Skip to content

v2.0.0

Latest
Latest

Choose a tag to compare

View all tags
@sylvesterdamgaard sylvesterdamgaard released this 08 Oct 16:18
· 140 commits to main since this release
v2.0.0
0802d49
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Cbox ID 2.0.0: everything the console can do, agents can do too, over REST, MCP and the cbox CLI, with the same rules, refusals and audit trail. It requires cboxdk/laravel-id ^1.23.

Read UPGRADING.md before you upgrade. This release breaks the public management API.

Breaking

  • Workspace API. /api/v1/organization is now /api/v1/workspace, and workspace keys are cbid_ws_…. Old cbid_org_ keys are retired, with no aliases.
  • Admin Portal links take intents, a list of sso, dsync, domain_verification, log_streams, certificate_renewal and audit_logs. covers is gone.
  • PHP 8.5 is required.
  • Error envelopes carry request_id, and every response has an X-Request-Id header.

Highlights

  • One action, four doors. Every console write is an action, reached from the console, REST (/api/v1, /api/v1/workspace, /api/v1/me, /api/v1/platform), MCP and the CLI. OpenAPI documents are generated, and so is an actions reference (docs/reference/).
  • MCP server at /mcp, on every environment host and on the platform root.
    • Agents connect with a management key or sign the person in with OAuth: dynamic registration in mcp mode, or client ID metadata documents.
    • On the root, one connection covers the whole workspace.
  • Keys and approvals.
    • Keys mint narrower keys, bounded by the parent's scopes and expiry, with cascade revoke across planes.
    • A per-key approval policy holds actions until the person approves them in Cbox Authenticator or the console. A person's token always waits for approval on Critical actions.
  • AI agents console: Agents, Approvals and Connect pages, with ready-made setups for Claude Code, Claude Desktop, Cursor and VS Code.
  • Console:
    • A context switcher that keeps your page when you switch, and new navigation.
    • An organization hub, replacing the "acting organization".
    • ⌘K search, "API" panels with curl/MCP/CLI/SDK snippets, and a Get started checklist.
    • One vocabulary across the console.
  • Enterprise:
    • Audit Logs as a product: customers' apps send events per organization, with schemas, a hash chain, retention, CSV export and a view in the Admin Portal.
    • The Admin Portal sets up SSO, Directory Sync, domains, log streams and certificate renewal, and shows audit logs. It has guides for 20 IdPs, is in six languages, and links can be revoked.
    • SAML apps owned by an organization.
    • GDPR erasure.
    • Certificate-expiry alerts.
  • Integrations:
    • Log streams to Datadog, Amazon S3 and Google Cloud Storage.
    • Standard Webhooks signing.
    • RFC 9470 step-up.
    • LinkedIn, Bitbucket, Xero and Intuit sign-in.
    • SCIM /Bulk, ETags, sorting and full filters.
  • Hosted pages (sign-in, consent, Admin Portal and mail) in English, Danish, German, Swedish, Norwegian Bokmål and French.
  • Security hardening:
    • A cross-tenant id sweep over every action.
    • Named rate limits.
    • Doctor checks for multi-replica cache and session.
    • Production settings in cbox.yaml, with secrets as references only.
  • Docs: quickstarts per framework, concepts, IT-admin guides and screenshots.

The full list is in CHANGELOG.md.

Assets 2
Loading