Changelog

If you belong to several workspaces and switch workspace in one browser tab, your other open tabs now say so and ask you to reload or switch back. A change submitted from a tab that still shows the previous workspace is refused, with nothing saved. A bulk dispatch action now changes every dispatch you selected or none. Reading pages is not affected, and neither are API keys, xAPI credentials or learner launch links.

A reviewer can now say how the skill is demonstrated and how much it demands. The highest level a score can prove is worked out from those answers. Content with nothing set is scored as before. API: demandRatings, demonstrationMode, passMarkScaled; GET /api/v1/capability/evidence-framework, PUT /api/v1/capability/mappings/{mappingId}/evidence-attributes.

Uploading a course, the SCORM validator, Quick Publish, test launches, opening a learner session from the Player page and recording a VR outcome are now for workspace owners and admins. Other roles still see courses, delivery and reports. With several workspaces, these work in your active workspace only. API keys and learner launch links are not affected.

Temporary backend InternalServerError responses now receive one bounded retry on read-only queries. If the backend remains unavailable, API requests return 503 BACKEND_UNAVAILABLE with Retry-After instead of a generic 500. Writes are never automatically retried.

POST /api/v1/packages/{packageId}/launch returns 409 SESSIONIDSCOPE_MISMATCH when session_id already belongs to a different package or workspace, instead of HTTP 500. Omit session_id to start a new session; same-package resume is unchanged.

Hosted SCORM packages may embed YouTube and Vimeo iframes; player CSP frame-src allowlists those hosts while keeping other third-party frames blocked.

Captivate YouTube embeds in hosted SCORM now load correctly: content CSP script-src allowlists www.youtube.com and s.ytimg.com for the YouTube IFrame API (frame-src alone left a gray placeholder).

Incomplete session progress now maps SCORM 2004 cmi.progress_measure onto progress_percent (0–99 while incomplete). GET and PUT /api/v1/sessions/{sessionId} return the documented progress alias alongside progress_percent.

Hosted Storyline packages whose SCORM entry is launcher.html now load sibling index_lms.html when that file is present. GET /api/v1/content/{…path} serves the SCO when a hosted request still names launcher.html, and falls back to launcher.html if the sibling is missing, so a blocked window.open no longer prevents the course from starting.

POST /api/v1/sessions/{sessionId}/refresh-token now returns launch_url with the fresh token already in the query string, so LMS reopen can embed the hosted player. Refresh-token still does not persist CMI; it only rotates the JWT for the same session.

Package, content, and session reads now stay responsive as workspaces grow. Package and session lists expose when a total is a bounded lower estimate, session pagination keeps its deprecated compatibility aliases, and temporary backend-capacity failures return structured retryable 503 responses with Retry-After guidance instead of an HTML error page.

Session reads now return the documented cmi_data, suspend_data, time_spent_seconds, and completion_status fields on GET /api/v1/sessions and GET /api/v1/sessions/{sessionId}, so SCORM resume and completion work for integrations built against the published schema. Existing camelCase fields are unchanged. Commit persistence is also hardened across page unload, back/forward-cache restore, and launch-token refresh.

Course lifecycle controls: archive or restore a package in place (DELETE /api/v1/packages/{id} soft-archives and stops new launches while preserving learner history), or permanently delete archived courses and their stored files from the dashboard after confirming the exact title.

Organization attribution across delivery: list organizations via GET /api/v1/organizations, optionally attach organizationId when creating dispatches, and PATCH dispatch attribution for downstream LMS reporting.

Intelligence service endpoints for role briefs, structured skill extraction, and auditable recommendation feedback under /api/v1/intelligence/*.

Flexible usage and quota alerts: separate learner and course threshold emails with signed one-click upgrade links, cumulative storage ceilings on uploads, and clearer overage guidance for Starter and Growth plans.

CALE Skills & Outcomes partner APIs: register client learning systems, resolve frameworks and skill graphs, publish versioned alignments with verifiable receipts, and query evidence-backed learner-skill projections under /api/v1/cale/*.

Webhook deliveries that fail an attempt now recover automatically: the delivery drain retries with increasing backoff and dead-letters after 5 attempts, instead of stalling on the first failure.

Webhook event documentation and endpoint scoping now list only events that are actually delivered, including package.launched and usage threshold alerts (70%, 90%, 100%).

Documentation corrections: the webhook event catalog now lists only delivered events, signature guidance leads with X-Connect-Signature (legacy X-Allure-Signature still sent), and the GET /api/v1/sessions filter reference matches the implemented parameters.

Webhook delivery records returned by GET /api/v1/webhooks now include lastResponseBody — a truncated copy of your endpoint’s last HTTP response — so you can diagnose rejected deliveries (e.g. auth errors) without contacting support.

Terminal session webhooks (completed, failed, suspended) are emitted on state transitions with signed, executor-compatible payloads that include session progress fields for downstream LMS integrations.

GET /api/v1/sessions supports filtering by user_id and package_id plus limit and offset pagination for tenant-scoped session inventories.

Partner API session reads now return progress, completion, and score fields from the same Convex source of truth used by SCORM runtime commits—no stale or divergent values after learner activity.

A customer-visible product changelog is available at /docs/changelog, with in-app What’s New highlights when you sign in.

OpenAPI and integration guides now document the required read-before-write session version flow, 409 conflict retries, and webhook signing headers (X-Connect-Signature with legacy X-Allure-Signature compatibility).

OpenAI GPT Actions schema at /api/v1/openapi-actions for AI tool integration. A TypeScript SDK (@allureconnect/sdk) and MCP server are in development and not yet published to npm.

Developer sandbox with actest and aclive API keys—start integrating without a credit card, with watermarked SCORM output and 30-day package expiry on sandbox workspaces.

PPT-to-SCORM conversion (POST /api/v1/conversions) and quick-publish (POST /api/v1/quick-publish) for JSON-to-SCORM in a single API call.

Tenant credential handoff across onboarding and Integrations: visible workspace ID, one-time API key reveal, and rotate/revoke controls.

SCORM API documentation and examples updated for the tenant ID plus API key credential flow, including launch URL token requirements.

Session cache discipline and durable continuity unified across v1 partner API and SCORM launch flows.

Credentials UX fixes in onboarding and Integrations: copy behavior, rotation/revocation actions, and checkout-success credential presentation.