What shipped.

The public OpenAPI document (api.notifly.io/openapi.json) has been rebranded end to end — titles, descriptions, and server URLs reference Notifly surfaces instead of upstream branding.

Groundwork for publishing the JavaScript SDKs to npm is in place: package identity and a publish pipeline are prepared. The packages are not yet on npm — until they are, the REST API is the supported integration path.

Notifly now ships a remote MCP server, live on api.notifly.io. It includes an OAuth 2.1 authorization server built into the platform, so AI clients connect with a standard OAuth flow — no API-key pasting.

Seven tools are exposed over the /mcp endpoint: trigger_workflow, list_workflows, get_workflow, list_subscribers, get_subscriber, list_topics, and list_notifications.

SAML and OIDC single sign-on via an embedded Ory Polis engine, with SCIM 2.0 directory provisioning for automated user lifecycle management.

Organizations can enforce SSO-only sign-in (with owner break-glass) and require MFA at the organization level.

Delivery-data retention is now TTL-based and configurable, organizations can export their data, and erasure requests perform a hard delete across the platform's data stores.

The organization-scoped audit trail now covers the sensitive mutation surface, supports CSV and NDJSON export, and applies configurable retention.

Explore Notifly without creating an account: guest mode spins up a working workspace instantly, and a 14-day free trial covers the paid plans.

Role-based access control, TOTP multi-factor authentication, the audit log, and subscription billing went live. Multi-factor authentication is available on every plan; roles arrive with the Team plan.