# RankRight API changelog

The API is path-versioned (`/api/v1`). Additive changes are listed here as they ship; breaking changes only arrive in a new major version. Deprecations are announced 60 days ahead (email to organization owners + the `api.deprecation` webhook event) and the affected method answers with `Deprecation` and `Sunset` headers until it is removed. Policy: https://app.rankright.dev/developers.md#versioning--deprecation

## 2026-09-06
- **SAML 2.0 SSO** (self-serve per organization): `list/add/update/delete_org_saml_provider`; SP metadata at `/saml/<key>/metadata`, ACS at `/saml/<key>/acs`; `/login/sso` routes SAML domains automatically.
- Hardening: org identity providers cannot authenticate users who belong to other organizations (or platform admins); OAuth tokens need the explicit `jobs` scope to dispatch jobs; the organization export download is owner-only (plus the sandbox key); a code presented by the wrong client revokes its grant; registered `client_uri` must be https.
- **Python SDK** `rankright` 1.0.0 (`pip install rankright` / `https://app.rankright.dev/sdk/rankright-python.zip`).
- **Versioning & deprecation policy** published; `X-RankRight-API-Version` response header; `Deprecation` / `Sunset` / `Link` headers on deprecated methods; `deprecated` flag in `capabilities` and `openapi.json`; this changelog at `/changelog.md`.
- Sandbox key may run the `export_org` job (one per 10 minutes) and download the result.

## 2026-09-05
- **OAuth 2.0** authorization server: `/.well-known/oauth-authorization-server`, `/.well-known/oauth-protected-resource[/api/v1/mcp]`, `POST /oauth/register` (RFC 7591), `/oauth/authorize`, `/oauth/token`, `/oauth/revoke`; `rro_` access tokens accepted everywhere a key is; `oauth_list_grants`, `oauth_revoke_grant`.
- **Self-serve SSO**: `list/add/update/delete_org_sso_provider`; company sign-in at `/login/sso`.
- **Org export**: job kind `export_org`; `GET /api/v1/exports/<org_id>/<filename>`; `list_org_exports`.
- **Webhooks**: `register_webhook`, `list_webhooks`, `update_webhook`, `delete_webhook`, `rotate_webhook_secret`, `test_webhook`, `list_webhook_deliveries`, `redeliver_webhook`, `emit_event`; events `job.completed|failed|cancelled`, `aeo.capture.ingested`, `aeo.report.saved`, `aeo.item.status_changed`, `action_item.status_changed`, `ping`.
- **MCP server** `POST /api/v1/mcp` (Streamable HTTP; tools = org-scoped RPCs + `list_rpcs` / `describe_rpc` / `call_rpc`).
- **Public sandbox** key and org (`capabilities.sandbox`).
- **AI Visibility partner surface**: `generate_aeo_questions`, `set_aeo_cadence`, `get_aeo_cadence`, `get_aeo_summary`, `aeo_report_html`, `update_organization_branding`, `reanalyze_aeo_client`, `dedupe_aeo_queries`, plus the `get_aeo_*` readers; OpenAPI operations tagged by domain; `x-workflows`.
- Google Sign-In (OIDC) on the login page.