Changelog

2026-07-22 — Production launch — initial release (1.0.0)

thibit is live at https://api.thibit.id. What ships in 1.0.0:

• Launch scope: Mozambique + Mexico. Fully tuned treatment for MZ Bilhete de Identidade + MZ passport and MX national ID + MX passport. See Accepted documents.
• Neutral assessment vocabulary. Results carry an advisory assessment — no_material_concerns | manual_review_recommended | material_inconsistency | assessment_incomplete — and your team’s review is a separate customer_disposition. The final business decision is always yours.
• Uncalibrated document tier. Any explicit country’s ICAO-9303 MRZ passport (plus named MZ/MX documents) runs the full pipeline with the outcome floored at manual_review_recommended (reason uncalibrated_document_scope) while calibration matures. Wildcard countries in requests are rejected — always pin explicit country codes.
• Project-scoped webhooks, branding, and keys. Per-project signed webhooks (PUT /v1/projects/{id}/webhook, secret minted once on set), hosted-page branding, and key create/revoke/rotate.
• Team memberships. Invite colleagues by email + role (owner · admin · developer · compliance); they join automatically on their next OAuth sign-in. No invitation email is sent yet — share the dashboard link yourself.
• Engine Profiles + Decision Policies. Each Case is stamped with the exact engine profile and decision policy revision it ran under — immutable, reproducible run identity. See Versioning & stability.
• KYC only. type: "kyb" is rejected in production; business verification is outside this release’s scope.

2026-06-19 — Templates, Flows, Cases & intake

• Author once, run many. A new Template → Flow → Case model separates authoring a flow blueprint from running it. Author a Template in Build, activate it into a project as a Flow (a stable slug + base link), and each run is a version-stamped Case with its own expirable link. Editing a live Flow publishes a new version under the same link — running Cases are never altered. See Templates, Flows & Cases.
• Intake API. POST /v1/flows/{slug}/intake runs a Flow for a payload you already hold — pre-filling capture for the verifiee and stamping your reference record on the Case. Requires a project-scoped API key. POST /v1/verifications stays fully supported.
• Record match. A new record_match Check piece compares the collected identity data against the claimed reference data from intake and flags name / DOB / number divergences — a read-only signal that never changes the assessment. simple_match ships; rules mode ships equals + contains.
• Dashboard surfaces. Build (author Templates) · Flows (activate + share links) · Verifications (the Case list + per-Case pages) · Case Management (review) · Integrate (keys, webhooks, the intake endpoint).

2026-06-19 — Dashboard, accounts, and projects

• Session dashboard. Sign in with Google or GitHub and work inside an org → project. Manage projects, project-scoped API keys, and webhooks; review verifications in the Cases queue (recording a disposition is gated by the cases:review permission); and shape flows in the Build composer. Invite teammates with roles (owner · admin · developer · compliance).
• Project-scoped API keys. API keys now belong to a project; rotate with POST /v1/keys/rotate, or create/list/revoke them from the dashboard.

2026-06-19 — Authenticity check moved to a vision model

The document-authenticity step no longer uses Error-Level-Analysis or pixel forensics. It now runs a vision-model tamper / recapture check (alongside the existing EXIF/metadata checks) to flag edited or re-photographed images. Liveness also gained an optional active-liveness challenge (blink / head turn / nod).

2026-06 — Public docs launch

Initial public documentation scaffold for thibit developer integrations, including concepts, API overview, and a Scalar-rendered OpenAPI reference.