Skip to content

Changelog

All notable changes to the Facephi IAD Service will be documented in this file.

The format is based on Keep a Changelog.

[2.0.0] - 2026-05-26

Breaking

  • Version 2.0.0 breaks public REST API compatibility with the 1.x.x series: endpoint names, multipart request fields, and successful response payloads changed and require client migration.

Added

  • Public liveness response mapping with Facephi-style diagnostic, reason, probability, score, sdkDuration, and queueDuration fields.
  • Experimental replay attack mitigation documented as a public facephi-iad-service capability with startup environment variables FACEPHI_IAD_REPLAY_ATTACK_CHECKER_ENABLED and FACEPHI_IAD_REPLAY_ATTACK_TOLERANCE_TIME.
  • Unit tests for Engine success-payload mapping and public-field leak prevention.
  • Unit tests for the required capture multipart field contract.

Changed

  • Public operational routes now use /api/v1/iad/liveness/evaluate and /api/v1/iad/extract.
  • Multipart endpoints now require the capture field at runtime and reject legacy file-only requests.
  • Startup failures now propagate to main instead of exiting from service startup code.
  • IAD provider validation errors are normalized to Facephi/SelphID-style response values.
  • Expired captures rejected by experimental replay protection now return the documented public HTTP 400 message Replay attack detected.
  • Public liveness documentation now enumerates the exact reason values returned by the service: None, Unknown, UntrustedEnvironment, SuspiciousActivity, UntrustedDevice, SdkIntegrityViolation, UntrustedCorruptedPayload, UntrustedContent, and UntrustedContentLowConfidence.
  • Public documentation and OpenAPI examples describe the new public response contract instead of provider payloads.

Fixed

  • Signal handling no longer calls logging, shutdown routines, or std::exit from the signal handler.

Removed

  • Public Engine-shaped success fields capture_liveness, capture_type, rejection, and mime_type.

[1.2.0] - 2026-04-30

Security

  • LICENSE_ID and LICENSE_DATA values in the license file are ignored if present.

Changed

  • API documentation now includes IAD engine rejection reasons and validation error_code mappings for service responses.
  • Swagger/OpenAPI examples now document engine-originated HTTP 400 errors for check-capture and extract-image.
  • Demo documentation improve adding the modification of the IP addresses of the services needed.

Fixed

  • Public documentation and release metadata now reference version 1.2.0 consistently.
  • Installation and OpenAPI examples were aligned with the current runtime defaults and /api/v1/iad/* endpoint paths.

[1.1.1] - 2026-03-30

Changed

  • Upgrade IAD engine to version 2.5.3.

Fixed

  • Docker registry paths corrected from docker-pro-fphi to docker-core-pro-fphi across all documentation and release notes.
  • OpenAPI specification updated with accurate request/response schemas matching actual endpoint behavior.
  • API documentation enhanced with configuration and health check endpoint examples.

[1.1.0] - 2026-03-20

Added

  • Runtime configuration overrides through environment variables.
  • License error translation and normalized license error reporting utilities for clearer operational diagnostics.

Changed

  • Upgrade IAD engine to version 2.5.2.
  • License management improvements to support offline validation scenarios and provide clearer error reporting.
  • Dockerfile streamlined: switched base image, improved package management and runtime dependency handling.

Fixed

  • Docker runtime and base image hardening updates.
  • REST proxy error normalization and consistent error creation/reporting paths.
  • Reduced excessive verbose logs in Docker checks and engine activation flows.

[1.0.0] - 2026-02-03

Added

  • Automatic engine activation from license metadata
  • Docker environment detection and automatic engine initialization
  • ProcessExecutor facade for background process management
  • Filesystem compatibility layer for GCC 7

Changed

  • BREAKING: Standardized all endpoints with /iad prefix (e.g., /api/v1/iad/check-capture)
  • Unified namespace structure across all endpoints
  • Improved engine health check delays and timing
  • Enhanced logging in engine activation process
  • Simplified ProcessExecutor implementation
  • Refactored internal REST proxy logging

Removed

  • BREAKING: Removed /extract_data endpoint (consolidated functionality)

Fixed

  • Filesystem compatibility issues with older GCC versions
  • Engine initialization timing in Docker environments

[0.0.1] - 2026-01-29

Added

  • Initial release of IAD Service REST API
  • Endpoint /api/v1/iad/check-capture for liveness detection and injection attack verification
  • Endpoint /api/v1/iad/extract-image for image extraction from validated captures
  • Management endpoint /api/v1/iad/version for version and license status
  • Management endpoint /api/v1/iad/health for health monitoring
  • Management endpoints /api/v1/iad/config (GET/POST) for configuration management
  • Connection pooling for engine communication
  • Automatic retry mechanism with configurable backoff
  • Dynamic configuration updates without service restart
  • Docker-based deployment with Ubuntu 24.04
  • Support for online and offline license validation
  • Comprehensive logging with configurable levels and rotation
  • OpenAPI 3.0 specification (Swagger documentation)