API (Node.js) SDK changelog

The server-side SDK for Node.js, published as @ruptjs/api. It replaces the earlier @ruptjs/core package.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[3.3.0] - 2026-09-10

Added

evaluate, with an optional content block.
content and review on Evaluation, and review in the verdict union.

[3.2.0] - 2026-09-09

Added

suspendUser and unsuspendUser. Suspending sets the flag the is_suspended policy condition reads, the same one the suspend verdict sets, so pair it with a policy that denies on that condition. Both return the user and throw a RuptApiError with status 404 when the user doesn't exist in your secret's environment.
addToList and removeFromList to manage the lists your policies match on from your backend. Pass the list id from its dashboard URL and one value or up to 500. addToList takes an optional comment and ttl in seconds. Both return counts (AddToListResult, RemoveFromListResult).
suspended on User, so every user embedded in an evaluation or challenge tells you whether the account is suspended.

Breaking type changes in a patch release, which isn't how we like to do it, and we're sorry for the odd bump. The old fields described a response the API had already stopped sending, so leaving them in place only produced type errors against real data. We checked with every customer on the SDK before shipping and none of them read category or risk_summary.

Changed

EvaluationRisk now has id, definition, and name in place of category, matching the API. Branch on definition, the id of the risk definition the risk was raised against. name is a display label and can be renamed in the dashboard.

Removed

Evaluation.risk_summary. The API no longer returns it, and it repeated risks one for one.

[3.0.0] - 2026-06-02

Added

Initial release as @ruptjs/api, targeting the Rupt V3 API.
getEvaluation and consumeEvaluation to confirm evaluations server-side. Consuming is single-use: a replayed evaluation returns a 409.
getChallenge to retrieve a challenge and its status.
getUserDevices to list a user's devices.
updateUser for partial updates to email, phone, metadata, and groups.
Automatic retries with exponential backoff on network errors and 5xx responses, plus typed errors: RuptApiError, RuptNetworkError, and RuptTimeoutError.
Configurable domain, timeout, retries, and maxRetryDelay.