Changelog

Previously, the CSV Import API only supported sending import completion reports to a fixed email address field reportMailAddress. You can now use the notificationRecipientIds.userIds and notificationRecipientIds.groupIds fields in the import configuration to send reports to selected users or groups via email.

The combined recipient list can include up to 10 unique activated users or contacts. Direct user IDs and group members count toward the same limit. If the recipient list exceeds this limit, the API rejects the configuration. If group membership grows after the configuration is saved, delivery is still capped to the first 10 resolved users or contacts. When recipient IDs are configured, they take precedence over the existing report email address. Failed delivery does not trigger an email fallback.

If you do not configure recipient IDs, a previously saved report email address remains the fallback. Staffbase recommends using the new fields to specify which users and groups should receive import completion reports rather than relying on the reportMailAddress field.

Outbound Webhooks enables signed HTTP POST deliveries for subscribed event types to your configured endpoint. To configure and manage webhook subscriptions in Studio, see Manage Outbound Webhooks in Staffbase Studio. Use the Webhooks API reference to implement request handling, signature verification, and response behavior for webhook deliveries.

Use `GET /comments/{commentId}` to retrieve a comment by its ID. The response uses the existing Comment schema.

When using the Search groups endpoint, you can now set permission=read in addition to the existing permission=manage and permission=access filters. The new filter enables editors and API consumers to filter groups by read-only level, ensuring all relevant groups are included in content-targeting workflows.

The Staffbase MCP Server now lets agents fetch a page by ID and read its full content to answer questions and create summaries. The get_page_content tool returns plaintext by default and can return HTML when page structure matters. As with all MCP tools, responses are permission-aware and only include pages the authenticated user is allowed to view. Learn more in Staffbase MCP Server Tools and Troubleshooting.

The Staffbase MCP Server has been tested and verified with Microsoft Copilot in Microsoft Teams and Microsoft Copilot Studio. While it should work with any MCP-compatible AI client, these two clients have been thoroughly tested to ensure optimal integration and support. See Supported AI Clients for the complete list of verified clients.

Migrate your user integrations to User API Version 2 before October 1, 2027, to avoid disruption when Version 1 is removed. User API Version 2 offers improved performance and usability. Follow the User API migration guide to update your integration.

The mandatoryGroupIDs field defines groups that a user cannot unsubscribe from, and is no longer available in create and update user requests or responses. You can achieve the same use case by combining an internal group that users cannot leave on their own and an open group that users can join themselves. Update any integrations that rely on this field if you haven't done so.

The Staffbase MCP Server can now connect to your Staffbase Email. The tool set enables you to search across drafts, scheduled, and sent emails by title, date, or author, and read the full content of emails in all localized versions. This enhanced capability helps you streamline your email workflows.

The Staffbase MCP Server implements the Model Context Protocol, an open standard that defines how an AI agent discovers and calls tools on a remote server. The MCP Server allows AI agents to read content from the Staffbase platform on behalf of a signed-in user. It exposes a narrower, task-oriented subset of Staffbase data in a format designed for AI agents, complementing the Staffbase API. This allows you to connect supported AI clients to Staffbase without building a separate integration for each agent.

To enhance security, the full API token secret is shown only when you create or rotate a token from the Studio. After it is saved, the full secret cannot be viewed again. This change also affects the existing tokens. Be sure to copy and securely store your token secret immediately after creating or rotating it. If you lose the token secret, you will need to rotate the token to generate a new secret.

The mandatoryGroupIDs field defines groups that a user cannot unsubscribe from, and will no longer be available in create and update user requests or responses. You can achieve the same use case by combining an internal group that users cannot leave on their own and an open group that users can join themselves. Update any integrations that rely on this field before the removal date.

These endpoints provide detailed analytics data for pages. The new endpoints fall into two groups. Aggregate endpoints report across all pages: Page ranking lists pages ranked by views and visitors, Pages timeseries shows how views and visitors change over time, and Page view counts returns the view count for each page. Single-page endpoints focus on one page at a time: Page views returns its total views, Page stats summarizes its views, visitors, clicks, and session metrics, Page timeseries shows how its views, visitors, and clicks change over time, Page click ranking ranks the elements users clicked, Page group ranking ranks the groups its visitors belong to, Page time distribution shows when during the day visits happen, and Page traffic sources shows where visits come from by UTM parameters and platform. For request and response details, see the Analytics API.

These parameters define the time range for the ranking of posts based on their visits. Requests to the GET Post ranking endpoint that omit either parameter will return an HTTP 400 Bad Request response. Update your integration before October 1, 2026 to include both parameters to ensure successful API requests.

By default, includeProfile parameter value is false. Set it to true to include the profile data of each group member in the response. This lets you to retrieve member and profile information in a single request.

Previously, retrieving pending users required an administrative token. This update changes the required token permission to a read-only token, allowing broader access while maintaining security. This change aligns pending user retrieval behavior across API versions for consistent access.

This event is emitted when security-relevant platform settings change. The additionalData.fields array lists the affected configuration fields and can include allowSupportLogin, ipRestrictions, ipRestrictionsMode, and passwordPolicy.

These events are triggered when a Staffbase support user logs into the platform on your organization's behalf. The support_login event indicates a successful login, while the support_login_failed event indicates a failed login attempt. This feature is relevant if you have enabled the Support Login option under the Security settings in the Studio, allowing Staffbase support to access the platform for troubleshooting purposes.

The eventType field has been extended with a new eventSubType field, offering more granular insights into bounce reasons. For example, you can identify specific reasons such as a non-existent recipient address, a full mailbox, or a suppressed address, helping you better understand and act on delivery failures. Additionally, the eventReadTime field indicates how long recipients spent reading an email, in seconds, enabling deeper analysis of engagement.

Audit log entries capture events related to authentication activity, user account changes, and API token management, such as failed login attempts, password changes, and API token creations or deletions. Use this API to support security monitoring, incident investigation, and compliance requirements.

This makes it easy to identify when an API specification was last updated. This change applies only to newly created or updated API specifications. Whenever an API file is modified, its version reflects the corresponding update date going forward.

Rotating a token generates a new secret while preserving the token ID and all its permissions. Any systems using the previous secret immediately lose access and must be updated with the new secret. This enhances security by allowing you to rotate API secrets without creating new API tokens.

You can overwrite all users, or overwrite only users that were previously imported via CSV.

With the relevance_DESC sort parameter, the most relevant groups appear first in the results.

The media URLs returned by these requests will require authentication. To obtain publicly accessible media URLs, use the Make media URLs public endpoint.

This lets you restrict token usage to specific source IP addresses or ranges using CIDR notation. If a request is made with the token from an IP address outside the configured ranges, the request is rejected. Use this option to limit token exposure, enforce network-level access control, and reduce the risk of unauthorized use in case a token is compromised.

The previous version endpoints remain fully supported and continue to work as before. However, Staffbase recommends migrating to the latest version for improved performance and additional features. For more information on the changes and how to migrate, refer to the User API migration guide.

This endpoint was deprecated in September 2025.

Use it to create and manage groups on the Staffbase platform more efficiently.

This boolean field indicates whether the page content is outdated based on its update reminder settings. This addition helps you easily identify pages that may require updates or reviews.

Previously, the userName response included only the value. With this change, email and userName behave the same way, making it easier to understand the source as well.

The activatedAt field indicates the date and time when a user account was activated on the platform.

You can now filter group members by their status using the status query parameter.

The reactivated field appears alongside existing metrics (created, updated, deactivated, deleted). Previously, reactivated users were not tracked as a separate metric.

When using the PATCH method to update members, you have more flexibility in how you add or remove users.

Previously, a Forbidden (403) response was returned in this case. This change improves security by preventing information leakage about the existence of entities.

These endpoints help users retrieve email performance data more efficiently.

This allows users to track changes made during CSV imports more effectively.

It brings enhanced flexibility and automation, allowing you to integrate groups management into your workflows.

It is now limited to administrators and group administrators.

In rare cases, profile fields were not updated correctly, and user reactivation did not work as expected. These issues have now been fixed.

You can now delete group chat conversations. Learn more.

New versions are available for List users, Invite users, Return a user, and Delete a user. Staffbase recommends migrating to these versions to benefit from the enhancements. Use the migration guide to test and plan your migration, and learn more about the Staffbase versioning policy before you plan your migration.

To replace certain legacy behaviors and improve efficiency, new Update a user and Search users endpoints have been added.

The Return metadata endpoint is planned to be removed on January 1, 2026. Learn more about the Staffbase API lifecycle and deprecation policy.

This allows you to specify a different redirect URL for mobile devices, enhancing the user experience by directing mobile users to a mobile-optimized search engine. If not specified, it defaults to the value of redirectUrl.

This makes it easier to share media content for display without requiring authentication. Learn more.

The media URLs fetched will require authentication. Instead, publicly accessible media URLs can only be retrieved via the Make media URLs public endpoint. If you use APIs to fetch media files, ensure that you update your implementation accordingly before this date. Learn more.

The partialTag property is especially useful if you want to create conditional groups based on partial CSV tags, or migrate to the CSV Import API if you previously used partial CSV imports with the legacy method.

Staffbase strongly recommends using the CSV Import API for user management.

The request body schema has been updated to accurately reflect the required structure. The iconURL property is now read-only and can no longer be updated.

You can send a notification to notify specific users or user groups using the notification center, push notifications, or both; and send a plugin notification to notify specific users or user groups about a particular plugin instance. This is particularly useful for plugin developers targeting a plugin instance's audience. Both endpoints allow you to customize the notification's text, icon, and image for more personalized, context-aware messages.

The two new enhanced endpoints replace the existing Send notifications endpoint, which is now deprecated and scheduled for removal by the end of 2025. Staffbase strongly recommends switching to the new endpoints to ensure continued support and access to enhanced functionality.

Utilize this API to synchronize users from the Staffbase platform, ensuring that your user data is always up-to-date and consistent across your applications.

You can now use the relevance_desc parameter to sort search results by relevance in descending order, making it easier to find the most relevant spaces first.

This endpoint allows you to replace existing media files with new ones while maintaining the original URL, ensuring that any references to the original file remain valid. This is particularly useful for updating media content without needing to change links or references in your content.

It offers a range of methods to streamline file management tasks on your platform, such as adding files to your File Manager and creating, updating, or deleting collections. Whether you need to import assets from an external source, set up files for a new editor, or manage collections centrally as an administrator, the File Management API makes it simple and efficient. Learn more on getting started with the File Management API.

The update internal sections endpoint has been added. The update integration sections endpoint now uses the PUT method instead of PATCH. The update search settings endpoint has been removed as its behavior can be achieved via the other three update endpoints.

The Campaigns API has been updated to reflect recent changes in platform capabilities. The sourceType parameter, which specifies the type of content assigned to a campaign, no longer supports the EXTERNAL_CONTENT value. Instead, a new content source type, EMAIL, has been added to support Staffbase Email.

This is particularly useful for integrating media results into federated search solutions. The endpoint returns media information that matches the filename, content, or type directly from the Staffbase platform, based on your users' search input.

Show or hide sections and the flyout, rename or reorder sections, set up a custom redirect URL after search input validation, and define which sites or knowledge bases should be searchable in Microsoft or ServiceNow.

This is particularly useful to fetch plugin details into your federated search solutions. The endpoint returns plugin information with accurate relevance and proper permission handling, directly from the Staffbase platform, based on your users' search input.

It retrieves a list of news posts that match the search query in the content, hashtags, image descriptions, teasers, or titles of the posts. This is particularly useful for third-party federated search solutions, enabling you to fetch news post details without indexing or storing the data in external systems.

It searches across all searchable fields within user profiles. This is especially useful for third-party federated search solutions, enabling you to fetch user profile details without indexing or storing the data in external systems.

The campaignId parameter is deprecated in the POST Create a news post and PUT Update a news post endpoints. To assign a post to a campaign, use the campaignId parameter in the create campaign reference endpoint of the Campaigns API. The campaignId parameter will be removed from the News API endpoints on November 1, 2025. This change ensures that campaign-related actions are handled consistently through the Campaigns API.

When a user's avatar image was set to null via an API call, the user was unable to access the Studio. This has been fixed.

This API provides key performance metrics, including the number of emails sent, opened, and clicked, helping you measure engagement and optimize your communication strategy. Discover more about its capabilities.

Additionally, the newly introduced section array enables you to identify and assign spaces across one or more products available on your platform, such as Employee App, Front Door Intranet, or Staffbase Email.

The Update CSV import configuration endpoint's optional type parameter defines whether it is a user import or a contact import for Staffbase Email.

The News API now includes a new endpoint dedicated to retrieving acknowledgments on a news post.

Instead, Staffbase is developing a more scalable and user-friendly error reporting functionality with the endpoint /users/imports/{import_Id}/errors.

Staffbase is developing a more scalable and user-friendly error reporting functionality with the endpoint /users/imports/{import_Id}/errors.

The visibleInPublicArea parameter allows Quicklinks to be available in the public area. This update does not change the default behavior of existing Quicklinks. When creating a new Quicklink, it remains unavailable in the public area by default.

Starting December 10, 2024, Staffbase discontinues support for the following generic URLs as reply URLs: de.eyo.net (DE) and backend.staffbase.com (US). If you use any of these domains as reply URLs, you must update your Identity Provider (IdP) settings with your Staffbase platform domain in the list of allowed reply URLs. This is essential to avoid disruptions to your API integrations and SAML-SSO authentication flow. If you are impacted, your Customer Success Manager or Support team will reach out to you to assist you further.

The Pages API is ideal for organizations migrating to the Staffbase platform or consolidating scattered information. It helps preserve valuable content and ensures a seamless transition during migration. You can also manage your pages using the Pages API. Learn more: Extract Page Content Using the Pages API and Import External Content to Pages.

You can add files to your File Manager and create, update, or delete collections. Whether you need to import assets from an external source, set up files for a new editor, or manage collections centrally as an administrator, the File Management API makes it simple and efficient. Learn more on getting started with the File Management API.

The Spaces API brings enhanced flexibility and automation, allowing you to integrate Spaces management into your workflows.

In the Analytics API, the maximum limit for Content and Post ranking has been adjusted to 50000.

The 429 error code is returned when too many requests are sent in parallel and exceeds the rate limits. When this error occurs, wait a short period before retrying the request. To avoid this error, we recommend staggering API calls instead of sending them all at once.

The plannedAt parameter shows at what time and date the post is planned to be published and is returned with the response body in ISO 8601 format. For example, 2024-09-17T12:00:00Z.

As announced last year, the enabled, pending, and verificationCode response fields of a user have been removed. To access the same information, use status and secret instead.

You can now create a campaign reference and delete a campaign reference.

It is now possible to use the vertical bar | as a CSV separator in the CSV Import API.

To get started, see the Get Started With CSV Import guide. Staffbase recommends using this beta feature for advanced CSV import capabilities and an improved user experience.

Learn more about the Quick Links API.

The sort parameter now supports updated_DESC (descending by last updated date), created_DESC (descending by creation date, newest to oldest), updated_ASC (ascending by last updated date, oldest to newest), scheduledFor_ASC (ascending by publishing order), and scheduledFor_DESC (descending by publishing order). In addition, the default value has been changed from updated_DESC to created_DESC.

SAML domain hints ensure that users don't attempt to authenticate with the identity provider (IdP) using domains that are not allowed when using the Staffbase platform. To activate this feature, contact Staffbase Support or your Customer Success Manager. This feature currently works with Microsoft Entra ID as the IdP, although it may also work with other IdPs.

The multipart/form-data and application/x-www-form-urlencoded content types have been removed.

Use the Tags API instead.

These webservices are no longer available as public Staffbase APIs.

The Profile API is no longer available as a public Staffbase API. You can use the User API for the same purposes. Contact Staffbase Support or your Customer Success Manager for more information.

When updating pending user details with the User API, the profile fields were not populated. This has been fixed quickly.

The verificationCode, pending, and enabled response fields of a user account will be removed on August 31, 2024. Instead, use secret for verificationCode, and status for pending and enabled. The enabled property is replaced by the status property to enable or disable a user with a request.

The Tags API will replace the user/tags endpoint under the User API. If you are still using the user/tags endpoint, Staffbase recommends migrating to the Tags API.

The user/tags endpoint will soon be removed. Staffbase recommends migrating to the Tags API.

The new User timeseries endpoint comes with significant improvements, offering enhanced functionality and improved performance to ensure your integrations are future-proof.

The existing User timeseries with SCIM endpoint will be deprecated. Staffbase will continue to support this endpoint until the beginning of 2024, after which it will no longer be supported. Staffbase recommends migrating to the User timeseries endpoint.

Users and tokens assigned as editors on a specific plugin could set properties via API on these plugins, which exceeded their permission level. This has been fixed. Now, users and tokens with editorial access for specific plugins can only set the plugin properties available to them in the Studio user interface.

The source response field of a user has been removed. Instead, you can now use the creation response field.

The Contact API allows you to sync your recipients’ email addresses and other attributes from any third-party human resources system directly into Employee Email for creating custom distribution lists.

Previously, the creation date of a user account was incorrectly overwritten with the activation date. This has been fixed.

Previously, acknowledgments were not displayed when the News API was used to search for posts. This has been fixed.