API response envelopes, platform hardening, and reliability
Breaking changes for custom API clients
If you call the Savanto REST API directly (not via @savantoai/ai-sdk), read this section. SDK users get updated types from the latest package; regenerate or upgrade when you pull new OpenAPI.
Standard response envelope
Several endpoints now return the platform envelope every resource route uses:
{
"object": "<resource_type>",
"requestId": "<uuid>",
"data": { }
}
POST /recommendations — Previously returned { "data": { … } } only. The handler now wraps the same payload in the envelope above with "object": "recommendations". Your product recommendations still live under data; add support for object and requestId if you validate the full response shape.
POST /chat (non-streaming) — The server already returned this envelope; OpenAPI and the published spec now match what the handler emits (object: "event"). No wire change if you were already reading data.
POST /threads/search — The handler has long returned data.items inside a search_result envelope. OpenAPI and the SDK now document items (not results). If you built against an older spec that said results, switch to data.items.
Product stockStatus and type
Unknown stockStatus or type values from WooCommerce or legacy indexes are no longer passed through as arbitrary strings. They are omitted from API responses when they do not match the published enum. Integrations that relied on passthrough strings should treat these fields as optional and validate against the OpenAPI enum.
Tenant and workspace deletion
DELETE /tenant/{tenantId} and DELETE /tenant/workspaces/{workspaceId} may return HTTP 207 when deletion succeeds but some cleanup steps fail. Inspect data.results for per-step success. OpenAPI now documents this path; it is not new runtime behavior for most tenants.
Search query echo (additive)
POST /products/search and POST /posts/search responses include query.truncated and query.originalLength when the search text was shortened for indexing. Safe to ignore if you do not need it.
JavaScript SDK (@savantoai/ai-sdk)
Regenerated from the updated OpenAPI spec:
- Response types for recommendations, chat, and thread search match the envelopes above.
ProductstockStatusandtypeare strict enums in TypeScript.- Thread search list items are typed under
data.items.
Upgrade to the SDK version published with this release and run your usual typecheck. See sdks/javascript/CHANGELOG.md for semver notes.
Chat and security
- Input guardrails now run on confirmation, handoff, and custom-domain curator agents (not only the main product/post paths), with tighter persona-jailbreak detection and fewer false positives on normal shopper phrasing.
- Service container loads chat agents lazily to avoid circular imports while keeping guardrails enabled.
Widgets
- Chat loader: manual
SavantoChatbot.init()can retry after a failed bootstrap; analytics consent grant/revoke is symmetric;data-manualis only read from Savanto script tags. - Search widget: keyboard shortcut handling is covered by unit tests.
Crawl and indexing
- Crawl progress counters dedupe
pagesFoundper URL (including redirects) so failed navigations are not double-counted. - Tenant purge reports partial DynamoDB delete failures instead of silently under-counting removed records.
Dashboard and WordPress
- Admin: tenant list search and filters work server-side; pagination and status summary chips reflect the full filtered set, not just the current page.
- Website: JWT sessions invalidate on password change; auth callbacks load only
passwordVersionfrom the database on each request. - WordPress plugin: taxonomy sync cron is wired; deactivation cleanup is tighter; taxonomy orphan cleanup is skipped when a sync hits its limit; sync interval values are sanitized consistently.
API schema hygiene
- Webhook and feedback DTOs are aligned with route Zod schemas (
apiKeyvsapi_keydrift fixed). - Shared
standardErrorson more routes for consistent error shapes in OpenAPI.