GA readiness roadmap
The EvoMap developer platform is live in beta: OAuth, OpenAPI, test mode, recipe APIs, catalog reads, webhooks, app management, and confidential-client introspection are usable today. GA means a stranger can self-serve from the website, integrate without private hand-holding, operate safely, and get support when something breaks.
This page tracks the gap between beta usable and qualified open platform.
Status legend
| Status | Meaning |
|---|---|
| Live | Available to external developers now. |
| Beta | Usable but still needs examples, UX polish, or operational hardening. |
| Planned | Design needed; not a self-serve platform capability yet. |
GA capability matrix
| Capability | Current status | GA target | First useful slice |
|---|---|---|---|
| 1. Multi-language SDKs | Planned | Official JS/TS, Python, and Go SDKs generated from OpenAPI plus hand-written OAuth/webhook helpers. | Publish @evomap/sdk beta with OAuth URL builder, token exchange, catalog read, test publish, webhook verifier, typed errors. |
| 2. Unified developer console | Beta | One portal for apps, secrets, scopes, versions, usage, calls, webhooks, deliveries, grants, billing, and support. | Promote /dev/portal into the /dev flow; add empty/error states that tell developers what to do next. |
| 3. App review, versions, permissions, tenant install | Beta | Feishu-style app version review, scope request, tenant/org installation, admin consent, and rollback history. | Surface existing scope-request and app-version APIs in the portal with review status and changelog. |
| 4. Event subscriptions and replay | Beta | Webhook event catalog, filtered subscriptions, ping, delivery log, redelivery, replay by event id, and retention policy. | Add a first-class delivery-detail page and replay button; document retry/backoff/retention. |
| 5. Large example set | Beta | Quickstarts, recipes, Postman/Bruno collection, generated clients, webhook verifier, error handling, test-mode demos. | Ship Minimal examples plus downloadable sample projects. |
| 6. API Explorer | Beta | OpenAPI-driven browser explorer with auth helper, request builder, sample snippets, and safe redaction. | Harden /dev/docs/41-api-explorer so it can import a token locally without logging it and show copied curl/JS/Python. |
| 7. Error-code system | Beta | Stable error catalog with cause, remediation, retryability, and support escalation path. | Create errors.md and link every common invalid_*, insufficient_scope, quota, moderation, and idempotency failure. |
| 8. Marketplace | Planned | Public app listing, developer profile, app install, scopes shown before consent, reviews/ratings, and takedown flow. | Start with curated partner app cards linked from /dev, not open listing. |
| 9. Developer support and tickets | Planned | Support form, community discussion, issue templates, contact SLA, and escalation for security incidents. | Add /dev/support or docs page with GitHub Discussions, email/form, and required debug fields. |
| 10. Status page and SLA | Planned | Public status, incident history, API availability targets, webhook delivery SLO, and maintenance notices. | Link /status from /dev and add developer-specific API/webhook status rows. |
| 11. Permission governance / admin authorization | Beta | Admin consent for org-wide installs, high-risk scope warnings, least-privilege review, audit logs. | Add explicit admin-consent state and high-risk-scope warnings in the portal. |
| 12. Enterprise tenant isolation and audit | Beta | Org/tenant-scoped API keys, wallet/spend controls, audit logs, SCIM/SSO, data-isolation guarantees. | Document org agent/token boundaries and expose audit/downloadable logs for OAuth app events. |
What is already live
- OAuth 2.0 Authorization Code + PKCE (
S256only). - OIDC discovery, userinfo, and JWKS.
- OAuth authorization-server metadata and protected-resource metadata.
- Dynamic Client Registration for read-only public clients when enabled.
- Token revoke and confidential-client token introspection.
- OpenAPI 3.1 at
/openapi.jsonand YAML mirror. - Recipe / gene / reuse read APIs.
- Recipe draft and publish APIs, with test mode for sandbox publish loops.
- App registration, scope requests, app versions, usage/call/activity logs, and secret rotation history.
- Webhook registration, signing, ping, delivery logs, and redelivery.
- Organization and agent-token surfaces for enterprise-style use cases.
GA acceptance checks
A release can be called GA when these are true:
- A new developer can complete the Quickstart in under 30 minutes without private help.
- First token, first catalog read, test publish, webhook ping, and error debug all have copy-pasteable examples.
- The portal shows app status, requested scopes, review state, live/test mode, recent calls, quota, webhook delivery failures, and next actions.
- OpenAPI, discovery, docs, and implementation stay aligned in CI.
- SDKs exist for at least JS/TS and Python, with Go planned or generated.
- High-risk scopes require explicit review/admin consent and are auditable.
- Support, status, changelog, and incident channels are public and discoverable.
- Security signals are actionable: repeated stale-client loops are deduplicated so real token-reuse incidents are not buried in noise.
Near-term roadmap
P0 — make strangers succeed
- Keep
/devas the public front door. - Finish Quickstart and minimal examples.
- Add error catalog and troubleshooting.
- Add downloadable Node/Python sample apps.
- Harden API Explorer token handling and snippets.
P1 — make integrations operable
- Webhook delivery-detail UI and replay.
- Developer support page and issue template.
- API/webhook status rows and SLA language.
- Portal next-action states for app review, scope requests, quota, and failed webhooks.
- Refresh-token failure handling guidance (stop retry loops; force re-login).
P2 — make an ecosystem
- SDK packages.
- Marketplace starter listing for curated partner apps.
- Tenant/org install flow and admin consent.
- Audit export and enterprise governance controls.