# Changelog

Every change to the Fare API, newest first. Within `/v1` changes are additive only (see
[Versioning](https://fare.dev/docs/#versioning)). Fare has not launched publicly yet; the renames
and the removal below happened before launch.

## 2026-10-28

- Fixing PDFs moved to Remediate: https://remediate.now/developers/. The old endpoint now
  returns `410 moved` with that link, and is never billed. `POST /v1/pdf/validate` is unchanged.

## 2026-10-15 (MCP)

- Remote MCP server at `https://api.fare.dev/mcp` with tools `grade_email_security` and
  `validate_pdf_ua`, billed like the REST calls. OAuth 2.1 (dynamic registration, PKCE) or an
  API key.

## 2026-10-15

- `GET /v1/email-grade`: the SPF check now counts DNS lookups through nested `include:` and
  `redirect=` records, as receivers do. It fails a record that needs more than 10, and fails an
  include that has no SPF record. The SPF notes show how many of the 10 are used.
- Every error is now JSON with a stable `code`, including the ones the framework raises:
  `not_found` (404), `method_not_allowed` (405), `file_too_large` (413),
  `unsupported_media_type` (415) and `invalid_request` (400, such as a missing `domain`).
- Billing is usage only. Calls from a key without a card on file return
  `402 payment_required`, and from a suspended account `402 account_suspended`. These replace
  `subscription_required`.
- `GET /v1/account` returns `access` and `monthly_cap`. These replace `plan` and
  `monthly_quota`.

## 2026-10-14

- `GET /v1/account`: your key's status, limits and calls this month.

## 2026-10-13

- `POST /v1/pdf/validate`: PDF/UA-1 and PDF/UA-2 validation with veraPDF rule ids.
- `GET /v1/email-grade`: an A–F grade for a domain's SPF, DKIM and DMARC, with fixes.