Skip to main content

Changelog

Notable changes to the LeonAI API, the @leonai/sdk TypeScript SDK, and the @leonai/mcp-server. The API follows URL-based versioning (/api/v1); breaking changes ship under a new version, and the previous version is supported for at least 12 months.

v1 — current​

2026-10-07​

  • GET /me: the account, plan and email-verification state behind the calling key, plus the key's scopes. Any valid API key may call it regardless of scopes, so integrations can test a key first.
  • PATCH /links/:id now takes domainId (a verified custom domain you own, or null for the default short domain) and "password": null to remove a link's password. An empty password string still leaves it unchanged.
  • domain.verified webhooks are sent, once, the first time a domain passes POST /domains/:id/verify. link.expired, link.limit_reached and domain.ssl_ready remain reserved: accepted in a subscription, not sent yet.
  • Smart routing destinations are screened against Google Safe Browsing on create and update, like link destinations; a flagged URL gets 422 Unsafe Destination.
  • POST /links/bulk no longer includes a row's password in results[].input.
  • Make.com app: 47 modules covering the whole API-key surface (not published in Make's app directory yet). See Integrations.

2026-07-11​

  • Folders: nest links up to 5 levels deep, assign links in bulk (PUT /folders/:id/links), and filter the library with GET /links?folderId={id|root}. Deleting a folder keeps its links (detached) and reparents child folders. See Folders.
  • Shareable analytics: mint a revocable, optionally-expiring share token for a link and serve a public, PII-free analytics page at /s/{token} (GET /public/analytics/:token, no auth). See Shareable analytics.
  • Retargeting pixels (Business+): register Meta / Google Ads / LinkedIn / TikTok / X pixels and attach up to 20 per link. Redirects for pixel-bearing links serve a GPC-aware JS interstitial that honors Sec-GPC before firing. See Retargeting pixels.
  • Bot detection & fraud prevention (Business+): clicks are classified and bot clicks are excluded from headline analytics; the summary exposes botClicks and botClicksFiltered. See Bot detection.
  • White-label branding (Enterprise): GET /branding (any tier, defaults) and PUT /branding (Enterprise) theme public bio and analytics pages and can hide "Powered by LeonAI". See White-label branding.
  • One-click Bitly import: POST /imports/bitly recreates your Bitly links through the normal creation path — idempotent, tier-limit aware, with a dryRun preview. See Import from Bitly.
  • Custom social previews: ogEnabled / ogTitle / ogDescription / ogImage on links serve a meta-tag page to crawlers while humans keep the fast redirect. See Social previews (OG).
  • Alternative link types: linkType of url / mailto / tel / sms composes the proper URI from structured fields. See Link types.

API​

  • OpenAPI 3.1 spec published at /api/v1/openapi.json with interactive Swagger UI at /api/v1/docs.
  • Links: create with custom back-halves, UTM params, tags, and expiry; list/search; update; bulk import (up to 1000); export (JSON/CSV).
  • Analytics: per-link and account timelines, device/browser/OS/country/referrer breakdowns, real-time (last hour), and raw CSV export.
  • Conversions (Business+): lc_id click flow with idempotent conversion tracking.
  • Webhooks: HMAC SHA-256 signed deliveries for all ten link/domain/subscription events, with retries and delivery logs.
  • Smart routing (Business+): geo / device / time / A-B rules per link.
  • QR codes: public dynamic QR images (PNG / SVG / data URL).
  • Custom domains: one-click Cloudflare auto-connect (auto CNAME + TXT + SSL) plus a manual DNS path for any provider.
  • AI endpoints: slug suggestions, link insights (Business+), and anomaly detection, with a deterministic heuristic fallback (Anthropic-backed when configured).
  • Two-factor auth (2FA): TOTP enrollment, recovery codes, and a two-step login.
  • Billing moved to Sumit (OfficeGuy) — ILS pricing (Pro ₪69 / Business ₪290 / Enterprise ₪1,090 ex-VAT), client-side card tokenization, and VAT tax invoices. The legacy Stripe integration was removed.
  • Link-in-bio pages, teams with RBAC roles, and GDPR/CCPA data export & deletion.

@leonai/sdk (TypeScript)​

  • Fully typed client with zero runtime dependencies (built on global fetch).
  • Automatic retries with exponential backoff + jitter on 429/5xx (idempotent methods only), honoring Retry-After.
  • Rate-limit headers surfaced on every response and error.
  • Auto-pagination via links.listAll().
  • verifyWebhookSignature() helper (WebCrypto HMAC SHA-256).

leonai (Python) — new​

  • Official Python SDK (3.9+), zero runtime dependencies (stdlib only).
  • Mirrors the TypeScript client: typed resources, retries, rate-limit parsing, auto-pagination, and verify_webhook_signature().

@leonai/mcp-server​

  • MCP server over stdio exposing 14 tools and 3 resources for AI assistants.
  • Works with Claude Code, Claude Desktop, Cursor, and any MCP client.

Roadmap​

  • Go SDK.
  • Additional webhook events and delivery replay from the dashboard.
note

Have a spec or a specific version history to publish here? Replace this page's content with dated entries (newest first). Keeping a changelog is part of the API's backward- compatibility commitment.