Release 0.5

In progress

Every version listed below is in production. The series closes once its last epic is delivered and SmaCH has accepted it on the development environment. Progress is followed on the 0.5 roadmap, which needs a SmaCH account on the forge.

The 0.5 series lays the foundation of v1.0.0. The SmaCH super-admin runs organizations and users on their own, the business API is rebuilt on modern ground with the same data model, and the API is documented and open to integrations.

It is delivered as three work packages:

• Organizations and users: administration console, then members managed by each organization
• Public API and documentation site
• Storage space per organization

Integrating the API, or maintaining the mobile application? Read the migration guide first: it lists every contract change of the series and what to adapt, in one pass.

Added

• Administration console for the super-admin: organizations, users, members and roles, with search and pagination.
• Invitations by email. A new account receives an invitation, confirms its address and chooses its own password. The link is valid 3 days and can be sent again.
• Password reset from a user’s record, and the super-admin role granted or withdrawn from the console.
• A language per user, French or English, for emails and the login page.
• Members managed by the organization. Its administrators invite people by address, change their role, resend an invitation or remove a member. An administrator can neither change their own role nor remove themselves.
• Directory figures in the console: members per organization, organizations and last login of each user, logins over 90 days.
• My profile, for every role: first name, last name and language. The password is changed on the SmaCH login page.
• Public API portal at the root of api.smach.science: the reference of the whole API, two getting-started guides, and requests sent from the page with your own SmaCH account.
• Monitorings: the list shows the real duration and the alert count of each session, can be filtered by status and type, and a monitoring’s page updates live when it starts and stops.
• After an update, the web application offers to reload the page.

Changed

• Business API rebuilt on PostgreSQL, with the same data model. Every existing record was migrated on 20 October 2026, in production and on the development environment: artworks, monitorings, events, inventory. File storage moved the same day.
• One API contract for every service: pagination, search, sorting and error format, described in the API conventions. The API is served under /apis, without a /v1 prefix.
• The API checks data consistency, which the former one did not:
  • the equipment named when setting up a monitoring must exist in the inventory;
  • equipment that has been used cannot be deleted, nor a packaging assigned to an artwork;
  • deleting an artwork deletes its monitorings and their events, archiving keeps everything and remains the normal way;
  • monitoring identifiers become UUIDs, so saved links to a monitoring no longer work.
• Development environment on its own realm, smach-dev. Test accounts and organizations no longer sit next to production ones, and accounts are not shared between the two environments.
• GET /me is answered by the identity service, with the same payload. Its role field now reports the highest role held.
• A viewer no longer reaches the inventory, not even through a direct link.

Removed

• The former business API, retired on 20 October 2026.

Fixed

• A record opened right after closing another one showed empty.
• A member signed in with the organization scope, the one StaRT requests, was refused by the API as belonging to no organization.

Versions

Each service publishes its own 0.5.x versions at its own pace. Their release notes are on the forge, most recent first, and need a SmaCH account.

Service	Release notes
Web application	smart
Identity service	iam
Business API	artworks
Documentation and API portal	docs