API Versioning Changelog

Read access to the code-quality and metadata-inventory data captured in an org's Hubbl scan: per-file line counts, Apex class-type classifications, PMD violations against Apex, ESLint findings against LWC and Aura JavaScript, and the scanned metadata items themselves.

• API: GET /v1/orgs/{orgId}/{codeCounts,classTypes,esLints,pmds,items}, each with a single-record companion except classTypes.
• MCP: list_org_code_counts / get_org_code_count, list_org_class_types, list_org_es_lints / get_org_es_lint, list_org_pmd_violations / get_org_pmd_violation, and list_org_items / get_org_item.

Read access to each Salesforce and Hubbl limit recorded for an org, with its cap, remaining headroom, and derived percent used (DailyApiRequests, PermissionSets, DailyBulkApiBatches, and the rest). This is one row per limit, so the list returns every limit in a single page.

• API: GET /v1/orgs/{orgId}/orgLimits and GET /v1/orgs/{orgId}/orgLimits/{name}. The by-name record is identical in shape to the list record.
• MCP: list_org_limits and get_org_limit.

Read access to the adoption data behind the dashboard's Cloud tab: a per-cloud adoption breakdown with an overall usage summary, plus per-object metrics covering record counts, active users, automations, field counts, and last-used dates.

• API: GET /v1/orgs/{orgId}/cloudUsage (a singleton, so no filter, sort, or pagination) and GET /v1/orgs/{orgId}/objectUsages.
• MCP: get_org_cloud_usage and list_org_object_usages.

Read access to the junction rows that link a connected app to the profile or permission set it is granted through, completing the picture alongside the existing Connected Apps and Profiles and Permission Sets resources. Each row targets exactly one of the two: profileId or permissionSetId is set, and the other is null.

• API: GET /v1/orgs/{orgId}/connectedAppAssignments.
• MCP: list_org_connected_app_assignments.

Server errors are no longer reported as malformed filters. Previously a 500 came back with the "poorly formatted RQL filter" message, which sent agents into retry loops against a failing backend.

• MCP: every list and get tool now returns a stable code in structuredContent.error, one of bad_filter, rate_limited, not_found, access_denied, or server_error. Genuine 400s keep the filter elicitation and its resource:// links.
• API: filter failures now split three ways. A parse error returns 400 with the reason, a value that is only rejected later in processing returns 400 with a safe classification hint (previously a 500), and everything else returns 500.

List and search the Salesforce orgs you can access, the first endpoint in the public surface that is not scoped to a single org. It returns a compact record per org (salesforceId, name, edition, instance URL, sandbox flag, last scan date and status, scan count, and Hubbl score); fetch the single org for the full record. You see only the orgs you already have access to in the dashboard.

• API: GET /v1/orgs.
• MCP: list_orgs, the entry point for resolving an orgId before calling any per-org tool.

Read access to the license usage captured in an org's Hubbl scan: total, used, and remaining counts per license, with type, status, and expiration date.

• API: GET /v1/orgs/{orgId}/licenseUsages and GET /v1/orgs/{orgId}/licenseUsages/{apiName}.
• MCP: list_org_license_usages and get_org_license_usage.

Read access to the Salesforce profiles and permission sets captured in an org's Hubbl scan, including the risky-permission flags surfaced on the dashboard's Profiles and Permission Sets tab (modifyAllData, viewAllData, manageUsers, dataExport, authorApex, and the rest).

• API: GET /v1/orgs/{orgId}/sfProfiles and /sfProfiles/{sfProfileId}, plus GET /v1/orgs/{orgId}/permissionSets and /permissionSets/{permissionSetId}.
• MCP: list_org_sf_profiles / get_org_sf_profile and list_org_permission_sets / get_org_permission_set.

Read access to Salesforce login activity for an org: a per-user table carrying 30, 90, and 365 day login counts, plus an adoption rollup of licensed users, how many logged in, how many did not, and login adoption percentage over the same trailing windows.

• API: GET /v1/orgs/{orgId}/loginActivity and GET /v1/orgs/{orgId}/loginActivity/overview. The overview is a singleton with no pagination, and takes an optional repeatable license parameter that scopes every count in the response to the selected Salesforce license types.
• MCP: list_org_login_activity and get_org_login_activity_overview.

Read access to the Apex triggers captured in an org's Hubbl scan, completing the automation trio alongside Workflows and Flows.

• API: list and filter triggers, or fetch a single trigger's full record.
• MCP: list_org_triggers and get_org_trigger.

Read access to the workflow rules and flows captured in an org's Hubbl scan, the first two of the automation trio.

• API: list/filter and single-record fetch for each.
• MCP: list_org_workflows / get_org_workflow and list_org_flows / get_org_flow.

Any user, not just admins, can now connect to the REST API or MCP server by signing in with a Hubbl account, with no API key required. You see only the orgs and scans you already have access to, and existing API keys keep working unchanged.

Programmatic read access to the field-level and object-level data captured in an org's Hubbl scan.

• Fields: list and filter scanned fields, or fetch a single field's full record.
• Objects: list an org's objects, fetch a single object, or list the fields on a given object.

MCP responses now carry the full payload in structuredContent, with content[0].text reduced to a pointer, removing duplicated JSON. Redundant scan timestamps were dropped from connectedApps, installedPackages, and fields responses.