Skip to content
INSIDEINSIDEINSIDE Gateway
Console

Changelog

New features, improvements and changes to the INSIDE Gateway. Follow along with the RSS feed.

Area
Type

October 2026

NewDocumentationREST API

New developer site and complete response schemas

The Gateway now has a public developer site with guides, agent setup, a generated API reference and this changelog. Every REST operation documents its response schema.

The INSIDE Gateway developer site brings together:

  • Guides for creating an app and credential, authentication, safe writes, files and events.
  • AI agent setup for Codex, Claude Code, Cursor and other MCP clients, plus A2A.
  • API reference generated from the Gateway’s own operation catalogue, with the scopes, data access and MCP tool for each operation.

The OpenAPI document now includes a response schema for every operation, including discovery, configuration, AI features, reporting, directory catalogues, writes and event subscriptions. Operations are grouped by tag and have readable titles.

MCP tool output schemas are unchanged.

NewREST APIMCPA2A

Conversation, visitor and contact reads

Read stored conversations, transcripts, messages, visitors, contacts and notes over REST and MCP, with masked personal fields unless PII access is granted.

New read operations cover:

  • Conversations: list, read, transcripts, single messages with delivery status, internal transcripts with explicit permission, subject search and contact filters.
  • Visitors: visitor metadata, conversation history and visitor notes.
  • Contacts: list and field-specific search, single contacts, linked visitors, contact notes and conversation contact links.
  • Catalogues: saved responses and saved links.

Contact personal fields are masked unless the credential has contact_read_pii and the pii flag. The A2A endpoint adds a contact_inspection skill.

See all operations.

NewEventsREST APIMCP

Event pull subscriptions

Pull payload-free change receipts for up to 50 websites per subscription, over REST or MCP, with safe retries.

Create a subscription for event families such as conversation.*, then pull receipts with GET /api/v1/events and read current data through the REST API. Receipts carry no message text, personal data or resource IDs.

  • Subscription create, replace and delete accept an optional Idempotency-Key.
  • The same operations are available as MCP tools, with an event_recovery guide for agents.

See event pull subscriptions.

NewREST APIMCP

Message attachments and file content

Read attachment metadata and download file content in verified 64 KiB chunks, as JSON or raw bytes with HTTP ranges.

Three new operations read attachments for an exact conversation message:

  • GET /api/v1/conversations/{conversation_id}/messages/{message_id}/attachments
  • GET /api/v1/files/{file_id}
  • GET /api/v1/files/{file_id}/content

Content reads return a version and SHA-256 for each chunk. Binary responses support one Range header and If-Match.

See read attachments.

NewEventsREST API

Realtime sockets for change receipts

Applications can stream event subscription receipts over an origin-bound WebSocket instead of polling.

Create a session with POST /api/v1/realtime/sessions, open the socket with a single-use ticket, then attach existing pull subscriptions. Each page must be acknowledged with its exact cursor, and reconnecting replays from the last acknowledged cursor.

See realtime sockets.

ImprovedREST APIMCP

Write receipts

Check the status of a write with GET /api/v1/operations/{operation_id}, using the X-Gateway-Operation-Id returned by the write.

Write responses can include an X-Gateway-Operation-Id header, and MCP write results include operation_id. Read the receipt with the same credential to see whether the command is pending, acknowledged or outcome_unknown.

See safe writes and retries.

NewREST APIMCP

AI conversation summary report

Summarize AI-evidenced conversations for a website and period, with content-based measures available only when content and PII access is granted.

GET /api/v1/analytics/ai-conversations/summary returns volume, platform, message counts, durations and response timing for today, last-7-days, last-month or a date range of up to 31 days. Installation restrictions apply before aggregation.

Topics, sentiment, resolution, ratings and outcomes need content and PII access. Without it they are null, never zero.

MCP adds reporting resources and a performance_summary prompt.

NewREST APIMCP

AI features and configuration metadata

Read configured AI feature metadata, run offline language detection, and preview AI feature name or enabled changes without saving them.

  • AI features: GET /api/v1/ai/features and GET /api/v1/ai/features/{feature_id} return closed metadata, including whether the feature can be executed.
  • Execution: POST /api/v1/ai/features/{feature_id}/execute runs offline language detection on supplied text.
  • Configuration: catalogue, schema, item and search reads for /ai/features, plus POST /api/v1/settings/plans for dry-run previews.

MCP adds configuration resources and a configuration_preview prompt.

NewA2AOAuth

Business A2A endpoint

Other agents can send structured tasks to /a2a using Agent2Agent 1.0 and poll for the results.

The A2A endpoint supports SendMessage, GetTask, ListTasks and CancelTask, with these skills:

  • support_insights
  • conversation_evidence
  • configuration_inspection
  • offline_language_detection

A2A uses its own OAuth audience: request tokens with resource=https://api.inside.chat/a2a. Tasks share the application’s request quota.

See send A2A tasks.

NewMCP

Business MCP server

Connect Codex, Claude Code, Cursor or any Streamable HTTP client to /mcp, with tools generated from the same catalogue as the REST API.

The MCP server lists only the tools, guides, resources and prompts the credential can use right now. Tools share names, inputs, permissions and quotas with REST operations.

Public discovery endpoints were added at the same time: /api/v1/openapi.json, /llms.txt, /llms-full.txt and the OAuth protected resource metadata.

See connect AI agents.

NewOAuth

OAuth authorization code with PKCE

Hosted web applications can ask an organization owner or admin for explicit consent, with optional rotating refresh tokens.

Register up to 10 exact HTTPS callbacks on a credential, then send people to /oauth/authorize. They choose the scopes and websites to grant, and can allow renewal for up to 8 hours. Admins can review and revoke consents in the console.

See OAuth authorization code with PKCE.

NewOAuth

OAuth client credentials

Exchange a credential for a 15-minute access token bound to REST, MCP or A2A, optionally narrowed to fewer scopes.

POST /oauth/token with grant_type=client_credentials and HTTP Basic authentication returns a short-lived token for the resource you choose. Tokens can be revoked with POST /oauth/revoke.

See OAuth client credentials.

NewEvents

Signed webhook notifications

Owners and admins can push change notifications to an HTTPS receiver, signed with HMAC-SHA256 and replayable for seven days.

Set up webhooks on the Webhooks page of the console, for one website and one installation credential. Deliveries are at least once, with up to five attempts.

See webhook notifications.

INSIDE by PowerfrontChangelogOpenAPI documentllms.txt