What shipped, and when

Added

• An agent can put images into your documentation. Writing a documentation page over MCP covered the words but not a single screenshot: every image had to be uploaded by hand in the editor and its address carried back. Five new tools close that — upload_doc_image for content images, and upload_branding_asset, delete_branding_asset, upload_custom_font and delete_custom_font for a portal's logo, favicon, social image, backgrounds and typefaces. The limits are the editor's own (5 MB per image, 2 MB per font, WOFF2) and the conversion to WebP still happens on our side. The file travels base64-encoded in the call rather than as a path, because the MCP server runs in the Routebase cloud and not on the machine your agent works from. The address that comes back is root-relative and belongs in the page exactly as given — an absolute blob address stops loading once a portal moves to your own domain.
• Documentation images can be listed and removed. list_doc_images names every content image of a documentation with its address, size, dimensions and whether a page still points at it; delete_doc_image removes one. An image a page or snippet still uses is refused rather than deleted, and that check covers every version of the documentation, not just the newest — a published older version keeps the images its pages were written with. Both are available over REST as well.
• Guides in a repository carry their images. sync-guides transfers Markdown and images together: write a repo-relative reference such as ![Endpoint tree](<Section 3/endpoints-tree.png>), and the sync finds the file, uploads it and rewrites the reference to its portal address. The same image keeps the same address — its name is derived from its content — so repeated runs neither duplicate anything in portal storage nor mark untouched pages as changed. A local manifest skips files that have not changed, --dry-run shows the planned uploads without writing, and --force-images transfers everything again. Addresses already pointing at the portal are left untouched, so nothing needs migrating.
• A rebase conflict shows what actually differs. Bringing a branch up to the current main state meant choosing between Take main and Keep branch for each conflict without seeing either side. Every conflict card now carries a table of the differing fields with the value on main and on the branch side by side; lists such as parameters and responses appear line by line as a +/− diff, so a parameter added on the branch is immediately visible. Above the table stands who last touched which side and when, and under the two buttons the consequence in one sentence. From the second conflict on the cards start collapsed. The choice stays deliberately per entity — merging field by field is not offered.

Improved

• Saving in the settings works the same way on every page. Save and Discard sit together at the bottom right of a card, they appear with your first edit rather than sitting greyed out, and they leave again once the change is stored — a card you have not touched shows no buttons at all. The labels are the same everywhere (Save changes, or Create … when something is being added), success is reported once and inline instead of as a toast, and a switch that saves immediately shows a small Saving… / Saved at the control rather than filling the screen with notifications. Where an entry is invalid — score weights that do not add up to 100 %, for instance — the button stays visible and greyed out, because there the grey button is the explanation.
• Unsaved work is harder to lose. A dialog no longer closes when you click beside it, and around 85 forms across the product — from New endpoint through monitors and webhooks to the organization settings — ask Discard changes? on Escape, the close button or Cancel while something is filled in. Leaving a settings page with unsaved edits, by the navigation or the back button, asks the same question. A successful save closes without asking, an untouched form closes as before, and the command palette still closes on a click beside it.
• Five consequential actions ask first. Deactivating AI Assist, Reset to Defaults in the API Designer (which also resets every keyboard shortcut — the dialog now says so), switching an SSO connection on or off, and rotating a SCIM token each carry a confirmation. Enable All / Disable All for the built-in matching rules now covers every rule of the chosen filter rather than the twenty on screen, and names the count.
• A modified schema in a merge request shows its changes. Opening a schema marked Modified in the Changes tab used to reveal an empty area: the branch comparison knew that the definition differed, not in what. It now uses the same comparison as the version diff — added, removed and changed properties line by line with type and required marker, changed enum values likewise. With an intended side effect: because the breaking-change rules read exactly this data, a branch diff now also recognises a field becoming required or an enum value disappearing, so the breaking counter of a merge request and the approval on breaking changes policy apply to schema changes too.
• Notes in sequence diagrams stay inside their box. A note spanning two participants takes its width from the distance between them, so a longer text used to run past the box on both sides. Routebase now measures the finished diagram and, where a note overflows, redraws it once with more room until the text fits. This holds across all three places a diagram appears — the app preview, the portal preview and the published portal — and diagrams that never overflowed are drawn exactly as before.
• Portal addresses are stated consistently. The canonical link, og:url, sitemap.xml, llms.txt and llms-full.txt all name a page by the same address the portal serves it under. Search engines see one page instead of two spellings of it, and an agent following llms.txt is spared the detour. This takes effect with the next portal publish, which rebuilds the portal once in full.
• The governance dashboard is organised in tabs, and the duplicate quality-score card is gone.

Added

• Images in the documentation have a display width and an alignment. A portrait screenshot no longer has to fill the whole text column: select an image in the editor and set it to 25 %, 50 %, 75 % or 100 % — and once it is narrower than the column, align it left, centre or right, centre being the default. The percentage is a ceiling on the text column rather than a zoom, so a small image is never blown up beyond its own size, the aspect ratio holds in both themes, and a page does not jump while it loads. A light/dark pair takes both settings together. Pages maintained outside the editor carry them as classes — class="docs-img docs-img--w50 docs-img--right". Without a width set, nothing changes.
• A click on an image opens it full size. Every content image on a documentation page enlarges up to its own full resolution — in the Doc Hub preview and on the published portal alike — so an annotated screenshot stays readable on a phone and a deliberately narrowed one stays readable at a desk. Escape, a click beside it or the close button bring you back; the keyboard path works the same way and returns the focus to the image it came from. Where a page carries a light/dark pair, the variant the reader is looking at is the one that opens, and an image wrapped in a link stays a link. There is nothing to switch on. Existing portals pick this up on their next build, which re-uploads every page.
• An environment shows how it got to the version it runs. Every promotion has been recorded from the first one; the Contract tab now opens that record per API. Each entry names the version, when it was promoted and — the column that carries the weight — where it came from: stated in the UI, reported by the pipeline, or deployed by Routebase. Routebase does not deploy your service, so a pin set by hand is an assertion while one reported by a deploy job is a fact, and the two should not read alike. The promotion that froze a contract and the one that was a walk back are marked as such, and Pin this again takes an earlier version through the ordinary promote dialog, warnings included. The rollback button stays where it is: one click for the common case, with the precise way beside it.

Improved

• The promote dialog offers every version, not just the draft. An environment running 1.2 while 1.4 is being designed can now state what it actually serves — the version is a choice rather than whatever sits in draft. The previous candidate stays preselected, so the one-click path is unchanged, and deprecated versions are left out. The freeze warning follows the version you pick: one that is already frozen gets a calm note instead of a warning about something that cannot happen a second time.
• Diagrams look like the portal they are published in. Mermaid diagrams render in the portal's own typeface and colours — dark mode and your organization's primary colour included — instead of the library's stock theme. Edge labels have room to breathe, nodes sit further apart, rectangular shapes carry soft corners, and the layout is measured with the real font once it has loaded, so a multi-line shape keeps every line. One configuration drives all three places a diagram appears: the published portal, the preview, and Markdown inside the app.
• Search results name the API they belong to. In a project with more than one specification, two endpoints sharing a path were told apart only by opening them. Endpoints, schemas and tags now carry project › API as their context. Results that belong to no specification — projects, test suites, mock rules and organization documents — are unchanged.

Changed

• A test suite's base URL and variables come from the environment. The suite configuration no longer carries its own Base URL and Suite Variables fields. A run resolves the base URL and the variables from the environment it is started against, and run-specific values from the data set — in the app, in scheduled runs and in the CLI alike. Suite authentication (Inherit, Custom or None) is unchanged.

Added

• The CLI runner is on nuget.org. dotnet tool install --global Routebase.Cli installs routebase — run test suites with JUnit output your CI renders as a real test report, run security scans with SARIF export and a threshold gate, promote a version after a deploy, and pull documentation as Markdown files out of the Doc Hub and write it back, with optimistic concurrency, --dry-run, and the guarantee that it never deletes anything. From 1.0.0 on, exit codes and flag names are part of the contract. US-hosted organizations set their region once with routebase config set-region us, or per pipeline with ROUTEBASE_REGION. A new CLI section in the docs covers all of it. See the CLI overview.
• SSO setup guides for Okta, Microsoft Entra ID, Google Workspace, OneLogin and Ping Identity. Each one walks the order that actually works: create the SAML application at your identity provider with placeholders, create the connection in Routebase, then carry the real Entity ID and ACS URL back. They name the exact pages — Domains, Single Sign-On, API Keys and Audit Log each have their own — and the one step people miss: a domain verified after the connection exists needs the connection saved once more before it routes. New portal section SSO Setup, linked per provider from the SSO page.
• A folder in the Doc Hub is a working surface. Clicking a folder or a section opens an overview beside the tree: its slug, a description field that saves when you leave it, the numbers that matter (pages, changes since the last publish, last edit and who made it), and its contents as a list you can reorder by handle — the same call as dragging in the tree, so both show the same order. Every page edited since the last successful portal build carries a "Changed since publish" dot, subfolders roll their pages up, and the header names the total. Create a page or subfolder, rename, change a slug or delete right from the surface. Read-only versions show the same overview without the fields and handles.
• The documentation opens on a version overview. Instead of an empty pane, the Doc Hub greets you with the state of the version you are in: whether it is live and at which address, how the last portal build went, and whether an embedded API specification has moved on since.
• PHP code samples — and a language selection that takes effect. PHP joins the generated samples, built on the cURL extension every PHP installation ships with, version header included. And the languages you pick in the documentation settings are exactly the tabs that appear, in the app and on the published portal alike. Deliberately forgiving: no selection, or one that matches nothing, still shows every language — an endpoint page without a code sample would be the worse outcome. Existing portals pick this up on their next build, which re-uploads every page.
• A test suite sets its fixture scope. All fixtures (the default), only the selected ones, or all except the selected ones, across the project's fixtures and those imported from the organization library — the latter under the name a run actually resolves them by, alias included. update_test_suite takes the scope over MCP too. The scope is per suite, not per test case, and that is deliberate: a suite loads its fixtures once for every case, so values captured with CaptureToFixtureName stay visible to later ones.
• The branch workflow has the surfaces it was missing. The Merge Requests page opens on four figures — open requests, merges in the last 30 days, the share of merges carrying breaking changes, and the average time from opening to merge — and splits into Requests and History, the merges in the order they actually landed, each with the changes recorded at its merge. A merge request's detail view carries a History tab with its review trail. Manage Branches in the branch picker opens the full branch list for the current version, closed and merged ones included, filterable by status — and the one place to close a branch. Merges from before this release carry no timestamp and are left out of all four figures rather than counted as zero; the page says so.

Improved

• Reviewers are picked from your organization. Adding reviewers to a merge request is a searchable member list with avatars and roles, not a field asking for identifiers.
• A merge request states whether the branch breaks the contract — read from the actual diff between branch and base — and the merge policy can require an administrator's approval before such a branch lands.
• A test step blocked by a read-only environment reads the same everywhere. Routebase refuses write requests against an environment marked read-only before they reach the network and reports the case as Blocked, not failed. Scenario runs now say so as plainly as suite runs do, and the summary toast at the end of a run counts Blocked and Pending as their own states rather than folding them into failures.

Changed

• Billing access rests on two permissions. billing:read — every member — carries the plan and limit information the product uses to explain why something is gated. billing:manage is owner-only and governs the billing pages and every change to a subscription.

Added

• Contract drift has a page of its own. Under Monitoring → Contract Drift, every endpoint whose live responses no longer match its contract is listed — grouped by endpoint (method, path, spec), with one row per environment naming since when it has been drifting, when it was last seen, how many of the checks are affected, the individual deviations, and the contract version they were checked against. Filter by severity, environment and time range; the sidebar carries a counter. The card on the health dashboard stays, carries the same name, and links through with View all. Agents get the same list as list_contract_drift.
• Every deviation is an event with a history. Acknowledge keeps it in the list but takes it out of the sidebar counter; Resolve closes it, with a note if you want one; both can be undone. When the endpoint matches its contract again the next check closes the event on its own and says so — "Recovered on its own" reads differently from one somebody closed by hand — and "Including resolved" brings the history back. An event is defined by the fields that deviate, not by the endpoint: when a deploy changes which field is off, that is a new event, so an acknowledged "unexpected field discountCode" cannot quietly swallow a later "required field customerEmail missing" on the same route. Agents: manage_drift_event.
• Details opens the whole picture behind a drift. A table of Field · Change · Expected · Received across all deviations, a jump straight to that endpoint with Open in API Designer, and on request the response the finding was read from — status code, duration, headers and the first 4 KB of the body. The call that produced it sits in the same place: method, the URL actually hit, and the headers sent, recorded with each check rather than read from the monitor's current configuration, so a later change does not relabel an old finding. Credentials are never written into that record in the first place: only variables not marked secret are resolved, and a header carrying a credential shows its name without its value — that it went out belongs to the diagnosis, its contents do not. A deviation also names the value that actually arrived — expected Integer, got "30", where the quotes are the finding — while a missing required field says not present rather than null. Agents: get_contract_drift.
• A monitor can watch whether a field's value still moves. Contract validation catches a field that changes its shape — suddenly null, a different type, a broken format. A field that keeps returning a perfectly valid value but has not updated in three weeks passes all of it: the contract holds and the numbers are wrong anyway. Under Field freshness on the monitor, a handful of paths ($.data.updatedAt, $.items[0].price, one per line) are read on every successful check, compared with the value last seen, and kept: "Unchanged for 47 checks · last changed Aug 9, 14:02", with the value beside it. There is deliberately no threshold and no alarm — whether a value that has not moved in 200 checks is a frozen feed or a correct constant is something only you can know, and an invented limit would pass judgement on data we cannot judge. A field standing still counts neither against availability nor opens an incident. Three states are kept strictly apart because they mean different things: a fresh path says "No check has read this path yet", the first measurement says "First value recorded", and a path absent from the last response is reported as "Not found in the last response" — a missing field is unknown, not stable. Agents: manage_monitor(action: "set_freshness_watches") and get_monitor(includeFreshnessWatches: true).
• A monitor says which contract it validates against. The monitor detail view carries a line "Validated against 2.1.0 (environment pin)", and the drift card on the health dashboard the same per event. Three states: pinned (with a frozen note where the version is frozen), no pin — a neutral statement, since nothing deployed is a normal condition — and a stale pin, where the pin sits behind the published version: that monitor keeps validating the old contract, and drift against the current one goes unnoticed. Only that third case warns, and it offers "Re-pin … to 2.1.0" on the spot. The version used is recorded at check time, so a re-pin does not relabel history. The "Watch for drift" dialog names the baseline before you switch it on.

Improved

• Publishing a version takes 37–50 % less time, and the gap grows with the size of the spec. Two pieces of work nobody was waiting for — the diff against the previous version behind the breaking-change notification, and the recalculation of the governance score — now run in a background job, as documentation, mock, test and monitor synchronisation have done for a while. Measured on a spec with 600 endpoints: 21.8 s → 13.1 s; at 50 endpoints, 4.8 s → 2.4 s. Nothing changes about what happens: the breaking-change notification still goes out, the governance score is still recalculated after every publish — opening the governance dashboard in the same second shows the previous figure for a few seconds.
• A failed check says what kind of failure it was. Every failure now carries a structured reason, shown as a badge in the check list: Auth failure (401/403, or the environment auth failing to resolve at all), Timeout, Connection error, Schema drift (the response arrived as expected and its body failed strict contract validation), and Waiting for deployment. An ordinary status-code failure deliberately keeps just its status code beside it — "500" and "Status mismatch" say the same thing twice. An expired token no longer reads like a dead endpoint. The numbers are unaffected: these failures count against availability, the error-rate window and the sparkline exactly as before.

Added

• Enum values can carry a readable label and a description. An integer enum — 1, 2, 3 — says nothing on its own. Each value now takes a display label ("Mr", "Mrs") and, optionally, a description, entered right in the schema editor: a new "Show labels and descriptions" toggle turns the chip list into a grid with Value, Label and Description columns, on the schema itself and on any property. They travel by the common convention — labels as x-enumNames, descriptions as x-enumDescriptions — so an imported spec that already carries them shows its labels immediately, and both survive publish, export and the portal build. The docs reader and the published portal render every enum value as a badge with its label and description, parameters included, and the Markdown export carries the labels into "Possible values".
• Response and request body components define their schema in the editor. A newly created component offers Add Property to build a schema inline and Link Schema to point at an existing one — from the empty state and from the schema card's header, where a linked component shows Unlink instead. A schema can also be dragged onto the card straight from the sidebar. Unlinking keeps the content: a previous inline schema comes back, and where there was none, a copy of the linked schema stays behind.
• The schema table's columns can be resized. Name, Type and Example have handles on the column edge, and a double-click restores the default. The widths apply across every schema table — response body, request body, component and shared-schema editors — and survive a reload.

Improved

• An object[] property is filled in like any object. Item properties are ordinary child rows: add, rename, retype, move, delete, or drag another property in to nest it — in every property table and at any depth. A property that switches between object and object[] takes its children along. Items that reference another schema (Category[]) stay read-only by design; those fields belong to that schema and are edited there. A schema whose own type is Array with Inline Object items behaves the same way, and a schema dropped from the sidebar onto the Items block becomes the list's item type (Category[]).
• Following a $ref leaves a way back. Clicking the link icon beside a type like Category[] opens that schema, and the editor now carries a "← Back to GET /categories" chip at the top — it stays while you scroll and disappears once you navigate elsewhere. Reference icons work in the schema editor's own property table too, so a jump from one schema to the next is remembered the same way.

Added

• Delete a workspace — with 30 days to change your mind. Deleting an organization is a scheduled operation. A pre-check states what stands in the way before the dialog opens (an active subscription is cancelled first; one that is already cancelled but still running does not block), the dialog names the member count and what is kept, and asks you to type the workspace name. Every member is signed out immediately, and the owner receives a mail with a restore link that works for 30 days without signing in — it brings the workspace back at its original address, with all memberships intact. After the 30 days a daily run removes the workspace across all 13 modules, including published portals and their custom domains. Where there is an invoice history, the accounting records and their anonymous anchor are kept for the statutory retention period; where there is none, nothing remains.
• Delete your account, yourself. A new Delete account card sits below the data cards on your profile. A pre-check says what would happen: a sole owner of an organization with other members transfers ownership first, an active subscription is cancelled first, and a sole owner without other members takes the workspace along — the dialog says so in as many words. Accounts managed through SSO or SCIM point to their identity provider instead: that lifecycle belongs to the IdP. The dialog lists what is deleted and what is kept, and asks you to type your own email address. The confirmation mail carries a one-time "Keep my account" link that reverses everything for 30 days — account reactivated, a co-deleted workspace restored at its original address.
• Download a complete copy of your personal data. A new Your data card on the profile page hands you everything tied to you as JSON: profile, memberships, chat history with messages, personal variables and their values, notifications, preferences and usage data (AI runs, credits, review activity). This covers the right to data portability (GDPR Art. 20). Workspace content such as specs and tests belongs to the organization and stays out — the regular export functions cover that. It also works without signing in: the farewell mail after leaving an organization carries a download button with a one-time link, valid for 30 days.
• A verified domain belongs to the organization that verified it. Anyone whose address sits under a domain an existing organization has verified (max@acme.com while Acme Corp has verified acme.com) joins that organization through an invitation from its administrator. Only verified domains bind — listing a domain without the DNS proof binds nobody. Domain management now has its own page under Settings → Domains, visible on every plan; the SSO page itself remains Enterprise.
• Assign a security scheme to every endpoint of a spec in one go. The action "Assign to endpoints…" now sits on the security scheme itself. Pick the endpoints in one of four ways — all, by folder, by tag, or hand-picked with search — and the dialog states what you are about to do before it happens: "38 endpoints selected · 3 already have BearerAuth". It is repeatable: a second run over the same selection skips what already carries the scheme instead of duplicating it, and reports both numbers. And it is reversible: the same selection can be cleared again with "Remove from selected". Locked versions — published or deprecated — are left untouched, and the action is hidden from anyone without write access to specs.
• add_security_scheme assigns to several endpoints at once over MCP. The tool takes endpointIds (comma-separated) together with versionId and returns how many assignments were created, how many were skipped, and how many of the given ids do not exist in that version. The single-endpoint call is unchanged.
• A new style-guide rule finds paths that collide. /languages/{id} and /languages/{languageId} look different but are the same route in OpenAPI — a placeholder's name is documentation, not part of the address, and the same goes for a trailing slash. "Paths must be unique" names each pair and the endpoint on the other side; its severity is configurable per organization and per project like any rule. The create dialog says it up front, too: it names the endpoint already holding that route and keeps "Create" disabled. See the style guide.

Improved

• Code samples send the authentication the endpoint actually declares. All nine languages now follow the security scheme in the spec: API key in the header, in the query string or as a cookie (under its declared name), Basic in the form each language has for it (curl -u, http -a, requests(auth=…), SetBasicAuth, basic_auth), Bearer, and OAuth2 / OpenID Connect as bearer tokens; an HTTP scheme that is none of these is named rather than guessed, and an endpoint declaring several schemes carries all of them. The Copy button in the API Designer resolves exactly the same way as the published docs, and the Markdown form of an endpoint page names the mechanism ("X-Api-Key header") rather than just the scheme. The playground follows: it now handles Basic and query-string API keys alongside bearer and header keys, and pre-fills type, parameter name and location from the endpoint's scheme instead of having you type them.
• Code samples carry the full production URL. When no environment is released to the playground, the portal falls back to the environment with the "Feeds the public docs" role — its base URL describes precisely the contract these docs document — and appends the spec's base path (/v3), read live from the spec at build time, so a correction takes effect with the next portal build without republishing the doc version. The OpenAPI export, and with it Postman and Insomnia, now writes the base path into the servers URL, where OpenAPI 3 expects it.
• Schema aliases stay aliases, end to end. A component written as a pure reference to another (ErrorResponse: { $ref: … ProblemDetails }) is imported as an alias rather than a copy, exported back under the name the file used, and shown in the editor with the target's fields and both names in the table header — ErrorResponse › ProblemDetails, both clickable. Chains across several intermediate names are followed. Editing stays at the target, and the JSON view still shows the reference as stored.
• The endpoint editor always shows the Security row. With no scheme defined yet it reads "No security schemes defined" and offers Add security scheme, which creates one straight from the endpoint editor — and assigns it to the endpoint you have open.

Changed

• Team events now reach the people who manage members. An invitation, a removal, a role change go to owners, admins and any custom role holding org:manage-members — the same permission you need to invite someone in the first place. The invitation mail to the invited person is unaffected and arrives as before, and webhooks fire unchanged. In personal notification settings the Team category is hidden for anyone without that permission. See roles & permissions.
• Leaving, removal and workspace deletion run through one offboarding path. The Auth0 session is ended server-side; if the address sits on a verified domain of the organization being left, the account is suspended as well — the address belongs to the company. Private addresses and external consultants under a foreign domain are never suspended. The person receives a neutral mail naming the concrete date their account is removed if they do not join an organization again: 30 days. Every way back stops the clock — a new invitation lifts the suspension, and otherwise joining or signing in is enough. SCIM deactivation (active=false) deliberately stays out of this: it is reversible — parental leave, a sabbatical — and does not end a membership.
• The 14-day Pro trial is granted once per person rather than once per workspace. Registration itself stays open; only the one-time welcome trial is affected.

Added

• Test runs validate against the spec version deployed in the environment under test. A run against staging is judged by the contract staging actually serves, not by whichever version the test case happens to link to. A failed schema assertion names the version it checked against, and a test whose endpoint link has gone stale says so explicitly.
• Scenario steps open in a dialog that shows which variables they need. Clicking a step name reveals what it is made of and which variables are unresolved before you run it.
• Doc portals: the navigation sidebar is resizable. Readers can drag it between 180 and 520 px, double-click to reset it to the portal's own width, or nudge it with the arrow keys. The width is remembered per browser and applies on the next visit without the layout jumping on load.
• Doc portals: every navigation row with content below it now collapses. Previously a plain grouping folder had a chevron while a folder with its own page did not — and showed its subfolders permanently but its endpoints only while you stood on it. Every row now behaves the same, with two targets: clicking the name opens the folder's page, clicking the chevron expands it, as in any file tree.
• Doc portals: long navigation labels are truncated instead of wrapping, so every row keeps the same height, and hovering reveals the full title in a tooltip styled like the rest of the portal — same type, colours and border, and it follows light and dark mode. The portal's own tooltips replace the browser's grey boxes throughout the navigation and the API reference.
• Doc portals: the header can be lifted off the top edge. A new Top margin dial under "Header" in the design settings turns the bar into a free-floating pill together with the existing horizontal inset and corner radius. The margin survives scrolling, and everything that sticks below the header — navigation, table of contents, the endpoint bar and pinned code samples — moves with it.
• API reference: hovering a property scrolls the matching line of the code sample into view. Highlighting the line only helped when it happened to be visible; in a longer sample it was off-screen and you had to find it by hand. It now scrolls there — but only when the line is actually out of view, and after a short pause, so the sample does not twitch as you move down the property list.

Added

• MCP server — the full platform is now driveable by an agent. The server grew from 81 to 398 tools across 31 toolsets. Monitoring, Security, Projects, Variables, Mock Server and the testing workshop went from partial to complete: an agent can now create a project, manage variables, reorder and regenerate mock rules, set up test schedules and data-driven test tables, triage security findings, acknowledge incidents, and schedule maintenance windows. Alongside the tools there are now 12 resources and 13 guided workflows, including incident triage, security finding triage, and walking a deprecation to its end. Deliberately read-only: billing, plan limits, roles and team assignments are readable so an agent can explain why something is blocked — but it cannot switch a plan, buy seats, grant a role, or add anyone to a team. See the MCP quickstart.
• A dedicated address for the MCP server. It is now https://mcp.routebase.dev — the address you paste into Claude or your IDE no longer carries a path. The previous address keeps working.
• Review mode in the API Designer. A "Changes" toggle shows what has changed since a chosen baseline — the last published version by default. Changed and added endpoints and schemas are marked with a dot in the tree, folders carry a rollup count, and removed entities are listed in a popover since they no longer have a row. Inside a schema, property rows show the diff directly: added rows in green, changed rows in amber with the old type struck through, and removed properties as a read-only ghost row. Request and response bodies are marked too, including bodies that resolve through a $ref.
• Project-wide endpoint and schema overview, with duplicate detection. One surface across every spec in the project — the scale at which redundancy actually appears, and where per-spec lists cannot help. It finds exact duplicates across spec boundaries — schemas by a documentation-insensitive structure hash, so it catches Address in one spec and PostalAddress in another with identical structure, which a name search never finds. Duplicate endpoints (same method, same normalized path template) are flagged in red rather than blue: they are a potential gateway routing conflict, not redundancy.
• The style guide's path naming convention is configurable. Kebab-case is one legitimate convention among several — a .NET-style API with /AccountManagers paths is not a style violation. Pick the convention per organization and per project (kebab-case, camelCase, PascalCase, lowercase); quick fixes follow the setting, so you keep the consistency check without rewriting a single path. See the style guide.
• A new style-guide rule finds dangling references. no-dangling-refs catches a $ref that points at no schema in the spec — at design time, rather than when a test hits it at runtime. It is the counterpart to no-unused-components and carries Warning severity, so it shows in the score without blocking a publish.
• Test cases can be renamed. Rename, duplicate and delete now live in one context menu, reachable by right-click or the hover menu on the sidebar row and from the card. Double-clicking a row renames it inline.
• Mock server: delete a folder with all rules under it. The confirmation names the folder and count up front and lists the affected rules. See mock server.
• Try It: save the response body to a file. The raw body the server returned, named from request path, status code and date, with the extension following the Content-Type. The desktop app opens a native save dialog.
• Tag autocomplete in the API Designer and Testing. Typing a tag now suggests from the version's tag catalog and from the tags used on other endpoints, suites and scenarios — so Users and users stop drifting apart. Free text still wins: Enter creates what you typed unless you arrow into a suggestion.
• Undo and Redo in the designer toolbar. Both sit next to the spec title with a tooltip naming the exact action ("Undo Schema change"), and are mirrored in the command palette. They cover response status codes, content types and descriptions, schema link and unlink, and parameter edits and ordering. The endpoint tree is now fully keyboard-navigable with the arrow keys.
• "Copy From" can copy authentication when creating an environment. Auth type, all non-secret fields and {{VAR}} references come along and resolve against the variables copied beside them. See environments.
• Link an existing schema to a response, and an existing component to a request body. Attaching ErrorResponse to a 400 is now a searchable picker on the response itself, with an unlink action beside it. Dropping a schema from the sidebar links it rather than copying it, so one shared definition stays one definition.
• Desktop app 1.0.0 for macOS and Windows.
• MCP CLI 1.0.4 — routebase-mcp init now asks for your region, so US-region accounts no longer have to know about ROUTEBASE_REGION up front. See the CLI reference.

Improved

• OpenAPI import and export carry the full contract. Operation-level security requirements now survive an import and stay linked to their operations, with OpenAPI inheritance applied correctly: an operation without its own entry inherits the document-wide default, and an explicit security: [] remains an opt-out. Validation constraints — minLength, maximum, pattern, multipleOf and the rest of the schema editor's set — round-trip on both sides.
• Version comparison sees the whole schema. Changes nested below a schema's top level are now detected, as are changes to enum values alone — removing an allowed value is a breaking change for everyone who sends it, and it now surfaces as one. Fields typed as "string or null" (the OpenAPI 3.1 form MCP-created schemas use for nullable fields) are read correctly, and request body changes appear in the diff alongside responses. This is what the review mode above builds on.
• Export fidelity. $refs inside array items and composition members resolve to the full referenced schema, and fully qualified generic .NET type names shorten to a readable form (FilterFieldDtoOfSchedulerEventType) instead of being cut at the wrong boundary.

Added

• Doc portals: nested folder navigation. The portal sidebar now mirrors the folder hierarchy from the API Designer instead of flattening it.
• "Watch this API for drift" — drift monitoring for a whole spec in two clicks. Previously this meant creating monitors endpoint by endpoint. See schema drift.
• Slack and Teams alerts, properly formatted. "Add to Slack" connects a channel in one click instead of a two-minute manual setup. Incident, monitoring, security and drift messages are formatted with Block Kit and Adaptive Cards rather than raw payloads, and a security scan arrives as one message instead of one per finding. Slack and Teams integrations now have their own Messaging page in settings.
• Components overview as a triage surface. Clicking the "Schemas" or "Shared" sidebar header opens an overview in the main panel. See shared library.
• Callouts, tabs and mermaid diagrams in endpoint descriptions, via slash commands in the description editor.
• A dialog warns about tag divergence when you move an endpoint into a folder whose name disagrees with the endpoint's tags; for nested folders, the nearest folder wins.

Changed

• Contract violations in array items are now classified as errors. Previously they were reported at a lower severity, which understated a real contract break.

Routebase brings the full API lifecycle under one roof:

• API design — Design OpenAPI 3.0 / 3.1 specs visually, with reusable components, a shared library, and style-guide linting. Ship changes safely: freeze a version and promote it through your environments.
• Testing — Build test suites and multi-step scenarios, drive them with fixtures, seeds, and data sets, validate response schemas with contract testing, and schedule runs.
• Mock server — Serve realistic responses straight from your spec while the frontend is still in progress. Mock server.
• Monitoring — Keep APIs healthy with uptime monitors, alert policies, incidents, and schema-drift detection.
• Security testing — Scan your APIs against the OWASP API Security Top 10 with 13 built-in scanners, including schema and mutation fuzzing. Security overview · scanner reference.
• Documentation portals — Publish branded, versioned developer docs. Tailor the look and feel and serve them on your own domain.
• Team & administration — Roles & permissions, single sign-on, API keys, and an audit log.
• Built for AI agents — A native MCP server lets agents design, test, and document your APIs directly.

New to Routebase? Start with Getting Started.