Changelog

We've tightened cross-origin access so only foura.ai can call the API with credentials. We also hardened an input filter on the metrics endpoint and dropped a development-only fallback secret. Existing integrations don't change.

If you've set validate.status.accept on a request, the engine treats an accepted non-200 as a clean success. Activity was still labeling those as failures, which threw off your usage stats. Outcomes now follow your validate verdict, so a 403 you accepted shows up as success, not App Fail.

Activity used to show raw outcome strings like Application_fail while Overview used friendly labels (App Fail) with proper colors. Activity now uses the same labels and colors, so the two views read the same.

If you were scraping Cyrillic, Chinese, Japanese, or other non-UTF-8 pages through Single, the body used to come back as mojibake. We were force-decoding every response as UTF-8 before you saw the raw bytes. Now we read the charset from the response (Content-Type, then <meta charset>, then UTF-8 fallback) and decode it correctly. Thanks, Alexandar Kanchev (Sensika), for reporting this.

Some proxies in the wild don't actually forward your request. They echo it back as a plaintext server dump and try to harvest what's inside. We now spot that pattern before the response hits your code, so Single, Browser, and Proxy Finder all return an honest failure (or retry) instead of the garbage.

Every Activity row with a stored payload is now clickable: the dialog shows the full request and response (pretty-printed, with copy buttons and clear messages for requests that errored before producing a body). Hit 'Open in Playground' to load that exact call back into the form with its archived response already rendered, so you can tweak parameters and rerun without rebuilding it. Stored payloads stick around 24 hours, last 200 per key.

Authenticated calls now come back with an X-Foura-Request-Id header. Stash it in your own logs and you can match any request to its row in Activity, or hand it to support so we can look up exactly what happened on our side.

Hit the new Cancel button while a playground request is loading and we abort it cleanly. The panel snaps back to idle with a 'Request canceled' note instead of a scary network error.

Keys you create from today can be revealed any time, both on the API Keys page and inside the playground's curl reproducer. Click the eye, confirm, and the full key shows for 15 seconds before clearing itself (every reveal is audit-logged). Older keys remain one-time-view; regenerate any old key to make it revealable.

The recheck queue now drains in days instead of weeks. We cut the time to pick each proxy to test from about 2 seconds to about 10 ms, so the pool stays fresher under load. Fewer dead IPs in rotation, and every Single and Proxy Finder call works against a healthier set.

Every refresh batch now spreads across distinct subnets, so each run uses the full concurrency budget. The Proxy Finder pool turns over 5 to 10 times faster and stale entries clear within hours.

We fixed a slowdown that kept newly discovered proxies waiting before they got validated. Proxy Finder now checks them right away, so the pool stays fresher with more live, working proxies in rotation.

Below 768px the URL row reflows into two rows, response tabs scroll horizontally, and the cookie table becomes a card grid. Hint tooltips open on tap instead of hover; iPhone SE (below 374px) gets extra shrink. The Send button is centered properly and a long URL no longer pushes the page into horizontal scroll.

Expand used to stretch the response card inside the page flow, so tall panes added body scroll and shifted the layout. It's now a fixed overlay between the sidebar and viewport edge, with panes that grow to fill the viewport. Escape closes it; one helper handles click and key paths.

Playground now tracks the Domain attribute properly, so host-only cookies stay on their host. The Parsed view marks them with an HO badge, and Raw matches what the upstream sent.