Changelog

Dates are the day the change reached the development environment; the hosted platform announces general availability separately.

Version 1.2.0: the analytics MVP

Images ghcr.io/innovafour/iforevents-api:1.2.0 and ghcr.io/innovafour/iforevents-dashboard:1.2.0.

New

• Cohorts: save a group of users by what they did or who they are, and filter the explorer, boards, funnels and retention by it.
• Flows: the paths users take before or after an event.
• Funnels and Retention pages, with step filters, exclusions, a breakdown and time to convert.
• Boards: saved pages of charts with board-wide and per-chart filters, sum, average, minimum and maximum of a property, chart time zones, comparison to the previous period and drill-down; boards can be private.
• Export and import: move a project, configuration and events, as a verified bundle, from Settings → Export & import.
• The events explorer filters on any property.

Changed

• Self-hosted installs run unmetered: no monthly event cap, no MCP allowance and every organization on EVENTS_RETENTION_DAYS (forever by default). Events written under 1.1.0 with the free-tier window are moved back onto the install's window by the first nightly retention run.
• An event costs about 13 bytes on disk all-in, down from 21: no stored event id (the uuid shown is a hash of the event), a user is a hash of the id you send in X-User-Id, the URL is kept as origin plus query, and there are fewer, smaller daily rollups.
• The charts follow your plan's retention window, like raw events: unique users, visits, bounces and the daily series stop where the window does.
• identify is not an event any more: it updates the user's profile, is not stored as an event and does not count toward the monthly total. Only identified users have a profile; the users explorer lists everyone active in the range.
• SDKs batch 20 events or 10 seconds by default (were 10 and 5), and no longer copy identify traits into every event: each backend keeps them on the profile.
• Batches go straight to the api's ingest buffer; self-hosted installs run without RabbitMQ.
• The traffic overview counts visits as a user's day, so bounce rate and views per visit are right.
• An install on 1.1.0 is carried over at its first boot; the old tables are kept as legacy_v1_events and legacy_v1_users.

Version 1.1.0: smaller events

Changed

• Events storage went from about 60 to 21 bytes per event, and each event carries its plan's retention window, expired by ClickHouse.

Version 1.0.0 (in progress)

New

• Self-service signup with email verification, organizations, team roles (owner, admin, viewer) and invitations.
• Onboarding wizard that creates the first project and shows the project key and once-only secret with SDK snippets.
• Scoped API tokens (ifmcp_…) with rotation, revocation and expiry.
• Account settings (profile, password) and a cookie consent banner with a documented cookie table.
• Plan catalog: Free, Pro, Scale, Enterprise with per-organization entitlements pushed to the data plane.
• This documentation site, with the API reference generated from the OpenAPI document.

Improved

• Retention enforced per plan (90 days, 1 year, 2 years) as a ClickHouse TTL.
• Monthly event quota with 80% and 100% warnings, a 7-day grace period and a machine-readable 429 quota_exceeded.
• Nightly reconciliation of usage counters against ClickHouse, exported to Prometheus.
• Secrets loaded from HashiCorp Vault; deployments through GitHub Environments with health checks.

Security

• Sessions issued by the accounts service as EdDSA tokens verified through JWKS; refresh-token rotation with reuse detection.
• Signup protected by Cloudflare Turnstile and a disposable-domain blocklist; per-IP and per-email signup limits.
• Every container bound to loopback behind nginx; project credentials refused on organization-level routes.

Breaking

• Ingest names the person with X-User-Id (any string up to 256 characters, the same value identify takes as custom_id) instead of X-Custom-UUID with an IForevents UUID. Profiles are created on first sight, so identify is no longer a prerequisite for tracking. SDKs generate and keep an anonymous id until identify; server-side callers pass their own. Without the header the api still falls back to an address-derived shared profile, now documented under Tracking.
• The browser SDK is served by every api at /sdk/v1/iforevents.min.js; self-hosted snippets point at the install's own origin instead of iforevents.com.
• Client SDKs send only X-Project-Key; X-Project-Secret is for servers and never ships in an app.
• All API routes live under /v1 (/v1/events/track, /v1/events/identify, /v1/events/batch).
• New signups and logins go through the accounts service; the data plane's own /v1/auth/register remains for self-hosted deployments without it.

Coming next

• Paddle billing, invoices and dunning.
• The MCP server and OAuth 2.1 for AI clients.
• Web (JavaScript) and Python SDKs.

Earlier

The API's own history before the SaaS work is in CHANGELOG.md of the iforevents-api repository (1.0.0 of the API, December 2024).