Changelog

Changes to the Estalo API, webhooks and AI assistant, with dates.

Changes to API v1, webhooks and the AI assistant, newest first. The full project history is in CHANGELOG.md in the repository.

2026-11-02: changes through the AI assistant

The AI assistant (MCP) can create and change clients, listings, inquiries, sales, calendar events and tasks in two steps: estalo_prepare_write shows a preview of the change, estalo_commit_write saves it only after a confirmation in the conversation. A preview is valid for 10 minutes and works once.
Change scopes (*:write) sit on the consent screen in a separate group "Changes to office data", never ticked in advance. Changes work only in an office whose owner switched changes through the API on.
A limit of 20 saved changes per minute per connection; every change is logged with the connection that made it.

POST /api/v1/{resource} and PATCH /api/v1/{resource}/{id} for all six resources, and DELETE for clients (archive), listings (trash), events and tasks. A write runs as the key's creator, under the same rules as the app.
Twelve scopes: every *:read got a *:write. A write scope does not include reading.
Writes need the office owner to switch them on once, and a key with a write scope can be created only with two-step verification on. /me returns a new writes field. The owner can switch changes off again; a key also stops writing when its creator switches two-step verification off.
Idempotency-Key header (required on POST), expected_updated_at on PATCH, write limits of 30 per key and 120 per office per minute, bodies up to 64 KB, new write error codes.
Webhooks: new events lead.updated, client.updated, deal.created, task.created, property.created, property.updated; delivery runs from a scheduled job every minute.
OpenAPI document version 1.1.0-beta describes the write operations. Public documentation at /developers.

The API and the AI assistant follow the office setting "Widoczność danych między agentami": with "Pełne biuro (odczyt)" an agent reads all of the office's clients and listings.
leads returns message (the inquiry text from the portal e-mail, only for source = email_import) and portal, offer_number, provider_listing_id and listing_title from the inquiry's import record.

A date filter with an unencoded + in the time zone (+02:00) answers 400 with a message saying the + must be written as %2B.

The MCP server https://estalo.pl/api/mcp (read-only, four tools) switched on in production for the first offices. Supported client: Claude. Consent on the Estalo screen, revocation under Settings › Connected AI apps.

Read access to six resources (clients, properties, deals, events, leads, tasks) with read-scoped keys, cursor pagination, date filters, limits of 60 per key, 240 per office and 120 per IP address per minute, an audit log without values.
Webhooks with an HMAC signature and retries built in code, switched off until testing.

Changelog

Changes to the Estalo API, webhooks and AI assistant, with dates.

Changes to API v1, webhooks and the AI assistant, newest first. The full project history is in CHANGELOG.md in the repository.

The AI assistant (MCP) can create and change clients, listings, inquiries, sales, calendar events and tasks in two steps: estalo_prepare_write shows a preview of the change, estalo_commit_write saves it only after a confirmation in the conversation. A preview is valid for 10 minutes and works once.
Change scopes (*:write) sit on the consent screen in a separate group "Changes to office data", never ticked in advance. Changes work only in an office whose owner switched changes through the API on.
A limit of 20 saved changes per minute per connection; every change is logged with the connection that made it.

POST /api/v1/{resource} and PATCH /api/v1/{resource}/{id} for all six resources, and DELETE for clients (archive), listings (trash), events and tasks. A write runs as the key's creator, under the same rules as the app.
Twelve scopes: every *:read got a *:write. A write scope does not include reading.
Writes need the office owner to switch them on once, and a key with a write scope can be created only with two-step verification on. /me returns a new writes field. The owner can switch changes off again; a key also stops writing when its creator switches two-step verification off.
Idempotency-Key header (required on POST), expected_updated_at on PATCH, write limits of 30 per key and 120 per office per minute, bodies up to 64 KB, new write error codes.
Webhooks: new events lead.updated, client.updated, deal.created, task.created, property.created, property.updated; delivery runs from a scheduled job every minute.
OpenAPI document version 1.1.0-beta describes the write operations. Public documentation at /developers.

The API and the AI assistant follow the office setting "Widoczność danych między agentami": with "Pełne biuro (odczyt)" an agent reads all of the office's clients and listings.
leads returns message (the inquiry text from the portal e-mail, only for source = email_import) and portal, offer_number, provider_listing_id and listing_title from the inquiry's import record.

A date filter with an unencoded + in the time zone (+02:00) answers 400 with a message saying the + must be written as %2B.

The MCP server https://estalo.pl/api/mcp (read-only, four tools) switched on in production for the first offices. Supported client: Claude. Consent on the Estalo screen, revocation under Settings › Connected AI apps.

Read access to six resources (clients, properties, deals, events, leads, tasks) with read-scoped keys, cursor pagination, date filters, limits of 60 per key, 240 per office and 120 per IP address per minute, an audit log without values.
Webhooks with an HMAC signature and retries built in code, switched off until testing.