> For the complete documentation index, see [llms.txt](https://docs.tiny.plus/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tiny.plus/api/changelog.md).

# Changelog

Changes to the API that an integration might notice, newest first. Dates are when a change reached production.

## Unreleased

* **AI assistants can read lists.** The MCP server has `list_lists` (the lists the token's user can see, target lists first, or the lists a record is on) and `get_list` (one list with its summary and a page of its members), and, where the account allows changes, `create_list` and `add_to_list`. They are there when the account shows Lists in its menu, as `integrations.lists` on [`/me`](/api/endpoints/me.md#integrations) says. See [AI assistants](/api/getting-access/ai-assistants.md) and [Lists](/api/endpoints/lists.md).

## 15 October 2026

* **Bid teams.** New endpoints read the competing teams a project is bid through, each led by another firm, and the teams under a lead firm with its two numbers, and add, change and remove them. A team's result moves its project: a win wins it, and the last team out of the running closes it. Bid teams come with the Pro plan, and an account admin turns them on under Account Settings → Projects; [`/me`](/api/endpoints/me.md#integrations) says whether they're on, in `integrations.bid_teams`. The MCP server's `get_record` lists a project's teams. See [Bid teams](/api/endpoints/bid-teams.md).
* **While a project has a bid team in the running, its fee and probability come from its teams.** A `PATCH /v2/projects/{id}` that sends `fee_value` or `probability` for it leaves them as they are. See [The fee and probability](/api/endpoints/bid-teams.md#the-fee-and-probability).

## 11 October 2026

* **A list chooses each company's key contact.** On a list of companies, [`PATCH /v2/lists/{id}/members/{record_id}`](/api/endpoints/lists.md#key-contacts) takes `key_contact_id`, and a member's `key_contact` is the one the list names, or else its first current contact by name, as before. [`GET /v2/lists/{id}/members/{record_id}`](/api/endpoints/lists.md#one-member) is new: one member, with the company's current contacts to choose from. [`/me`](/api/endpoints/me.md) lists `list_key_contacts` in `api_features`. A confidential contact the token's user can't see is no longer given as the key contact, or counted in `other_contacts`.
* **A record read on its own names its people:** `assigned_user_record`, `created_user_record` and `modified_user_record`, named even after they leave the team, and `subscribers` lists its followers, each with `id` and `name`, where it used to be `null`. See [Get a record](/api/endpoints/records.md#get-a-record).
* **A post names the people who like it:** `social.likers`, each with `id` and `name`, beside `like_ids`. See [Comments](/api/endpoints/updates.md#comments).
* **`/me` says whether the account shows Support Docs:** `permissions.support_page`, for the account in use and for each of `extra_accounts`. See [Current user](/api/endpoints/me.md#permissions).
* **More image types.** [`POST /v2/attachments`](/api/endpoints/attachments.md#images-and-documents) stores WebP, AVIF, BMP, HEIC, TIFF and SVG files as images, converted to JPEG, or to PNG when the picture has transparency. They used to be kept as documents.

## 4 October 2026

* **Lists.** New endpoints read the account's lists of companies, contacts and projects, their members and a record's lists, and add, remove, comment, follow, make, change and delete. A personal list is only there for the person who made it. [`/me`](/api/endpoints/me.md) lists `lists` in `api_features`, and says in `integrations.lists` whether the account shows Lists. See [Lists](/api/endpoints/lists.md).
* **A record's lists carry their comments.** Each list in [`GET /v2/lists?record_id={id}`](/api/endpoints/lists.md#the-lists-a-record-is-on) has `comment`: what that list says about the record, or `null`.
* **`/me` says whether the person is an account admin:** `permissions.account_admin`, for the account in use and for each of `extra_accounts`. Only an account admin can set `created_user`, `modified_user`, `created_date` or `modified_date` to anything but their own. See [Current user](/api/endpoints/me.md#permissions).

## 3 October 2026

* **A time zone field lists its zones.** In `GET /v2/fields/staff` and `GET /v2/form_structure/staff`, `timezone` has `options`: the zones tiny+ offers, each with a `value` and a `label`, such as `{"value": "Australia/Sydney", "label": "(UTC+10:00) Sydney, Canberra"}`. See [Time zone](/api/endpoints/team-members.md#time-zone).
* **A time zone has to be one.** Setting `timezone` to anything but a zone name, such as `Australia/Sydney`, gets a `400`, and nothing is saved. It used to be saved as sent.
* **Time zones are stored under their current names.** A team member or an account on an old name now reads the current one in `/me` and `GET /v2/staff`: `Asia/Kolkata` rather than `Asia/Calcutta`, `Australia/Sydney` rather than `Australia/Canberra`. Those on `Etc/Greenwich`, which tiny+ offered as Dublin, read `Europe/Dublin`, with Irish summer time.

## 2 October 2026

* **Relationship plans.** New endpoints list, start, log and change relationship plans, on accounts with the Pro plan. [`/me`](/api/endpoints/me.md#integrations) says whether an account has them, in `integrations.relationship_plans`. See [Relationship plans](/api/endpoints/relationship-plans.md).
* **Tasks say which plan they belong to, and when they were completed:** `plan_id`, `plan_step_id`, `plan_occurrence`, `touch_type`, `completed_date` and `completed_user`. See [Tasks](/api/endpoints/tasks.md#follow-ups-on-a-relationship-plan).
* **Companies say where their plans stand:** `plan_status`, `plan_next_due`, `plan_next_staff`, `last_contact_date` and `plan_count`. A company on a plan has its health worked out from its last contact on the plan. See [Companies](/api/endpoints/companies.md#relationship-plans).
* **A post that holds a plan follow-up's notes carries `plan_touch`.** See [Posts](/api/endpoints/updates.md#notes-logged-on-a-relationship-plan).
* **Fields that tiny+ keeps itself are left out of a write, not written.** A create or an update that sends one, such as `record_url`, saves the rest and names it in `ignored_fields`. See [Records](/api/endpoints/records.md#fields-that-are-not-editable).
* **A project's status pipeline:** [`GET /v2/status_history/projects/{id}`](/api/endpoints/projects.md#status-pipeline) returns the states a project has been in, where it is now and for how long, and what comes next, as its Status panel shows them.
* **A record's images and documents:** [`GET /v2/attachments?related_id={id}`](/api/endpoints/attachments.md#images-and-documents-on-a-record) lists them, and [`GET /v2/attachments/{id}`](/api/endpoints/attachments.md#open-a-document) gives a short-lived link that opens a document. An image attached through `POST /v2/attachments` is listed straight away.
* **`linked_to={id}`** on a list returns the records linked to another record, as a record's panels in tiny+ find them. [`/me`](/api/endpoints/me.md) lists it in `api_features`. See [Listing, filtering and paging](/api/concepts/listing.md#records-linked-to-another-record).
* **Meeting times come back in UTC.** `meeting_date` and `meeting_date_end` used to come back in Australia/Sydney time, though they are sent and filtered in UTC. See [Meetings](/api/endpoints/meetings.md).
* **A meeting sent without `record_status` is `planned`.** It used to have no status, so no panel in tiny+ listed it.
* **A meeting's `primary_related` can be a project.** A project's id used to be dropped, leaving the meeting unlinked.

## 1 October 2026

* **`GET /v2/search/{type}` searches only that type.** For a type the tiny+ search box leaves out, such as `stages`, it used to search every other type instead and return their records. The MCP server's `search_records` tool did the same. See [Search](/api/endpoints/records.md#search).
* **`GET /v2/search/updates` leaves out the posts a** [**search on `GET /v2/updates`**](/api/endpoints/updates.md#the-news-feed-or-a-search) **does:** posts tiny+ writes automatically, confidential notes, and posts on a confidential record the token's user can't open. It used to return posts on such a record, with their opening words. It is the search [Ask](/api/endpoints/ai-filter.md) falls back to for posts, and the MCP server's `search_records` tool uses it too. See [Search](/api/endpoints/records.md#search).

## 30 September 2026

* **Setting who made a record, or when, needs an account admin.** Only an account admin can send `created_user`, `modified_user`, `created_date` or `modified_date`. Anyone else who sends one gets a `403`, unless the value is their own id or the one the record already has. See [Permissions](/api/concepts/permissions.md).
* **`DELETE` answers `{"results": true}`**, or `false` if the record couldn't be deleted.
* **A simple access token works only for the account it was made in.** Sending another account's id as `account` gets `403 {"error": "This token is for account N only."}`, and a token whose creator has left the account gets a `401`. Account admins can now revoke a simple access token on the API Access screen. See [Simple access token](/api/getting-access/getting-an-access-token.md).
* **Only a post's author, or a News Feed admin, can edit or delete it.** Every post's `perm_edit` and `perm_delete` now say whether the token can. See [Posts](/api/endpoints/updates.md).
* **`GET /v2/updates?single_id=`** finds any post the token's user could see on a feed, not only posts on the News Feed.
* **Posts and comments check what they're attached to.** A comment on a post the token's user can't open, or a post whose `related_id` or `extra_ids` they can't see, gets a `404`, and nothing is saved. A comment that can't be saved gets a `500`, rather than `200 {"id": false}`.
* **Attaching a file needs edit rights on the record.** [`POST /v2/attachments`](/api/endpoints/attachments.md) answers `403` for a record the token's user can't edit, and for a read-only token, and `400` for a confidential record they can't see, as for a missing one. Its errors are `{"error": …}` objects now, and `image/bmp`, `image/tiff` and `image/svg+xml` are kept as documents rather than failing.
* **`sort` on `GET /v2/updates`** takes `created_date`, `modified_date`, `name` or `id`. Anything else is ignored.
* **A confidential company's name is hidden** on the projects and contacts linked to it, from people who can't see the company.

## 29 September 2026

* **Ask can search posts.** [`POST /v2/ai/filter`](/api/endpoints/ai-filter.md) with `"flavour": "updates"` returns `text`, `about` and `broadcast` filters for `GET /v2/updates`.
* **Confidential records stay confidential in the API.** Lists and searches leave out the confidential records the token's user can't open, a direct read masks them, and their history is refused. See [Permissions](/api/concepts/permissions.md).

## 28 September 2026

* **Fixed:** [`POST /v2/webhooks/add`](/api/endpoints/webhooks.md) works again. From 25 September it answered `500`.

## 14 September 2026

* **AI assistants can use tiny+** through its MCP server at `https://api.tiny.plus/mcp`. See [AI assistants](/api/getting-access/ai-assistants.md).
* **Apps can register themselves** with `POST /oauth/register`. See [Register a Client App](/api/getting-access/register-a-client-app.md).
* **Ask filters.** [`POST /v2/ai/filter`](/api/endpoints/ai-filter.md) turns a plain-English question into filters for a list.

## 30 August 2026

* **The v1 API is closed.** Requests to `/api/v1`, which used `?token=`, now answer `404`. Use `/v2` with an [access token](/api/getting-access.md).
* **`/me` has a `permissions` object,** with `show_fees` and `all_records`. See [Current user](/api/endpoints/me.md).
* **Pipeline statistics were rebuilt.** [`GET /v2/stats/projects`](/api/endpoints/stats.md) groups each status's figures by phase, covers every status, and takes the same `me`, `staff`, tag and custom-field filters as a project list. `/all` needs permission to see the company-wide pipeline, and fee figures are `null` when the account hides fees.
* **Lists can be filtered on more kinds of custom field:** date, number, currency, percentage and URL, as well as text and yes/no. A custom-field filter that can't be applied answers `400`, rather than returning the list unfiltered.