QuivaWorks ships continuously rather than in numbered releases, so entries below are grouped by
month rather than by version. Where a change landed gradually over several weeks, the entry is
dated to the month it became generally available rather than to a single commit.
SpacesDevelopersFlowsSecurity
Task sync: API integrations, versioned writes, a changes feed, signed webhooks, staging Spaces and a service desk
API integrations
Root and admin users can now create API integrations under Account, Connections. An integration is a named machine identity with its own client credentials. You choose, Space by Space, whether it can read tasks, write tasks, write comments or configure the Space’s workflow. It takes no seat, never appears in your members list, and every change it makes is attributed to it by name. Secrets are shown once, rotate with a grace period you set, and can be revoked immediately.API integrations
Create an integration, scope it to Spaces and rotate its secrets.
Task sync authentication
Exchange client credentials for a one-hour token.
Keep tasks in step with another system
Tasks now carry a version that goes up on every write, andPATCH, DELETE and the new upsert accept an If-Match header so a stale write is refused with 409 version_conflict instead of overwriting. A task can hold your own external id, and a single idempotent call creates or updates it. A new changes feed returns every task, comment and action write in a Space, deletes included, with a cursor and 30 days of history. Tasks also gain activity_at, which moves on comments, time logs and actions, and the task list reports has_more.Task sync
External ids, versions, the changes feed and a minimal sync loop.
Signed task webhooks
Each integration can subscribe endpoints to task events. Deliveries are signed with the Standard Webhooks scheme, retried over about 24 hours, paused automatically with an email when an endpoint keeps failing, and never echoed back to the integration that caused them. You get a delivery log, replay of a cursor range, test events, and secret rotation with a 24-hour window where both secrets sign.Task webhooks
Verify signatures, handle retries and replay missed events.
Connect a tracker
Admin and root users can now connect an item tracker under Account, Connections, Connectors. A short wizard asks for the tracker’s token, a Space and how statuses, owners and priority map, then sets up the webhook and task subscription for you. Tasks and tracker items stay in step in both directions, with no flow to build. The card shows the last sync in and out, refused calls and a run log, and offers Repair and Disconnect. Flows gain a Connector step, and developers can describe a new tracker with a connector definition and itssync block.Connect a tracker
The wizard, the connection card, Repair and Disconnect.
Connector step
Normalise, apply and push from a flow.
The sync block
Field rules, outcomes and reasons.
Verify signatures on webhook and HTTP Request triggers
A webhook or HTTP Request trigger can now check a signature before the flow starts. It supports HMAC SHA-256, including GitHub-style and Slack-style presets, and Standard Webhooks. A request that fails the check gets a 401 and no run is created. Theeval step also gains a small crypto object for HMAC, SHA-256 and constant-time comparison.Webhook trigger
The signature fields, limits and behaviour.
Eval step
The crypto helpers.
Staging Spaces
A Space can be marked staging. Copy a live Space’s statuses, priorities, tags and folders into one with a single call, point a test integration at it, and reset it between runs. Reset also clears the Space’s external ids so a sync can be repeated.Staging Spaces
Copy structure, reset and test safely.
Service desk
Connect client accounts to one central board. Tickets raised in a client’s own Space appear on your board, filtered by client, and status changes and comments move both ways. If both sides edit the same ticket at once, nothing is overwritten: the ticket shows a Sync conflict with Keep mine and Take theirs. See Service desk.Retries on flow steps
Steps that setattempts now retry inside the step with exponential backoff and a cap of five attempts, so the steps after it run once, with the final result. A status listed in ignore_response_codes on an HTTP, function or flow step now lets the step finish with a result you can branch on, instead of failing the run. Review any flow that relied on such a status still failing.AbbieAccountsSpacesSecurityDevelopers
Abbie's mode picker, footnoted citations, the account switcher, Entities & Contacts, and a hosted MCP server
Abbie’s mode, model and run strip
A chip next to the message box now shows the mode and model for your next message. Fast answers straight away with no separate check, Auto leaves it to Abbie to decide how much checking a request needs, and Thorough always checks the answer and compares more candidates. Pin a specific model yourself, or leave it on Auto and let Abbie choose. While she’s working, a run strip appears above the reply with one block per step of the work, appended live and expandable right there in the transcript.When a request is big enough to fan out into several independent pieces of work, Abbie now shows a card first — how many pieces, and what they are — with the choice to run them all in parallel, run a smaller capped number, or skip it. Nothing runs until you answer.Watching her think
The mode and model picker, the fan-out approval card, and reading the run strip.
Citations as footnotes
An answer that draws on the web, or on something already in your account, now marks the claim with a footnote instead of just asserting it. Web sources link out with their host shown alongside; sources from your own account — a task, comment, record, file, meeting, memory, conversation or attachment — show as a badged reference instead of a raw link. If Abbie searched the web while drafting an answer but the draft came back uncited, a repair pass matches each claim to the sources she actually used and attaches the footnotes afterwards, and says so. Each step’s cognition-log card also gained a Provider-run web searches panel, listing every search or page fetch the model ran natively, with its query or URL and what came back.Citations
Footnotes, the source badges, and the uncited-answer repair pass.
What each stage means
Where citation repair and the provider-run search panel fit in the pipeline.
Switching accounts
If you belong to more than one account, a Switch account entry in the profile menu now opens an Accounts modal listing every account signed in on this browser, with the current one marked, so moving between them no longer means signing out and back in.Working in more than one account
Where the current account is shown, the Accounts modal, and adding or removing a browser session.
Entities & Contacts, Modules and task templates
A Space that anchors on a contact and an organisation now shows a folder-scoped Contacts panel (named after the Space’s own contact record): browse to a folder and see the organisations and contacts filed there, open one and the panel narrows to what’s inside it.Space owners can also turn a whole module off — Files, Tasks, Records, Chats or Meetings — removing its tab and Overview card at once, or withdraw individual tabs without touching the rest of the module, from Edit space → General. And a task can now be created from a task template, which pre-fills its fields and seeds a set of actions in one step.Entities & Contacts
The folder-scoped panel, and how a Space declares a contact and an organisation.
Tasks
Task templates, and everything else on a task.
Privacy: less kept, less logged
Prompts, and the arguments of external tool calls Abbie makes through MCP, no longer reach QuivaWorks’ own application logs. Requests to OpenAI models are also now sent with server-side storage turned off — Abbie resends the relevant history herself with every turn, so nothing needs to sit on the provider’s side between turns.Security Overview
What’s kept, what isn’t, and how this differs from your own Data Retention setting.
Connect an AI assistant with MCP
Quiva now hosts an MCP server athttps://api.quiva.ai/mcp. Point Claude Code, Cursor, VS Code or
Claude Desktop at it with an API key, and your AI assistant can build and manage flows, records,
document templates, spaces, assistants and distribution directly on your account, with nothing to
install. The servers can still be run locally if you prefer.Connect a client
The URL, the API key header, and a config snippet for each client.
Tool reference
Every tool the server exposes, grouped by area.
API reference
The API reference gained its own Assistants group, documenting assistant endpoints directly rather than folding them into Hub Flows. Two corrections came back from that pass: the task action endpoints now match what the workspaces service actually accepts, and every document template path carries the/file-generator prefix the service has always required.SpacesFormsClient PortalAbbieFlowsRules
Client Portal, task actions, form flows, Abbie's name, and a round of flow and form corrections
Client Portal
External people — a customer, a supplier, a contractor — can now sign in to a cut-down view of QuivaWorks that shows only what your team has put in front of them: their own tasks, documents and conversations, nothing else in the account. Clients sign in with a one-time link or code, not a password.Client Portal
Who a client is, how they get a sign-in, and what they can and can’t see.
Task actions and form flows
Tasks can now carry a checklist of actions — a form to fill in, a document to read or sign, a conversation with an assistant, or a to-do list — worked through in order before the task is counted done. A long form on one of those actions can be cut into sections and delivered as a conversation, with Abbie asking a few fields at a time and picking up where you left off.Task Actions
The four kinds of action, and how they show up on a task.
Form flows
Turning one long form into a conversation.
Abbie has a name
The assistant that runs your Spaces, files tasks and works through forms is now named Abbie throughout the product, rather than referred to generically.Subtasks
A task can now be set as the parent of others, giving each task a Parent field and letting a piece of work be broken into smaller tracked pieces underneath it.Tasks
Subtasks, time tracking and the rest of what’s on a task.
Query strings and path parameters reach a flow
A call to a webhook or HTTP Request trigger no longer loses everything outside the JSON body. Query parameters arrive asx-param-query-<name> and path parameters as x-param-<name>, both readable
from $.env.headers, and the request method arrives as x-method. A request with no body at all is
now a legitimate trigger rather than an error.Those endpoints also answer properly when something goes wrong. A body that is not valid JSON comes
back as 400 with a JSON error naming the parse failure, instead of 200 with a bare error
string; a flow that does not answer in time is a 504, and one that answers with nothing is a
502.HTTP Request trigger
Reading query and path parameters, and the error responses.
Webhook trigger
The same, on a generated URL.
Task actions move the task
Completing a task’s actions now moves the task itself, and it does so through statuses the Space owns rather than three fixed ids. Give a status the To do, In progress or Done role on Edit Space → Tasks → Statuses and the checklist drives the board. A status a Space does not have is never written, and a finished task is never dragged back to the start.Task actions
The three roles, and what happens when one is not set.
A form rule that cannot run no longer hides its field
A Visible rule built on an operator the form engine does not have used to resolve to nothing, which counted as no — so the field it guarded disappeared for everybody, permanently and with no warning. Such a rule is now ignored instead: the field stays visible, and Required, Disabled and Readonly keep whatever their settings gave them. The rule card flags the unsupported operator while you are writing it.A required field inside a hidden card, row or repeater no longer blocks submission either. A question nobody could see is pruned before validation, and the record is saved without it.Form rules
What a rule does when it cannot be evaluated, and the operators that exist.
A misnamed rule operator now says so
The rules engine used to drop a fact whose operator it did not recognise, with no error anywhere — a typo looked exactly like a condition that did not match. A Rules step or a Condition step now fails before it runs and names the rule and the operator. Several other ways a rule can produce nothing are still silent, and the reference now separates the two.The Condition step’s operator list has been reconciled with the engine as well: two names that were offered but never worked are gone, and ten the engine has always supported are now on the list. A new condition cell starts on a working operator rather than an empty one.When a rule produces nothing
What is caught, and what still is not.
Corrections across flows
hin a schedule interval means hours. It was being read as minutes, so2hrepeated every two minutes. Anything written as120mto work around it can go back to2h.- Two schedule triggers on one flow may share a name. They no longer collapse into one at publish.
- A nested flow accepts a single object. Only an array worked before; an object now starts one
run and returns it without a
resultswrapper. - A step’s Response Map is applied on every step type whose editor offers it, not only Function and nested-flow steps.
- A per-step
timeoutworks on HTTP Request and Verify Challenge steps, where it was previously read as a fraction of a millisecond and had no effect. - A paused run keeps
$.trigger. The message that resumed it now has its own place,$.resume, instead of overwriting the payload that started the run. - An assistant step may carry its own
context. It is merged with the run’s context variables, with the step’s own entries winning. dateDiffmeasures spelled-out units."days","months","minutes"and the rest now work alongside the single letters, and"ms"has been added.- Rerun starts a fresh run. In Monitoring it now begins from the first step on the flow’s current published version, with your edited trigger, and appears as its own row. Retry and Continue still resume, as intended.
- A secured webhook can be created from the dialogue. The Create Webhook dialogue now issues an API key, and the trigger node carries a Public URL toggle and a Security section of its own.
Forms
Record Sets — the custom, schema-defined data types introduced with Spaces — can now have one or more forms built over them: which fields appear, in what order and layout, and under what conditions. One Record Set can carry several forms, so a short intake form and a longer review form can both write to the same records.Forms
How a form relates to its Record Set.
Building a form
The form editor — palette, canvas and inspector.
Conditional forms and computed values
Forms support rules for showing or hiding a field, requiring it conditionally, or computing its value from others on the form — and a rule can now be described in plain language and written for you, rather than built by hand.Form rules
The operators that work, and what happens when a rule cannot be run.
The rule assistant
Describing a rule and having it drafted for you.
File approvals and signing
A file in a Space can now be sent for approval or signature — assign it to a teammate or an external person by email, and track outstanding approvals from the file itself.File Management
Folders, uploads, sharing and approvals.
QuivaWorks introduced Spaces — a self-contained area of work holding files, tasks, records,
chat sessions and meetings under one identifier, with its own statuses, priorities and tags. You
might run one Space for supplier contracts, one for client onboarding, one for internal requests —
each with its own task board, nothing leaking between them.Each panel in a Space — Tasks, Records, Files — can offer its own assistant for setup, guidance
and troubleshooting.
A Space has no members or permissions of its own — access to QuivaWorks is account-wide. What
shipped this month, and what a Space is, is documented in full below rather than repeated here.
Spaces Overview
What a Space is and how its panels fit together.
Tasks
Statuses, priorities, tags and a drag-and-drop Board view alongside the List view.
Records
Custom, schema-defined data types, filed against a Space and its contacts.
Escalations
The built-in Space that catches work automation couldn’t finish alone.
Scheduling
Due dates, the Schedule view, and recurring or one-time actions on a task.
- Clearer sender attribution in chat, and the interface now stops you sending a second message while a response is still arriving.
- A refined document preview interface for browsing and downloading knowledge base files.
- More reliable Word and PowerPoint generation — for best results, state formatting requirements explicitly or provide a template document.
- Fixed a Word document encoding issue that could mark a valid document unreadable, and an authorisation bug that blocked admins from deleting user accounts.
Shared assistant sessions
You can now invite a colleague into an assistant session so you both see the same conversation and updates as they happen, instead of working alone and relaying results afterwards.Collaboration
Sharing a session, and what a shared collaborator can and can’t do.
Assistant learning
Upvoting or downvoting an assistant’s response now feeds a learning document you can review and edit, so an assistant’s answers improve from the feedback it actually gets.Assistant Learning
How feedback becomes an editable learning document.
Also shipped
- Platform branding — custom colours, an application name and a favicon, set once for the whole account.
- Document generation to PDF and Word directly from an assistant conversation, and simple deployment of static web apps and interactive dashboards without any infrastructure setup.
- A redesigned chat interface: voice input, emoji support, richer formatting, and tabs so you can hold several sessions open at once.
- Flows gained HTTP request and QuivaWorks service nodes, alongside delay and rules nodes, for building automations that reach outside the platform.
- The marketplace was redesigned: faster search, clearer categorisation and a featured section for discovering assistants and integrations.
- A sub-assistant invoked from a parent conversation now automatically inherits the parent’s documents and recent context, instead of starting cold.
- Personal context on a shared assistant — your own instructions, knowledge and integrations layered on top of a shared definition — plus a credit usage dashboard with budget alerts, a large-document processing pipeline for bigger knowledge files, and a unified marketplace submission flow for assistants, integrations and flows.
- Assistant responses stream in real time by default, appearing as they’re generated rather than all at once.
- A parent conversation can hand work to a sub-assistant and navigate back once it’s done, with the child session automatically summarised.
- Natural-language date parsing (“tomorrow”, “next week”, “in 3 days”) in the date and time tool.
- A significantly improved mobile experience across chat, the sidebar and forms.
- Every plan now includes credits from the moment an account is created, so you can start using QuivaWorks before configuring your own API keys.