Changelog

​

Added

• Five end-to-end guides, one per newer engine, each grounded in the server’s spec and source: Sync a Shopify store with NetSuite, Your first EDI 850 → 855 → 856 → 810 cycle, Gate a refund with a verified decision (NSR), Run a durable order workflow end to end (Temporal), Automate a back-office tool that has no API (Computer Use).

​

Fixed

• Every documented stateset CLI invocation is now one the CLI accepts (63 rejected flag/subcommand pairs rewritten to the real grammar or to the REST call).
• EDI overview: the outbound 810 example showed a JSON response; the server returns the wire-ready X12 interchange.
• Temporal: GET /v1/workflows/order-fulfillment/{id}/status documents the bare "<status>:<phase>" string the handler actually returns.

​

Removed

• 349 legacy StateSet One API pages (api-reference/<resource>/*, response-api-reference/*) that targeted a host with no deployment. Each URL now redirects to the iCommerce or ResponseCX page for the same endpoint where one exists, otherwise to that tab’s overview. The api-reference/v1/* pages are kept.

​

Changed

• Realistic examples on every generated page. Request and response examples now use values a reader can recognise — emails, SKUs, addresses, plausible amounts — chosen from the field name, with the spec’s own examples taking precedence.

​

Fixed

• Temporal Engine (137), Sync Server (74) and ResponseCX (17) responses typed. Each server’s OpenAPI left these as untyped objects or referenced schemas it did not export; the fields are now transcribed from the handler that returns them (spec/overlays/*.json, merged at generation time so a fresh export never wipes them). Pages whose handler answers 201/202/204 no longer list a spurious 200. Reference pages grading D went from 231 to 12.

​

Changed

• Introduction and Why StateSet aligned to the same messaging — the competitive framing now says what the matrix says (helpdesk AI automates interactions; iPaaS is excellent orchestration; StateSet sits above and across your ERP, not instead of it), with the objection-handling answers added to the hard questions.
• StateSet Overview rewritten to the 2026 messaging matrix — “StateSet is the iCommerce company; the iCommerce Engine is the execution layer for AI commerce” — with the Engine’s parts mapped to their API tabs, the six pillars, audience messaging, and where each part stands today. Unsourced metrics are gone; the figures that remain are the scoped ones from the evidence ledger.

​

Added

• Agents API tab — the 35 routes of the stateset-agents FastAPI gateway (agents, conversations, training jobs, /v1/messages, /v1/chat/completions, observability), exported from the app’s own OpenAPI. Self-hosted; no StateSet deployment exists.
• Chat Widget API tab — the 39-route contract a backend implements for the Response chat widget (POST /api/chat with its SSE event stream, threads, catalog, cart, settings, review, analytics) plus the widget admin server’s API. Authored from the repository’s APIS.md and docs/ADMIN-API.md; customer-specific flows are left out.
• Sync Server API tab — 86 tenant endpoints from the spec api.sync.stateset.com publishes; the 39 admin operations are excluded.
• Computer Use API tab — the 90 versioned v1 endpoints, exported from the platform’s own FastAPI app. The production host answers 503 today; the pages document the contract.
• NSR API tab — 259 endpoints from api.nsr.stateset.com’s published spec, in 37 groups; the docs previously covered 13.
• EDI API tab — 116 endpoints from edi.stateset.com’s published spec.
• For AI Agents dropdown — every MCP server (15) and every skill (8) in one place. Four skills published for the first time: NSR, Computer Use, Voice, Sync Server.
• Skills overview — the .md URL convention, how to load a skill into an agent harness, and how skills pair with MCP servers.
• Sandbox: webhooks page — 24 events, subscription, payload envelope, HMAC verification in three languages.
• ResponseCX: the approvals queue — where a money-moving action waits on suggest.
• NSR: SDKs page (Node, Python, Rust, Go) and the v0.9.4 proof-verification changes.
• stateset-agents: the six additional RL objectives and the four rented-GPU commands.
• iCommerce: the 24 stable invariant error codes an agent can branch on, and the two ICP conformance profiles.

​

Removed

• Five Sync Server endpoints built for individual accounts (/sync/capacity*, /sync/luminous*) are not shown; spec/exclusions.json keeps them out of regeneration.

​

Changed

• The StateSet One API tab is no longer in navigation. All 509 of its pages target api.stateset.com, which has no deployment; the pages stay at their URLs until a host exists, and the iCommerce tab is the reference for that surface.
• Navigation is now three dropdowns — Documentation, API Reference, For AI Agents — with the tabs inside each, instead of eleven top-level tabs.
• The Resources tab is gone; its five app pages live under Documentation → Apps & Consoles.
• curl examples on NSR and Temporal Engine pages lead with the X-API-Key header each service lists first; Bearer is still accepted.
• Computer Use authenticates with X-API-Key, not Bearer; the MCP page’s host corrected to api.computer.stateset.app.
• EDI pages point at edi.stateset.com — their paths were already right, their host was not.

​

Fixed

• A generated page that did not compile: a markdown list inside a field description. Field descriptions are single-line now.
• NSR’s spec declares four query parameters as path parameters; the generator reclassifies any “path” parameter the URL cannot carry.

​

Added

• Voice API tab — 65 tenant-key endpoints from api.voice.stateset.com’s published spec.
• Sandbox API tab — 17 endpoints from the controller’s spec.
• Temporal Engine API tab — 170 endpoints from the engine’s spec at api.workstream.stateset.com; nine of its eleven workflow families had never been mentioned.
• iCommerce invariant error codes and ICP conformance profiles; sandbox webhooks; ResponseCX approvals queue; NSR SDKs and 0.9.4 changes; stateset-agents algorithms and rented-GPU commands.

​

Changed

• The sandbox host is api.sandbox.stateset.app; 92 places said .com, which does not complete a TLS handshake.
• Pages whose spec types the response as an untyped object now say so instead of showing a blank Response section (164 across five specs).

​

Fixed

• 22 broken StateSetSandbox imports — an earlier casing pass had renamed the SDK’s class.

​

Changed

• The Quickstart runs against response.stateset.com/api/v1, the live ResponseCX API. Every claim on it is read from the server’s spec. Its previous version made three requests against a host that serves nothing and one against an endpoint that never existed.
• Four long “quickstarts” (876–2,361 lines) retitled as guides and moved to their topic groups; the two iCommerce quickstarts distinguished by title and cross-linked.
• sdk-installation lost 1,643 lines describing Ruby and PHP SDKs that are published nowhere.

​

Fixed

• Twelve ResponseCX endpoint pages retired for contradicting the published spec (rules and functions are agent-scoped and have no delete; responses are read-only). The Rules concept page’s example used name/type where the schema requires rule_name/rule_type.
• Two Cloud “update” pages that were copies of their create pages.

​

Added

• ResponseCX API tab — 38 endpoints from the spec response.stateset.com publishes, with a playground on each. Every page names the scope its key needs and its per-minute rate limit.
• iCommerce API tab — the 513-page reference moved out of API Reference into its own tab.

​

Changed

• The iCommerce spec caught up with the engine: 10 new endpoints (warehouse bins, return dispositions), and monetary amount re-typed from float to exact-decimal string.

​

Fixed

• Five ResponseCX agent pages with the wrong host, prefix and method, and one endpoint that does not exist — redirected to the generated pages.
• A misspelled endpoint (/v1/attritbutes) and nine pages whose path disagreed with their own directory.

​

Fixed

• 506 Go, Java and C# strings written with JavaScript’s single quotes — compile errors in all three languages. 82 missing Go trailing commas. A Rust metrics example using lazy_static syntax the engine no longer uses, with two metric names wrong. Two Ruby blocks using capitalised locals.

​

Fixed

• 78 GraphQL blocks that did not parse — mostly a stray backtick left from a template literal; four genuinely malformed queries.
• Two mermaid diagrams that rendered as an error box (parentheses in unquoted labels).
• A section of the sandbox production guide swallowed by an unclosed YAML fence.
• 25 page titles showing { instead of {.
• Eight TypeScript blocks hiding a JSON response inside a code fence.

​

Added

• Roughly 200 MCP tools documented for the first time across six servers; every count verified against a live tools/list.
• scripts/check-mdx.mjs — every page is compiled with a real MDX parser in CI.

​

Changed

• Theme aligned to stateset.com’s design token #1A62FF; the light-mode accent had been a near-black.

​

Fixed

• 359 code samples that could not run: 341 X.method({ 'id' }) calls, 17 misplaced semicolons, one const return.
• Three pages that did not render at all.
• Numbers that had drifted: 203 tables documented as “70+”; 155k lines documented as 55k; 719 methods as “671+”.
• 64 JavaScript and 19 Python SDK calls corrected against the live clients.

​

Fixed

• Query parameters documented as request bodies; descriptions naming the wrong resource; ids documented twice.
• Eight pages the live site had served until July were 404ing; docs.json gained its first redirects.

​

Added

• A StateSet Agents section; the ResponseCX autonomy dial; Sync Server connectors and troubleshooting; NSR console surfaces; Voice translation calls.

​

Fixed

• A page told readers a shipped product did not exist, under a package name on no registry.

​

Fixed

• Every part of the request contract had defects — auth scheme, URL, method, path and query parameters, request body — and so did the response: field types contradicted by their own examples, fields documented flat that the response wraps. Each class is now enforced by a check.

​

Fixed

• An auth header the API rejects, on 297 pages. 192 curls calling an endpoint other than the one documented. Truncated request bodies, a Python SyntaxError, JSON blocks that were not JSON.

​

Fixed

• An auth header declared nowhere; curl examples calling a different endpoint than the page documents; install commands naming packages that do not exist; 572 pages whose response section named a status code and no field.