Troubleshooting

Changelog#

Customer-visible changes, most recent first. Anything that changes how the API behaves is labelled API change — those are the entries to read if you have an integration or an agent running against Laver.

Internal refactors, test and tooling work are not listed.

28 August 2026#

Document signatures#

API change — additive. A wiki page can be sent to one named person to sign. Choose Get a signature from the page's ⋯ menu, give an address, pick the section — the page's top-level headings, plus The end of the document — and add an optional message of up to 500 characters. They get a private link, read the page in the browser with no Laver account and no sight of anything else in the workspace, fill in whatever blanks the page carries, type their name and sign. Or they decline, with a reason of up to 500 characters that is quoted back to you exactly as typed.

The blanks are written while the page is: /signature-input-text, /signature-input-number and /signature-input mark a place for a line of text, a number and a drawn signature, and only the ones inside the section being signed are asked for — up to 20, of which 8 may be drawings. Answers are stored with the request along with the label each blank had at the time, never in the page, so editing the page afterwards does not change what somebody agreed to. Both sides can download the signed document as a PDF, and a page edited since a signature says so on screen and in the file.

Links expire after 30 days, with one reminder to the recipient three days before and one notice to the author when a request runs out unanswered. A page may hold 25 unanswered requests, and one person may send 20 requests an hour. Every request writes wiki_page.signature_requested to the workspace audit log with the address it went to. The signature routes take session tokens only — an API key gets a 401, so an agent cannot mail your documents out. On both plans. See Document signatures.

Diagrams inside a document#

API change — additive. /diagram draws boxes, arrows and labels on a canvas inside a wiki page, a page comment, a ticket description, a ticket comment or a quick note. Rectangles, ellipses, diamonds and text, connectors pinned to a side of a shape or left floating, five themed fills, and labels on both shapes and connectors. Up to 60 shapes and 80 connectors, labels of up to 160 characters, on a canvas between 160 and 4000 wide and 120 and 4000 tall.

A diagram is part of the document rather than a file beside it: it copies with the text, appears in version history, needs no storage allowance, and is edited by anybody who can edit the document. The other side of that is that a text export leaves it out — exporting as Markdown, HTML, ODT or PDF, or editing a page as Markdown, carries everything except the drawing. See Diagrams.

The browser extension#

Laver quick-add files a ticket from the page you are looking at, with a screenshot, a recording of the tab and the URL already attached. Alt+Shift+L opens the panel, Alt+Shift+S shoots the page first, Alt+Shift+R records the tab and stops on its own after two minutes so the clip stays under the 25 MB an attachment can be. A pin button crops the shot to one element and puts its DOM path on the ticket. Each site remembers the board it files to.

It authenticates with an ordinary workspace-scoped API key, held by the extension's service worker and never visible to the page being reported, so revoking the key in Laver stops it. It is not on the Chrome Web Store: it ships in the extension/ directory of the Laver repository and is loaded unpacked, and it needs Chrome 116 or newer. See The browser extension.

17 August 2026#

Shared secrets#

API change — additive. A password or token a colleague needs can be kept in the workspace instead of a chat message. Save it under Secrets in the sidebar, share it with named people in the same workspace, and each of them can reveal it — nobody else, workspace owners and admins included. Values are encrypted at rest and come back from one endpoint only, POST /secrets/:secret_uuid/reveal, which is limited to 60 reveals an hour and writes secret.revealed to the audit log every time; the value is hidden again on screen after two minutes. The owner alone can rename, rotate, share, revoke or delete. The /secrets routes take session tokens only — an API key gets a 401 — for the same reason quick notes do: a key sits unattended on a machine. See Shared secrets.

A screenshot can go straight into a quick note#

API change — additive. Pasting an image into a quick note now uploads it instead of doing nothing, and a note that is one screenshot and no words saves. PNG, JPEG, GIF and WebP, 10 MB an image and 100 MB of them per person — a note has no workspace whose storage allowance it could draw on, so it draws on a cap of its own, and deleting a note releases the pictures no other note of yours shows. Each upload is checked for malware before it can be displayed. The new /notes/attachments routes take session tokens only, exactly as the rest of /notes does. See Quick notes.

12 August 2026#

A column can insist on what a ticket carries#

API change — additive. An owner or admin can give a column entry requirements — an attachment, an assignee, a due date, every subtask ticked off, no unfinished blockers, or a named custom field filled in — and a ticket that does not meet them is turned away at that column with a 400 naming every unmet condition. Up to 20 conditions per column, read at GET /boards/:uuid/statuses/:uuid/entry-requirements by any board member and set with PUT by an owner or admin.

The check runs on the way in, so a requirement added later does not evict the tickets already sitting there, and anything you set in the same request counts — one call can add the assignee and make the move. Board copies, imports, sprint rollover and restoring from Trash are not gated. See Boards.

Quick notes#

API change — additive. A per-person scratch pad, opened from anywhere with Cmd/Ctrl+Shift+K — including with a ticket open — and saved with Cmd/Ctrl+Enter. A note belongs to its author and to nobody else: no owner or admin can read one, and they are not in search or a board's export. The /notes routes take session tokens only, because an API key is scoped to a workspace and a note has no workspace to be scoped to. See Quick notes.

A ticket can wait for a column to free up#

An owner or admin can park a ticket outside a column and have it move itself in the moment that column is empty, from Move when a column frees up on the ticket. It sits alongside the board's automations rather than replacing them. See Automations.

Archived boards, several at a time#

Archived boards can be selected as a group in Trash and restored or deleted together, rather than one at a time. See Trash and restore.

11 August 2026#

Save a board as a template, and start the next board from it#

Behaviour change. Any board can be saved as a template from its sidebar menu, and appears under Saved from your boards when the next board is created. A template is a snapshot, not a link: it captures columns with their colours and completion mark, labels, and each ticket's title, description, priority, labels and column, up to 300 tickets. It does not carry assignees, due dates, comments or attachments, and later edits to the board do not reach templates already saved. See Boards.

Turn a line of a description into its own ticket#

Highlight text in a description and Create ticket turns it into a ticket on the same board, with the first line as the title and the highlighted words left behind as a link to it. See Tickets.

An archived board can be deleted for good#

Behaviour change. An owner or admin can now destroy an archived board and everything in it from Trash, rather than only archiving it. This is permanent and there is no undo. See Trash and restore.

5 August 2026#

The storage pool is now enforced, and warns you twice first#

Behaviour change. The Pro storage pool — 10 GB per billable seat, pooled across the workspace — has been a published figure that nothing checked. It is now enforced: once a workspace has used its pool, new uploads are refused with a 402. This supersedes the note of 3 August below, which said nothing refused an upload at that line.

You are warned before it happens, and again when it does. The owner gets an email at 80% of the pool and another once it is full, alongside the in-app notice on Billing that already existed.

Nothing is deleted, and nothing else is blocked. Reading, editing, commenting, exporting and — importantly — deleting all carry on exactly as before, on a full workspace as on an empty one. The only refused action is adding a new file. Clearing space is therefore always available to you, and so is the other way out: adding a billable seat raises the pool by 10 GB.

If your integration uploads attachments, a 402 on POST /tasks/:uuid/attachments now means the workspace is out of storage rather than out of subscription; the message body names the pool and the usage. See Billing.

3 August 2026#

Behaviour change. A sprint board drops out of the sidebar once the series has rolled past it and it ended more than 14 days ago, so a workspace that has been running sprints for a year no longer scrolls past a year of finished ones to reach the board it works on. Nothing is deleted: a hidden sprint is still listed under Sprint overview → Previous sprints, still opens from a link, and reappears in the sidebar while you are looking at it. See Sprints.

Outbound webhooks#

API change — additive. A workspace can register HTTPS endpoints that Laver posts to when a ticket, comment or wiki page changes. Payloads are signed with X-Laver-Signature, using the same HMAC-SHA256-over-timestamp.body scheme Stripe uses; delivery is retried five times with a widening gap, and every attempt is visible in a delivery log. Registration is admin-only and takes a session token. See Outbound webhooks.

Deleting is undoable for 30 days#

Behaviour change. Deleted tickets, comments, wiki pages and attachments now go to a workspace trash and can be restored for 30 days, after which an hourly sweep destroys them — including an attachment's bytes in object storage, which previously stayed indefinitely. These docs used to say a delete had no undo and should be treated as permanent; that is no longer true. See Trash and restore.

Notification emails, and control over them#

Assignments, mentions and replies now send email as well as an in-app notification, and sprints notify when they start and shortly before they end. Every event can be switched off per channel in My profile → Notifications.

The unsubscribe link in those emails is one decision rather than one category: it stops notification email and billing updates together. Security notices and the non-payment sequence ignore it by design. See Notifications.

Ticket relationships#

API change — additive. Alongside the existing blocks/blocked_by dependency, tickets can be linked as related_to or duplicate_of through POST /tasks/<uuid>/relationships.

Archive several tickets in one call#

API change — additive. POST /tasks/archive takes up to 200 task_uuids. It is what the app's multi-select delete now uses.

Smaller things#

The board filter box also matches a ticket uuid by prefix, so pasting one from a link or an API response finds it.
Billing shows what the workspace has stored against its fair-use pool once it is near the line. Nothing is blocked at the line.
The board can be filtered by label, priority, assignee, due-date range and overdue — see Filters and card display.

Tickets have a start date#

API change — additive. Tickets carry an optional start_date alongside due_date, so a ticket can describe a span rather than only a deadline. It is a calendar day ("YYYY-MM-DD") or null, accepted on POST /boards/:uuid/tasks and PATCH /tasks/:uuid, and returned everywhere a ticket is — the single read, the board read and the updated_since delta.

The two dates are independent: the API does not check one against the other, so a start date later than the due date is accepted. If your integration needs them ordered, enforce it yourself.

Published storage allowance#

The Pro plan's storage allowance is published as 10 GB per billable seat, pooled across the workspace — five billable seats is 50 GB, not 10 GB each. Viewers are free and add no headroom. Billing shows usage against the pool and warns at 80%, but the figure stays a fair-use one rather than an enforced ceiling: nothing refuses an upload at that line.

Superseded on 5 August 2026 — the pool is now enforced and uploads are refused once it is full. See Billing.

Copy instructions to agent#

A column's ⋯ menu can copy a ready-made briefing for an agent picking up that column — the board and status uuids, the request that lists the column's tickets, and the questions to settle before starting. See the Agent quickstart.

1 August 2026#

A workspace now needs a live subscription#

API change — breaking. A workspace with no live subscription is locked, and the lock covers reads as well as writes. Boards, tickets and the wiki answer:

json

{
    "error": "This workspace does not have an active subscription. Start one in Billing to get back in.",
    "subscription_required": true
}

with HTTP 402. Billing, sign-in and profile routes keep working, so an owner can always reach the page that restarts the subscription.

New workspaces start a 14-day trial taken with a card up front, on the paid plan's limits. If you have an integration that previously read a board on a workspace with no subscription, it now needs to handle 402. See Errors.

Superseded — there is a free plan now, and with it the trial has gone: a new workspace runs on free rather than counting down, and subscribing charges the card at checkout. See Billing.

Seats, plan limits and non-payment states#

API change. Billing is now enforced end to end:

The free plan allows 3 seats, 2 boards and 1 GB of storage. The paid plan is unlimited. Exceeding a limit answers 402 with a body that quotes the current price in a prices object.
Viewers are free and never count as a billable seat. Outstanding invitations do count, so ten pending invites can no longer walk a workspace past its cap.
A workspace behind on payment stays fully readable but stops growing: new members, boards and uploads are refused with 402.
A workspace further behind becomes read-only. Writes answer 402 with billing_frozen: true; every read keeps working.
Support-comped workspaces are supported without a Stripe subscription.
Tax is calculated at checkout where it applies.

Wiki pages can be reordered#

Pages can be dragged into a new order within their parent, and the order sticks for everyone.

31 July 2026#

Billing and subscriptions#

One paid plan. The plan choice was collapsed to a single Pro plan, monthly or annual.
Pricing and renewal are visible. The billing screen shows what you pay, in your currency, and when it renews. API change: plan-limit refusals now carry a prices object so a client can offer the upgrade in place.
Deleting a workspace cancels its subscription. Previously the workspace went away and the subscription did not.
Payment updates are applied in order, and only once. Out-of-order or repeated notifications from the payment provider no longer flip a workspace's billing state back and forth.

Working with tickets over the API#

Read one ticket without reading its board. GET /tasks/<uuid> returns a single ticket including its version, so a write no longer needs a whole board fetch first.
A 409 now tells you the current version. API change. A version conflict answers {"error": "Task was updated by another request.", "version": 9} — you can retry without re-reading. Previously you had to go and find the version out for yourself.
Search a board, and address a column by name. GET /boards/<uuid>/tasks matches a substring of the title or description with q, and filters by column with status (a name) or status_uuid. Column names are accepted anywhere a status_uuid is, on creating and moving tickets too, so an agent can say "In Progress" rather than hold a uuid.
Ask a board what changed since last time. API change. Every board read returns server_time; pass it back as updated_since and the reply carries only what changed, plus removed_task_uuids for what left the board.
Deltas report cross-board moves. API change. A ticket moved to another board now appears in the source board's removed_task_uuids instead of lingering in a client's copy.
Deltas carry board metadata. API change. A delta response now includes the board, its columns, swimlanes, members, labels and card preferences, so a client can apply one without a second request.
Board search can be walked a page at a time. limit (1–200, default 50) and a cursor/next_cursor pair. The cursor is a keyset, so tickets changing mid-walk cannot make it skip or repeat a row.
Body-less POSTs no longer need a body. API change. Calls such as archive stopped requiring a pointless {}; previously they answered 400 body must be object.

API keys#

Agent-friendly API keys. Workspace owners and admins can issue laver_ bearer tokens from Admin → API keys. A key acts as the person who created it and inherits exactly their access, so there is no second permission model: change their role and the key changes with it, deactivate them and the key stops.
Members can issue their own key. POST /profile/api-keys, up to ten live keys per person per workspace. A key cannot mint further keys.
Changing your password no longer kills your API keys. They were being revoked along with sessions, which they are not.

Live board updates#

Server-sent events per board. GET /boards/<uuid>/events pushes a frame whenever anything on the board changes, so open boards update without waiting for the next poll. The frame says only that something changed — fetch a delta to find out what.
The board refreshes from a delta rather than re-reading everything, which makes a busy board noticeably lighter on both ends.
The rate limiter no longer takes a board down. The allowance was raised to 900 requests per minute and event streams were exempted; previously a 429 triggered a reconnect loop that 429d again.
The event stream works cross-origin. It was being blocked by the browser despite answering 200.

Boards and tickets in the app#

Success criteria on a ticket. A checklist on each ticket, with a progress badge on the card. (Named subtasks when it shipped; the API path is still /tasks/<uuid>/subtasks.)
Split view. Open a second board beside the first.
Boards behave as tabs, preloaded, so switching between them is instant.
Multi-select and group actions. Select several tickets and move, label or archive them together.
Columns can be re-arranged, and each column carries its own hover shortcut on a card, so a ticket can be moved without opening it.
Ticket dialog fixes. Tickets no longer close the instant they are opened, no longer reload themselves on every board poll, and no longer refetch in a loop while open. Boards no longer lock up after a ticket is moved.
Ticket layout. Action buttons moved to the eyebrow row, the title got the full width, the actions menu got a control that is not the right-click menu, and card cover images now bleed to the card edges.
Attachment previews got a viewport-sized stage and several fixes.
Sidebar and filters. Boards show their initial in the sidebar chip, the board filter opens ready to type, the collapsed workspace tile was rebuilt, the app version is shown, and there are no more warning toasts when there was simply nothing to load.

Working offline and on a phone#

Laver survives a bad connection. Changes made while offline are queued and replayed when the connection returns.
The offline queue no longer replays one person's writes as another. Queued changes are now bound to the account that made them and are discarded on sign-out.
Mobile. Long-press drag and drop with the drag scoped to the pointer that started it, column-snapping board scrolling, safe-area handling, notifications in the board navigation, one consistent breakpoint across the app, no autofocus on the ticket title, and the ticket dialog grab pill removed.

Wiki#

The editor is faster, and images and tables can be resized — with the resize handles actually reachable.
Drafts no longer destroy or strand work. The draft layer could lose an edit or leave it unreachable; it does neither now.
@-mentions render inside the open dialog instead of behind it.

Security and accounts#

Password resets are all-or-nothing. A reset that failed part-way used to report success while leaving the account in between states. It now rolls back completely.
Hardening. Security headers, HTML escaping in email, upload and attachment checks — including verifying that a file's contents match the type it claims — session handling, content-security policy, and validation of rich-text content on the way in.
Two-factor sign-in is not currently available. Its endpoints are closed while the feature is disabled, rather than half-open.