API Changelog

A wrong method on a known path now answers 405. A request to a route that exists, with a method it does not serve, used to fall through to 404 request.not_found. It now answers 405 request.method_not_allowed with an Allow header naming the methods the path accepts. A path that matches no route still answers 404.

The OpenAPI description is published. https://envless.cloud/openapi.json serves the OpenAPI 3.1 description this reference is built from, generated from the API's route table and readable from any origin. It now also describes the anonymous exposed and example feeds, every error code an operation can return, including the ones every route shares (401 auth.api_key_*, 403 auth.workspace_two_factor_required, 403 auth.scope_missing, 413 request.body_too_large and 503), and the Request-Id and Envless-Api-Version response headers.

Rename and rollback conflicts carry their documented codes. PATCH .../variables/{name} and PATCH /variables/{id} answer a rename onto a live name with 409 variable.name_conflict, and POST /versions/{id}/rollback answers a name clash with 409 variable.name_conflict and names that are no longer valid with 400 request.body_invalid. They used to send the generic 409 request.conflict and 400 request.invalid. The statuses are unchanged.

• 413 request.body_too_large now states the limit in message: 1 MiB (1,048,576 bytes) for a JSON body
• GET /members documents the search and roleId filters it has always honored
• POST .../variables/apply documents updates[].name, which renames a variable in the same transaction

Project lookups now answer with the codes this reference documents. Seventeen routes that take a project slug answered an ambiguous slug with the generic 409 request.conflict and a missing project with 404 request.not_found. They now send 409 project.ambiguous_product and 404 project.not_found, like the routes that already did. The statuses are unchanged, so code that branches on them keeps working.

• Affected: reading, updating, deleting and exposing environments, reading, updating and deleting projects, every variable route under an environment except single create and apply, and listing and publishing versions
• POST .../expose answered an ambiguous slug with 409 project.not_found, and now sends 409 project.ambiguous_product

A live subscription no longer blocks DELETE /workspace. The workspace goes and its subscription is canceled with the billing provider in the same call, immediately and with no refund for the rest of the period. The 409 workspace.delete_has_subscription branch is gone and the code has been retired from the error vocabulary.

• The cancellation is attempted once the workspace is removed, so a billing provider that refuses it leaves the subscription live rather than failing the delete. It is still cancellable from the customer portal, which any workspace's billing page opens
• The billing recipients, meaning every member holding billing:manage or workspace:update, are emailed a confirmation naming the workspace and the canceled plan
• The other four preconditions are unchanged: the owner only, never your last workspace, at least 7 days old, and no projects left

Envless no longer rate limits anything you do. The per-invite resend cap and cooldown are gone, so invites.resend() never answers 429 and can be called as often as you need. Only a missing invite (404 invite.not_found) and an expired one (409 invite.expired) refuse it. The matching caps on members.invite(), which used to refuse a repeat invitation to an address already holding a pending invite, are gone too.

• EnvlessApiError.isRateLimited and retryAfterSeconds stay, and the client still retries a 429 with backoff. A 429 can now only have come from infrastructure in front of the API, such as a CDN or a proxy
• resendCount and lastResendAt are still returned on InviteResource, but they are bookkeeping rather than a budget

These public API endpoints were added so the SDK could reach everything the CLI can. They are available over plain HTTP too.

• GET /workspaces and POST /workspaces, the first endpoints that read the key owner's memberships rather than the bound workspace
• DELETE /workspace
• PATCH /workspace now accepts virtualEnvsEnabled
• GET, POST and DELETE /workspace/domain, plus POST /workspace/domain/verify
• POST /projects/{slug}/environments/{environmentSlug}/expose
• DELETE /members/me