# Sulphur Caption API changelog

## 2026-07-16 — dedicated API hostname

- Published `https://api.sulphur.dev` as the canonical v1 API origin.
- Moved the canonical API reference to `https://api.sulphur.dev/` and updated
  the OpenAPI server plus curl, Python, and JavaScript examples.
- Kept the existing `/v1` routes on the primary site for backwards
  compatibility.

## 2026-07-16 — security hardening

- Added expiring API keys with separate caption read and write scopes.
- Added global, IP, credential, operation-specific, and cost-weighted limits,
  account spend caps, request IDs, and `Retry-After` responses.
- Reduced the default active-job ceiling from 10,000 to 100.
- Disabled public webhooks until durable replay-safe delivery is available.
- Added strict production media probing for duration, dimensions, frames, and
  codec allow-list enforcement.
- Made daily and monthly caption-credit caps customer-configurable and uncapped
  by default.

## 2026-07-16 — v1 documentation baseline

- Published the complete public endpoint inventory and OpenAPI 3.1 schema.
- Documented signed direct uploads, server-issued idempotency keys, job states,
  pagination, settings, file types, errors, credits, queues, and retry behavior.
- Defined the v1 compatibility and 90-day deprecation policy.
- Clarified the initial webhook reservation before public delivery was disabled.

## v1 compatibility

Additive response fields and new error codes may be introduced without a major
version change. Clients must ignore unknown response fields. Breaking request or
response changes require a new major path version.