Changelog

MCP server version: 2.8.0

Breaking changes and deprecations are called out inline. If your integration targets a version older than the one listed here and something no longer works as documented, check for a deprecation note; otherwise contact support.

Versioning policy

FaceSign follows a non-breaking-by-default versioning policy for the REST API:

• Additive changes (new endpoints, new fields on responses, new optional fields on requests) ship without a version bump. Your integration should ignore unknown fields.
• Breaking changes (field removals, type changes, required-field additions) are rare. When they happen, we:
  • Publish a deprecation notice in this changelog at least 90 days in advance
  • Email the integration contact on your account
  • Maintain the deprecated behavior behind a dated version header for 6 months after the notice

No breaking changes are currently planned for the 1.x line.

---

2026-08-05 · Inconclusive liveness outcome, deepfake analysis status, optional captions

Breaking (flow builders only)

• liveness_detection nodes now route a fourth outcome, inconclusive — the check produced no verdict, because the detector could not decide, errored, timed out, or had no usable media to analyse. It is a failure of the check, not of the user, and it is now a branch you route rather than one we pick for you. These cases previously resolved to noFace, which reported "no face" for a session where a face was present and our own detector had failed.

  Flows submitted without the edge are not rejected. The missing outcome is filled with the node's noFace target, recorded on the session as settings.flowNormalizations, and reported in the warnings array of the create-session response. Treat that as a migration aid: a filled edge is our guess, not your decision. Add the edge and choose where it goes.

• Node reports for liveness_detection carry inconclusiveReason when the outcome is inconclusive: no_media, unusable_media, unknown_verdict, timeout or provider_error.

Added

• report.deepfakeDetectionStatus — pending, succeeded, failed or timed_out, with startedAt, finishedAt and errorCode. This tells "the post-session deepfake analysis ran and found nothing" apart from "it never produced a result", which previously both appeared as a missing verdict.
• analysis.deepfake webhook event, fired when that analysis reaches a terminal state — including failure and timeout. Doorbell only: refetch the session for the verdict.
• customization.controls.captionsOpenedByDefault — open the closed-captions panel at session start, for accessibility and for viewers reading along in a second language. Omitted or false keeps today's closed panel; the user can toggle it with the CC button either way. Ignored when showUxControls is false.

---

2026-04-16 · Docs restructure

Documentation

• Restructured /docs around MCP-first hello-world flow. /docs now redirects to /docs/mcp (Build with AI).
• Consolidated the full MCP integration guide into a single /docs/mcp page with anchor sections (Quickstart, Supported Clients, Tool Catalog, Recipes, Troubleshooting).
• Introduced a dedicated Use Cases section (wire transfer, account recovery, anomaly step-up, payment authentication).
• Moved Concepts (sessions, flows, nodes, reports) under Reference as a single consolidated page.
• Added /docs/reference/authentication for API-key mechanics and retry guidance. Operational prerequisites live inline on the MCP page.
• Added /docs/security/audit-evidence covering what's retained, how to retrieve it, and known gaps.

No API changes in this release.

---

Reporting a docs issue

Spot something inaccurate, outdated, or missing? Email [email protected] with the page URL and what's wrong. We triage docs issues weekly.