Skip to main content

API changelog

The AIR HTTP API is pre-1.0 and unversioned — paths do not include a version prefix. Breaking changes are announced here before deploy.

2026-07-07 — Domain-scoped API keys​

What changed

  • API keys are scoped to a domain, not an entire organization.
  • Service account and key management is per domain in the portal.
  • Each key can access only resources in the domain where it was created.

What integrators should do

  1. Sign in at https://air.thalus.ai and create a new key in each domain you automate against.
  2. Call GET /domains/ to confirm which domain your key belongs to.
  3. Use GET /domains/<domainPid>/projects to list projects — do not assume org-wide access.

See Authentication and Getting started.

2026-07-06 — API key scope enforcement​

What changed

  • Integrator routes check per-key scopes (projects:read, assessments:write, etc.).
  • Key creation requires a non-empty scopes array.
  • Write scopes imply read on the same resource.
  • integrations:full grants all integrator scopes.

What integrators should do

  1. Review existing keys in the portal.
  2. If you receive 403 with API key missing required scope: …, create a new key with the scopes from Recommended presets.

2026-07-06 — Service-account integrator access​

What changed

  • Bearer API keys can call projects, assessments, domains, search, and portfolio endpoints.
  • Async work is tracked by polling document and assessment status.

What integrators should do

  • Use Async jobs for upload → assess → report automation.

2026-07-06 — Initial public documentation​

What changed