Changelog

Every change to the published API contract, pricing and SDKs. Generated from the committed contract itself, so it cannot drift from what the API actually does.

# Regulation to Control changelog

What changed in the public API — endpoints, request and response schemas,

authentication, error codes, plans, quotas and the base URL. Generated from

git history by npm run gen:changelog; edit the contract, never this file.

A commit that moved none of those things moved nothing you can observe, so it

gets no entry here.

2026-08-31 · cc31023

Customer account portal, key lifecycle, and the money path that never worked

Endpoints

• Added GET /v1/keys — List your API keys for this API
• Added POST /v1/keys/claim — Exchange an emailed claim token for the API key (no API key required)
• Added POST /v1/keys/{id}/revoke — Revoke one of your API keys
• Added POST /v1/keys/{id}/rotate — Replace one of your API keys with a new secret

Requests and responses

• POST /v1/keys request: added name.
• POST /v1/keys response: added status, email, expiresAt, next, message; removed apiKey, accountId, product, quotaPerPeriod, plan, warning, usage.

Base URL

• Base URL is now https://controlgraph-api.com (was https://web-production-7c170.up.railway.app).

SDKs

• Python client SDK updated.
• TypeScript client SDK updated.

Documentation

• POST /v1/keys summary and description revised.

2026-08-31 · 1ddbbcd

Add usage endpoint, docs playground, changelog, and a completeness audit

Endpoints

• Added GET /v1/usage — Your consumption and remaining allowance for this period

2026-08-31 · a726f08

Make the site build self-contained, and set the real contact address

Plans and quotas

• Plans published. Billed per mapped change.

| Plan | Per month | Included mapped changes | Additional | Overage cap |

| --- | --- | --- | --- | --- |

| Developer | $499 | 500 | $1.50 each | $1,000 |

| Growth | $1,999 | 2,500 | $1.10 each | $4,000 |

| Scale | $5,000 | 8,000 | $0.80 each | $10,000 |

| Enterprise | $10,000 | 25,000 | $0.50 each | $20,000 |

2026-08-31 · 0ec73e8

Stamp the deployed origin into the contract, and pin it with tests

Base URL

• The contract now names the deployed origin https://web-production-7c170.up.railway.app. Generated clients built from an earlier copy point at nothing.

2026-08-31 · e2c949c

Cleanup release: truthful docs, a twelve-spoke colour wheel, layout fixes

SDKs

• TypeScript client SDK updated.

2026-08-31 · 62687c3

Regulation-to-Control Graph API: regulatory change to control impact

Endpoints

• First published contract, 8 operations:
• GET /health — Liveness and deployed version (no API key required)
• GET / — Service index — endpoints, auth and error format (no API key required)
• POST /v1/changes — Map regulatory changes onto your obligations, controls, evidence and deadlines
• POST /v1/demo/map — Public demo — map one change with no API key (no API key required)
• GET /v1/obligation-types — The code catalogue: obligation types, evidence kinds, findings and the priority weights (no API key required)
• POST /v1/checkout — Start a hosted Square checkout for a paid tier (no API key required)
• POST /api/billing/webhook — Square billing events, forwarded by the shared hub (no API key required)
• POST /v1/keys — Create a free sandbox API key (no API key required)

Authentication

• Keys are sent as bearer authorization, or as the x-api-key header.

Errors

• Errors return a machine-readable error.code: invalid_api_key, missing_api_key, quota_exceeded, rate_limited, invalid_request, not_found, method_not_allowed, payload_too_large, conflict, internal_error.

Plans and quotas

• Free sandbox keys allow 50 mapped changes per period, no card required.

SDKs

• Python client SDK published.
• TypeScript client SDK published.

Derived from the committed openapi.json, site/pricing.json, the

SANDBOX_QUOTA enforced in src/index.ts, and sdk/. Dates are commit dates.

Base-URL entries ignore loopback origins: those are written by the contract

generator when it runs without BASE_URL and were never addresses anyone

could call.