Changelog

Every change to the public contract is recorded here. Entries track the committed API spec and MCP tool inventory, so this page cannot drift from what the surface actually does — a change to an endpoint or a tool lands in the same change as its entry below.

Read Conventions → Versioning for what counts as breaking, and how deprecations are announced before anything is removed.

Collection MCP tools require a workspace

Breaking change for multi-workspace callers

The MCP tools that list across a workspace — list_deals, list_jobs and list_videos — now take the same workspace rule as REST's Passo-Workspace header. Pass the workspace's wsp_ public id as workspaceId:

If you belong to exactly one workspace, omit it — it is filled in automatically. Nothing changes for you.
If you belong to more than one (an agency across several brands, or staff working through a support grant), a call with no workspaceId is now refused with { error: "workspace_required" }, whose workspaces field lists your workspaces (id, name, slug) so you can pick one or ask the user. Before, such a call returned rows spanning every workspace — which could lead an agent to act in the wrong tenant on its next step. Find a workspace id with list_workspaces.

Tools keyed by a resource id (get_video_review, get_script, …) and the per-deal reads (list_deliverables, get_deal_activity) are unaffected — their workspace is already implied by the id. list_workspace_members and get_notification_preferences already required a workspaceId.

v1 — Initial surface

The first version of the Passo developer surface.

Workspace and agency ids are prefixed

Workspaces and agencies are identified on the contract by a prefixed public id (wsp_…, agy_…), matching the cre_/vid_/scr_/dlv_ scheme every other resource uses — see Concepts. Pass it in the Passo-Workspace header or a tool's workspaceId; a raw uuid is rejected with a 400. This is the surface as shipped — no uuid form was ever public — so there is nothing to migrate.

MCP server

The remote MCP server is public at /v1/mcp, with a read-only variant at /v1/mcp/readonly. Authentication is OAuth 2.1 with dynamic client registration; an agent acts as the user who authorised it. Tools in this version:

whoami — the connected user's profile.
list_workspaces — the workspaces the user belongs to.
list_videos_awaiting_review — the review queue: videos whose current cut is in_review.
get_video_review — a single video and its full version history.
list_deals — deals the user can see, newest first.
list_jobs — jobs (briefs) the user can see, newest first.
list_workspace_members — the roster of a workspace.
get_script — a script and its version history.
create_deal — assign a creator to a job.
create_job — create a job in a workspace.
invite_member — invite a teammate to a workspace by email.

See the tools reference for inputs and example results. Some operations are REST-only by design — see Conventions.

REST API

The REST API is built and documented, and published on request. This version covers workspaces and membership (/me, /workspaces, workspace members and invites), the creator-video domain (jobs, deals, videos, sign-offs), and scripts (detail and sign-offs). See the API reference for every endpoint.

Conventions established

Clamped pagination (limit default 20, max 100; offset; total in every list response).
HTTP status codes with a code / message body for REST; structured { error } results for MCP tools.
Path versioning (/v1, /v1/mcp); additive changes are non-breaking.