Changelog

Changes to the Bot API, newest first. Until the platform opens to everyone, breaking changes are possible; they will be listed here.

Launch (October 2026)#

• Bots are open to every Qivuna account; anyone who meets the conditions can create bots with @qivbot.
• Updates arrive by long polling (getUpdates) only. setWebhook answers 400 webhooks_disabled (a new error code) until webhooks open.
• Encrypted bots are not open yet: every new bot is a plain bot.

Bot API 1.0 (22 October 2026)#

The first version, rolling out to Qivuna staff and invited developers first.

• Core: bot accounts created with @qivbot, tokens in the Authorization header only, pseudonymous ids per developer, getMe, getUpdates, sendMessage with entities or HTML, editMessageText, deleteMessage, getChat, leaveChat, descriptions; 1:1 chats with Start/Stop; groups and channels through admin grants with consent receipts; privacy mode.
• Interaction: inline keyboards and callback_query, answerCallbackQuery, editMessageReplyMarkup, commands with scopes and languages, edited_message and edited_channel_post, bot transfers.
• Moderation and media: member reads, ban, unban, mute, pin, bot invite links, deleting others' messages, default rights, chat_member, sendPhoto/sendVideo/sendDocument, getFile, the anti-phishing content check, bot reports (reviewed by the Qivuna team; reports never act on a bot by themselves).
• Webhooks: setWebhook with an ownership challenge, HMAC-SHA256 v1 signatures (dual during secret rotation), retries with back-off, automatic disabling, delivery through a dedicated egress proxy.
• End-to-end encrypted bots: bot keys certified on the owner's phone, encrypted 1:1 chats, addressed mode in encrypted groups with reply tokens and the inbox, encrypted button presses, qbw1 webhook payload encryption, test vectors.
• Verification: the blue check, requested from QivBot.
• SDKs: Node.js and Python, complete; publishing to npm and PyPI pending.

Not in 1.0#

Not available yet, and not promised: polls, forwarding and copying messages, inline mode, web apps, payments, sending files by URL, files in encrypted bot messages, scoped tokens, bots as full members of encrypted groups, and a Telegram-compatible token-in-path layer.