> For the complete documentation index, see [llms.txt](https://docs.facephi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.facephi.com/docs.facephi-en/sdks/backend-sdk/iad/changelog.md). # Changelog ## \[2.2.0] - 2026-08-12 ### Added * Public endpoints `GET /api/v1/iad/metrics` and `GET /api/v1/iad/metrics/prometheus` for operational snapshots and exposure in Prometheus format. * Unit and integration tests for health snapshots and metrics endpoints. ### Changed * `GET /api/v1/iad/health` keeps the engine health check active, while `/metrics` exposes cached snapshots and in-memory counters suitable for frequent scraping. * Updated the internal engine. ## \[2.1.0] - 2026-07-20 ### Added * Optional support for JWT authentication. * Unit tests covering the runtime precedence of the JWT configuration and the redaction/rejection behavior of the configuration endpoint. ### Changed * Public configuration endpoints now omit JWT authentication keys in the responses from `GET /api/v1/iad/config`. * Public configuration updates via `POST /api/v1/iad/config` now reject JWT authentication keys; those values must be configured only at startup via `config.json` or the environment variables `FACEPHI_IAD_REST_*`. ## \[2.0.0] - 2026-05-26 ### Breaking changes * Version `2.0.0` breaks compatibility of the public Rest API with the series `1.x.x`: endpoint names, multipart request fields, and the correct response payloads changed and require client migration. ### Added * Public liveness response mapping with Facephi-style fields `diagnostic`, `reason`, `probability`, `score`, `sdkDuration` and `queueDuration`. * Experimental replay-attack mitigation documented as a public capability of facephi-iad-service, with startup environment variables `FACEPHI_IAD_REPLAY_ATTACK_CHECKER_ENABLED` and `FACEPHI_IAD_REPLAY_ATTACK_TOLERANCE_TIME`. * Unit tests for Engine success payload mapping and prevention of public field leaks. * Unit tests for the required multipart field contract `capture`. ### Changed * Public operational routes now use `/api/v1/iad/liveness/evaluate` and `/api/v1/iad/extract`. * Multipart endpoints now require the field `capture` at runtime and reject legacy requests that include only `file`. * Startup failures now propagate to `main` instead of exiting from the service startup code. * IAD provider validation errors are normalized to Facephi/SelphID-style response values. * Rejected expired captures by the experimental replay protection now return the public HTTP message `400` documented `Replay attack detected`. * The public liveness documentation now lists the exact values of `reason` returned by the service: `None`, `Unknown`, `UntrustedEnvironment`, `SuspiciousActivity`, `UntrustedDevice`, `SdkIntegrityViolation`, `UntrustedCorruptedPayload`, `UntrustedContent` and `UntrustedContentLowConfidence`. * The public documentation and OpenAPI examples now describe the new public response contract instead of the provider payloads. ### Fixed * Signal handling no longer invokes logging, shutdown routines, or `std::exit` from the signal handler. ### Removed * The public Engine-shaped success fields `capture_liveness`, `capture_type`, `rejection` and `mime_type`. ## \[1.2.0] - 2026-04-30 ### Security * The values `LICENSE_ID` and `LICENSE_DATA` present in the License file are ignored. ### Changed * The API documentation now includes the IAD engine rejection reasons and the mappings of `error_code` validation errors for service responses. * Swagger/OpenAPI examples now document HTTP errors `400` originating from the engine for `check-capture` and `extract-image`. * The demo documentation was improved by adding modification of the IP addresses of the required services. ### Fixed * The public documentation and Version metadata now reference Version consistently. `1.2.0` consistently. * The installation and OpenAPI examples were aligned with the current runtime defaults and the endpoint paths `/api/v1/iad/*`. ## \[1.1.1] - 2026-03-30 ### Changed * IAD engine update to Version 2.5.3. ### Fixed * The Docker registry paths were corrected to use `docker-pro-fphi` throughout the documentation and release notes. * The OpenAPI specification was updated with precise request/response schemas that match the real behavior of the endpoints. * The API documentation was improved with examples of the configuration and health check endpoints. ## \[1.1.0] - 2026-03-20 ### Added * Runtime configuration override via environment variables. * License error translation utilities and normalized license error reporting for clearer operational diagnostics. ### Changed * IAD engine update to version 2.5.2. * Improvements in license management to support offline validation scenarios and provide clearer error reporting. * Simplified Dockerfile: base image change, better package management, and runtime dependency handling. ### Fixed * Docker runtime and base image hardening updates. * Normalization of REST proxy errors and consistent error creation/reporting paths. * Reduction of excessive verbose logging in Docker checks and engine activation flows. ## \[1.0.0] - 2026-02-03 ### Added * Automatic engine activation from license metadata * Docker environment detection and automatic engine initialization * ProcessExecutor facade for background process management * Filesystem compatibility layer for GCC 7 ### Changed * **INCOMPATIBLE CHANGE**: All endpoints were standardized with the prefix `/iad` (for example, `/api/v1/iad/check-capture`) * Unified namespace structure across all endpoints * Improved engine health check timeouts * Improved logging in the engine activation process * Simplified ProcessExecutor implementation * Refactoring of internal REST proxy logging ### Removed * **INCOMPATIBLE CHANGE**: The Endpoint was removed `/extract_data` (consolidated functionality) ### Fixed * Filesystem compatibility issues with older GCC versions * Timing synchronization in engine initialization in Docker environments ## \[0.0.1] - 2026-01-29 ### Added * Initial release of the IAD Service Rest API * Endpoint `/api/v1/iad/check-capture` for liveness detection and injection attack verification * Endpoint `/api/v1/iad/extract-image` for extracting images from validated captures * Management Endpoint `/api/v1/iad/version` for the License Version and status * Management Endpoint `/api/v1/iad/health` for health monitoring * Management endpoints `/api/v1/iad/config` (GET/POST) for configuration management * Connection pool for communication with the engine * Automatic retry mechanism with configurable backoff * Dynamic configuration updates without restarting the service * Docker-based deployment with Ubuntu 24.04 * Support for online and offline license validation * Full logging with configurable levels and rotation * OpenAPI 3.0 specification (Swagger documentation)