Changelog

Changes to the published contract, newest first. The dates are the days a change was made. Added means new; Changed means something that already worked now behaves differently.

2026-10-14

Added

• Proof of play in the format tanba.pop/1: a batch carries batch_seq, prev_sha256 and numbered records. Each record is judged on its own and the answer lists the ones that were flagged, refused or repeated. See Send proof of play.
• Reports from a CMS: POST /api/v1/pop/batches takes one signed batch for many players. The plays count as attested. The CMS installation and its players are registered in the console.
• A presence token in the QR code of a player: ?p= on the approval page, and qr_key and qr_secret in the heartbeat.
• Daily seals of the received statistics: GET /v1/stats-seals and GET /v1/stats-seals/{day}, with the place of the seal in the public ledger. tanba-verify seal checks them.
• Random inspection visits: GET /v1/spot-checks and GET /v1/spot-checks/{day} publish the hash of the secret of each round the day before and, after 7 days, the secret, the candidates and the sample, so anyone can recompute it. The hash and each inspection are leaves of the public ledger.
• The webhook event case.step: a step of a violation case was applied, lifted or the case was closed. The operator sees its cases, its compliance score and the notices in the console.
• The creative registry and programmatic submissions: GET /api/v1/creatives/{sha256}, GET /api/v1/creatives/lookup, GET and POST /api/v1/structure-sets, POST /api/v1/submissions/{id}/submit.
• Product categories: GET /api/v1/categories.
• Programmatic claims: POST /api/v1/plays/claims takes what an ad platform says it served, line by line, and GET /api/v1/plays/claims/verification answers for every line how many plays the players proved (matched, over_claimed, unmatched). A play record may carry the seller in detail.src. Claims never change billing.
• Billing by evidence tier: lines of a billing period name the tiers and the model behind them, and the period page has reported_not_billed and shortfalls.
• Every field of the published calls now has a description and an example, and the device calls are described in full. The revocation list body is documented field by field.
• Kazakh interface and guides on this site, and Russian text for the main reference pages.
• Guides for operators and advertisers in Kazakh, Russian and English: submit a creative, enrol a player, find a statement and its evidence in the console and answer a violation case.

Changed

• A device that has had a tanba.pop/1 batch accepted can no longer send the earlier format: such a batch is refused with 409 legacy_after_pop.
• A ledger day that holds a seal has inputs of version 2. Use the current tanba-verify.
• The wording of the revocation list calls now says that the PKCS#7 file carries the list, not that it is detached.

2026-10-07

Added

• Play import: POST /api/v1/plays/import takes the plays your own CMS counted, hour by hour. They are compared with the players' reports every night.
• The public ledger: GET /v1/ledger-days, GET /v1/ledger-days/{day}, GET /v1/ledger-days/{day}/proof.ots, GET /v1/approval/{number}/ledger-proof and the page /v1/ledger. A day shows anchored with a block height only after the block header has been checked against two independent explorers; until then it is pending_check.
• Renewal of a device certificate, POST /d/v1/renew, and replacement of the key of a signed agent, POST /s/v1/rotate-key.
• Upload of the hash-chained log of a player, POST /d/v1/logs.
• Operational reports and their CSV sections: GET /api/v1/stats/reports.
• Revoked devices on the revocation list: the field revoked_devices.

Changed

• The body of a command acknowledgement names the command, command_id, and must match the identifier in the path.
• The public approval page marks the masked manifest as masked (manifest_masked) and gives the hash of the original (manifest_sha256).
• A structure can carry the size of its screen and the length of its slot (optional fields). A submission whose media do not fit them is returned to the applicant.

2026-10-06

Added

• The first published contract: public verification of an approval, the revocation list, and the integration API with API keys, scopes, signed webhooks and CSV exports.
• The structure sticker page and the public complaint form: GET /v1/structure/{code}, /v1/complaint.
• The registry of certified player models: GET /v1/certified.
• Daily audit anchors: GET /v1/audit-anchors and GET /v1/audit-anchors/{day}.
• Platform status: GET /v1/status and the page /v1/status-page.
• The RPC concentrator for players that are commanded over RPC.
• Billing reports and their CSV exports.
• The webhook event city_event.opened.