# Changelog

> Dated changes to the EntryBit API — new endpoints, scopes, and behavior. Newest first.

Notable changes to the EntryBit API, newest first. Breaking changes are called out explicitly; additive changes (new endpoints, new optional fields, new scopes) are not breaking. Machine-readable history lives in the [OpenAPI spec](/docs/api-reference/openapi/).

## 2026-07 — Organization member directory

- **Member directory endpoints.** [`GET /api/v1/org/members`](/docs/api-reference/organization/) and `GET /api/v1/org/members/{public_id}` — read who is in the organization, keyset-paginated, with Graph-style `fields` selection over a basic tier (name, title, department) and a contact tier (`email`, `phone`).
- **New scopes.** `org:members:read` (basic fields) and `org:members:contact:read` (adds contact fields) for API keys, and the user-delegated `members:read` for OAuth apps — see [Scopes](/docs/oauth/scopes/).

## 2026-07 — Initial public release

The first public release of the EntryBit developer platform. Shipped:

- **OAuth 2.0 / OpenID Connect provider.** A full authorization server with the authorization-code flow and **PKCE (S256) required for every client**. Endpoints: [`/api/oauth/authorize`](/docs/oauth/authorize/), [`/api/oauth/token`](/docs/oauth/token/), [`/api/oauth/userinfo`](/docs/oauth/id-token-userinfo/), [`/api/oauth/introspect`](/docs/oauth/introspection-revocation/), [`/api/oauth/revoke`](/docs/oauth/introspection-revocation/), and RP-initiated [`/api/oauth/logout`](/docs/oauth/logout/). RS256 signing, rotating refresh tokens with reuse detection, and `iss` (RFC 9207) on all authorization responses.
- **Discovery & JWKS.** [`/.well-known/openid-configuration`](/docs/oauth/discovery-jwks/) (and the RFC 8414 alias) plus [`/.well-known/jwks.json`](/docs/oauth/discovery-jwks/) for offline token verification.
- **The `/api/v1` resource API.** User-delegated [passes](/docs/api-reference/passes/) (`list`, `create`, `get`, `revoke`) and [invitations](/docs/api-reference/invitations/), Bearer-authenticated with `passes:*` and `invites:read` scopes.
- **Organization API keys.** Server-to-server [`/api/v1/org/*`](/docs/api-reference/organization/) endpoints (org-wide passes + facilities) authenticated with `eb_sk_…` [keys](/docs/api-keys/overview/) carrying least-privilege `org:*` scopes, with optional expiry and source-IP allowlists.
- **Self-service client registration.** Org admins register their own OAuth apps in **Settings → Team → OAuth apps** ([Register an app](/docs/oauth/register-an-app/)) — public or confidential, tenant-scoped, up to 50 per org.
- **OpenID Connect identity.** `id_token` with `amr` (how the user authenticated) and `auth_time`, scope-gated identity claims, and the [UserInfo](/docs/oauth/id-token-userinfo/) endpoint.
- **Published [OpenAPI 3.1 specification](/docs/api-reference/openapi/)** and LLM-friendly [`llms.txt`](/docs/resources/tools/) resources.