Public API Changelog

/public/v1 follows an additive-first policy — see Versioning. This page lists what's shipped, newest first.

September 2026#

• Added outbound webhooks: subscribe to recommendation_approved, recommendation_dismissed, anomaly_acknowledged, fix_applied, fix_failed, and fix_rolled_back, with HMAC-signed deliveries and automatic retry. See Webhooks.
• Added official JavaScript/TypeScript (@aezona/costlens-sdk) and Python (aezona-costlens-sdk) client libraries. See SDKs.
• Added a permanent Sandbox mode — a synthetic-data-only demo organization for building against /public/v1 without a real cloud account. See Sandbox mode.
• Added the Auto-Fix domain: GET /autofix, GET /autofix/{id}, GET /autofix/{id}/status, POST /autofix/{id}/approve, POST /autofix/{id}/reject, POST /autofix/{id}/rollback (scope fixes:write).
• Added the Realized Savings domain: GET /savings/breakdown, /effectiveness, /audit, /timeline (scope savings:read).
• Added the Cloud Inventory domain: GET /inventory/resources, /asset, /findings (scope inventory:read).
• Added the Forecast domain: GET /forecast/{account_id}, GET /forecast/by-service (scope forecast:read).
• Added the Aevi Insights domain: GET /insights, POST /insights/refresh (scopes insights:read/:write).
• Added a dedicated, always-on interactive API reference at /public/v1/docs, separate from the internal app's DEBUG-only docs.
• Added per-request access logging and a GET /api-credentials/access-log endpoint for admins to see which keys have called what.
• Added rate limiting: a 60-req/60s burst cap and a monthly quota, both reported via X-RateLimit-* response headers.
• Added the Anomalies domain: GET /anomalies, GET /anomalies/{id}, GET /anomalies/{id}/drivers, PATCH /anomalies/{id}/acknowledge (scopes anomalies:read/:write).
• Launched /public/v1 with the Recommendations domain: GET /recommendations, GET /recommendations/{id}, PATCH /recommendations/{id}/approve, PATCH /recommendations/{id}/dismiss (scopes recommendations:read/:write) — the first /public/v1 endpoints, proving the full auth/scope/rate-limit/audit stack end to end.
• Launched self-service API key management in Settings → API Access — create, rotate, and revoke keys without contacting support.