> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usehasp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> AI API version history — additive changes, deprecations, and breaking change timelines.

## 2026-07-31

Deterministic constraint solving (staff scheduling, coverage rostering, resource allocation) is now reachable directly — not just from a `solve` workflow step.

### New endpoints

* `POST /v1/solve` — Solve a literal constraint-satisfaction / assignment spec against HASP's self-hosted CP-SAT solver (scope `control:workflows`). `optimal`/`feasible`/`infeasible` all return `200` — infeasible carries the conflicting-constraint subset, never an error. See [Constraint Solving](/ai-api/reference/solve).

## 2026-07-12

BYO-Tool `custom_http` integration credential and binding management has shipped — an API-only agent builder can register their own tool endpoint and submit its secret programmatically.

### New endpoints

* `GET /v1/integrations` and `POST /v1/integrations` — List and register `custom_http` integration credentials (scope `control:integrations`).
* `GET /v1/integrations/{integrationId}` — Retrieve a single integration credential's metadata. Never returns the stored secret.
* `POST /v1/integrations/{integrationId}/rotate-secret` — Replace a credential's secret without changing its id, name, or bindings.
* `DELETE /v1/integrations/{integrationId}` — Revoke a credential. The row and its bindings persist; a revoked credential resolves to a stale state at dispatch time rather than being removed.
* `GET /v1/integrations/{integrationId}/bindings` and `POST /v1/integrations/{integrationId}/bindings` — List and create project-scoped bindings for an integration credential.
* `DELETE /v1/integrations/{integrationId}/bindings/{bindingId}` — Remove a binding without affecting the underlying credential.

Credential registration, rotation, and revocation require the API key's delegating user to be an organization admin. Binding management does not carry that requirement — it follows the same authorization as every other `integration.write` action: the key's granted scope.

## 2026-05-27

OpenAI is now a supported provider, and the agent registry, budget, provider-status, and end-user export endpoints have shipped.

### New provider: OpenAI

The AI API now supports OpenAI models alongside Anthropic. OpenAI models pass through the same Gateway compliance checks as every other model — BAA enforcement, credit accounting, and PHI policy. BAA coverage is `hasp_openai_baa_2026`.

### New endpoints

* `GET /v1/provider-status` — Upstream AI provider health.
* `POST /v1/agents/{agentId}/credentials/{credentialId}/revoke` — Revoke an agent credential.
* `POST /v1/webhooks/deliveries/bulk-replay` — Replay webhook deliveries.
* `GET /v1/orgs/{organization}/end-users/{runtimeUser}/export` — GDPR Art. 20 end-user data export (scope `org.end_users.read`).
* `GET /v1/agents` and `POST /v1/agents` — List and register agents in the agent registry.
* `GET /v1/agents/{agentId}` and `PATCH /v1/agents/{agentId}` — Retrieve and update an agent.
* `POST /v1/agents/{agentId}/archive` — Archive an agent.
* `POST /v1/agents/{agentId}/reactivate` — Reactivate an archived agent.
* `GET /v1/agents/{agentId}/credentials` and `POST /v1/agents/{agentId}/credentials` — List and issue agent credentials.

### Models available since launch

* `claude-opus-4-7` — Claude Opus 4.7. Anthropic. Most capable. 1,000,000-token context window with extended thinking. premium tier — requires explicit opt-in per organization.
* `gpt-5.5` — GPT-5.5. OpenAI. High capability with vision. 1,050,000-token context window. premium tier — requires explicit opt-in per organization.
* `gpt-5.5-pro` — GPT-5.5 Pro. OpenAI. Highest capability with extended thinking — the highest-cost model in the catalog. 1,050,000-token context window. premium tier — requires explicit opt-in per organization.
* `gpt-5.4` — GPT-5.4. OpenAI. Fast and capable. 1,050,000-token context window. standard tier — available to all plans.
* `gpt-5.4-mini` — GPT-5.4 mini. OpenAI. Fast and efficient. 400,000-token context window. standard tier — available to all plans.
* `gpt-5.3-codex` — GPT-5.3 Codex. OpenAI. Code-optimized (agentic-coding tuned; usable as a Studio backing model). 400,000-token context window. standard tier — available to all plans.

## 2026-04-01

Initial public release of the HASP AI API V1.

### New endpoints

* `POST /v1/ai/chat` — Native HASP AI inference. Supports streaming and non-streaming. Full HASP event taxonomy, PHI metadata in responses, `meta.request_id` on every response.
* `POST /v1/messages` — Anthropic-compatible inference. Drop-in for `@anthropic-ai/sdk` — change `baseURL` only. Same compliance checks as native surface.
* `GET /v1/ai/messages/{id}` — Retrieve a stored inference record by `request_id`. Returns original messages, token usage, model, stop reason, PHI metadata, and audit trail reference.
* `GET /v1/api_keys` — List API keys for your organization.
* `POST /v1/api_keys` — Create a new API key with specified scopes.
* `DELETE /v1/api_keys/{keyId}` — Revoke an API key.
* `GET /v1/usage` — Current billing period usage summary (credits used, credits remaining).
* `GET /v1/usage/budget` — Current spend cap configuration.
* `PATCH /v1/usage/budget` — Update monthly credit cap.
* `GET /v1/compliance/baa` — Current BAA status and template for your organization.
* `GET /v1/compliance/baa/acceptances` — List BAA acceptances (signed versions).
* `GET /v1/compliance/baa/acceptances/{id}` — Retrieve a specific BAA acceptance.
* `GET /v1/compliance/baa/acceptances/{id}/download` — Download a signed BAA PDF.
* `GET /v1/audit` — Query the audit log for your organization.
* `GET /v1/webhooks` — List webhook endpoints.
* `POST /v1/webhooks` — Register a new webhook endpoint.
* `DELETE /v1/webhooks/{endpointId}` — Remove a webhook endpoint.

### Models available at launch

* `claude-haiku-4-5` — Fast, low-cost. Available to all plans.
* `claude-sonnet-4-6` — Balanced. Available to all plans. Recommended default.
* `claude-opus-4-6` — Highest capability. Requires explicit opt-in per organization.

### Authentication

API keys use the `hasp_api_live_<32-char-alphanumeric>` format. The `ai:chat` scope is required for inference endpoints. The `control:read` scope is required for control-plane read endpoints. The `control:webhooks` scope is required for webhook management endpoints.

### PHI handling

PHI scanning and redaction (powered by Microsoft Presidio) runs on every inference request. The compliance substrate is HASP-owned — it runs inside the HASP platform before any content reaches the upstream model provider. See [PHI Guard](/ai-api/concepts/phi-guard) for details.