Tuma 1.0.1

Added

• Drag requests, folders and collections in the sidebar to arrange them, or to move them into another folder or
  collection. Collections keep their order in workspace.yaml.

Fixed

• Multipart bodies sent with a Content-Type: multipart/form-data header of their own (as Postman exports have) now
  include the boundary, without which servers couldn't read the parts.
• Relative file paths in multipart and binary bodies are read from the workspace folder, not from wherever Tuma was
  started, so they work in the app and on other computers. Files picked inside the project are saved that way.
• Undo (Ctrl+Z) in the URL bar, body, script and GraphQL editors no longer erases the text or brings back another
  tab's; each request has its own history, and the URL bar has one at all.

Tuma 1.0.0

The first stable release.

Requests

• HTTP with every body type (JSON, XML, text, form, multipart, binary file, GraphQL), timing breakdown, redirects,
  compressed responses, and a response viewer with pretty, raw and preview modes and a JSON path filter
• GraphQL with schema introspection, completion and a schema explorer
• WebSocket with saved messages and a message log; server-sent events shown live; gRPC (unary and every kind of
  streaming) by server reflection or .proto files
• Auth: Bearer, Basic, API key, OAuth 2.0 (every grant, PKCE, refresh, a token manager), JWT, Digest, AWS Signature v4
  and OAuth 1.0, inherited from folders and collections
• Proxies, client certificates, extra CA certificates and a cookie jar per workspace

Workspaces

• Collections, folders and requests as plain YAML files in a folder you can commit, with JSON Schemas and
  tuma check
• Environments, folder, collection and global variables, dynamic variables, secrets in the OS keychain, and current
  values that scripts set kept on this machine only
• Workspaces created from the app in a workspaces folder (Documents/Tuma Workspaces by default), a workspace menu
  to switch between them, and workspaces imported from a folder or a .zip and exported as a .zip
• Import from Postman (collections with their examples, environments, globals), Insomnia, Bruno, OpenAPI and Swagger
  (with discovery and sync), HAR, cURL, and JSON files of names and values as environments; export to Postman and
  cURL, Python and JavaScript snippets
• Duplicate requests, folders and collections; rename anything by clicking its name
• A cookie manager: see, add, edit and delete cookies by domain, clear a domain or everything
• Responses saved as examples on requests
• Comments (// and /* */) in JSON bodies, removed before sending; Ctrl+/ toggles them

Docs and mocks

• API docs generated from requests, folders, collections or the whole workspace: OpenAPI 3.1 (YAML or JSON) with
  schemas inferred from examples, Markdown, or a standalone HTML page; in the app, with tuma docs, or by a coding
  agent through MCP
• Mock servers that answer with saved examples, matched by method and path, in the app or with tuma mock

Performance and security

• Performance tests: virtual users, a duration or iterations, ramp-up and think time; throughput, error rate and
  latency percentiles per request and per second, live charts, pass/fail limits, and reports as HTML or JSON; in the
  app or with tuma perf
• Passive security checks of the responses a test receives: HTTPS, security headers, cookie flags, CORS, information
  that leaks, secrets in URLs
• Encryption of chosen request body fields and decryption of response fields: AES-GCM or AES-CBC, RSA-OAEP (SHA-1
  as node-forge does, or SHA-256) with PEM keys, and hybrid responses whose AES key and IV come RSA-encrypted with the
  data; keys from secret variables

Scripts and testing

• Postman's pre-request and test scripts (pm.*, the older postman.* and tests[...]), sandboxed, with lodash,
  moment, crypto-js, chai, ajv and tv4
• Checks without code (expect:), and contract checks against OpenAPI specs
• A collection runner with iterations, data files, setNextRequest, saved runs and JUnit export

For terminals, CI and agents

• The tuma command: send, run, test, check, import, export, docs, mock, perf, openapi, grpc,
  ws, auth, with --json output and exit codes for CI
• tuma mcp: an MCP server so coding agents can test the API they are building, write its scripts and tests, and
  document it (describe requests, save examples, generate docs) and load-test it (run_performance_test, capped at
  50 users and 60 seconds unless raised with --max-load-users and --max-load-seconds), with host rules and
  secrets masked; the app's Scripts tab writes the prompt for them

App

• Tabs, a command palette (Ctrl+K), keyboard shortcuts, light and dark themes, history, and automatic updates
• A resizable sidebar with collections, environments and history (Ctrl+B hides it), the environment beside the tabs,
  and the request and response split by a handle you drag, one above the other or side by side
• A console (Ctrl+`) logging every request, collection run, WebSocket connection and gRPC call, each expanding to
  its network details and timing, request and response headers and bodies, and script output