Changelog

`documentCount` now counts DISTINCT documents instead of document-to-item links, so a document attached to two items (common for fire drawings, which satisfy both a Brann item and a Tegninger item) counts once rather than twice. The number previously overstated how much of a building the report covers — on a real building it read 223 where only 214 distinct documents were attached. Per-item `documentCount` in the render data is unchanged.

Document counts are now correct for foldered collection workspaces, which previously reported 0 because their documents live in folders rather than in the collection itself. `get_collection` returns the real count. `list_collections` returns null rather than a wrong 0 for those collections — call `get_collection` when you need the number, as computing it for a whole list is expensive.

API keys can now be scoped to individual buildings rather than whole building owners. A building-scoped key sees only its own buildings on owner-level endpoints: building_owners lists just the owners it can reach, /buildings returns just its buildings, and /status and /search cover just those buildings. Owner-level changes still require access to the whole building owner. Nothing changes for existing keys.

Documents in a folder are now permission-checked individually whenever the caller cannot read the folder itself, not only inside private subtrees. Callers with full access to a folder see exactly what they saw before; a caller who could merely navigate into a folder no longer sees documents they cannot open. No change to inputs or response shape.

Search max_results now serves the full requested page, up to 1000. It was previously truncated to 100 regardless of what you asked for. A large page costs barely more than a small one, so prefer one big request over many sequential pages - this supersedes the 2026-06-29 note.

The discipline and documentType filters now actually narrow results. They were accepted and then ignored, so searches using them returned unfiltered results. Searches are also faster and no longer return document text that was never used.

Internal billing-field documentation was updated after retiring legacy customer invoice information. No change to inputs, response shape, or behavior visible to callers.

Document downloads are now returned as a normal downloadUrl in the tool text and structured output, without an attached MCP resource block, so Copilot Studio can consume the response instead of converting it to "Tool did not respond with success".

Internal usage-metering wiring only (T-9019) — no change to inputs, response shape, or behavior visible to callers.

All tools now explicitly declare read-only, destructive-action, and open-world annotations for marketplace/connector review scans. No change to inputs or response shape.

The document download link now saves the file to disk instead of opening it as a preview, so clients that hand it straight to the operating system get a real file. No change to inputs or response shape.

Downloaded documents now arrive with their real filename and file type. They previously reached some clients named after an internal token and typed as a generic file. No change to inputs or response shape.

The category filter now cascades: filtering by a three-digit code (e.g. 564) also returns documents filed under its four-digit NS 3451:2022 subcategories (5641, 5643) instead of silently excluding them.

Fixed document retrieval for buildings stored in the UK data region — get_document returned an error for every file and folder thumbnails were missing. No change to inputs or response shape.

Red flag generation now records the exact requesting user so completion notifications remain attached to the correct active account.

Agentic retrieval is now the only Ask path. Omit use_agentic_rag; an explicit false returns 400.

Ask requests now default to agentic retrieval when use_agentic_rag is omitted.

Document search and folder browsing now return compact result lists without attaching every file; select one result and call get_document to receive that single correctly named file. Search pages default to 10 (max 20) and folder document pages to 20 (max 50); reconnect the MCP client to refresh cached tool descriptions.

Copilot document links now point to the full original file instead of a page-one thumbnail. Thumbnail URLs remain available only to UI widgets; reconnect the MCP client to refresh cached tool descriptions.

Building photo URLs no longer consume model context in building and portfolio results, preventing large listings from exceeding host token limits; UI cards still receive and display the same photos.

Document search and folder browsing results now include direct downloadUrl values and MCP resource links with filename + MIME type, so Copilot-style hosts can attach the actual files instead of falling back to preview links.

Document results now include MIME types derived from their filenames. get_document also emits a first-class MCP resource link with the real filename and MIME type so Copilot can recognise the returned file as a document resource.

No behavior change — ask_findable stays document-only and never searches the web. The product Ask UI gained a "Web access" permission (default on) that lets the chat model search the web when useful, but the MCP ask_findable tool explicitly keeps web access off so its answers and citations stay scoped to your documents.

Search max_results is capped at 100; paginate with start_index for larger result sets.

No behavior change — internal only. The SharePoint AppSubscriptions table these tools read is now owned by apps/integrations after the standalone findable-integrations repo was migrated into the monorepo. Same table, same byBuildingId GSI, same responses.

Private folders are now enforced for the documents these tools return. Previously both only checked that you could read the building, so documents inside private folders could be surfaced to building members without access — get_red_flag_item exposed their filenames + AI confidence/reasoning, and list_sharepoint_documents exposed their Findable + SharePoint ids. Now documents in a private folder are only included for users explicitly granted access to them; documents in normal folders are unaffected.

Private folders are now enforced when fetching a document by ID. Previously these tools only checked that you could read the building, so a document inside a private folder could be retrieved (file + metadata) by any building member who had its documentId. Now a document in a private folder is only returned to users explicitly granted access to it — matching search_documents and the folder browser. Documents in normal (non-private) folders are unaffected.

Documents paused before processing (e.g. when a building hits its ingestion volume cap) are no longer returned in folder listings, matching the dashboard — such documents are surfaced only in the dedicated Unprocessed pane, not in the normal file tree. Folders and non-paused documents are unaffected.

Now also returns previewUrl — a rendered page-1 thumbnail when one exists. The document-viewer widget renders PDFs inline (pdf.js to a canvas, since the host sandbox blocks <object>/<embed>), using previewUrl as the placeholder and fallback; downloadUrl still returns the real file with its original filename.

Each document now includes a preview thumbnail (previewUrl), like search_documents already does, so the folder browser shows rich previews instead of icon-only tiles.

A document’s download URL now serves the file inline and with its real filename (previously an opaque token), so PDFs preview directly in the document-viewer widget and saved files keep their original name. Response shape is unchanged — still { document fields…, downloadUrl }.

Internal system buildings (the hidden __system_workflows__ and __system_portfolio_documents__ records Findable uses behind the scenes) are no longer surfaced anywhere: they are excluded from list_buildings, from find_resources name searches, from a portfolio’s building roster, and from get_customer’s building_count and top_buildings. This matches the dashboard, which has always hidden them.

Each attached document now includes its filename (was documentId only), so a caller (or the compliance-card UI) can list the evidence documents for an item readably and open them without a separate get_document lookup just to learn the name.

MCP Apps (SEP-1865): these tools now render as interactive UI widgets in hosts that support them (document viewer, search-results grid, building/portfolio cards, compliance card) — text hosts are unaffected and get the same content as before. New/changed fields: get_building, list_buildings, get_portfolio and list_portfolios buildings now include an imageUrl (building photo); list_buildings also adds city, type and constructionYear; search_documents echoes the query and applied filters; get_red_flag adds buildingName and themes[].items (each theme’s leaf items with status + documentCount) so a UI can drill down without a follow-up call. Document download/preview links are served through a same-origin, 7-day, signed asset proxy (was 1h) so they keep working when a chat is reopened later.

Added building, drive-item, folder, and citation resolution endpoints for SharePoint Ask integrations.

Restored backwards-compatible pagination defaults and the established Partner API response shape.

Added scoped session-token exchange for browser SDK and React integrations.