Changelog

This page highlights the latest developer-facing enhancements. For detailed API references, see the API Reference section.

July 2026 — Finance Tier Access Control

Finance document types and actions are now gated by the client's Total Finance subscription tier. This affects the Public Data API, outbound webhooks, and API key scopes.

What's new

• New Public Data API actions:

  • generate-finance-document-pdf — Generate a PDF for any finance document (invoice, quote, credit note, purchase order, etc.)
  • convert-finance-document — Convert one finance document type to another (e.g. quote → invoice)
  • See Public Data API — Finance for full parameter details

• Server-side tier enforcement:

  • The generate-finance-document-pdf and convert-finance-document API actions return 403 Forbidden (TIER_RESTRICTED) if the requested document type is not included in the client's subscription tier
  • Both source and target document types are validated for conversion actions

• Client-side tier filtering:

  • Public Data API Manager: Finance document actions (generate-finance-document-pdf, convert-finance-document, and list-* finance actions) are hidden if the document type is not allowed by the client's tier
  • Outbound Webhook Modal: Financial event category events (e.g. invoice.created, quote.paid) are filtered to only show events for allowed document types
  • API Key Modal: Finance Documents scope category scopes (e.g. invoices:read, credit_notes:write) are filtered to only show scopes for allowed document types

• New error code: TIER_RESTRICTED (HTTP 403) — Returned when a finance document type is not allowed by the client's subscription tier

Affected document types

The following finance document types are subject to tier restrictions: invoice, quote, credit_note, debit_note, purchase_order, delivery_note, proforma, sales_order, supplier_invoice, supplier_quote, supplier_credit, expense, billing_submission, waybill, rma, grn, purchase_requisition, rfq, purchase_return, work_order, picking_slip, packing_slip, stock_adjustment, transfer_order.

See Finance Tier Restrictions for the full table and more details.

July 2026 — Work Item Comment Webhooks

Webhook events are now triggered for all work item comment lifecycle actions. Previously, only work_item.comment_added was listed in the event catalog but never actually fired. Now all four comment events are fully wired:

New events

Payload structure

All comment webhook payloads include the full work_item object and the comment object. The comment_visibility_changed event additionally includes old_visibility and new_visibility objects with is_internal and comment_type fields.

See the Event Catalog for full payload examples.

Implementation notes

• Webhook triggers are fire-and-forget — API responses are not blocked by webhook dispatch
• The triggerWebhooks infrastructure with BullMQ queueing and retry logic is reused from existing work item events
• Billing and Total Finance comments are excluded from visibility change webhooks (they are immutable)

July 2026 — AI Agent & MCP Bridge

Total Access now exposes its data and actions to AI agents through a lightweight Model Context Protocol (MCP) adapter built on top of the existing Public Data API. No new business logic was introduced; the bridge reuses the existing API-key authentication, scopes, rate limiting, and audit logging.

What's new

• New endpoint: GET /api/v1/public/data/tools

  • Returns the Public Data API action catalog as tool definitions.
  • Supports two formats:
    • ?format=mcp — Model Context Protocol tool schemas (default)
    • ?format=openai — OpenAI / Anthropic function-calling schemas

• New endpoint: POST /api/v1/public/mcp

  • Stateless JSON-RPC adapter for MCP.
  • Supported methods: initialize, tools/list, tools/call, notifications/initialized, notifications/cancelled.
  • Translates MCP tools/call requests into POST /api/v1/public/data calls.

• UI integration

  • The Public Data API Manager now includes an AI Agent / MCP Setup card.
  • Copy a ready-to-use MCP server config and a curl command for listing tools.

• Authentication and rate limiting

  • The bridge inherits all Public Data API security:
    • X-API-Key header
    • Per-action scopes
    • 100 requests/minute per API key
    • api_usage audit logging

Example: list tools with curl

curl -G 'https://totalaccess.co.za/api/v1/public/data/tools' \
  -H 'X-API-Key: ta_sk_...' \
  -d 'format=mcp'

Example: MCP initialize call

curl -X POST 'https://totalaccess.co.za/api/v1/public/mcp' \
  -H 'Content-Type: application/json' \
  -H 'X-API-Key: ta_sk_...' \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "initialize"
  }'

See the full AI Agent & MCP Bridge documentation for request/response examples and security best practices.

July 2026 — Developer Enhancement Phase 1

OpenAPI 3.1 Specification

A machine-readable OpenAPI 3.1 specification is now available:

• GET /api/v1/openapi.json — Spec served as JSON
• GET /api/v1/openapi.yaml — Spec served as YAML

Covers all Public Data API actions, REST endpoints, webhook schemas, error responses, security schemes, and CORS headers. CI linting via Spectral validates the spec on every PR.

API Versioning

Formal versioning policy with header-based minor version negotiation:

• X-API-Version header — Date-based minor version (e.g. 2026-07-01)
• X-API-Version response header — Echoes the negotiated version
• meta.api_version — All Public Data API responses now include the API version in the meta object
• Sunset / Deprecation headers — Emitted on deprecated operations
• See Versioning for the full policy

Idempotency Keys

Prevent duplicate side effects from retried requests:

• Idempotency-Key header — Accepted on all mutating Public Data API actions
• 24-hour TTL — Cached responses replayed with X-Idempotent-Replay: true header
• 409 Conflict — Same key with different request body returns IDEMPOTENCY_CONFLICT
• Outbound webhooks — All webhook deliveries now include Idempotency-Key: evt_<uuid> header
• See Idempotency Keys for usage details

Error Code Reference

Comprehensive error catalog with HTTP status, code, description, causes, and resolution steps:

• Standardized error envelope with request_id and documentation_url
• See Error Codes for the full catalog

CORS Policy

Documented CORS policy with allowed origins, headers, methods, and preflight cache configuration:

• Added Idempotency-Key and X-API-Version to allowed headers
• Exposed rate limit, idempotency replay, version, sunset, and deprecation headers
• See CORS Policy for details