Skip to main content

Changelog — v0.2

Release Date: May 2026

New Features​

Credentials Management​

Secure, encrypted storage for secrets referenced in service task headers.

  • POST /v1/credentials — create a credential (value never returned)
  • GET /v1/credentials — list credential metadata
  • GET /v1/credentials/:name — get credential metadata by name
  • PATCH /v1/credentials/:name — rotate a credential value
  • DELETE /v1/credentials/:name — soft-delete a credential
  • Credentials encrypted at rest with AES-256-GCM
  • Reference credentials from taskHeaders using {{credentials.name}}
  • Credential value is resolved at execution time and never written to logs, audit records, or webhook payloads
  • Requires credentials:read / credentials:write scopes

See Credentials.

Monitoring API​

Operational metrics for observing process health in real time.

  • GET /v1/monitoring/summary — instance, task, service job, timer, and webhook counts for the authenticated tenant (no special scope required)
  • GET /v1/monitoring/system — cross-tenant aggregated metrics (requires admin scope)
  • GET /metrics — Prometheus-formatted metrics endpoint for internal scraping

See Monitoring.

Process & Decision Rollback​

Atomically reactivate a previous definition version without disrupting running instances.

  • POST /v1/definitions/:key/rollback — roll back to a previous process definition version
  • POST /v1/decisions/:key/rollback — roll back to a previous decision definition version
  • Rollback is atomic: switches is_active in a single operation
  • Running instances remain bound to their original version
  • Next PUT after rollback uses MAX(version)+1 to avoid collision

See Process Versioning.

Mermaid Preview​

Visualize process definitions as Mermaid flowcharts.

  • GET /v1/definitions/:key/preview.mermaid — returns a Mermaid diagram as text/plain
  • Optional ?version=N to preview a specific version

See Defining Processes.

BPMN Auto-Layout​

Apply automatic layout to BPMN XML exports.

  • GET /v1/definitions/:key/xml?layout=true — applies bpmn-auto-layout before returning the XML
  • Compatible with bpmn.io and Camunda Modeler
  • Without ?layout=true, the raw stored XML is returned

See Defining Processes.

Decision Evaluation History​

Full audit trail for every decision evaluation.

  • GET /v1/decisions/:key/evaluations — list evaluations with filters (instance_id, from, to, version, limit)
  • GET /v1/decisions/:key/evaluations/:eval_id — retrieve a specific evaluation
  • Evaluations from businessRuleTask in processes are automatically saved with instance_id and element_id
  • Each evaluation record includes decision_hash (SHA-256) linking it to the exact version at evaluation time

See Decision Models.

source_hash for Audit​

Every process and decision definition version now includes a source_hash — a SHA-256 digest of the original source content.

  • Returned in every GET, POST, and PUT response for definitions and decisions
  • For process instances, definition_hash is stored at startup and links the instance to the exact source that was deployed
  • Enables verifying that an instance ran on an unmodified version of a definition

Email Verification for Registration​

Tenant registration is now a two-step process to verify email ownership.

  • POST /v1/register — creates a pending tenant and sends a 6-digit verification code to the provided email
  • POST /v1/register/verify — verifies the code and activates the tenant; returns the initial API key (once only)
  • Codes expire after 10 minutes; up to 5 verification attempts per code

See Authentication.

Redis-Based API Key Cache​

API keys are now cached in Redis to reduce database load on every request.

  • Default TTL: 60 seconds (configurable via REDIS_AUTH_CACHE_TTL_MS)
  • Revoked keys remain valid for up to the cache TTL after revocation
  • Enables horizontal scaling of API workers

Improvements​

  • Token execution hashes added for deeper audit trails
  • DMM evaluation IDs are globally unique and retrievable after the fact
  • correlation_id support on instance creation for linking to external entities

Known Limitations​

  • No web UI for process management (planned for Phase 3)
  • No SDK clients (planned for Phase 3)
  • No i18n support (planned for Phase 3)