ChangelogAPI changelog
API changelog
Every change that affects integrations through the REST API, GraphQL and webhooks since release 6.0, newest first, with the breaking changes first and what to do about them.
Answer
This changelog lists each change that affects integrations through the REST API, GraphQL and webhooks since release 6.0, grouped by release, newest first. Each release lists its breaking changes first, each with the action an integration needs, then what was deprecated, removed, changed, added or changed for security, and the fixes. The API version stays v100.
Changes that affect integrations built on the REST API, GraphQL and webhooks, since release 6.0. Each release lists its breaking changes first, with what to do about them; product features are in Coevera's release notes, and MCP server versions in the MCP changelog.
Breaking changes
A Breaking change may need a change in existing code, and its Action says which. There is no fixed deprecation period, and a removal without one says so. Policy: Versioning and deprecation.
Change types
| Type | Meaning |
|---|---|
| Deprecated | Still works, and will be removed. |
| Removed | No longer available. |
| Changed | Existing behaviour that now works differently. |
| Added | Something new that integrations can use. |
| Security | A change made for security, and what an integration now gets. |
| Fixed | A request that failed now works, or fails with a clear error. |
Release 6.6
- 6.6.0
Breaking changes · 7
App-only mutations removed from the public schema
markEmailsAsReadEmail, markEmailsAsUnreadEmail, updateEmailThreadContentShareModeEmail,
bulkDeleteEmailFromMailboxEmail, createImageCloudObjectTemplate, purchasePhone and
syncFromCpPhone serve only the Coevera apps and were never documented for integrations. They
are removed without a deprecation period, and a call fails with Cannot query field.
Action: Remove these calls from your integration.
getByIdsFor… queries removed from cloudObjectTemplate
getByIdsForProcess, …ForEmailSequence, …ForReportSchedule, …ForApprovalProcess and
…ForFieldMapping are gone from the cloudObjectTemplate repository, without a deprecation
period. The queries of the same names on cloudObject are unchanged.
Action: Remove calls to these queries on cloudObjectTemplate.
Three repository queries return a different shape
entityScoring.getByEntityTypereturns a list, in configured order, instead of one record.entitySettings.getForEntityreturns one record ornullinstead of a list.leadType.getByLeadProcessrequiresleadProcessId.
Action: Update how you read these results, and pass leadProcessId.
At most 200 mutations and 500 aliases per operation
A larger operation is refused with HTTP 400 before any of it runs. Aliases inside a fragment
count every time the fragment is spread.
Action: Split large operations, or write many records with one bulkUpdate… mutation.
merge validates master like an update
POST /entities/Accounts/merge and /entities/Contacts/merge refuse read-only or unknown
fields in master with code 117, and nothing is merged.
Action: Send only fields that PATCH accepts.
Saving a process or sequence checks template and document access
The caller needs read access to the e-mail templates and documents that the save adds.
Otherwise the save fails with code 50.
Action: Give the API application at least Read Only Access to Emails and Documents.
OpenAPI tags renamed, and related records' id is a UUID
The tags become API Access (was Api), Field (Data, Type), Online Form (Online)
and Text Message (Text, Unsubscribed), related records' id is a UUID instead of a URI,
and request bodies declare application/json correctly. Every operation and field now has a
description, and the API itself behaves as before.
Action: If you generate a client from the spec, expect renamed classes when you regenerate.
Changed
Opportunity value follows its line items when auto-calculated
When is_value_auto_calculate is true, creating, updating or deleting a line item recalculates
the opportunity's value, as the app does. The flag defaults to false for opportunities
created through the API.
created and modified in the future are ignored
A value more than one day in the future is dropped on write; past dates, used to import history,
are still stored. Set validation-level bit 8 to store the value anyway.
A mass e-mail cannot be unlinked from its recipient
Deleting the MessageRelations row that links a mass e-mail to the contact or account it was
sent to fails with code 2002. Relations that e-mail sync adds later can still be deleted.
Picture fields accept only images
A picture field, such as Account.picture_id, refuses a cloud object that is not an image with
code 117, at every validation-level. Before, skipping validation let it through.
The Pipelines permission covers quote processes
An API key or OAuth token with the Pipelines permission can now access quote processes
(QuoteProcess).
Added
E-mail visibility settings on roles
MasterRights have access_entity_email_access_level, which limits which e-mails users of the
role see on records (at level 1, to the users and units in access_entity_email_allowed), and
three access_entity_email_link_to_* settings for linking e-mails to accounts and contacts.
Step checklist e-mails can go to a lookup field's record
send_email_lookup_field_id takes the recipient from a Contact or Account lookup field. Empty
means the primary contact or account, as before.
Webhooks can have a name
A webhook's options take name, a label that does not change delivery. A value that is not a
string is refused with code 117.
Security
Files from a storage URL must belong to your space
A CloudObject created with a url on Coevera's file storage is kept only when the file belongs
to the caller's space; any other storage path is refused with code 117. getSignedUrls leaves
out paths with dot segments.
Fixed
- Input the API cannot store (
NaN,Infinity, NUL characters, unpaired surrogates, over-long indexed text, deep nesting) returns code117instead of a server error.RESTGraphQL convert…mutations apply theirvalidationLevel.GraphQLrestoreLead,restoreOpportunityandrestoreQuotereturn the record when it was not deleted, instead ofnull.GraphQLreactivateLeadOpptyandbulkReactivateOpportunitykeep the closing date when none is sent, andbulkReactivateQuotekeeps the expiration date.GraphQL- The OpenAPI document no longer lists
validation-levelonDELETE,batch-deleteandbatch-restore, which never accepted it.REST PATCH /entities/FieldMappings/{id},batch-deleteof folders and project objectives, andbatch-modifyof targets work instead of failing with a server error.RESTbatch-modifyfinds IDs written in upper case, and answers code143for a record the caller cannot see instead of a server error.REST- A query string that is not UTF-8 and a malformed
AppointmentSchedulesbody answer HTTP400instead of a server error.REST WebResourceswith an unknown entity answer code117, and aPhonesupdate with an unknown ID code143, instead of a server error.RESTTextMessagesandTextMessageConversationsanswerDELETEandbatch-deletewith code171andbatch-modifywith116, instead of a server error.RESTEntityFitnessIndicatorswithoutsettingsanswerERROR_PARAMETER_MISSING, andProfileRelationsandClientFavoritesneed exactly one target, instead of a server error.REST
Release 6.5
- 6.5.3
- 6.5.2
- 6.5.1
- 6.5.0
Breaking changes · 5
EmailMailboxRelations are read-only
Create, update and delete are gone from both APIs without a deprecation period, because Coevera
writes these rows itself when it sends or syncs e-mail. REST answers code 116, GraphQL no
longer has the mutations, and reads are unchanged.
Action: Stop writing EmailMailboxRelations.
validation-level refuses internal bits, and -1
A REST create, update or batch-modify whose validation-level sets either of two internal bits
is refused with code 117, and nothing is written. -1, which sets every bit, is refused too.
Action: Send the bits or member names in Validation instead of -1.
Steps cannot be deleted through REST
DELETE /entities/Steps/{id} and batch-delete answer code 171, without a deprecation
period. Deleting a step used to leave its records on a deleted step.
Action: Remove the step from its pipeline or process instead, which moves its records to another step.
fitness is nullable and only computed in getById
LeadEntity.fitness, OpportunityEntity.fitness and their fitnessDescription are nullable,
and null outside getById. Selecting them in a list used to fail.
Action: Handle null, or read single records with getById.
Custom fields cannot be created on LeadOppty or Activity
POST /entities/Fields, createField and createDraftField refuse an abstract entity, such as
LeadOppty or Activity, with code 117. Such a field used to be created but could never be
published.
Action: Create the field on Lead, Opportunity, Task or Appointment and share it with mapDependency.
Changed
Scoring and target filters must start from their own entity
An EntityScorings filter must start from the scored entity, and a Targets filter from Lead
or LeadOppty, depending on the target type. Otherwise the write is refused with code 117.
Every e-mail has a thread_id
Email.thread_id is never null: an e-mail created without one gets its own id. A standalone
e-mail can now be moved into another thread; changing any other thread_id is still refused
with code 2002.
Single-currency plans cannot add currencies
In a space whose subscription supports only its base currency, creating or restoring a currency
is refused with code 50. When a space moves to such a plan, its other currencies are deleted
and amounts stay in the base currency without conversion.
Added
E-mail labels
EmailLabels and EmailLabelRelations hold a user's personal labels and the conversations they
are on, and EmailMailboxRelations have label_ids. An API application needs its e-mail
permission for them.
E-mails record the account that sent them
Email.sender_email_account_id is the personal e-mail account that sent the e-mail, or null;
GraphQL can also filter on it.
Validate and compare settings payloads against their JSON Schemas
POST /api/v100/rest/schemas/{RootType}/validate returns the violations of a settings payload,
and …/diff compares two payloads. Neither needs authentication, and each accepts 60 requests
per minute per IP address.
Products list their price lists and schedules
Product.price_lists and Product.price_schedules are read-only lists of {id, name}: the
active price lists and schedules that price the product.
Security
plain_password is no longer returned to integrations
For a migrated API access, plain_password reads null for requests made with an API key or an
OAuth token. The value returned when the access is created is unchanged.
Files created from a URL are fetched only from public addresses
When a CloudObject is created with a url, Coevera fetches only http and https URLs whose
host and redirects resolve to public addresses. Other URLs are refused with code 117.
OAuth authorization errors redirect only to registered URIs
An error for an unsupported response_type is redirected only to a redirect_uri registered
for the client. For any other URI it is shown without a redirect.
Fixed
- 6.5.2Unknown paging cursors and sorts through a relation to the same entity (
parent_account.name) return code117, and apicturewithouturlcode119, instead of a server error.RESTGraphQL - 6.5.2Merging a record into itself is refused with code
117; it used to delete the only copy of the record.RESTGraphQL - 6.5.0Malformed
settings, tag, filter,orderBy,durationandmeeting_urlinput returns code117instead of a server error.RESTGraphQL - 6.5.0
PATCHwithvalidation-levelon draft-and-publish entities (Fields, the record types,Translations…) no longer fails with a server error.REST - 6.5.0A task or appointment with
project_relations: nullis saved with no project relations.RESTGraphQL - 6.5.0An appointment created by an integration with a Microsoft Teams or Zoom
meeting_urland no join URL gets its meeting created for its owner.RESTGraphQL
Release 6.4
- 6.4.7
- 6.4.6
- 6.4.5
- 6.4.4
- 6.4.2
- 6.4.0
Breaking changes · 1
AI-applied dates can no longer be sorted on in GraphQL
lastAiAccountHierarchyApplied and lastAiOrgChartApplied (accounts) and
lastAiBuyingCenterApplied (leads and opportunities) are gone from the order-by inputs, without
a deprecation period. They can still be read and filtered on, in REST and GraphQL.
Action: Remove these fields from orderBy.
Changed
Record type forms keep their required and forbidden fields
A write of form_edit or form_lost on a record type entity, such as TaskTypes, is refused
with code 117 when it places a field that cannot be on the form, or leaves out one that must
be, such as a task's due date and status.
batch-modify merges validation-level lists with OR
A comma-separated validation-level on batch-modify is merged with OR, as on every other
route: 6,2 means 6. Before, batch-modify added the values, and read 6,2 as 8.
Deleting an e-mail deletes its unsent draft replies
DELETE /entities/Emails/{id}, batch-delete and deleteEmail also delete the drafts that
reply to the e-mail, in every mailbox. Before, the drafts stayed and pointed at a deleted e-mail.
Filters on multi-select fields match an option
filter[<field>]=<option id> on a multi-select checkbox field returns the records with that
option checked, and a webhook's options.filter reads it the same way. Operators other than the
default and ieq are refused with code 117; before, every operator failed with a server error.
Last Contacted Date can be based on a field
An admin can base Last Contacted Date on a Date or DateTime field, stored in the settings of
its field record as LastContactedDateProperty. A field write that makes the definition depend
on itself is refused with code 2026.
Advanced formula errors name the field and list every problem
A field write with an invalid advanced formula is still refused with code 117, and the message
now names the field and lists every problem, joined by ; .
Added
Who last modified a record, on the KPI entities
AccountKPIs, ContactKPIs, QuoteKPIs, LeadOpptyKPIs, ActivityKPIs and ProjectKPIs
record a record's last change as a LastModified row (kpi 5; 9 on LeadOpptyKPIs, 3
on ActivityKPIs and ProjectKPIs) with the user (client_id) or API application
(application_id) and the time. The records themselves have no Modified By field in the API.
JSON Schemas for settings payloads
GET /api/v100/rest/schemas lists a JSON Schema for each of the 20 settings payloads, such as
those of online forms, processes and reports, and GET /api/v100/rest/schemas/{RootType}.json
returns one. Neither needs authentication.
Solutions and solution templates
Solutions group the automations, e-mail sequences, online forms and e-mail templates of one
business process, and SolutionTemplates hold their templates. The space needs the Solutions
item of the Automation Hub.
E-mails have bcc and can be drafts
Emails have bcc and is_draft, and draft_parent_email_id names the e-mail a draft replies
to.
Create a task or appointment from an e-mail
task.autoPrefillFromEmail(emailId:, mailboxId:) and appointment.autoPrefillFromEmail return
an unsaved record filled from the e-mail's conversation. Nothing is written until you create it.
Task and appointment types by user role
MasterRights have access_entity_task_types and access_entity_appointment_types, with the
selected types in AllowedTaskTypes and AllowedAppointmentTypes. They limit the types the apps
offer; API writes are not checked against them.
Fixed
- 6.4.7A wrong
rollupdefinition on a new field returnsERROR_INVALID_ROLLUP_CONFIGURATION(code2019) instead of a server error.RESTGraphQL - 6.4.6With
validation-levelbit16, a relation to a record that does not exist returnsERROR_RELATIONS_DOESNT_EXIST(code120) instead of a server error.RESTGraphQL - 6.4.6Step checklist items can be created without
sort_order, and are added at the end of their step; it used to fail with a server error.RESTGraphQL - 6.4.2Responses are compressed with
br,gzipordeflateasAccept-Encodingallows; 6.4.0 and 6.4.1 could answer withzstd, sometimes without aContent-Encodingheader.RESTGraphQL - 6.4.0
getPublishedon draft-and-publish repositories, such asfield, acceptslimitandoffset; it used to fail with them.GraphQL
Release 6.3
- 6.3.7
- 6.3.5
- 6.3.3
- 6.3.2
- 6.3.0
Breaking changes · 5
Too many failed sign-ins answer HTTP 429 instead of 401
After too many failed sign-ins (about 10 per API key, or 100 per IP address, in 5 minutes), a
request is answered with HTTP 429 and code 182, without a Retry-After header, where it
was answered with HTTP 401. In GraphQL the body is
{"status": 429, "message": …, "errorcode": 182}, not an errors list, and code 182 raised
after sign-in is answered with 429 instead of 400.
Action: Treat HTTP 429 with code 182 as a lockout: stop signing in and wait before retrying.
Country is a managed list, checked when custom values are off
The country of accounts and contacts comes from a managed list, CountryCrms, and when an admin
turns off the field's enable_custom_values (on by default), a write that sets a new country
must use a name from that list or a value another record of the entity already has. Otherwise
it is refused with code 117, Selected value does not exist; API writes are checked too, and
values already stored are not checked again.
Action: Send country names from CountryCrms, or handle code 117 on the country field.
replyBody and forwardBody can be null
EmailEntity.replyBody and forwardBody are nullable (String instead of String!).
Action: Handle null in replyBody and forwardBody.
Scheduled e-mail settings name the sending account by ID
In SendEmailService (EmailEntity.scheduleSettings and report schedules), personalAccount
is replaced by personalAccountId (a UUID) and personalAccountClientId is renamed
clientPersonalEmailAccountId. Removed without a deprecation period: a query that selects the
old fields fails validation.
Action: Select personalAccountId and clientPersonalEmailAccountId instead.
JSON values are validated on every write
JSON fields, such as the settings of forecasts and processes, price list rules, e-mail
schedule_settings and CloudObject.params, are checked on REST writes as on GraphQL ones, and
a value of the wrong shape is refused with code 117 (9001 for an online form type's
form_edit). The public GraphQL schema describes the types of these payloads.
Action: Send JSON values in the shape the public GraphQL schema describes.
Changed
Creating a user with an unknown ID answers 404
POST /entities/Clients and createClient with an id that is not a user of the team space
answer code 143 (HTTP 404 in REST), TeamSpaceClient with id <id> doesn't exist. Before,
they answered HTTP 400 with code 2002.
Added
E-mails per mailbox
EmailMailboxRelations link an e-mail to each mailbox it is in, with its thread, direction,
type, scheduling and tracked events (event_types). CompanyEmail.mailbox_id gives a company
mailbox's ID.
Tags on quotes and custom-entity records
Quotes and custom-entity records have tags, and TagRelations have quote_id and
custom_entity_id. A tag for them sets the supported_entities flag 512 (Quote) or 1024
(CustomEntity), and a custom-entity tag names its entity in entity_api_name (code 117
otherwise).
Dates of the last AI suggestions applied
Accounts have last_ai_org_chart_applied and last_ai_account_hierarchy_applied, and leads and
opportunities last_ai_buying_center_applied: date-times that can be read, filtered on and
written. Roles have access_ai_record_enrichment.
Fixed
- 6.3.7Creating a field of a rollup type without a
rollupobject is refused with code117instead of a server error.RESTGraphQL - 6.3.7Creating a field that has no source type works instead of failing with a server error.RESTGraphQL
- 6.3.7
quote.autoPrefillprefills from the first quote process that has a quote type, or from the process of the type intargetEntityTypeId, instead of failing when the space's first quote process has none.GraphQL - 6.3.5
advancedFormulaon a field draft (field.getDrafts,field.getDraftById) returns the draft's own formula, ornull, instead of the published one.GraphQL - 6.3.3
GET /entities/CustomEntityRelationDatasand other lists that read custom-entity relations no longer fail now and then with HTTP500; in the rare case that caused it,revisionisnull.REST - 6.3.2Completing a recurring task, or moving its due date with
applyRecurrence, creates the next task even when it would fail the space's form rules, instead of refusing the update with code40000.RESTGraphQL - 6.3.2A list that filters on a relation and sorts by the same relation, such as
filter[product.name]withorder-by=product.name, returns its records instead of a server error.RESTGraphQL - 6.3.0An API application whose e-mail permission is Read gets the
subject,body,bodySummary,sentimentanddocumentsof e-mails, which were empty unless it had Write.RESTGraphQL - 6.3.0A product line (
OpptyProductRelations) withoutoppty_id,quote_idoronline_form_idis refused with code119instead of a server error.RESTGraphQL - 6.3.0Updating a relation record onto a pair that exists as a deleted row is refused with code
2002instead of a server error.RESTGraphQL - 6.3.0
batch-deleteof several product lines andPOST /entities/ApprovalProcessesno longer fail with a server error.REST
Release 6.2
- 6.2.3
- 6.2.1
- 6.2.0
Breaking changes · 1
access_voyager_ai removed from roles
MasterRights no longer have access_voyager_ai (accessVoyagerAi): REST answers code 118
to a load-only that names it, and a GraphQL query that selects it fails validation. Removed
without a deprecation period.
Action: Stop reading and writing access_voyager_ai.
Changed
Links to the former domain in notes read as coevera.com
Links to the company's former domain in notes are returned with coevera.com in their place on
every API host. The stored note is unchanged.
Added
Accounts show when AI org charts and hierarchies were last applied
AccountEntity has lastAiOrgChartApplied and lastAiAccountHierarchyApplied, read-only
date-times of the last AI org chart and account hierarchy applied to the account, or null.
Roles can enforce e-mail notification settings
MasterRights have access_email_notification_enforcement (a Boolean, false by default) and
access_email_notification_settings (GraphQL type NotificationSettings; null reads as the
default settings). Both can be read and written.
Filter owner fields by active users
FieldOperator has IsActive and IsNotActive, which filter an owner field to active or to
deleted users, in the filters of targets, lookup and rollup fields and reports.
Limit the scheduled updates of an AI Smart Field
The scheduled updates of an AI Smart Field can be limited with autoUpdateScheduledFilter in
FieldAiValueUpdateOptions (ai_options.value_update.auto_update_scheduled_filter in REST).
Fixed
- 6.2.3A field whose advanced formula is nested too deeply, such as a long chain of
IFs, is refused with code117instead of failing with code1000.RESTGraphQL - 6.2.0A
containsfilter on a multi-select checkbox field matches the records that have the option checked instead of always failing, and a value that is not an option ID is refused with code117.RESTGraphQL - 6.2.0Creating a
lookupfield without itslookupdefinition, or with an incomplete or unknown one, is refused with code119or117instead of a server error.RESTGraphQL - 6.2.0
PATCH /entities/Targets/{id}andPATCH /entities/Phones/{id}work and keep the fields that are not sent, instead of failing with code1000.REST - 6.2.0
POSTwith avalidation-levelon the record type entities,Webresources,FieldPermissionsandCustomEntityTypesis accepted, with no effect, instead of failing with a server error.REST - 6.2.0A profile relation may point at a deleted profile instead of being refused with code
120.RESTGraphQL - 6.2.0An appointment's
meetingUrlwithout a join URL isnullinstead of a GraphQL error, and a failed meeting creation no longer stores a partialmeeting_url.RESTGraphQL
Release 6.1
- 6.1.4
- 6.1.3
- 6.1.1
- 6.1.0
Breaking changes · 1
Archiving an opportunity checks the Lost form's conditional rules
archiveOpportunity and bulkArchiveOpportunity apply the conditional required and visible
rules of the opportunity type's Lost form on every call, and refuse a call without a field the
form makes required with code 119. Before, the rules applied only to a call that sent the ID
alone.
Action: Send the fields the Lost form makes required, such as a reason description.
Changed
Filters on relations return each record once
A filter on a relation, such as filter[account_relations.account_id] in REST or
accountRelations in an EmailFilterInput, matches each record once, so totalCount and
paging are right; deleted relation rows match only when the filter names is_deleted. Webhook
filters on relations are read the same way.
Links to the former domain read as coevera.com
In URL fields, such as an account's home_page, and in rich-text fields, a link to the
company's former domain is returned with coevera.com in its place on every API host. The
stored value is unchanged.
The next recurring task is created when the current one is overdue
For tasks that recur on a fixed schedule, a daily job creates the next task when the current one was due the day before and is not completed, writing as the application System; before, it was created only on completion. Recurrences that repeat after completion are unchanged.
AI Smart Fields no longer need the Automation Hub item
AI Smart Fields fill values after a write wherever the space's AI setting and the role allow it.
Added
Roles control AI relationship charts
MasterRights have access_ai_relationship_charts (accessAiRelationshipCharts), a Boolean
that defaults to true.
Fixed
- 6.1.4
PATCH /entities/Fields/{id}withname_translations: nullis refused with code117instead of a server error.REST - 6.1.4Tasks created by a recurrence get the owner of the task they repeat instead of no owner.RESTGraphQL
- 6.1.4
createImageCloudObjectcalled with API application credentials creates the image, withcreatorIdnull, instead of failing with code1000.GraphQL - 6.1.3An appointment invitee with
invitee_type1(Scheduled) and nocontact_idis stored as sent, keeping itsfirst_nameandlast_name, instead of being replaced by a matching contact.RESTGraphQL - 6.1.1The
custom_entityrelation of rows that point at custom-entity records is filled for every row when one request reads records of several custom entities.RESTGraphQL - 6.1.1An opportunity update that adds a
revenue_scheduleback to a won opportunity after its closing date changed succeeds instead of failing with code1000.RESTGraphQL - 6.1.1A file created or updated with a
urlon Coevera's own file storage host is treated as a stored file instead of being downloaded again.RESTGraphQL - 6.1.0An opportunity or quote update that sets a required field to
nulltogether withproduct_relationsgets a validation error and changes nothing, instead of a server error or a partial write.RESTGraphQL - 6.1.0Restoring a deleted revenue schedule on a won or lost opportunity is accepted instead of refused with code
2002.RESTGraphQL - 6.1.0
ForecastEntity.targetGoalreturns0for a target period with an open end instead of an error.GraphQL - 6.1.0
bulkUpdateAppointmentwithlinkAttendees: truematches attendee e-mails to users, contacts and accounts ignoring case.GraphQL
Release 6.0
- 6.0.3
- 6.0.0
Changed
OAuth refresh, introspection and revocation accept body credentials
The refresh-token grant of POST /oauth2/app/token, POST /oauth2/app/introspection and
POST /oauth2/app/revocation accept client_id and client_secret in the form body
(client_secret_post) as well as in HTTP Basic. The client-credentials grant still takes HTTP
Basic only.
AI Smart Fields update records after they are written
When a record is created or updated, also through the API, its AI Smart Fields that update on
create or on update are filled shortly afterwards by the application AI Smart Field, so an
integration sees a later modification with its own webhook events. In this release it applies
only with the AI Smart Field item of the Automation Hub, where the space's AI setting and the
role's access_ai_smart_field allow it.
Several OAuth tokens per application, and revocation is immediate
- Tokens of one OAuth application in one space no longer revoke each other; a refresh revokes only the token pair it refreshes.
- A token revoked through
POST /oauth2/app/revocationis refused at once with code128. - A token granted both
<scope>.fulland<scope>.readkeeps write access. - The introspection response (
POST /oauth2/app/introspection) hasuser_id,nullfor an application token. - Authorization through a
coevera.comregional host works.
Added
aiOptions on system fields
GraphQL updateField accepts aiOptions on system fields too.
AI Smart Field options on fields
Fields have ai_options (FieldEntity.aiOptions): whether the field is an AI Smart Field, its
prompt and data sources, and when its value is updated. REST returns it read-only, and GraphQL
writes it through aiOptions on createField and updateField for text, number, e-mail,
phone, URL and currency fields (code 117 on other types).
Roles control AI reports, automations and online forms
MasterRights have access_ai_reports, access_ai_automatizer and access_ai_online_forms
(accessAiReports, accessAiAutomatizer, accessAiOnlineForms), Booleans that default to
true.
AI credits on text messages
TextMessageEntity.creditInfo gives the AI credits spent on an AI-written text message
(status InProgress or Finished, and value), or null.