotificationSettings`; `null` reads as the
default settings). Both can be read and written.

#### Filter owner fields by active users

**Added** · GraphQL · 6.2.0

`FieldOperator` has `IsActive` and `IsNotActive`, which filter an owner field to active or to
deleted users, in the filters of targets, lookup and rollup fields and reports.

#### Limit the scheduled updates of an AI Smart Field

**Added** · GraphQL · 6.2.0

The scheduled updates of an AI Smart Field can be limited with `autoUpdateScheduledFilter` in
`FieldAiValueUpdateOptions` (`ai_options.value_update.auto_update_scheduled_filter` in REST).

### Fixed

- 6.2.3 · REST, GraphQL: A field whose advanced formula is nested too deeply, such as a long chain of `IF`s, is refused with code `117` instead of failing with code `1000`.
- 6.2.0 · REST, GraphQL: A `contains` filter on a multi-select checkbox field matches the records that have the option checked instead of always failing, and a value that is not an option ID is refused with code `117`.
- 6.2.0 · REST, GraphQL: Creating a `lookup` field without its `lookup` definition, or with an incomplete or unknown one, is refused with code `119` or `117` instead of a server error.
- 6.2.0 · REST: `PATCH /entities/Targets/{id}` and `PATCH /entities/Phones/{id}` work and keep the fields that are not sent, instead of failing with code `1000`.
- 6.2.0 · REST: `POST` with a `validation-level` on the record type entities, `Webresources`, `FieldPermissions` and `CustomEntityTypes` is accepted, with no effect, instead of failing with a server error.
- 6.2.0 · REST, GraphQL: A profile relation may point at a deleted profile instead of being refused with code `120`.
- 6.2.0 · REST, GraphQL: An appointment's `meetingUrl` without a join URL is `null` instead of a GraphQL error, and a failed meeting creation no longer stores a partial `meeting_url`.

## Release 6.1

6.1.4 (2026-05-21) · 6.1.3 (2026-05-14) · 6.1.1 (2026-05-07) · 6.1.0 (2026-04-29)

### Breaking changes

#### Archiving an opportunity checks the Lost form's conditional rules

**Changed** · GraphQL · 6.1.1

`archiveOpportunity` and `bulkArchiveOpportunity` apply the conditional required and visible
rules of the opportunity type's Lost form on every call, and refuse a call without a field the
form makes required with code `119`. Before, the rules applied only to a call that sent the ID
alone.

**Action:** Send the fields the Lost form makes required, such as a reason description.

### Changed

#### Filters on relations return each record once

**Changed** · REST, GraphQL, Webhooks · 6.1.1

A filter on a relation, such as `filter[account_relations.account_id]` in REST or
`accountRelations` in an `EmailFilterInput`, matches each record once, so `totalCount` and
paging are right; deleted relation rows match only when the filter names `is_deleted`. Webhook
filters on relations are read the same way.

#### Links to the former domain read as `coevera.com`

**Changed** · REST, GraphQL · 6.1.1

In URL fields, such as an account's `home_page`, and in rich-text fields, a link to the
company's former domain is returned with `coevera.com` in its place on every API host. The
stored value is unchanged.

#### The next recurring task is created when the current one is overdue

**Changed** · REST, GraphQL, Webhooks · 6.1.0

For tasks that recur on a fixed schedule, a daily job creates the next task when the current one
was due the day before and is not completed, writing as the application **System**; before, it
was created only on completion. Recurrences that repeat after completion are unchanged.

#### AI Smart Fields no longer need the Automation Hub item

**Changed** · REST, GraphQL · 6.1.0

AI Smart Fields fill values after a write wherever the space's AI setting and the role allow it.

### Added

#### Roles control AI relationship charts

**Added** · REST, GraphQL · 6.1.0

`MasterRights` have `access_ai_relationship_charts` (`accessAiRelationshipCharts`), a Boolean
that defaults to `true`.

### Fixed

- 6.1.4 · REST: `PATCH /entities/Fields/{id}` with `name_translations: null` is refused with code `117` instead of a server error.
- 6.1.4 · REST, GraphQL: Tasks created by a recurrence get the owner of the task they repeat instead of no owner.
- 6.1.4 · GraphQL: `createImageCloudObject` called with API application credentials creates the image, with `creatorId` `null`, instead of failing with code `1000`.
- 6.1.3 · REST, GraphQL: An appointment invitee with `invitee_type` `1` (Scheduled) and no `contact_id` is stored as sent, keeping its `first_name` and `last_name`, instead of being replaced by a matching contact.
- 6.1.1 · REST, GraphQL: The `custom_entity` relation of rows that point at custom-entity records is filled for every row when one request reads records of several custom entities.
- 6.1.1 · REST, GraphQL: An opportunity update that adds a `revenue_schedule` back to a won opportunity after its closing date changed succeeds instead of failing with code `1000`.
- 6.1.1 · REST, GraphQL: A file created or updated with a `url` on Coevera's own file storage host is treated as a stored file instead of being downloaded again.
- 6.1.0 · REST, GraphQL: An opportunity or quote update that sets a required field to `null` together with `product_relations` gets a validation error and changes nothing, instead of a server error or a partial write.
- 6.1.0 · REST, GraphQL: Restoring a deleted revenue schedule on a won or lost opportunity is accepted instead of refused with code `2002`.
- 6.1.0 · GraphQL: `ForecastEntity.targetGoal` returns `0` for a target period with an open end instead of an error.
- 6.1.0 · GraphQL: `bulkUpdateAppointment` with `linkAttendees: true` matches attendee e-mails to users, contacts and accounts ignoring case.

## Release 6.0

6.0.3 (2026-04-23) · 6.0.0 (2026-04-10)

### Changed

#### OAuth refresh, introspection and revocation accept body credentials

**Changed** · REST, GraphQL · 6.0.3

The refresh-token grant of `POST /oauth2/app/token`, `POST /oauth2/app/introspection` and
`POST /oauth2/app/revocation` accept `client_id` and `client_secret` in the form body
(`client_secret_post`) as well as in HTTP Basic. The client-credentials grant still takes HTTP
Basic only.

#### AI Smart Fields update records after they are written

**Changed** · REST, GraphQL, Webhooks · 6.0.3

When a record is created or updated, also through the API, its AI Smart Fields that update on
create or on update are filled shortly afterwards by the application **AI Smart Field**, so an
integration sees a later modification with its own webhook events. In this release it applies
only with the AI Smart Field item of the Automation Hub, where the space's AI setting and the
role's `access_ai_smart_field` allow it.

#### Several OAuth tokens per application, and revocation is immediate

**Changed** · REST, GraphQL · 6.0.0

- Tokens of one OAuth application in one space no longer revoke each other; a refresh revokes only the token pair it refreshes.
- A token revoked through `POST /oauth2/app/revocation` is refused at once with code `128`.
- A token granted both `<scope>.full` and `<scope>.read` keeps write access.
- The introspection response (`POST /oauth2/app/introspection`) has `user_id`, `null` for an application token.
- Authorization through a `coevera.com` regional host works.

### Added

#### `aiOptions` on system fields

**Added** · GraphQL · 6.0.3

GraphQL `updateField` accepts `aiOptions` on system fields too.

#### AI Smart Field options on fields

**Added** · REST, GraphQL · 6.0.0

Fields have `ai_options` (`FieldEntity.aiOptions`): whether the field is an AI Smart Field, its
prompt and data sources, and when its value is updated. REST returns it read-only, and GraphQL
writes it through `aiOptions` on `createField` and `updateField` for text, number, e-mail,
phone, URL and currency fields (code `117` on other types).

#### Roles control AI reports, automations and online forms

**Added** · REST, GraphQL · 6.0.0

`MasterRights` have `access_ai_reports`, `access_ai_automatizer` and `access_ai_online_forms`
(`accessAiReports`, `accessAiAutomatizer`, `accessAiOnlineForms`), Booleans that default to
`true`.

#### AI credits on text messages

**Added** · GraphQL · 6.0.0

`TextMessageEntity.creditInfo` gives the AI credits spent on an AI-written text message
(`status` `InProgress` or `Finished`, and `value`), or `null`.