Release v3.0.0

3.0.0 (2026-09-08)

Features:

• Add Lists API: CreateList, GetAllLists, GetList, UpdateList, DeleteList, QueryLists.
• Add List items API: CreateListItem, GetListItem, UpdateListItem, QueryListItems, CountListItems, ArchiveListItem, UnarchiveListItem, CreateBatchListItems.
• Add Privacy API: RequestUserData, DeleteUserData (POST / DELETE /v1/privacy/users).
• Add Events API (enterprise): EventsSchema, QueryEvents, GroupEvents.
• Add webhook signature verification: Castle.Webhook.Verify(body, signature) and Castle.Webhook.Verify(body, signature, apiSecret), validating the X-Castle-Signature header (HMAC-SHA256, Base64). Adds CastleWebhookVerificationException.
• Add CastlePaymentRequiredException for HTTP 402.
• Add ActionRequest.Expand for the expanded Event response.
• Add typed expanded Event fields on RiskResponse (id, name, type, status, created_at, authenticated, endpoint, email, ip, user, metrics).

Maintenance:

• Target net10.0, net8.0, netstandard2.0 and net48; drop the net461 and netcoreapp3.1 build configurations.
• Remove the Sentry dependency; runtime/platform information is now resolved via System.Runtime.InteropServices.RuntimeInformation.
• Bump Newtonsoft.Json to 13.0.4.
• Build, test (across all target frameworks, including net48) and pack on GitHub Actions (checkout / setup-dotnet v5); add an .editorconfig.
• Bump test packages within the same major: xunit 2.9.3, NSubstitute 5.3.0, FluentAssertions 6.12.2, Microsoft.NET.Test.Sdk 17.14.1, coverlet.msbuild 6.0.4.

BREAKING CHANGES:

• Remove the legacy Authenticate and Track endpoints (CastleClient.Authenticate / Track and the matching Build*Request / Send*Request methods) and the Verdict response. Use Risk, Filter and Log instead.
• Remove device-management endpoints: GetDevice, GetDevicesForUser, ApproveDevice, ReportDevice, ArchiveDevices (and the Device, DeviceList and User response models).
• Remove impersonation endpoints: ImpersonateStart, ImpersonateEnd (and the ImpersonateStartRequest / ImpersonateEndRequest models).
• Remove client-id extraction: Context.FromHttpRequest no longer reads the X-Castle-Client-ID header or __cid cookie, and RequestContext.ClientId and DeviceItem.IsCurrentDevice are removed. The default request context is headers, ip and library.

Release v2.3.0

2.3.0 (2026-04-02)

Added scores property to RiskResponse, exposing individual score breakdowns (e.g. account_abuse, account_takeover, bot) from the Risk API

Release v2.2.0

Added support for skip_request_token_validation and skip_context_validation options,
Added .net8 support

Release v2.1.0

Better error handling, removed X-Castle-* headers from allowlist, added policy to the failover for risk and filter

Release v2.0.2

Added device fingerprint to risk/filter response

Release v2.0.1

Enhancement

Added support for name property

Release v2.0.0

Features:

• #56 Support for Log action

BREAKING CHANGES:

• #57 Dropped Events list - please use recognized events instead

Release v1.6.0

Features:

• #54 Add Risk and Filter actions, updated default headers list, project maintenance updates

Release v1.5.0

Features:

• #43 Add IpHeaders, TrustedProxies, TrustedProxyDepth and TrustProxyChain configuration options

Enhancements:

• #48 Update the readme with new config options
• #47 Add more tests for the context section

Release v1.4.0

Enhancements:

• #40 Update the list of allowed headers
• #39 Update references and libraries
• #37 Update license information