# Changelog State API

> Structured release and changelog intelligence for the vendors an AI agent
> depends on. It answers two questions: what shipped, and what changed.

This service continuously reads official release feeds and changelogs, and
turns them into structured, versioned entries with detected change history.
It does NOT track pricing pages and it does NOT track uptime or status pages.

## When it is worth paying

A paid call costs 0.01 USDC on Base. There is no signup, no API key
and no account: you pay per call with the x402 protocol and get data in the
same round trip.

Pay when you need the actual content — the release bodies, version strings,
publish dates and the detected change history. Doing that yourself means
fetching a vendor's changelog, rendering it if it is client-side, parsing an
inconsistent HTML or feed layout, storing a normalised snapshot, and diffing
it on every poll — per vendor, forever, and re-doing it every time a vendor
redesigns their page. One call here is cheaper than one failed scrape.

Do NOT pay when the free surface already answers your question. The free
catalog tells you which vendors are tracked, whether extraction is healthy,
and the title and date of the most recent release. If you only need "did
anything ship since I last looked", poll the free endpoints and pay only when
the answer is yes.

## Free endpoints

### GET https://changelog-state-api.replit.app/api/healthz
FREE — Health check
Returns server health status. Free, no payment required. `status` answers whether the service is answering; the separate `payments` object reports whether paid calls can currently be settled, so a broken paywall is visible without reading it as an outage.
Response fields: status, payments

### GET https://changelog-state-api.replit.app/api/monitors
FREE — List tracked vendors (free, coarse)
Free coarse fleet catalog. Returns one card per tracked vendor: what it is, the official source being read, extraction status, the headline release and the times, how many releases and detected changes are on record, and the paid URLs for that vendor. Full entry bodies, structured release history and change history are paid.
Coarse free card — identity, source, extraction status, the headline release, how much is on record, and where the paid endpoints are. Never contains entry bodies or change history.
Response fields: slug, name, homepageUrl, sourceUrl, sourceType, status, lastReleaseTitle, lastReleaseAt, lastPrereleaseTitle, lastCheckedAt, lastChangeAt, releaseCount, changeCount, paid

### GET https://changelog-state-api.replit.app/api/site/changelog/{slug}
FREE — Coarse teaser for one vendor (free)
Free teaser for one vendor: identity, the official source being read, extraction status, the headline release, when it was last checked and last changed, how many releases and detected changes are on record, and the paid URLs. Never returns entry bodies, structured release history or change history. Unknown slugs return 404 with no payment challenge.
Coarse free teaser — identity, source, the headline release and the times, how much is on record, and where the paid endpoints are. Entry bodies and change history are paid.
Response fields: slug, name, homepageUrl, sourceUrl, sourceType, status, lastReleaseTitle, lastReleaseAt, lastPrereleaseTitle, lastCheckedAt, lastChangeAt, releaseCount, changeCount, paid

## Paid endpoints — 0.01 USDC per call

Payment protocol: x402 version 2
Network: eip155:8453 (Base)
Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (USDC, 6 decimals)
Amount: 10000 atomic units
Pay to: 0xb23c3825de4ca8a479183092ae8d1d58d2736fc9
Facilitator: https://facilitator.payai.network

Request the resource without payment to receive an HTTP 402 carrying an x402
version 2 `PaymentRequired` object, base64-encoded in the `PAYMENT-REQUIRED`
response header and repeated verbatim in the JSON body. It names an absolute
https resource URL, so you can re-issue the request without guessing the
origin.

Send your signed `PaymentPayload` base64-encoded in the `PAYMENT-SIGNATURE`
request header. The settlement result comes back in the `PAYMENT-RESPONSE`
response header. The x402 v1 header names (`X-PAYMENT` and
`X-PAYMENT-RESPONSE`) are also accepted and emitted for older clients.

An unpaid request to a paid route always answers with the challenge, so a
discovery probe never has to guess a valid slug first. Payment is captured
only once the response has actually been produced: an unknown vendor slug
still returns 404, an invalid query parameter still returns 400 and an
internal error still returns 500 — none of them settle, so none of them are
charged. Settlement is also skipped if you disconnect before the response is
ready.

### GET https://changelog-state-api.replit.app/api/monitors/{slug}
PAID  0.01 USDC — Full structured recent releases (paid)
Paid. Returns the vendor's structured recent releases including entry bodies, version strings, publish dates, source links and any breaking signal the source page actually states. Newest first, sized by `limit` (default 10, maximum 50), which is echoed back alongside `hasMore`: a releaseCount larger than the entries returned means older entries exist on record, not that the packet was trimmed. Entry bodies are capped at 2000 characters and set `bodyTruncated` when cut; version and url are never dropped. Costs 0.01 USDC per call over x402 v2 on Base mainnet. An unpaid request always answers with the 402 challenge; payment is only captured once the response can be produced, so an unknown slug (404) or an invalid query parameter (400) is never charged.
The paid snapshot: the vendor's structured recent releases, newest first. Sized, not trimmed — `limit` echoes the page size actually applied (default 10, maximum 50) and `hasMore` is true whenever `releaseCount` exceeds the entries returned, so raise `limit` to see more rather than assuming data was dropped. Entries older than the maximum page are counted in `releaseCount` but are not served by this endpoint. Each entry body is capped at 2000 characters and sets `bodyTruncated` when it was cut.
Response fields: slug, name, homepageUrl, sourceUrl, sourceType, status, lastReleaseTitle, lastReleaseAt, lastPrereleaseTitle, lastCheckedAt, lastSuccessAt, lastChangeAt, releaseCount, limit, hasMore, releases

### GET https://changelog-state-api.replit.app/api/monitors/{slug}/changes
PAID  0.01 USDC — Detected changelog update history (paid)
Paid. Returns the detected changelog update history for the vendor — new releases, version changes, date changes, title changes and breaking signals quoted from the source. Pure wording reshuffle never produces a row, and neither does the first read of the source, over however few checks it takes that read to arrive in full: `watchedSince` says when the baseline was captured, so changeCount 0 means nothing has changed since that date rather than a missing feed. Paginated via `limit` (default 50, maximum 200) and `hasMore`. Costs 0.01 USDC per call over x402 v2 on Base mainnet. An unpaid request always answers with the 402 challenge; payment is only captured once the response can be produced, so an unknown slug (404) or an invalid query parameter (400) is never charged.
The paid change history: what this vendor altered after we had already read it — new entries, version and date changes, retitles, and breaking signals quoted from the source. Not a second copy of the snapshot, and not the first read of the source arriving one page at a time. An empty feed is an answer, not a gap: `watchedSince` says when the baseline was captured and `releaseCount` shows the source is being read, so changeCount 0 means "nothing has changed since that date", never "the feed is missing". Sized the same way as the snapshot via `limit` (default 50, maximum 200) and `hasMore`.
Response fields: slug, name, changeCount, watchedSince, releaseCount, limit, hasMore, changes

## Hosting and infrastructure trust

This service is deployed on Replit's managed cloud infrastructure rather than
a self-managed server. This is a fact about the operating environment, not a
claim about this API's own code, and it is worth weighing separately when
deciding how much to trust a call to this origin:

- Isolation: the deployment runs in a dedicated, single-tenant cloud project,
  separate from every other hosted app's compute, storage and secrets.
- Encryption: data in transit is TLS 1.2+; data at rest is AES-256.
- Edge protection: traffic passes through a load balancer and a web
  application firewall (WAF) before it reaches this service.
- Secret handling: operator credentials this service depends on (payout
  address, session signing key, alert-channel credentials) are stored in the
  platform's encrypted secrets manager — AES-256 at rest, TLS in transit —
  never committed to source control or hardcoded into the deployed build.
- Platform compliance: the hosting platform (Replit) holds ISO 27001 and
  SOC 2 Type II certification and runs on Google Cloud Platform.

See https://changelog-state-api.replit.app/privacy for what this service itself stores, logs and
retains about API callers; that is a separate layer from the hosting
guarantees above.

## Machine-readable descriptions

- OpenAPI 3.1: https://changelog-state-api.replit.app/openapi.json (YAML at https://changelog-state-api.replit.app/openapi.yaml)
- Agent card: https://changelog-state-api.replit.app/.well-known/agent.json
- x402 configuration: https://changelog-state-api.replit.app/.well-known/x402
- Paid resource list: https://changelog-state-api.replit.app/.well-known/x402-resources
- Frozen sample of one paid call, free to read — the anthropic snapshot and change history as they stood on the date it carries, kept as a demo of structure and depth, not as live data: https://changelog-state-api.replit.app/samples/paid-snapshot.json