Changelog

Notable additions and changes to the Kua API.

Changes to the public /v1 API. Ordinary schema additions follow the versioning policy. Security authorization changes can deliberately tighten existing access; see the verified security upgrade below.

8 November 2026 · SDK 0.3.3 and documentation

One API address, Test and Live keys

All public integrations use https://api.kuahr.com. Your verified Test or Live key selects supported data and behaviour; the URL stays the same. SDK 0.3.3 updates setup examples and keeps the existing client runtime. The public reference opens directly, and the docs follow your device theme with a light/dark toggle.

8 November 2026 · API

Production webhook recovery and explicit read scopes

Production now supports retained webhook attempt history and bounded, audited replay of exhausted deliveries. API keys require webhooks:replay for replay; inspection accepts an explicit webhook read, write or replay grant. The company dashboard uses Owner-controlled settings permissions; exceptional Kua operator recovery requires authorised scope and fresh identity confirmation.

Production also enforces payroll:read, events:read and test-data:clear, refuses Test reads on unpartitioned event/add-on resources, and supports paired since + afterId event continuation. See authentication, Test and Live keys, and recovery. A queue acceptance does not establish delivery or a downstream business effect.

8 November 2026 · SDK 0.3.2

Verified trusted publishing and brand links

Node @kuahr/node@0.3.2 and Python kuahr==0.3.2 include official product links and the developer contact, engineering@kuahr.com. Both publish from the public Kua SDK repository using OIDC. The npm package has verified registry signatures and provenance; manual publishing requires 2FA. Client runtime behavior is unchanged from 0.3.1.

8 November 2026 · SDK 0.3.1

Initial official SDK registry releases

Install @kuahr/node@0.3.1 from npm or kuahr==0.3.1 from PyPI. Python keeps import kua. The public source and distribution checksums are in Kua SDKs. The Node package uses Kua’s owned @kuahr namespace. All examples now use that name.

November 2026 source candidate

Explicit read grants and Test-mode isolation

Restricted keys now require events:read, payroll:read and test-data:clear for their corresponding operations. Unpartitioned events/add-on reads reject sufficiently scoped Test keys with 409 TEST_MODE_UNSUPPORTED; missing grants return 403 INSUFFICIENT_SCOPE first. * retains only mode-supported access. This intentional security tightening supersedes earlier read-all behavior. See upgrade guidance. These rules are enforced at api.kuahr.com as of 8 November 2026.

July 2026

Developer platform launch

Historical launch notes. Current SDK distribution and deployment status are described above and in the client guides.

API keys — issue, scope, and rotate keys from Settings → API keys in the dashboard. Keys support employees:write and payroll:write scopes, plus *.
Public /v1 endpoints — payroll runs (list + create), employees (create), and the events timeline.
Webhooks — register endpoints, receive signed, retried, at-least-once event deliveries, and inspect delivery attempts. See webhooks.
Test mode — kua_test_… keys operate on isolated Test data that never moves real money and auto-purges after 14 days.
Official client source — Node.js and Python. At launch, client source was version 0.3.0 and registry publication was pending. Current released versions are listed above and in SDK setup. Python distribution is kuahr, imported as kua.
Docs — this site, with a live API reference playground.