Changelog

User-visible changes to ScaiVault, newest first. Versioning is API-path based — breaking changes ship under a new path version (v2) and don't disturb v1 callers.

2026-08-11 — Authorization hardening, certificate agent, enrollment, fleet#

Breaking: PKI, ACME, DNS and identity endpoints now enforce scopes#

Previously these routers authenticated the caller but never checked a scope, so any valid token reached them — including POST /pki/certificates/{path}/private-key, which returns a stored private key. 74 of 197 routes were in this state.

They now require the scope their operation implies. A service account that worked yesterday will get 403 insufficient_scope if it lacks the right grant.

acme:* and dns:* are new. pki:* already existed and was offered when creating service accounts, but nothing enforced it — so a least-privilege account was not actually least-privilege.

What to do: review your service accounts and add the scopes they now need. GET /v1/service-accounts/scopes lists the full vocabulary. Human users signed in through the admin UI are unaffected, because scope checks exempt them.

Private-key export is additionally gated behind an administrator role for human callers, and every attempt — allowed or refused — is audited.

Certificate Agent#

A new client that keeps certificates current on a host: renews before expiry, writes the bundle where the service expects it, and reloads only when something changed. Profiles for nginx, Apache, HAProxy, Postfix and Dovecot, each validating configuration before reloading.

By default the private key is generated on the host and never crosses the network — the agent sends only a CSR. Download it from scailabs.ai/downloads; see Certificate Agent.

Enrollment tokens#

Short-lived, single-use tokens that let a new host obtain its own service account and API key, instead of copying a long-lived credential to every machine. Each redemption is recorded with the hostname and source IP. See Enrollment.

Fleet visibility#

GET /v1/fleet/status answers "which hosts are about to break?", separating hosts that have gone silent, hosts reporting failures, and certificates approaching expiry. See Fleet.

Also fixed#

• PUT/GET /v1/secrets/{path} now return id, matching the list endpoint. Its absence broke typed SDK deserialization on write — the secret was created and the client then raised, so callers' cleanup never ran.
• POST /v1/federation/proxy/read and /proxy/write now enforce the secret path policy. They read and write secrets by path but never consulted the policy the secrets router applies to those same paths, so an identity denied prod/** could reach it through the proxy.
• Path policies extended to PKI and dynamic credentials, in monitor mode by default — denials are audited as policy.violation without blocking, so enforcement can be rolled out deliberately. Promote per resource type with SCAIVAULT_POLICY_ENFORCED_RESOURCES.
• GET /v1/health/detailed now requires admin:read and reports measured values. It previously required no authentication and returned hardcoded ones, so it claimed healthy during a total dependency outage. GET /v1/health/ready had the same defect in its Redis and encryption checks and could never detect an outage.
• Rate limiting on POST /v1/auth/token and /auth/refresh, which were public and unthrottled.
• CORS no longer defaults to *; wildcard origins combined with credentials are refused outright.

SDK releases — 2026-06-01#

Three rounds of SDK work landed this release. See the per-language CHANGELOGs in each SDK package for the full detail.

API-key authentication. All three SDKs now accept ScaiVault key_… API keys in addition to ScaiKey JWTs. The SDK auto-detects the key_ prefix on token and routes to X-API-Key; you can also pass the credential as the explicit api_key / apiKey / ApiKey argument. Before this release, passing an API key as the bearer token would 401 (the server tried to JWT-parse it).

Response-shape audit. Every SDK response type was re-validated against the API's Pydantic response models. 73 missing-field gaps were closed across the three SDKs (notably on Certificate, IssuedCertificate, Subscription, FederationBackend, DynamicEngine/Role, Lease, ACMEAccount/Order, AuditSummary, GeneratedSecret). The SDK no longer silently drops fields on deserialize.

Feature parity. The JavaScript and .NET SDKs are now at full parity with the Python SDK — all 127 endpoints covered. New operation clients: acme, federation, identity, subscriptions, webhooks, batch, plus dynamic.testEngine, pki.renewCertificate, and pki.deleteCA. JS/.NET PKI CSR endpoints moved from the deprecated /pki/csr/... alias to the canonical /pki/csrs/....

Server fix. SecretResponse (returned by PUT/GET /secrets/{path}) now includes id, matching the list-endpoint shape. The asymmetry had caused the SDK's typed Secret model to crash on deserialize when used via client.secrets.write() / .read().

Package downloads — scailabs.ai/downloads:

1.0.0 — 2026-05-17#

Public launch.

Available API surfaces. Secrets (CRUD, versioning, expiration, soft-delete with recovery, batch read), Policies (path-pattern rules with IP/MFA/time-window conditions), Rotation (auto and event-driven, with grace periods and warn-before notifications), PKI (internal CA hierarchy + ACME via Let's Encrypt/ZeroSSL/BuyPass/Google + CSR workflow + trust anchors + CRL/OCSP), Dynamic Secrets (Postgres/MySQL/MongoDB/Redis/AWS/Azure/GCP/SSH), Federation (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager — proxy or sync mode), Webhooks and Subscriptions, Audit log with export to S3/GCS/Azure.

Clients shipped. Python, JavaScript/TypeScript, .NET. Python and .NET fully cover the API; JavaScript covers everything except a handful of admin-only operations. CLI (scaivault) and MCP server (67 tools) for shell and agent integration.

Identity. Authentication delegated to ScaiKey. Three-level tenancy (partner / tenant / identity). Identity cache synced from ScaiKey, kept fresh by webhooks plus a 15-minute background reconciliation.

Crypto. Envelope encryption with per-row data keys wrapped by a KMS-held root. AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault Transit, and PKCS#11 HSMs (including TPM 2.0) supported.

Limits. Default rate limits per identity per endpoint category — see Rate Limiting. Quotas per tenant — see Multi-tenancy.

Public docs. This site.

What's next#

We track upcoming work in our public roadmap. The shape and content of the API is stable; ongoing work is operational (more DNS providers, more dynamic engines, more federation backends).