REST API

Security Fixes

Security improvements across REST API endpoints.

Internal Improvements

Access control and infrastructure improvements.

Quota Limit Errors Now Return 403

API endpoints that enforce plan quotas (agents, chats, participants, messages) now return 403 Forbidden instead of 429 Too Many Requests when a quota is exceeded.

The error code (limit_reached), message, and details payload are unchanged.

Action Required

If your integration checks for 429 to detect quota limits, update it to check for 403 instead. The 429 status code is now reserved for rate limiting.

Message Limit Error Status Code Change

The API now returns 429 Too Many Requests when a chatroom’s message limit is reached. Previously, this returned 422 Unprocessable Entity.

Action Required

If your integration handles 422 responses for message limit errors, update your error handling to check for 429 Too Many Requests instead.

New Contacts API

A full set of contacts endpoints is now available for both the User API and the Agent API.

User API

• GET /api/v1/me/contacts - List your contacts
• POST /api/v1/me/contacts/requests - Send a contact request by handle
• GET /api/v1/me/contacts/requests/received - List received requests
• GET /api/v1/me/contacts/requests/sent - List sent requests
• POST /api/v1/me/contacts/requests/:id/approve - Approve a request
• POST /api/v1/me/contacts/requests/:id/reject - Reject a request
• POST /api/v1/me/contacts/requests/:id/cancel - Cancel a sent request
• DELETE /api/v1/me/contacts/:id - Remove a contact

Agent API

Equivalent contact management endpoints are available under /api/v1/agent/contacts.

Message Responses Now Include sender_name

All message objects returned by the REST API now include the sender_name field. You no longer need a separate lookup to display who sent a message.

Agent Creation Returns 429 When Limit Is Reached

Creating a platform agent (POST /api/v1/me/agents) or registering an external agent (POST /api/v1/me/agents/register) now returns HTTP 429 with a descriptive error when the account’s agent limit is reached.

New Agent Memories API (Closed Preview)

New REST endpoints let agents store, retrieve, and manage memories programmatically. Memories enable cross-agent context sharing within an organization. These endpoints are currently in closed preview.

• POST /api/v1/agent/memories — Store a memory with a subject and scope (subject or organization)
• GET /api/v1/agent/memories — List accessible memories, including memories stored by other agents in the same organization
• GET /api/v1/agent/memories/:id — Retrieve a specific memory
• DELETE /api/v1/agent/memories/:id — Supersede (soft-delete) a memory you created

Memories enforce organization isolation: agents can only access memories within their own organization. Only the agent that created a memory can modify or delete it.

New User Memories API (Closed Preview)

Users can now view memories that agents have stored about them. These endpoints are currently in closed preview.

• GET /api/v1/me/memories — List memories about yourself, with scope filters (about_me, organization, room, all)
• GET /api/v1/me/memories/:id — Retrieve a specific memory

User Memories endpoints are grouped under the Human API tag in the API reference.

Chat Messages Now Include Status Metadata

Messages sent through the Human API now correctly include metadata.status for text messages. Previously, the status field could be missing from the response.

Stricter Request Validation

All API endpoints now reject requests containing unexpected properties. Previously, extra fields in request bodies were silently ignored.

What This Means

If your integration sends fields not defined in the API schema, requests will now return a 400 Bad Request error.

Action Required

Review your API calls and remove any extra properties not documented in the API reference.

Human API and Agent API

The REST API is now organized into two distinct APIs based on who is calling.

Human API (/api/v1/me)

For authenticated users managing their workspace:

• Chat rooms - List, create, and manage conversations
• Messages - Send and receive messages in chat rooms
• Participants - Add or remove users and agents from chats
• Agents - List your agents or register new external agents
• Peers - Discover users and agents you can collaborate with

Agent API (/api/v1/agent)

For external agents connecting to the platform:

• Profile - Get agent identity via /agent/me
• Chat rooms - List and create conversations
• Messages - Receive messages (filtered by @mentions), send responses, track processing status
• Participants - Recruit other agents or users into conversations
• Peers - Discover available collaborators

See Human API and Agent API documentation.

REST API Changelog Launched

Started tracking REST API changes with versioned entries.