GET https://api.trooth.co/public/trust/{slug} is deprecated in favor of the canonical read, and the body-only webhook signature is legacy. Both stay in service until April 30, 2027.
What changed
Every answer of the older lookup now carries Deprecation (RFC 9745), Sunset (RFC 8594) and a Link header naming the migration recipe and the canonical lookup for the same identifier. Every webhook delivery that still carries version 1 also carries x-trooth-signature-v1-sunset naming the date. The same release states each Model Context Protocol (MCP) tool's policy in tools/list, counts the public agent budget in one store shared by every server instance, and adds the assurance boundary to every answer.
Why it changed
The older lookup duplicated the canonical read under another address, and the version 1 signature carries no timestamp, so a captured delivery keeps verifying.
Who is affected
- Affected: Integrations that call the older lookup on api.trooth.co, and webhook receivers that check x-trooth-signature without a timestamp. Readers of trooth.co and receivers that check Standard Webhooks or version 2 are not affected.
- Availability: Everyone. Nothing changes in what either answers before the date.
- Release stage: Available.
- Areas: API, MCP server, Webhooks, Trust Profiles, Legal.
What to do
Action required. Move calls to GET https://trooth.co/api/network/profile?q={domain-or-slug}&contract=2, and verify webhooks with the receiver recipe, before April 30, 2027.
- April 30, 2027: GET /public/trust/{slug} on api.trooth.co answers 410 Gone after this date.
- April 30, 2027: x-trooth-signature (version 1) is no longer sent after this date.
Versions and migration
Before:
curl "https://api.trooth.co/public/trust/example.com"After:
curl "https://trooth.co/api/network/profile?q=example.com&contract=2"Dates
- Announced: October 12, 2026, the day this entry was written. Entries are never backdated.
- Released: October 12, 2026.