Changelog

Changes and updates to the Open API. This API is currently in beta — breaking changes may occur between versions.

v0.30.0 — July 2026

  • Form responses now include a media array with the files uploaded with the submission (images, videos and documents), each carrying a direct download url — in the response endpoints and the formresponse.* webhook payloads (additive)
  • On anonymous responses the files are stored encrypted, so url is a short-lived signed link (expires after ~5 minutes) — re-fetch the response for a fresh one

v0.29.0 — July 2026

  • Users now include first_name and last_name as separate fields alongside name, plus date_of_birth (null unless collected)
  • hired_at now returns the effective hire date: a manual CMS override wins over the synced value
  • Users expose manager info: a top-level is_manager flag and a per-membership is_manager flag on each entry in groups[]
  • Groups returned by the /groups endpoints now include a managers array (id + name) — not included where groups are embedded in other payloads
  • Docs: corrected the users type example value (default, not user) and documented the existing since filter on users and groups

v0.28.0 — July 2026

  • Added Staff Cards endpoints (read:staff_cards, write:staff_cards scopes): full CRUD for the informational cards shown in the employee app — mirroring the CMS staff cards management. Cards are created as drafts by default
  • Cards are targeted via groups (departments, professions and custom groups mixed in one array) and/or individually assigned users; publishing (is_published: true) notifies targeted employees, exactly like the CMS publish button
  • Cards support a translatable title, an expiry (expires_date/expires_time), manager visibility, and a QR code image via media_ids
  • Personal cards: type: personal creates a card belonging to exactly one user (no groups) — e.g. a digital business card. qr_data generates a QR code image server-side, attached as media tagged qr_code. List filterable via ?type=
  • Rich card content is managed through the card's article_id via the articles endpoints — or attach a pre-built standalone article at create time

v0.27.0 — July 2026

  • Added Forms and Form Responses endpoints (read:forms, read:formresponses scopes): list forms, page through a form's responses, fetch single responses with full context, and a GET /formresponses?since= bulk feed for external dashboards and sync
  • Detail payloads embed the form, the shared public_comments thread (incl. media attachments), and staff-only internal_comments
  • The bulk feed's since filters on updated_at — one poll captures new, edited, status-changed, and newly-commented responses. Public comments now bump their response's updated_at, like internal notes already did
  • Whistleblower forms are completely excluded — never listed, always 404; anonymous responses keep respondent and comment author as null
  • Form response comment payloads (API and the formresponse.comment.* webhooks) now include a media array with the comment's attachments (additive)

v0.26.0 — July 2026

  • Added Feedback endpoint: POST /feedback sends feedback on the Open API straight to the Monotree team — feature requests, bug reports, anything. No scope required; any valid token works

v0.25.0 — July 2026

  • Added Handbooks and Courses endpoints (read:/write:handbooks, read:/write:courses scopes): CRUD for both containers and their chapters — create a draft, add chapters (each owning an article), publish when ready. Publishing notifies targeted employees
  • Added Articles endpoints (read:articles, write:articles scopes): the shared rich-content structure. Read an article's typed elements and bulk-save the complete element list via PUT /articles/{id}/elements; read-only elements (reference, gif) are never deleted by bulk saves
  • Element types: paragraph (markdown), header, image_gallery, video_gallery, document — media is referenced from the existing POST /media flow
  • Added GET /articles/{id}/markdown — any article flattened to a single markdown document (?locale= supported)
  • Announcements, events, calendar entries and certificates now expose their article_id, so the articles endpoints can manage their rich content too
  • Articles are fully translatable: every text field carries a field-keyed translations object on read and write — writing a translation activates that locale on the owning content. Handbooks and courses accept the same translations object for their own title/subtitle
  • The body convenience field on announcements, events and calendar entries now returns 422 instead of silently replacing rich article content. Existing integrations are unaffected: creating with body and updating content whose article was built by body itself keep working unchanged
  • Create standalone articles via POST /articles and attach them with article_id when creating announcements, events, and calendar entries — content is complete the moment it goes live
  • Added is_published to POST /announcements and POST /calendar-entries (default true — behavior unchanged): create drafts with is_published: false and publish later via update. Events already supported this

v0.24.0 — July 2026

  • Added Calendar Event Types endpoints (read:calendar_event_types, write:calendar_event_types scopes): list, create, and update the event types that categorize calendar entries — names are translatable per locale via a translations object
  • Calendar entries now accept calendar_event_type_id on create and update; when omitted on create, the default event type is used
  • Calendar entry responses now include the entry's calendar_event_type
  • PATCH /calendar-entries/{id} is now accepted alongside PUT
  • Added GET /locales (read:locales scope): the platform's active languages as a map of locale code to name, plus the default content locale — the valid keys for translatable fields

v0.22.0 — June 2026

  • Added direct messages (write:chat_messages scope): POST /users/{id}/messages sends a direct message to a single user's private chat, delivered by a bot user (the 1:1 room is created on first use and reused afterwards)
  • New direct_message incoming webhook action — deliver a webhook payload to one user's private chat; a bot user is always the sender
  • Added Bots endpoints (read:bots, write:bots scopes): create and manage the bot users that send direct messages and power incoming webhooks
  • Added Incoming Webhook management endpoints (read:incoming_webhooks, write:incoming_webhooks scopes): create, read, update, and revoke incoming webhooks programmatically — the trigger URL and token are returned once on create, and webhooks are scoped to the token that created them

v0.21.0 — June 2026

  • Added Webhook Management endpoints (read:webhooks, write:webhooks scopes): create, read, update, revoke, activate/deactivate, and test outgoing webhook endpoints programmatically — the same capabilities as the CMS Outgoing Webhooks tab
  • Choose events per endpoint and optionally filter entity-scoped events (post/comment events by wall, form response events by form)
  • Configure delivery auth (bearer_token, basic_auth, api_key) and custom headers; secrets, credentials, and header values are encrypted at rest and never returned (fetch the signing secret once via GET /webhooks/{id}/secret)
  • Endpoints are scoped to the token that created them; removing an endpoint is a revoke (history is preserved), matching the CMS

v0.20.0 — June 2026

  • Added form response comment webhook events: monotree.formresponse.comment.created, monotree.formresponse.comment.deleted
  • Fire when a public comment is created or deleted on a form response. Internal staff notes do not trigger webhooks
  • Filterable by form (select one or more forms when subscribing); whistleblower forms never dispatch
  • The comment payload's author is null when written by the respondent on an anonymous form — managers/owners are always identified

v0.19.0 — June 2026

  • Added Certificates endpoints (read:certificates, write:certificates scopes): full CRUD for certificate templates, plus assign, reset/expire, list holders, and a user's certificates
  • Added Certificate Types endpoints (read:certificatetypes, write:certificatetypes scopes): full CRUD for certificate categories
  • Assigning mirrors the in-app bulk assignment; "removing" a certificate from a user is the reset/expire operation (history is preserved, matching the platform)
  • Certificate templates and types are created as drafts by default; pass is_published: true to publish
  • Update endpoints accept both PUT and PATCH

v0.18.0 — June 2026

  • Added a status query parameter to list endpoints — published (default), draft, or all — on announcements, events, calendar entries, posts, and surveys
  • published returns only currently-live content; draft returns unpublished items (including those awaiting a scheduled publish); all returns everything. An unrecognised value returns 422
  • Breaking: GET /walls/{wall_id}/posts and GET /surveys previously returned drafts; they now return only published content by default. Pass status=draft or status=all to include drafts. (Posts created via the API are published immediately, so this mainly affects draft survey templates.)
  • Single-item endpoints (GET /{resource}/{id}) are unchanged — they still return an item regardless of its publication state
  • Certificates are not exposed via the Open API, so the status filter does not apply to them

v0.17.0 — June 2026

  • Breaking: events are now created as drafts by default. Previously POST /events always published immediately
  • Added is_published to POST / PUT /events — set true to publish, false to unpublish (back to draft)
  • Added publish_at to POST / PUT /events — schedule a draft to publish at a future time (mirrors the in-app scheduled publishing). Must be a future timestamp; takes precedence over is_published
  • Send publish_at: null on update to cancel a pending schedule; scheduling an already-published event returns 422
  • Event responses now include a scheduled_at field — the time a scheduled draft will go live, or null
  • Drafts and scheduled events are excluded from GET /events but remain fetchable via GET /events/{id}

v0.16.0 — June 2026

  • Form response webhook payloads (monotree.formresponse.created, monotree.formresponse.updated) now include choice and user field selections in field_responses — previously those field types were delivered with an empty value
  • choices fields serialize as an array of { id, title }; users and department_users fields serialize as an array of user objects, matching the respondent shape
  • Documented the full form response webhook payload, including the per-field-type value shapes

v0.15.0 — June 2026

  • Added monotree.formresponse.alarm_triggered webhook event (filterable by form)
  • Fires when a submitted form response matches a configured field alarm rule
  • Each alarm rule fires its own delivery — idempotent per response + rule pair (never fires twice for the same match)
  • Payload includes the full form response and the triggered alarm (rule name, operator, value, matched field)
  • Whistleblower forms are excluded, matching other form response events

v0.14.0 — June 2026

  • Added Academy statistics endpoints (read:stats scope) that mirror the CMS academy figures
  • Aggregate: GET /stats/academy/onboarding, GET /stats/academy/courses, GET /stats/academy/journeys (all accept an optional group_ids filter)
  • Quiz performance: GET /stats/academy/quizzes/{quiz_id} — per-question respondents, passed and pass rate
  • Per-user progress: GET /stats/academy/users/{user_id}/courses and GET /stats/academy/users/{user_id}/onboarding for HR / LMS integrations

v0.13.0 — May 2026

  • Added Surveys read endpoints (read:surveys scope): GET /surveys, GET /surveys/{id}
  • Added Survey answers endpoints keyed by template id: GET /surveys/{template_id}/answers and GET /surveys/{template_id}/answers/{id} — mirrors the CMS Excel export
  • Each answer embeds its spawn (id + starts_at), question, and choice so consumers can interpret rows without separate lookups
  • Filters: since, until (created_at), spawn_starts_at; per_page raised to 100 for bulk pulls
  • Anonymous surveys: spawns below survey_respondents_threshold (default 3) are suppressed entirely, matching the export's privacy contract

v0.12.0 — May 2026

  • User responses now include an avatar_url field — direct URL to the user's profile picture, or null if none is set
  • Affects GET /users, GET /users/{id}, and embedded user objects on posts, comments, announcements, events, calendar entries, form responses, and monotree.user.registered / monotree.onboarding.completed webhooks

v0.11.0 — April 2026

  • Added Media upload endpoints (write:media scope): POST /media and GET /media/{id}
  • Extended POST /walls/{wall_id}/posts with optional media_ids array — upload first, then attach by id
  • Incoming webhook wall_post and chat_message actions now accept an optional media array of URL + type pairs (server fetches URLs)
  • Supported media types: image, video, document. Max 10 per post/message, same type across the batch

v0.10.0 — April 2026

  • Added monotree.formresponse.updated webhook event (filterable by form)
  • Fires when a form response's status, deadline, visibility/archive flag, or assignees change
  • Does not fire on initial creation (use formresponse.created) or on unrelated activity like comments/notes
  • Whistleblower forms are excluded, matching the existing formresponse.created behavior

v0.9.0 — April 2026

  • Added Comments CRUD endpoints on posts (read:comments, write:comments scopes)
  • New endpoints: GET/POST /posts/{post_id}/comments and GET/PUT/DELETE /posts/{post_id}/comments/{id}
  • Added monotree.comment.created, monotree.comment.updated and monotree.comment.deleted webhook events (filterable by wall)
  • Comment updates are restricted to the author within 30 minutes of creation

v0.8.0 — April 2026

  • Outgoing webhooks now support resource filtering — optionally select specific forms or walls per event type
  • Form response webhooks can be scoped to specific forms (multi-select)
  • Post created webhooks can be scoped to specific walls (multi-select)
  • Default remains "all" — no filter means you receive all events of that type
  • Added filters field to webhook create/update API

v0.7.0 — April 2026

  • Added Calendar Entries CRUD endpoints (read:calendar_entries, write:calendar_entries scopes)
  • Create, update, and delete calendar entries with optional body and group targeting
  • Added Create calendar entry action for incoming webhooks

v0.6.0 — April 2026

  • Added Events CRUD endpoints (read:events, write:events scopes)
  • Create, update, and delete company events with date, time, location, and group targeting
  • Events are automatically published and added to the calendar on creation

v0.5.0 — March 2026

  • Added Statistics read-only endpoints (read:stats scope)
  • User summary: total, registered, active and new users (yesterday/7d/30d)
  • Engagement: time series with active users, app time, sessions — filterable by granularity, period count, and group
  • Adoption rate: per-department active/total employees percentage — filterable by group
  • Content activity: posts, comments, reactions, chat messages, completed todos — this week vs last week
  • All statistics responses are cached server-side (1h–24h) for performance

v0.4.0 — March 2026

  • Added Walls read-only endpoints with group associations (read:walls scope)
  • Post endpoints now nested under walls: /walls/{wall_id}/posts
  • Added Timestamp header to outgoing webhooks for replay attack prevention
  • Webhook signatures now include the timestamp: HMAC-SHA256(timestamp + "." + payload, secret)
  • Added bot user avatars for incoming webhooks (defaults to app icon)
  • Outgoing webhooks now use revoke instead of delete
  • Incoming webhooks now use unified text field for all actions
  • Added Pagination section to documentation with meta and links format
  • Added incoming webhook rate limiting documentation

v0.3.0 — March 2026

  • Added Users read-only endpoints (read:users scope)
  • Added Groups read-only endpoints (read:groups scope)
  • Added monotree.user.registered webhook event
  • Added monotree.onboarding.completed webhook event
  • Added monotree.formresponse.created webhook event
  • Added IP whitelist per token
  • Added configurable rate limit with rate limit response headers
  • Added usage counters on tokens, outgoing webhooks, and incoming webhooks
  • Added content author selection (bot user or yourself) on incoming webhooks
  • Added Test Webhook buttons for outgoing and incoming webhooks
  • Added signature verification documentation with Node.js example

v0.2.0 — March 2026

  • Added Announcements CRUD endpoints (read:announcements, write:announcements scopes)
  • Added Create post on wall action for incoming webhooks
  • Added monotree.announcement.published webhook event

v0.1.0 — March 2026

  • Initial beta release of the Open API
  • Bearer token authentication with scoped permissions
  • Posts CRUD endpoints (read:posts, write:posts scopes)
  • Outgoing webhooks with HMAC-SHA256 signing for post events
  • Incoming webhooks for sending messages to chat rooms
  • API request logging and webhook delivery logging
  • Rate limiting at 60 requests per minute per token
  • CMS admin interface for managing tokens, webhooks, and logs