Skip to main content
Dates are UTC.

2026-10-04 — Personal access tokens and connection guidance

  • Personal access tokens are available in signed-in web Settings. Read is included; optional notes.write and notes.review permissions cannot exceed the session’s permissions. The secret is shown once; tokens can be revoked.
  • Authenticated note mutations without notes.write now return 403 PERMISSION_MISSING. Supplying agent_id does not grant permission. Cloud MCP write tools require both write permission and connected write storage.
  • Personal-token writes use actor pat:<prefix> and follow agent write policy, budget, and review. Personal tokens cannot manage tokens, mutate device replicas, or rename/delete folders.
  • Queue and receipt inspection also require notes.review. Write-only agents report the pending ID and hand it to a reviewer. Agents leave approval to a human; review-scoped personal tokens are accepted by the API.
  • Access tokens covers setup, expiry, limits, and credential recovery.

2026-09-29 — Agent docs match the servers

  • Local MCP is read-only. Cloud MCP supports write_note and edit_note; see the current permission requirements.
  • A queued write has not changed the note. Record its pending ID and follow the current review workflow.
  • Reuse an Idempotency-Key only for an identical retry. After VERSION_MOVED, re-read and send the changed operation with a new key.
  • Search and receipt samples use full SHA-256 hashes, ids, committed_seq, and separate applied and queued receipts.
  • Authenticated search example reads ELA_API_TOKEN. SDKs stay workspace-only and read that variable.

2026-09-28 — Agent-facing docs

  • Site-wide agent instructions on every Markdown page, plus /skill.md
  • Agents page: search, read a slice, :edit, and the VERSION_MOVED retry
  • MCP tool arguments next to the HTTP route that returns the same shape
  • Search, applied-receipt, and VERSION_MOVED samples on the Agents page
  • Docs MCP flags on read routes only

2026-09-24 — Production API host

https://api.elanotes.com answers GET /healthz and GET /openapi.json. /v1 and /mcp still require a bearer in production. Local clone remains http://127.0.0.1:4000. The API reference servers list is production, then local.

2026-09-23 — Public docs on Mintlify

Notes, Search, Privacy, and Agents guides on this host (/using-notes, /using-search — not /notes or /search, which collide with Mintlify). Marketing Docs points here. elanotes.com/docs 301s to these pages. See CHG-2026-006.

2026-09-07 — Agent-first HTTP contract

Landed on main through CP-API.0–CP-API.6 (#74–#83).
  • OpenAPI 3.1 at GET /openapi.json and contracts/openapi/elanotes.v1.json
  • AIP-193 reason / hint / help / details[]; RFC 6750 WWW-Authenticate; RFC 9728 protected-resource metadata
  • Abuse rate limits with Retry-After (reads never metered)
  • AIP-160 filter, AIP-132 order_by, AIP-158 page tokens, GET /v1/tags
  • PATCH + update_mask; AIP-136 :edit / :move / :rename / :rollback / :listRevisions / :approve / :reject
  • @elanotes/sdk and Python elanotes
  • notes --remote as a first-class client (PROP-014)
Legacy slash forms and limit / cursor stay through v1 with Deprecation + Link.

2026-09-07 — Public docs scaffold (CP-DOCS.1)

Mintlify project in apps/docs, OpenAPI sync, llms.txt final URLs, mint validate / broken-links, deploy command node scripts/docs-deploy.mjs.