Skip to content
API and publishers operational
SMMist
Menu
API key
Vol. I · No. 4smmist.com · API v1

Changelog

Versioned entries, newest first, each tied to the commit that shipped it. A breaking API change is named in its own entry before it ships.

  1. v0.4.0Unreleased

    Sign-in, approvals and the dashboard

    DashboardAPISecurity

    • Magic-link sign-in with server-side sessions. Logging out revokes the row, so a copied cookie stops working too.
    • Approvals: submit, approve and reject. An approval binds to the content hash; any edit voids it, and the worker refuses to publish content that does not match.
    • approval_mode=agents now means API and MCP callers without the approve scope. People in the dashboard are not held for their own posts.
    • Organizations and members with five roles, and API keys created from the dashboard (shown once, stored as sha256).
    • New reads for the dashboard: GET /v1/queue with day roll-ups and usual-slot hints, /v1/events, /v1/stats/summary, /v1/mcp/setup, and GET /v1/media for the media library.
  2. v0.3.0commit 8a1c679

    Safety pass: no double posts, isolated test mode

    SecurityPlatforms

    • A send that might have landed is treated as live until the platform says otherwise; it is reconciled before any retry.
    • Account leases renew while a long Instagram upload runs, so a second worker cannot pick up the same target.
    • Test keys and sandbox accounts are isolated end to end: test rows only ever reach the fake publisher.
    • URL imports pin the resolved address, closing a DNS-rebinding route to private networks.
  3. v0.2.0commit 57d05ad

    X and Instagram, the worker, REST and MCP

    PlatformsAPIMCP

    • X adapter on your own developer app: text, up to four images or one video, weighted character counting with links at 23.
    • Instagram adapter on our Meta app: Reels, feed images and video, carousels and stories, with Meta’s 100-per-day ceiling checked first.
    • The REST API under /v1, with POST /v1/posts/validate, required Idempotency-Key on create, and errors with stable codes.
    • The MCP server at /mcp: 18 tools, each scope-checked, with destructive ones annotated.
  4. v0.1.0commit 87fd891

    Foundations: the audit chain, encryption and API keys

    RecordSecurityAPI

    • An append-only, per-organization hash chain of every post event. The database refuses updates and deletes.
    • Platform secrets sealed with envelope encryption; the key-encryption key never lives in the database.
    • API keys as smm_live_ and smm_test_, with scopes that default an agent to drafting.