Changelog

All notable changes to rtcStats are documented here, most recent first. This project follows Keep a Changelog and Semantic Versioning.

Tags, reused across releases:

• API: the public REST + MCP API
• Engine: the analysis engine, observations, deductions and the experience score
• AI: all work around AI
• Dashboard: the dashboard and session viewer
• Web Site: the public website (landing, pricing, showcase, blog)
• KB: the knowledge base
• Security: security fixes and hardening
• Chore: user-visible platform changes (performance, domains, infrastructure)

[2.1.0] - October, 19th 2026

Added

• [Dashboard]: Mark sessions recorded from an app that embeds Chromium, show connection certificates, expand replaceTrack events in the logs, and badge each device with its connection type.
• [Dashboard]: Add a Settings > Data tab for owners and admins to see what the account stores, export or import sessions with their tags and comments, or delete every session of the account in one run. Each imported session uses one credit.
• [Dashboard]: Settings > Billing shows the date of each credit purchase and how many purchased credits are used and left.
• [API]: Add maxReceivingAudioStreams and maxReceivingVideoStreams to each peer connection and isScreenshare to video streams, matching rtcstats-server.
• [API]: Publish an agent skill and a per-operation agentic access contract so AI agents can discover rtcStats and use it safely.
• [API]: Repeating an upload or analyze?save=true assemble with the same fileId within 24 hours returns the original response, with no second session or credit.
• [API]: Add three MCP prompts, what_changed_since, sessions_worth_opening and explain_session_observations, that clients such as Claude Code show as slash commands, and the rtcstats://observations/{type} resource, which returns the explanation of one observation type as Markdown.
• [API]: GET /v1.0/sessions and list_sessions return the low and info observation types in abstract.observationMinorFlags, with observationsLow and observationsInfo counts.
• [API]: Each observation returned by POST /v1.0/enrich now carries source, the same object as on GET /v1.0/sessions/{id}, with the peer connection pid and the related ids.
• [KB]: Ask for an optional reason after a negative "Was this page helpful?" vote, and show the vote on the WebRTC metrics articles too.
• [KB]: New articles on MOS, connection states, ICE candidate pairs, WebRTC monitoring, WebRTC debugging, and exporting and importing account data.
• [KB]: New integration guide for BigBlueButton 3.0 and 4.0.
• [Web Site]: Add a Free Tools page that links to the browser-only dump anonymizer and dump splitter.
• [Web Site]: The home page shows customer testimonials and explains how rtcStats keeps your session data in your own storage.

Changed

• [Dashboard]: The Observations panel shows four severity levels, High, Medium, Low and Info: the Critical level, which no observation used, is gone.
• [API]: Remove the critical severity value, the hasCritical filter of GET /v1.0/sessions and list_sessions, abstract.observationsCritical, and observationsCount.critical on GET /v1.0/sessions/{id}, POST /v1.0/analyze and POST /v1.0/enrich: no observation ever carried this severity and no client used these fields.
• [AI]: The AI summary of a dashboard upload starts when the upload finishes and appears in the session on its own once ready.
• [AI]: Generate AI summaries with Claude Haiku 5.5, which reasons before it answers and sticks closer to the session data.
• [Dashboard]: Rebuild the Analysis page to stay fast on large accounts, with a period selector, a sessions chart you can open by day or hour, collapsible filters with live counts, a Path filter and group for the connection type, a Group by menu and a list that loads as you scroll.
• [Dashboard]: The Devices table links a sent track to its device by track id and shows how long each device was on.
• [Dashboard]: The Video (inbound) card shows the number of received video streams over the call, with a mark at each freeze.
• [Dashboard]: Session tables follow your date and time format, and the Camera and Video cards show the resolution as a label such as 720p.
• [Dashboard]: Clearer tooltips that follow the theme and link to the knowledge base, and a compact layout for the timeline hover cards.
• [Dashboard]: New API tokens last 6 or 12 months, the Applications list shows who created each token, and a user's tokens are revoked when they leave the team.
• [API]: Concurrent upload, analyze and enrich calls can no longer spend more credits than the account has: the call that misses the last credit returns 402 no_credits.
• [API]: A gzipped dump that expands past 30 times the account size limit returns 413 file_too_large, and a chunk sent while too many chunks wait for assembly returns 429 rate_limited with Retry-After.
• [API]: In a newly generated aiSummary.summary, every < in highlight, network, media and user is escaped as <, which markdown renderers display as <.
• [Web Site]: Blog articles, author pages and category pages are built in advance, so they load fast even on a first visit.
• [KB]: A reader can change or clear a "Was this page helpful?" vote.
• [KB]: Explain how to tell a network interruption from a remote side that stopped sending, and correct the trigger values in two network articles.
• [KB]: The GeoIP article is renamed "How to add GeoIP location data to rtcstats-server".
• [Security]: Every non-public dashboard endpoint requires a signed-in session, administration and scheduled endpoints are locked down, share and embed links open only the shared session, and outbound webhooks reach only approved destinations and carry a shared secret.
• [Security]: Stop users outside an account from reading its session comments or restarting its AI summary, and show HTML in AI summaries as plain text.
• [Security]: AI summaries render only bold and italic text: a link shows as plain text and an image is not loaded.
• [Security]: Harden the AI summary against instructions hidden in session data, and store only a summary with the documented fields and scores.
• [Security]: rtcStats now generates each share link when you click Share and keeps every share or embed link unique to one session, and a share link no longer reveals the embed link.
• [Security]: Only owners and admins can manage teammates, invitations and API tokens, and an invitation can only be accepted by the invited email address within 7 days.
• [Security]: Update the libraries behind the MCP server to versions that fix published security advisories.

Fixed

• [AI]: Fix reopening a session while its AI summary was being written restarting the generation.
• [API]: Fix chunked uploads from the dashboard and the API sometimes failing at assembly with "No chunks found for this file"; chunks can now also be sent in parallel.
• [Engine]: Fix sessions without a reliable wall-clock time being dated January 1st, 1970, or lasting several decades.
• [Engine]: Fix sessions with no peer connection lasting from the first to the last device event, up to a full day: their duration and scores now read N/A.
• [Engine]: Fix a false audio observation on Chromium-based apps that play incoming audio through WebAudio.
• [Engine]: Fix false network observations on streams with only small or isolated variations, and date each one at its first spike.
• [Engine]: Fix a missing microphone level and underrated outgoing video quality when the app attached its microphone or camera after the call started.
• [Engine]: Fix a false connectivity observation on sessions recorded without ICE candidate events.
• [Engine]: Fix sessions from some non-browser WebRTC clients failing to process or missing their connection timing.
• [Dashboard]: Fix a microphone opened before the recording started showing as "No microphone" on the Devices page or missing from the Client tab.
• [Dashboard]: Fix sessions from clients that hide addresses, ports or stream identifiers showing raw values and a single local candidate: hidden values now read <masked>.
• [Dashboard]: Fix the Analysis page counting only the 1000 most recent sessions of an account.
• [Dashboard]: Fix dashboard uploads not being refused once the account had no credits left.
• [Dashboard]: Fix credits used beyond the monthly allowance being taken from a credit pack bought later, so remaining credits, GET /v1.0/quota and MCP get_quota can read higher.
• [Dashboard]: Fix the Credits Usage chart labelling each month one month early west of UTC.
• [Dashboard]: Fix sign-up, password reset and invitation showing the password rules when a valid password was refused for appearing in a known data breach.
• [Dashboard]: Fix packet loss charts going negative after lost packets were recovered, which also overstated the session peak loss and could drop audio MOS samples to 1.
• [Engine]: Fix two video observations counting time from before a late capture and showing an invalid time, and explain why session averages can include that earlier activity.
• [API]: Fix gatheredHostCandidate, gatheredSrflxCandidate and gatheredTurnCandidate reading false when the client hid candidate addresses, and omit gatheredMdnsCandidate when no address is known.
• [Chore]: Fix deleting a session leaving some of its earlier analysis files in storage.
• [API]: Fix the API reference page at /api-docs showing "Redoc script did not become available" instead of the documentation.
• [Web Site]: Fix robots.txt letting AI training crawlers into the API, dashboard, share and embed paths that every other crawler is kept out of.

[2.0.1] - October, 1st 2026

Fixed

• [Chore]: Fix the daily update email reporting on the new month on the 1st: it now covers the previous Europe/Paris day and that day's month, counts active accounts from all their activity, adds the distinct viewers, labels internal accounts as Internal, and includes purchased credits in the monthly usage.

[2.0.0] - September, 28th 2026

Added

• [API]: Add the rtcstats-features catalogue to every session payload under features.client, features.devices, features.globals and features.audio, with the per-connection and per-track facts folded into pConnections and streams, so dumps uploaded straight to rtcStats carry the same client, connection and track facts that rtcstats-server computes; on every plan and every surface (dashboard, share and embed viewers, REST, MCP, POST /analyze).
• [API]: Add the lifetime counters concealmentEvents, packetsDiscarded, retransmittedPacketsSent and retransmissionRatio to the media entries of streams, on every surface.
• [Engine]: Add 2 new observations covering connectivity issues.
• [API]: Add read-only application tokens: a read-only token serves every read (sessions, quota, observations, MCP tools) and is refused with 403 and the new errorCode insufficient_scope on the endpoints that spend a credit or delete a session (upload, analyze, enrich, DELETE /v1.0/sessions/{rtcstatsId}).
• [Dashboard]: Let you pick the scope of an application token, full access or read-only, when creating it under Settings > Applications, and show the scope of each existing token in the list.
• [API]: Add maxFileSizeBytes and maxChunkSizeBytes to GET /v1.0/quota and the MCP get_quota tool, so a client can read the size it is allowed to upload and how to split it, instead of discovering the limit through a 413. maxFileSizeBytes is null on an account with no limit.
• [API]: Add GET /v1.0/observations/{type} and the MCP tool get_observation_explanation, which return the explanation of one observation type as Markdown sections, with its title, description, severities, tags and related types. No credit is spent and read-only tokens are accepted.
• [Dashboard]: Show the periods where an audio or video stream's MOS sits at its minimum as a hatched Bad segment on the Streams timeline, with their duration in the tooltip next to Poor, each labeled with the MOS range it covers, and count them toward the stream's "Mostly poor quality" state.
• [API]: Paginate GET /v1.0/sessions and the MCP list_sessions tool with limit (1 to 1000, default 100) and page (default 1). Every response now also carries totalCount, page, limit, totalPages and hasMore, so a client can see how many sessions match and walk through all of them.
• [Dashboard]: Add a Negotiations section to each connection's details on the Connections page, listing every negotiation and renegotiation with its outcome (completed, failed, no answer, incomplete, rolled back) and, for each signaling call, its result, how long it took, the time since the previous call, the media sections with their SSRCs and the browser error when a call fails.

Changed

• [Dashboard]: The data channel chart now opens on Bytes, shown before Messages.
• [API][Breaking Changes]: The MCP endpoint now requires the application token on every request, initialize and tools/list included: a missing or invalid token is answered with HTTP 401 and a WWW-Authenticate header, a plan without API access with 403, instead of a tool error after connecting. REST 401 responses now carry WWW-Authenticate too.
• [API][Breaking Changes]: GET /v1.0/sessions and the MCP list_sessions tool now return the 100 newest sessions when called without limit, instead of up to 1000. Pass limit (up to 1000) and page to read more.
• [Engine]: With the advanced audio MOS, incoming audio the listener could not hear (an audio interruption, no audio released by the jitter buffer, or no audio energy at all) now scores the minimum MOS of 1, and a shorter interruption lowers the MOS in proportion to its duration, so the MOS, audio and experience scores of sessions with audio cuts can go down.
• [API][Breaking Changes]: Remove the documented MOS value 0 for an unusable transport (RTT of 15 seconds or more): it is now 1, the minimum, so every MOS, including avgMos and the mos_* keys of aggregatedStats, lies between 1 and 4.5. An unusable transport stays visible through rtt_*_max_ms at 15000 or more.
• [API][Breaking Changes]: Remove the deductions field from the session payload of the REST API, MCP get_session and POST /analyze while the Deductions layer is reworked; it returns once it is ready.
• [AI]: Rewrite the AI summary prompt: it reads only the session facts it needs, follows the media path in each direction, names the origin of a problem on evidence only, and uses the same five-level scale (excellent, good, acceptable, poor, bad) for every score.
• [API]: Remove mediocre from the documented values of the AI summary scores networkScore, mediaScore and userScore; the five remaining values are unchanged.
• [KB]: Observation explanations now open only inside the app, for a signed-in user or anyone holding a share or embed link, and a reference from one explanation to another opens in place in the same popup instead of sending you elsewhere. The popup now closes with Escape, keeps the page behind it inert while open, and returns focus to whatever you opened it from. The metric explanations behind the KB badges on the charts are now served the same way; the public knowledge base pages are unaffected.
• [API][Breaking Changes]: Remove GET /v1.0/observations, the catalog of observation types, which now answers 410 Gone with the new errorCode gone and a Sunset header, with or without a token. The observation types are no longer published anywhere: /schemas/vocabulary.json drops them too and keeps only the severity, category, tag, score and plan value sets. Read the types you need from data.observations[].type and from abstract.observationTypes on GET /v1.0/sessions, and treat the set as open.
• [KB]: Remove the observation pages from the public website: they no longer appear in the WebRTC Metrics list, its Observations filter, the knowledge base search, the category counts or the sitemap, and an old /kb/observation-... link now answers 410 Gone. The explanations themselves are unchanged and stay one click away in the app, on the session that raised the observation.
• [Chore]: Darken the blue accent carried by links, buttons, selected states and the account emails so text on it clears the WCAG AA contrast minimum, on both the light and the dark theme.
• [Dashboard]: Make the knowledge base badge on each chart legend row reachable with the keyboard, as its own stop beside the series toggle.
• [API]: Observations no longer carry the meaning field.
• [KB]: Align each observation's short explanation in the app with its knowledge base article, so both say the same thing, and correct the explanations of two audio observations.
• [API][Dashboard]: connectivity, each connection's type, the TURN usage flags and the candidate pair types now describe the local side only: a connection reaching the other party's relay without using its own reads DIRECT/UDP instead of TURN/UDP. Same values and shape, not breaking.
• [Dashboard]: The Symmetric NAT row of a connection no longer claims a TURN server is needed, and shows its value as a warning rather than an error.
• [Engine]: Raise the connectivity and experience scores of sessions that reached the other party's relay without using their own, since the connectivity score now counts only the relay this endpoint used.
• [Dashboard]: Observation cards now show the count or duration badge on the description line, keeping the timestamp alone on the title line.
• [Dashboard]: Redesign the Connections, Streams, Channels and ICE Connectivity tables: each row shows its state (such as Connected, Failed, Active, Stalled or Unused), its start time and its duration, and each group of rows shares its own time axis with clock times. Order the Connections, Streams and Channels by Time, placing each bar at its real start, or by Duration, starting every bar at zero to compare lengths; in Streams and Channels, Align by Peer start shows how long media took to start after the connection opened.
• [Dashboard]: Redesign the Devices table: rows are grouped by the origin that made the request, with one row per microphone, camera or screen track, its state (Used, Replaced, Unlinked, Not sent, Failed or Listed), the connections that sent it, and a timeline showing the wait for permission and how long each track was sent. A microphone or camera shows Unlinked, rather than Not sent, when a connection sent a track of the same kind that the app likely created from a capture, and it names that connection and track. Devices that belong to the same equipment, such as a webcam and its microphone or a headset's microphone and speaker, are marked as linked. Long device names show on two lines, with the model in parentheses below the name. Repeated identical failures and device listings fold into a single row, USB and default devices are marked with a badge, including the German and French default device prefixes, and long idle periods are folded on the time axis. The System details now sit above the table, which uses the full page width.
• [Engine]: Improve how observations and the device feature flags recognize device hardware, so more peripheral devices are identified correctly.
• [KB]: Knowledge base article pages are lighter to download, with the same content and links.

Fixed

• [Dashboard]: Fix the chart tabs showing a separator between some tabs but not others, and a blue right border on the selected tab of the connection and data channel charts.
• [Dashboard]: Fix STUN and TURN servers configured with an IPv6 address showing UNKNOWN instead of their transport and port in a connection's details, and a TURN URL without a port losing its transport parameter.
• [Engine]: Fix some connections that never managed to connect in Chrome being reported as having dropped, rather than as having failed to connect.
• [Engine][API][Dashboard]: Fix peer connections closed before their first statistics sample: they now appear in the session (with hasStatistics: false) with their real lifetime, state and failure reason, and get the connectivity observations they were missing. A connection closed before it ever tried to connect is no longer scored 0 and no longer lowers the connectivity score. A connection established over UDP no longer raises a false connectivity finding, configuration findings shared by several connections are reported once, the MCP tools also return their result as text, and observation cards in the session viewer are more compact.
• [Engine]: Fix four observations covering audio and outgoing media being reported at a fixed severity regardless of how much of the call they actually affected, which also pushed down the experience score of sessions that were barely impacted. Their severity now reflects the scale of what was detected, they carry the measured values that severity was graded on, and a signal too small to matter no longer raises them at all. Along the way, the one covering outgoing media was measuring its signal in the wrong unit, so it could be raised or missed for the wrong reason: it is now correct and applies to video as well as audio, and one audio observation that was repeated on every incoming stream of a connection is reported once.
• [API]: Fix a gzipped dump being measured against the account size limit twice with two different meanings: the chunks against their compressed size, then the assembled file against its decompressed size, so a file accepted chunk after chunk could still fail with 413 once fully sent. Only the bytes you upload are measured now, on every ingest path, and the 413 lands on the chunk that crosses the limit instead of at assemble.
• [Security][Dashboard]: Fix dashboard uploads not being checked against the account size limit at all on the server, where the limit was enforced only by the upload page before the first request left the browser.
• [API]: Fix data.fileSize reporting a different number for the same dump depending on how it was sent: a gzipped body on POST /analyze and POST /enrich reported its compressed size, while every other path reported the dump content size. It is now the dump content size everywhere.
• [API]: Fix POST /v1.0/upload answering 500 instead of 400 invalid_request when the assemble request carries a non-string fileName.
• [API]: Fix data.fileName changing after a session was re-analyzed; it now keeps its upload-time value.
• [Engine]: Fix two audio observations being raised on calls with no echo problem, by relying only on actual echo measurements.
• [Dashboard]: Fix the session Overview Summary panel showing its values at inconsistent widths, and cutting them off or pushing them outside their card on narrower windows.
• [Dashboard]: Fix the session Overview Insight chart not drawing at all on narrow windows, where its title ran into the Summary heading.
• [Dashboard]: Fix the dark theme serving the light theme's blue accent on several controls, where a hardcoded color overrode the theme value.
• [Engine]: Fix some rtcstats dumps captured after the collecting client reconnected being dated January 1st, 1970, and fix the duration of sessions where no connection produced statistics, which ignored when those connections ended.
• [Engine]: Fix the connectivity observations on ICE server errors pointing at the last failure instead of the first, and always counting a single failing server however many failed.
• [Engine]: Fix the microphone type not being detected when the dump capture started after the microphone was opened.
• [Engine]: Fix a connectivity observation being missed on short connections that closed before candidate gathering finished.
• [Engine]: Fix a connectivity observation raised on ordinary NATs, and also detect it from the connection in use.
• [Dashboard]: Fix the session Overview hiding its score cards when no score could be computed, and offering an upgrade on an empty experience score to plans that already include it.
• [Dashboard]: Fix the Microphone and Camera widgets of the Devices page showing a broken device name, such as "Standard - Desktop Microphone)", when the model name in the device label contains its own parentheses or the label starts with a German or French default device prefix.

[1.10.0] - September, 7th 2026

Added

• [Engine]: Introduce Deductions, automatic root-cause analysis that explains the likely reason behind a call's connectivity or audio problems.
• [Engine]: Add 11 new observations covering connectivity and audio issues.
• [Web Site]: Add a /compare section comparing rtcStats to the alternatives: webrtc-internals, watchRTC, callstats.io, ObserveRTC, and building it yourself.
• [Web Site]: Add a /trust Trust center gathering the security, privacy, compliance, availability and API lifecycle answers a security review asks for, and a /compliance page covering the data held, its location, its retention, the sub-processors involved, and which certifications rtcStats does and does not have.
• [Dashboard]: Show the last packet sent and last packet received times for each ICE candidate pair in the Connections panel.
• [API]: Add per-account rate limits on the public API and MCP tools: over the limit, REST returns 429 with Retry-After and MCP tool calls return a tool error, and every response emitted after the rate check carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset.
• [API]: Complete the OpenAPI spec (every errorCode value with its meaning and an example, the code returned by each error response, the 403 and 429 responses, the rate-limit headers) and add an agent quickstart to llms.txt, so a client can branch on the code rather than on the message.
• [KB]: Add an IT specifications and requirements page for the open source rtcstats-server, for infrastructure and security reviews.

Changed

• [API][Breaking Changes]: Group deductions by issue in the API and MCP response (one entry per issue holding its ranked causes) instead of one flat entry per cause, and drop the title, polarity and source fields from each deduction.
• [API]: Shorten the deprecation notice window to 6 months for a version and 3 months for an individual endpoint or field, and add the release blog post and changelog [Breaking Changes] tag as additional deprecation-signalling channels.
• [Engine]: Broaden an existing connectivity observation to also flag ICE restarts and re-offers made right after a call connects.
• [AI]: Leave unused peer connections and streams out of the AI summary input, for a more focused summary.
• [Dashboard]: Redesign the dashboard sessions table and session-viewer tabs for higher information density and a better fit on laptop screens, remove the redundant Connections "Error type" row now covered by observations, and move the Quick start checklist into the sidebar.
• [KB]: Redesign article pages with a persistent section rail, table of contents, last-updated dates, and a "start here" section on the knowledge base home.
• [Security]: Require an explicit confirmation click for sign-up instead of an email link that opens automatically (closing an automated-scanner bypass), and extend CAPTCHA protection to sign-in, password reset, and invite acceptance.
• [Dashboard]: Redesign the Streams, Pairs and Channels charts for long calls, which run from ten minutes to several hours: a multi-hour session now reads as clearly as a short one, each metric shows its range around a thinner mean line rather than a solid block of points, and dragging across the time axis zooms into a window at full detail.
• [Dashboard]: Simplify the Streams, Pairs and Channels chart tooltips and give each unit its own decimal precision.
• [Dashboard]: Relabel the Connections Pair Information traffic rows as Bitrate (Outgoing) and Bitrate (Incoming).
• [KB]: Rewrite the rtcstats-server requirements and operations guide around a before-production checklist and a production readiness path.
• [Web Site]: Reorganize the footer into Product, Resources and Company columns, and surface the Compare page and the Trust center from the header, footer, pricing and open source pages.

Fixed

• [API]: Fix an unexpected failure of GET /v1.0/sessions/{rtcstatsId} returning an HTML error page instead of the documented { error, errorCode } body with other_issue.
• [API]: Fix an oversized or malformed multipart/form-data chunk on /v1.0/upload, /v1.0/analyze and /v1.0/enrich returning an empty 500 instead of a documented error: a chunk above the 10 MB request body limit now returns 413 file_too_large, and an unparsable one 400 invalid_request.
• [API]: Fix an empty or malformed JSON assemble body on /v1.0/upload returning an empty 500 instead of 400 invalid_request.
• [Security]: Stop DELETE /v1.0/sessions/{rtcstatsId} returning the raw database error text in its 500 body; it now returns a fixed generic message like every other route, with the real cause logged server-side only.
• [Engine]: Fix streams that stall right after capture starts being misreported, and stop already-flagged stalled streams from producing extra, noisy observations.
• [Engine]: Fix connection-failure observations not firing when a call's ICE connects but negotiation never fully completes.
• [Engine]: Fix the experience score showing a low, misleading value instead of unavailable for sessions that never made a real call, and fix the connectivity score being skipped or computed incorrectly when a session's timestamps were invalid.
• [Engine]: Fix the call date missing on sessions where no peer connection produced statistics.
• [Dashboard]: Fix inbound media byte counts not being recorded for received streams.
• [Dashboard]: Fix Highcharts failing to render on the session-viewer Overview page after visiting Settings then Billing, or an admin chart, earlier in the session.
• [Dashboard]: Fix layout glitches in the sessions table (Title column collapsing) and the Logs tab (a stray double separator).
• [Dashboard]: Fix the Logs tab crashing when expanding an SDP event whose audio or video section carried no resolvable codec, as happens with sections rejected during a renegotiation.
• [Dashboard]: Fix the Logs tab scrolling slowly on sessions with many events.
• [Dashboard]: Fix candidate-pair charts and observation badges resolving to the wrong peer connection when two peer connections reused the same pair ID.
• [KB]: Fix broken links across the knowledge base.
• [Chore]: Fix web site, knowledge base, and blog pages being needlessly slow by making them cacheable at the edge instead of re-rendering on every request.

[1.9.2] - August, 30th 2026

Changed

• [SECURITY]: Extend Turnstile/CAPTCHA protection to /signin (password and magic link), /lost-password, and /accept-invite, matching the coverage already enforced on /register.

[1.9.1] - August, 27th 2026

Changed

• [SECURITY]: Require an explicit POST from a "Confirm sign up" click instead of the emailed link's GET completing signup, closing a bypass where automated email-security scanners could confirm accounts without the owner's action; add Cloudflare Turnstile groundwork to /register.

[1.9.0] - August, 3rd 2026

Added

• [Engine]: Add 7 new observations covering network and connectivity issues.
• [Dashboard]: Show custom application trace events from rtcstats-js in the Logs tab.
• [API]: Accept the same chunked upload protocol used by /upload on POST /analyze, so large dumps can be analyzed too.
• [API]: Add POST /v1.0/enrich, a lightweight endpoint returning scores and observations only, metered like /analyze.

Changed

• [Dashboard]: Render the session viewer as soon as the summary responds, loading devices, timeline, and logs in the background.
• [Web Site]: Retheme the site to the Signal Blue brand color and polish the landing page (hero motion, CTA accessibility, contrast).
• [KB]: Reorganize the knowledge base home page into tiers with a promoted category trio and a metrics reference band.
• [Dashboard]: Redesign the session-viewer cards (CPU, Buffering, Latency, Connectivity, Microphone, Speaker, Webcam, Video) with downsampled sparklines, threshold zones, and a unified color system.
• [API][Breaking Changes]: Stop returning internal schemaVersion, analysisVersion, observationsVersion, and youtube_url from session responses, and expose the processor version as processorVersion instead.
• [API][Breaking Changes]: Rename the duration field to durationInSeconds in sustained-loss and connectivity-loss indicators, and round numeric values across session responses (timestamps to whole milliseconds, others to at most 2 decimals).
• [Security]: Harden the upload chunk store against prototype-pollution and cross-account key collisions.

Fixed

• [Dashboard]: Fix the sessions table Date and Imported-at columns not sorting correctly.
• [API]: Apply the account's MOS computation settings on POST /v1.0/analyze even without ?save=true.
• [Engine]: Fix phantom MOS scores being computed on streams with no media.
• [Dashboard]: Fix addTrack/ontrack event details rendering as raw objects instead of a readable summary in the Logs tab.
• [Dashboard]: Fix TURN TCP/TLS detection being applied outside relay candidate pairs.
• [Dashboard]: Fix a Highcharts crash (missingModuleFor: arearange) on session-viewer charts and dashboard stat cards.
• [Dashboard]: Apply the brand color consistently on light-theme pages (sign-in, register, password reset, invite).

[1.8.0] - July, 13th 2026

Added

• [Dashboard]: Add dark and light themes with a toggle, persisted per user.

Changed

• [Dashboard]: Redesign the Overview stat cards (Audio/Video In/Out) with a min-to-max range track and hover detail, tiered Jitter/RTT units, and aligned call-start timelines across Streams, Data channels, and sessions list stat cards.
• [API][Breaking Changes]: Rename every aggregatedStats key to a <metric>_<scope>_<agg>_<unit> shape (e.g. rtt_out_audio_avg_ms) and add P5, P95, and standard-deviation variants; the former unitless keys are removed.
• [Chore]: Make rtcstats.com the primary domain; www.rtcstats.com now redirects to it.

Fixed

• [API]: Fix POST /upload, /analyze, and the dashboard upload returning 500 instead of 415 when the uploaded file can't be parsed.
• [Dashboard]: Fix downloading a session whose file is missing from storage returning 500 instead of 404.
• [Engine]: Fix MOS not dropping to 0 when round-trip time reaches 15 seconds or more.
• [Engine]: Fix an audio-delivery observation's percentage being computed over the wrong sample set.

[1.7.0] - June 22th, 2026

Added

• [Web Site]: Add a /support page, a homepage "What's new" section, and a dedicated /integrations/mcp hub page.
• [API]: Serve the public API from a dedicated api.rtcstats.com host, and add GET /v1.0/observations, a catalog of every observation type with its severity and tags.
• [Dashboard]: Add a Quick start checklist to the dashboard, and show available bandwidth and traffic for each ICE candidate pair in the Connections panel.

Changed

• [Dashboard]: Reorganize session-viewer tabs (Overview, Timeline, Session, Content, Client, Logs) and regroup widgets accordingly.
• [API]: Add per-type identifiers (ssrcId, labelId, sid) to the observation source; the top-level label is deprecated.
• [API][Breaking Changes]: Rename the observation flag field to type, and the observations/observationFlags filters to observationTypes.

Fixed

• [Engine]: Fix per-second rate and per-frame metrics assuming a fixed 1-second polling interval, throwing off values on sessions polled at a different rate.
• [Dashboard]: Fix the connectivity score not displaying for peer connections that never negotiated or connected.
• [Web Site]: Fix the header Resources dropdown rendering behind page content.

[1.6.0] - June, 1st 2026

Added

• [Dashboard]: Show session geolocation and an IPv4/IPv6 indicator on Overview and Connectivity, and add a Security section (TLS version, DTLS direction, ciphers) to the Peer Connection pane.
• [Engine]: Add 2 new observations covering configuration issues.
• [API]: Accept richer filters on GET /v1.0/sessions and MCP list_sessions (name, tags, browser version, conference/session ID, severity and score thresholds), plus a denormalized abstract summary on each session; also serve a Markdown API reference at /api-docs.md.
• [Dashboard]: Add summary stat cards, a Score column, and OS/Client filters to the dashboard sessions table.
• [Dashboard]: Add a dashboard "Client" screen with a media timeline of call phases, device acquisitions, and observations.

Changed

• [Dashboard]: Replace the Overview Areas tag strip with a treemap, and let logged-in users browse the homepage and other static pages.
• [Engine]: Fire performance-limiting observations based on absolute duration too, not only their share of the call.
• [Dashboard]: Simplify the free-plan sessions page to a single "needs attention" total with a paid-plan lock badge instead of per-session scores.

Fixed

• [Dashboard]: Fix audio levels going wrong when an outbound stream changes its media source mid-session.
• [Dashboard]: Fix STUN/TURN entries not rendering in the Connectivity table when an ICE server's urls was a single string instead of an array.
• [Engine]: Fix a connectivity observation firing even though the selected ICE pair already used UDP.
• [Dashboard]: Fix corrupt log timestamps producing a negative call duration, and surface the real parsing error instead of a generic "Parsing issue" message.
• [Security]: Block non-admin users from fetching another account's session summary or dump.
• [Web Site]: Fix the header showing the account name instead of the signed-in user's display name, and return users to the page they requested after sign-in instead of the dashboard.

[1.5.0] - May 1st, 2026

Added

• [Dashboard]: Show geolocation for TURN/STUN candidates and pairs, and log device changes, track endings, and getUserMedia errors.
• [Engine]: Add new observations covering audio and device issues.
• [Dashboard]: Let users leave feedback on a session, with email notifications.
• [KB]: Render Mermaid diagrams in articles.
• [Web Site]: Add an Open Source page and a Resources navigation menu.

Changed

• [API][Breaking Changes]: Rename sessionId to rtcstatsId and embed_url to embedUrl (Enterprise only) everywhere on the public API and MCP; add rtcstatsUrl and, on /quota, accountName/accountPlan; omit rather than null these fields when not applicable.
• [Security]: Harden against header injection from client-supplied identity headers, stop logging Authorization values in plaintext, and add CSP/X-Frame-Options headers on non-embed routes.

Fixed

• [Engine]: Fix simulcast-related observations counting more than once per peer connection.

[1.4.0] - April 20th, 2026

Added

• [Dashboard]: Add an embeddable viewer; Enterprise accounts can expose sessions in an iframe with a domain allowlist.
• [API]: Add session list/get/delete and quota endpoints, and turn the MCP endpoint into a full MCP server.
• [Engine]: Add 5 new observations covering network and video issues.
• [KB]: Add FAQ, how-to, privacy/compliance, and embeddable-viewer articles.

Changed

• [Dashboard]: Rework the free and trial plans (limits, counters, upgrade prompts) around a startup/developer trial flow.
• [Web Site]: Add more showcase examples and refresh pricing, homepage, and onboarding copy.

Fixed

• [Dashboard]: Fix stray chart lines, wrong per-stream timestamp references, and an "Excellent" MOS badge showing when MOS could not be computed.
• [Engine]: Remove an audio-processing observation that proved unreliable on Linux.
• [Dashboard]: Fix password recovery, an unintended logout of every session on password change, the Settings tab resetting on refresh, and incomplete cleanup on account deletion.
• [Security]: Stop sessions from being exposed through the embeddable viewer when the feature is disabled or the request comes from an untrusted domain.

[1.3.0] - March 27th, 2026

Added

• [Dashboard]: Add the Experience Score (a composite per-session score) and a Connectivity score with a visual connection timeline.
• [Engine]: Add a user-selectable MOS algorithm, an improved Opus-oriented and video MOS, a tag cloud, and new observations covering connectivity issues.
• [Dashboard]: Show peer role, content type, and simulcast/SVC indicators in the Streams table, and add outgoing webhooks configurable from account Settings.
• [Web Site]: Add more public showcase sessions and videos.

Fixed

• [Engine]: Fix ICE-server detection when multiple servers share one URL entry, and improve relay-only protocol inference.
• [Engine]: Fix MOS computation regressions and candidate-pair RTT/STUN handling when values were missing.

[1.2.0] - March 9th, 2026

Added

• [API]: Launch the public API (/upload, /analyze, /mcp) with an OpenAPI spec and documentation page.
• [Dashboard]: Add application tokens (Settings, Applications) to authenticate API requests.
• [Engine]: Add new observations covering performance and video issues.
• [Dashboard]: Show rtcstats client, user, conference, and session metadata in Session Details, and add tags and descriptions to sessions.
• [KB]: Add full-text search and a redesigned knowledge base.
• [AI]: Support newer Anthropic models for AI summary generation.

Fixed

• [Engine]: Fix a missing duration on an audio observation and a null framerate value.
• [Dashboard]: Fix handover timestamps, double scrollbars, and sessions table pagination and height issues when filtering.
• [KB]: Fix article content and search inside the article popup.

[1.1.1] - February 26th, 2026

Added

• [Web Site]: Add 6 new showcase sessions and videos.

[1.1.0] - February 16th, 2026

Added

• [Dashboard]: Give new accounts 5 gold credits to try Observations and AI summary.
• [Engine]: Add 5 new observations covering connectivity and security issues.
• [Dashboard]: Show time-to-first-candidate connection metrics, support moving a dump between accounts, show an error for AEC-only uploads, and add a YouTube banner on public shares.
• [Web Site]: Add a showcase page featuring the first publicly shared sessions and videos.

Changed

• [Web Site]: Refresh pricing to introduce gold credits and rtcstats-format support on the free plan.

Fixed

• [Dashboard]: Fix some rtcstats event logs not displaying, or displaying incorrectly.

[1.00] - January 25th, 2026

Added

• [AI]: Add automatic, background AI call-summary generation.
• [Engine]: Add 6 new observations covering device, audio, and connectivity issues.
• [Dashboard]: Detect and surface the media server or stack in use (Pion, PJSIP, Pixel Streaming, ICE-Lite) in Session Details.

Changed

• [Dashboard]: Skip AI summary generation on free accounts.

Fixed

• [Engine]: Fix RTT/MOS handling of null values and inconsistent RTT aggregation.
• [Dashboard]: Fix incorrect upload/email error messages and the password-recovery redirect, and crashes triggered by missing user-agent data or missing peer connections.

[0.13.2] - January 16th, 2025

Fixed

• [Dashboard]: Fix a crash when parsing rtcStats files.

[0.13.1] - January 13th, 2025

Fixed

• [Dashboard]: Fix a crash parsing rtcStats files generated from Safari.

[0.13.0] - January 12th, 2025

Added

• [Engine]: Add 9 new observations covering video and performance issues.
• [Dashboard]: Group local candidates and show network interface info in Peer Connections, and add video resolution/framerate, encoder/decoder (including hardware acceleration), and scalability-mode/RID details.
• [Dashboard]: Detect and surface additional media servers (Asterisk, Janus, MediaSoup, OpenAI, Jambonz, MediaMTX), and send an email notification when an upload fails.
• [Web Site]: Add full responsive design for tablet and mobile.

Fixed

• [Dashboard]: Fix several crashes (observations processing, public sharing, MIME-type parsing), and improve packet-loss and unused-stream detection accuracy.

[0.12.1] - December 17th, 2025

Fixed

• [Engine]: Fix a network observation misclassifying streams with an unrecognized codec type.

[0.12.0] - December 08th, 2025

Added

• [Dashboard]: Add public sharing: make any session viewable via a link, no account required.
• [Engine]: Add new observations covering network quality for all streams.
• [KB]: Overhaul the knowledge base with articles for every statistic and observation, and a clearer layout.

Fixed

• [Dashboard]: Fix inconsistent user-agent parsing for Safari/Firefox rtcStats-format uploads.

[0.11.0] - November 24th, 2025

Added

• [KB]: Add a fully integrated, publicly accessible knowledge base with contextual links from charts and observations.
• [Dashboard]: Show every ICE candidate pair state reached, with time spent in each.
• [Engine]: Add 5 new observations covering connectivity and audio issues.

Changed

• [Dashboard]: Redesign the Streams page, and merge ICE candidate pairs into their Peer Connection for easier drill-down.

Fixed

• [Dashboard]: Fix accounts not switching automatically when opening a link from an account you were invited to.

[0.10.0] - November 10th, 2025

Added

• [Engine]: Add new observations covering connectivity issues.
• [Dashboard]: Compute and show aggregated audio MOS in the Overview pane.

Changed

• [Dashboard]: Activate the file retention/expiration policy, with a banner warning before files expire.

[0.9.0] - October 28th, 2025

Added

• [Dashboard]: Redesign the session view into focused panes: Overview, Connections, Streams, Devices, and Logs.
• [Engine]: Add new observations covering connectivity and security issues.

Changed

• [Dashboard]: Show pending invitations directly at sign-in instead of requiring the emailed link.

[0.8.0] - October 13th, 2025

Added

• [Engine]: Add many new observations for audio streams.
• [Dashboard]: Show the connection setup timeline (disconnections, churns, handovers), and add email invitations for team members.

Changed

• [Dashboard]: Block uploading dump files older than M138, and improve the Logs view with peer selection, filters, and infinite-loading.

[0.7.0] - September 25th, 2025

This version is compliant with the new dump format introduced in M132 (JSON based).

Added

• [Dashboard]: Add email/password sign-in.
• [Engine]: Add the first observations.

[0.6.0] - September 11th, 2025

Added

• [Engine]: Add new observations covering connectivity and data channel issues.
• [Dashboard]: Limit upload size, and allow uploading zipped dump files.

[0.5.4] - September 5th, 2025

No public-facing changes in this release.

[0.5.3] - September 4th, 2025

Fixed

• [Dashboard]: Fix a regression where being already signed in did not redirect away from the sign-in page.

[0.5.2] - September 4th, 2025

Fixed

• [Web Site]: Fix incorrect developer-plan yearly and monthly pricing.

[0.5.1] - September 4th, 2025

No public-facing changes in this release.

[0.5.0] - September 4th, 2025

Polish pass on the previous version based on early feedback.

Added

• [Dashboard]: Show a band for audio interruptions, and add retention-based deletion of old session files.
• [Web Site]: Add the homepage pyramid explaining rtcStats' levels of computation, an integrations page, and Terms of Service / Privacy Policy pages.

Fixed

• [Engine]: Fix aggregated statistics computations, mainly packet loss.

[0.4.0] - August 26th, 2025

Added

• [Web Site]: Add the product page explaining rtcStats' architecture.
• [Dashboard]: Add billing purchase history and a usage chart, and direct download of the raw dump and computed summary.

Changed

• [Dashboard]: Show bandwidth/CPU-limitation bands and MOS on stream charts, with an annotation when the media source changes.

Fixed

• [Dashboard]: Fix a duplicated summary file caused by bad URL encoding, and duplicate entries corrupting stream charts.

[0.3.0] - August 21th, 2025

Added

• [Dashboard]: Add stream and device aggregation views, sign-in with GitHub, and monthly credit limits with usage counters.

[0.2.0]

Added

• [Dashboard]: Add a Logs view, data-channel charts, and dump-file download.

Fixed

• [Dashboard]: Fix an endless loop when switching accounts.

[0.1.0] - Initial Release

Added

• Initial release of rtcStats: WebRTC dump analysis and visualization, authentication and account management, team collaboration, real-time data processing, interactive charts, file upload and processing, and a dashboard with analytics.

This changelog follows Keep a Changelog: entries are grouped under Added, Changed, or Fixed for each release, tagged by area (see the legend at the top), and written for readers rather than as a commit log. Version numbers follow Semantic Versioning.