# alfaview API v2 changelog

## 05.10.2026

- Set length limits for `externalId` in [Authenticate a Guest (Group Link)](https://apis.alfaview.com/v2/docs/operations/AuthenticateGroupLink.md) (length 32 to 256 characters) and `displayName` in [Authenticate a Guest (Guest Link)](https://apis.alfaview.com/v2/docs/operations/AuthenticateGuestLink.md) and [Authenticate a Guest (Group Link)](https://apis.alfaview.com/v2/docs/operations/AuthenticateGroupLink.md) (at most 256 characters).
- Added markdown documentation for LLM agents: [llms.txt](https://apis.alfaview.com/v2/docs/llms.txt), [llms-full.txt](https://apis.alfaview.com/v2/docs/llms-full.txt).
- The OpenAPI specification and the markdown documentation can now be fetched from any origin (`Access-Control-Allow-Origin: *`), e.g. by browser-based tools.
- Added documentation of the error response body (`application/problem+json` with the `ErrorModel` schema) and `WWW-Authenticate` header of `401` responses.
- Access tokens are now also accepted with the `Bearer` prefix (`Authorization: Bearer <token>`).
- Added the access token as an OpenAPI security scheme (`accessToken`) on all endpoints that require it. The `Authorization` header is therefore no longer listed as a parameter in the documentation, but it is still required. Code generators now produce a proper authentication configuration instead of ignoring the header parameter, as mandated by the OpenAPI specification.

## 28.09.2026

- Added [Get own company](https://apis.alfaview.com/v2/docs/operations/GetOwnCompany.md).
- Bugfix: Authorizing via `/auth/password` with two-factor authentication returned an empty access token instead of `403`.

## 13.07.2026

- Added `localRecording`, `liveStreaming` and `examScreenshare` to room feature objects when updating and getting.
- Made all fields in the [Update Room Features](https://apis.alfaview.com/v2/docs/operations/UpdateRoomFeatures.md) request body optional and renamed the schema from `RoomFeatures` to `RoomFeaturesEdit`.

## 06.07.26

- Added `city`, `initials` and `locale` to user objects when updating and getting.
- Bugfix: Room permissions of old users were sometimes not returned correctly.

## 23.06.26

- Added [Get own user](https://apis.alfaview.com/v2/docs/operations/GetOwnUser.md).
- Restricted `locale` fields in requests to contain available languages only.

## 26.05.2026

- Improved security by omitting request details in error responses.

## 14.04.2026

- Allowed users with two-factor authentication enabled to authenticate via an API key (second factor not required then).

## 08.04.2026

- Added [Get file share settings](https://apis.alfaview.com/v2/docs/operations/GetRoomFileShareSettings.md).
- Added [Update file share settings](https://apis.alfaview.com/v2/docs/operations/UpdateRoomFileShareSettings.md).
- Added [Get file share limits](https://apis.alfaview.com/v2/docs/operations/GetRoomFileShareLimits.md).
- Added `webclientLaunchURL` to response body when authenticating as a guest (guest *and* group link).
- Deprecated `joinLink` and added `joinURL` in response body when getting group links.
    - `joinURL` lets the user choose between native client and web client instead of being a direct link to the native client.

## 01.04.2026

- Added [Update own user](https://apis.alfaview.com/v2/docs/operations/UpdateUser.md).
- Added [Delete user](https://apis.alfaview.com/v2/docs/operations/DeleteUser.md).

## 17.03.2026

- Change HTTP status code when authenticating users with two-factor-authentication from `500` to `403`.

## 10.03.2026

- Added [Regenerate Passcode](https://apis.alfaview.com/v2/docs/operations/RegeneratePasscode.md).
- Added [Get Passcode](https://apis.alfaview.com/v2/docs/operations/GetPasscode.md).
- Added `passcodeRequired` to room objects when creating, updating and getting.