{
    "description": "Machine-readable changelog for the PhishFort Client API (capi.phishfort.com). Entries are ordered newest first. Types: added, changed, deprecated, removed, fixed, docs. Entries with \"breaking\": true altered an existing request or response contract. Also available via the get_changelog tool on the docs MCP server (https://api-docs.phishfort.com/mcp) and rendered at https://api-docs.phishfort.com/changelog/.",
    "latest": "2026-08-24",
    "entries": [
        {
            "date": "2026-08-24",
            "type": "added",
            "breaking": false,
            "title": "API changelog feed and MCP tool",
            "description": "Client API changes are available as a rendered changelog, a machine-readable JSON feed and the get_changelog tool on the Docs MCP server.",
            "endpoints": [],
            "docs": "https://api-docs.phishfort.com/changelog/"
        },
        {
            "date": "2026-08-24",
            "type": "fixed",
            "breaking": true,
            "title": "Consistent incidentClass values",
            "description": "incidentClass now uses the documented six-value vocabulary across incident responses and webhook payloads. Values are derived from the threat classification, and unclassified incidents return other instead of n/a.",
            "endpoints": [
                "GET /v1/incidents",
                "GET /v1/incident/{incidentId}"
            ],
            "docs": "https://api-docs.phishfort.com/structures/#incident-class"
        },
        {
            "date": "2026-08-24",
            "type": "docs",
            "breaking": false,
            "title": "statusVerbose deprecation date updated",
            "description": "The planned deprecation date for statusVerbose is December 25, 2026. Use status for filtering and reading the computed verbose status value.",
            "endpoints": [
                "GET /v1/incidents",
                "GET /v1/incident/{incidentId}"
            ],
            "docs": "https://api-docs.phishfort.com/incidents/"
        },
        {
            "date": "2026-08-12",
            "type": "added",
            "breaking": false,
            "title": "Optional author on incident comments",
            "description": "Adding a comment accepts an optional author email so the comment is attributed to the right person in your organization. Omitting it attributes the comment to the API key owner.",
            "endpoints": [
                "POST /v1/incident/{incidentId}/comment"
            ],
            "docs": "https://api-docs.phishfort.com/add-comment/"
        },
        {
            "date": "2026-08-10",
            "type": "added",
            "breaking": false,
            "title": "Approve takedowns via the API",
            "description": "New endpoint to approve a takedown that is waiting on your confirmation, as an alternative to approving from the dashboard.",
            "endpoints": [
                "POST /v1/incident/{incidentId}/approve-takedown"
            ],
            "docs": "https://api-docs.phishfort.com/approve-takedown/"
        },
        {
            "date": "2026-08-10",
            "type": "added",
            "breaking": false,
            "title": "Blocklist listings on incident detail",
            "description": "The incident detail response includes a new blocklists field showing which blocklist partners the threat has been submitted to and where it is actively listed.",
            "endpoints": [
                "GET /v1/incident/{incidentId}"
            ],
            "docs": "https://api-docs.phishfort.com/single-incident/"
        },
        {
            "date": "2026-08-05",
            "type": "added",
            "breaking": false,
            "title": "Credit usage endpoint",
            "description": "New endpoint returning your plan's credit usage and remaining balance.",
            "endpoints": [
                "GET /v1/usage"
            ],
            "docs": "https://api-docs.phishfort.com/usage/"
        },
        {
            "date": "2026-08-05",
            "type": "docs",
            "breaking": false,
            "title": "Incident snapshots endpoint documented",
            "description": "The endpoint returning page snapshots captured for an incident is now documented.",
            "endpoints": [
                "GET /v1/incident/{incidentId}/snapshots"
            ],
            "docs": "https://api-docs.phishfort.com/snapshots/"
        },
        {
            "date": "2026-08-04",
            "type": "added",
            "breaking": false,
            "title": "Technical insights on incident detail",
            "description": "The incident detail response includes a new insights field with technical detail about the threat, including hosting, page and capture indicators.",
            "endpoints": [
                "GET /v1/incident/{incidentId}"
            ],
            "docs": "https://api-docs.phishfort.com/single-incident/"
        },
        {
            "date": "2026-07-16",
            "type": "added",
            "breaking": false,
            "title": "Docs MCP server",
            "description": "This documentation site is available as an MCP server at https://api-docs.phishfort.com/mcp, so AI assistants can search pages, read full docs and fetch OpenAPI specs while helping you build an integration.",
            "endpoints": [],
            "docs": "https://api-docs.phishfort.com/mcp-server/"
        },
        {
            "date": "2026-07-08",
            "type": "added",
            "breaking": false,
            "title": "Total counts for incident lists",
            "description": "Passing includeTotal=true to the incident list returns the total number of matching incidents in paging.total.",
            "endpoints": [
                "GET /v1/incidents"
            ],
            "docs": "https://api-docs.phishfort.com/incidents/"
        },
        {
            "date": "2026-07-06",
            "type": "docs",
            "breaking": false,
            "title": "Clients and Documents endpoints documented",
            "description": "The endpoints for listing your client accounts and retrieving documents (including signed download URLs) are now documented.",
            "endpoints": [
                "GET /v1/clients",
                "GET /v1/documents",
                "GET /v1/documents/{documentId}",
                "GET /v1/documents/{documentId}/signed-url"
            ],
            "docs": "https://api-docs.phishfort.com/clients/"
        },
        {
            "date": "2026-06-30",
            "type": "added",
            "breaking": false,
            "title": "List users endpoint",
            "description": "New endpoint listing the dashboard users of your organization.",
            "endpoints": [
                "GET /v1/users"
            ],
            "docs": "https://api-docs.phishfort.com/list-users/"
        },
        {
            "date": "2026-06-16",
            "type": "added",
            "breaking": false,
            "title": "Author attribution on incident history",
            "description": "Incident history entries now identify who wrote each entry (a PhishFort analyst or a member of your organization) via the author classification documented in Data Structures.",
            "endpoints": [
                "GET /v1/incident/{incidentId}"
            ],
            "docs": "https://api-docs.phishfort.com/structures/"
        },
        {
            "date": "2026-05-27",
            "type": "docs",
            "breaking": false,
            "title": "Attachment and throttling limits clarified",
            "description": "The Limits page now states attachment size limits and request throttling behavior precisely.",
            "endpoints": [],
            "docs": "https://api-docs.phishfort.com/limits/"
        },
        {
            "date": "2026-03-12",
            "type": "added",
            "breaking": false,
            "title": "Webhooks",
            "description": "Webhook subscriptions deliver HTTP notifications for incident events (created, status changed, history added, takedown updated, action required), signed with HMAC-SHA256.",
            "endpoints": [
                "POST /v1/webhooks",
                "GET /v1/webhooks",
                "PATCH /v1/webhooks/{id}",
                "DELETE /v1/webhooks/{id}"
            ],
            "docs": "https://api-docs.phishfort.com/webhooks/"
        },
        {
            "date": "2026-03-05",
            "type": "added",
            "breaking": false,
            "title": "Cursor-based pagination for incident lists",
            "description": "The incident list supports cursor-based pagination for stable iteration over large result sets, alongside the existing limit/offset paging.",
            "endpoints": [
                "GET /v1/incidents"
            ],
            "docs": "https://api-docs.phishfort.com/incidents/"
        },
        {
            "date": "2026-03-05",
            "type": "added",
            "breaking": false,
            "title": "Registrar, hosting provider and expanded threat taxonomy on incident detail",
            "description": "The incident detail response includes registrar and hostingProvider fields and an expanded threatTaxonomy structure.",
            "endpoints": [
                "GET /v1/incident/{incidentId}"
            ],
            "docs": "https://api-docs.phishfort.com/single-incident/"
        },
        {
            "date": "2026-02-25",
            "type": "deprecated",
            "breaking": false,
            "title": "Migration from statusVerbose",
            "description": "The status parameter began returning verbose values, starting the migration away from statusVerbose. statusVerbose remains accepted and returned for compatibility and is planned for deprecation on December 25, 2026.",
            "endpoints": [
                "GET /v1/incidents",
                "GET /v1/incident/{incidentId}"
            ],
            "docs": "https://api-docs.phishfort.com/incidents/"
        },
        {
            "date": "2026-02-24",
            "type": "added",
            "breaking": false,
            "title": "Threat taxonomy and classification fields",
            "description": "Incident responses include threatTaxonomy, incidentClass and related classification fields describing the type of threat.",
            "endpoints": [
                "GET /v1/incidents",
                "GET /v1/incident/{incidentId}"
            ],
            "docs": "https://api-docs.phishfort.com/structures/"
        },
        {
            "date": "2026-02-18",
            "type": "changed",
            "breaking": true,
            "title": "Verbose status values",
            "description": "Incident status values moved to the verbose set (pending_review, case_building, takedown_in_progress, …) and the other status was replaced by closed.",
            "endpoints": [
                "GET /v1/incidents",
                "GET /v1/incident/{incidentId}"
            ],
            "docs": "https://api-docs.phishfort.com/incident-lifecycle/"
        },
        {
            "date": "2025-11-12",
            "type": "changed",
            "breaking": false,
            "title": "Comments must be non-empty",
            "description": "Adding a comment with a null or empty body is rejected with a validation error.",
            "endpoints": [
                "POST /v1/incident/{incidentId}/comment"
            ],
            "docs": "https://api-docs.phishfort.com/add-comment/"
        },
        {
            "date": "2025-03-03",
            "type": "added",
            "breaking": false,
            "title": "Add a comment to an existing incident",
            "description": "New endpoint to add a comment to an incident you have already reported.",
            "endpoints": [
                "POST /v1/incident/{incidentId}/comment"
            ],
            "docs": "https://api-docs.phishfort.com/add-comment/"
        },
        {
            "date": "2024-08-28",
            "type": "changed",
            "breaking": false,
            "title": "50 MB attachment limit",
            "description": "Attachment uploads are limited to 50 MB per request.",
            "endpoints": [
                "POST /v1/incident/{incidentId}/attach"
            ],
            "docs": "https://api-docs.phishfort.com/add-attachments/"
        },
        {
            "date": "2024-08-19",
            "type": "added",
            "breaking": false,
            "title": "case_building status",
            "description": "New case_building incident status, covering incidents where PhishFort is gathering evidence before enforcement.",
            "endpoints": [
                "GET /v1/incidents",
                "GET /v1/incident/{incidentId}"
            ],
            "docs": "https://api-docs.phishfort.com/incident-lifecycle/"
        },
        {
            "date": "2024-06-05",
            "type": "added",
            "breaking": false,
            "title": "reportedBy on incident reports",
            "description": "Reporting an incident accepts an optional reportedBy field identifying the reporter.",
            "endpoints": [
                "POST /v1/incident/tkd"
            ],
            "docs": "https://api-docs.phishfort.com/report-incident/"
        },
        {
            "date": "2023-12-14",
            "type": "added",
            "breaking": false,
            "title": "Incident attachments",
            "description": "Attachments can be included when reporting an incident and added to existing incidents.",
            "endpoints": [
                "POST /v1/incident/{incidentId}/attach"
            ],
            "docs": "https://api-docs.phishfort.com/add-attachments/"
        },
        {
            "date": "2023-02-21",
            "type": "added",
            "breaking": false,
            "title": "statusVerbose parameter and new incident types",
            "description": "The incident list gained the statusVerbose parameter (since deprecated in favor of status) and support for additional incident types.",
            "endpoints": [
                "GET /v1/incidents"
            ],
            "docs": "https://api-docs.phishfort.com/incidents/"
        }
    ]
}