Changelog
What changed in the Exayard API, MCP server, webhooks, SDK, CLI and these docs. Newest first.
The read:usage scope
GET /v1/usage needs the read:usage scope. An app reads only its own usage: asking for another app's answers 403
forbidden. See Scopes and Pricing.
Archive takes the write scope
Archiving needs the resource's own write scope, not admin:org: write:projects for a project or a page,
write:products for a product or a list, write:vendors for a vendor, write:labor for a labor rate, crew or
equipment, and write:conversations for a conversation.
Widgets and custom properties are admin only
Only an admin of the company can create, change or remove a widget or a custom property, in Exayard. An app that
tries gets 403 forbidden, whatever its key or scopes.
A second takeoff start answers 409
Starting a takeoff for a project that already has one running answers 409 ANALYSIS_IN_PROGRESS, from both
POST /v1/projects/{id}/assessments and POST /v1/projects/{id}/analysis/run. It used to answer 400 with the
detail "Invalid request". See Errors.
Disconnecting an integration that is not there answers 404
DELETE /v1/integrations/{id} with a malformed or unknown id answers 404 not_found. It used to answer 400.
Restoring a project
POST /v1/projects/{id}/restore answers 204 when the project was archived, and 409 conflict when the project is
already active.
Unknown line-item fields are named
A line item sent with a field the API does not know answers 400 invalid_request. detail names each unknown field
and lists the fields a line item takes. Nothing is saved.
Attach moves the file
POST /v1/projects/{id}/files/{fileId}/attach moves the file into the project. A file from another project brings
its pages with it and leaves that project. A file that has not been processed yet is processed now. The reference
used to call this a link.
Keys live in apps
Apps hold keys starting exa_live_ or exa_test_. An app can have up to 25 active keys, and each key can have an
expiry. A key set to work in its own company implies that company, so calls need no company id. Older ak_ keys keep
working. See Apps and keys.
Sandboxes
Test in a sandbox: a company linked to yours, with exa_test_ keys. In a sandbox, AI answers given during a request
are samples at $0. Samples for takeoffs and file reads are coming. See Environments and sandboxes.
Correction, 2026-10-06: takeoffs and file reads in a sandbox already return sample results at no charge, marked
"sample": true. Nothing in a sandbox runs for real AI usage.
End users and usage
Send your own customer id in the Exayard-End-User header. Read the company's AI usage by end user, app, key or
operation with GET /v1/usage. See End users and
Pricing.
What a call cost
Takeoffs, estimates and bids carry a usage field with the credits and the amount the work cost. See
Pricing.
Webhook tests, deliveries and resend
Send a test event to an endpoint, list its deliveries, and resend one. exayard listen forwards events to your laptop.
See Subscribe to webhooks.
Rate limit per key
A key that works in its own company gets 60 calls a minute of its own, within its app's ceiling. See Rate limits per key.
Idempotency kept apart per app
Two apps that sent the same Idempotency-Key could get each other's kept response. Kept responses are now kept apart
by app, key and company. See Idempotency.
Leaked keys
Every key has a fixed start and a checksum, so a scanner can find it. We are joining GitHub's secret scanning
program. Once that is live, when GitHub reports an exa_ key in a public repository, we revoke it at once and email
the admins of the app's company. See Security.
SDK 0.3.0 and CLI 0.5.0
@exayard/sdk 0.3.0 and @exayard/cli 0.5.0 come to npm with the next release. See the Quickstart and
Use the CLI.
Docs search, Markdown copies and this changelog
Search every docs page with / or Cmd-K. Each page has a "Copy as Markdown" button and a Markdown copy at its address with .md added, such as /quickstart.md, and /llms.txt lists them all for AI coding agents. Tables in the docs now render as tables.
MCP server
124 tools, prompts and elicitation, structured content and tool annotations.
Webhook endpoints
Signed with HMAC-SHA256, retried for up to 3 days.
OAuth Dynamic Client Registration
MCP clients register themselves (RFC 7591) without anyone filling in a form.
Errors as RFC 9457 problem details
Every error is application/problem+json with a stable code, doc_url and request_id.