# Changelog Source: https://developers.leonai.io/docs/changelog/ Notable changes to the LeonAI API, the `@leonai/sdk` TypeScript SDK, and the `@leonai/mcp-server`. The API follows URL-based versioning (`/api/v1`); breaking changes ship under a new version, and the previous version is supported for at least 12 months. ## v1 — current ### 2026-10-07 - **`GET /me`**: the account, plan and email-verification state behind the calling key, plus the key's `scopes`. Any valid API key may call it regardless of scopes, so integrations can test a key first. - **`PATCH /links/:id`** now takes `domainId` (a verified custom domain you own, or `null` for the default short domain) and `"password": null` to remove a link's password. An empty `password` string still leaves it unchanged. - **`domain.verified` webhooks are sent**, once, the first time a domain passes `POST /domains/:id/verify`. `link.expired`, `link.limit_reached` and `domain.ssl_ready` remain reserved: accepted in a subscription, not sent yet. - **Smart routing destinations are screened** against Google Safe Browsing on create and update, like link destinations; a flagged URL gets `422 Unsafe Destination`. - **`POST /links/bulk`** no longer includes a row's `password` in `results[].input`. - **Make.com app**: 47 modules covering the whole API-key surface (not published in Make's app directory yet). See [Integrations](https://developers.leonai.io/docs/integrations/#makecom). ### 2026-07-11 - **Folders**: nest links up to 5 levels deep, assign links in bulk (`PUT /folders/:id/links`), and filter the library with `GET /links?folderId={id|root}`. Deleting a folder keeps its links (detached) and reparents child folders. See [Folders](https://developers.leonai.io/docs/guides/folders/). - **Shareable analytics**: mint a revocable, optionally-expiring share token for a link and serve a public, PII-free analytics page at `/s/{token}` (`GET /public/analytics/:token`, no auth). See [Shareable analytics](https://developers.leonai.io/docs/guides/shareable-analytics/). - **Retargeting pixels (Business+)**: register Meta / Google Ads / LinkedIn / TikTok / X pixels and attach up to 20 per link. Redirects for pixel-bearing links serve a **GPC-aware** JS interstitial that honors `Sec-GPC` before firing. See [Retargeting pixels](https://developers.leonai.io/docs/guides/retargeting-pixels/). - **Bot detection & fraud prevention (Business+)**: clicks are classified and bot clicks are excluded from headline analytics; the summary exposes `botClicks` and `botClicksFiltered`. See [Bot detection](https://developers.leonai.io/docs/guides/bot-detection/). - **White-label branding (Enterprise)**: `GET /branding` (any tier, defaults) and `PUT /branding` (Enterprise) theme public bio and analytics pages and can hide "Powered by LeonAI". See [White-label branding](https://developers.leonai.io/docs/guides/white-label/). - **One-click Bitly import**: `POST /imports/bitly` recreates your Bitly links through the normal creation path — idempotent, tier-limit aware, with a `dryRun` preview. See [Import from Bitly](https://developers.leonai.io/docs/guides/bitly-import/). - **Custom social previews**: `ogEnabled` / `ogTitle` / `ogDescription` / `ogImage` on links serve a meta-tag page to crawlers while humans keep the fast redirect. See [Social previews (OG)](https://developers.leonai.io/docs/guides/og-previews/). - **Alternative link types**: `linkType` of `url` / `mailto` / `tel` / `sms` composes the proper URI from structured fields. See [Link types](https://developers.leonai.io/docs/guides/link-types/). ### API - OpenAPI 3.1 spec published at `/api/v1/openapi.json` with interactive Swagger UI at `/api/v1/docs`. - Links: create with custom back-halves, UTM params, tags, and expiry; list/search; update; bulk import (up to 1000); export (JSON/CSV). - Analytics: per-link and account timelines, device/browser/OS/country/referrer breakdowns, real-time (last hour), and raw CSV export. - Conversions (Business+): `lc_id` click flow with idempotent conversion tracking. - Webhooks: HMAC SHA-256 signed deliveries for all ten link/domain/subscription events, with retries and delivery logs. - Smart routing (Business+): geo / device / time / A-B rules per link. - QR codes: public dynamic QR images (PNG / SVG / data URL). - Custom domains: **one-click Cloudflare auto-connect** (auto CNAME + TXT + SSL) plus a manual DNS path for any provider. - **AI endpoints**: slug suggestions, link insights (Business+), and anomaly detection, with a deterministic heuristic fallback (Anthropic-backed when configured). - **Two-factor auth (2FA)**: TOTP enrollment, recovery codes, and a two-step login. - **Billing moved to Sumit (OfficeGuy)** — ILS pricing (Pro ₪69 / Business ₪290 / Enterprise ₪1,090 ex-VAT), client-side card tokenization, and VAT tax invoices. The legacy Stripe integration was removed. - Link-in-bio pages, teams with RBAC roles, and GDPR/CCPA data export & deletion. ### `@leonai/sdk` (TypeScript) - Fully typed client with zero runtime dependencies (built on global `fetch`). - Automatic retries with exponential backoff + jitter on `429`/`5xx` (idempotent methods only), honoring `Retry-After`. - Rate-limit headers surfaced on every response and error. - Auto-pagination via `links.listAll()`. - `verifyWebhookSignature()` helper (WebCrypto HMAC SHA-256). ### `leonai` (Python) — **new** - Official Python SDK (3.9+), zero runtime dependencies (stdlib only). - Mirrors the TypeScript client: typed resources, retries, rate-limit parsing, auto-pagination, and `verify_webhook_signature()`. ### `@leonai/mcp-server` - MCP server over stdio exposing 14 tools and 3 resources for AI assistants. - Works with Claude Code, Claude Desktop, Cursor, and any MCP client. ## Roadmap - Go SDK. - Additional webhook events and delivery replay from the dashboard. :::note Have a spec or a specific version history to publish here? Replace this page's content with dated entries (newest first). Keeping a changelog is part of the API's backward- compatibility commitment. :::