appwrite · ChiragAgg5k · Aug 14, 2026 · Jul 13, 2026 · Jul 13, 2026 · Jul 23, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Change Log
 
+## 28.0.0
+
+* Breaking: removed `account.createJWT`; use `users.createJWT` instead. A leaked JWT could mint further JWTs, letting a credential outlive its own expiry — a session cannot duplicate itself to live forever either
+* Breaking: removed `project.createKey`. A leaked key could mint further hidden keys, making a compromise far harder to contain and revoke
+* Breaking: `activities.listEvents` `queries` now takes an array instead of a string
+* Added: `embeddings` service with `createTextEmbeddings`, plus the `EmbeddingModel` enum
+* Added: TablesDB migration methods `listMigrations`, `createMigration`, `getMigration`, `deleteMigration`, `cutoverMigration`, and `listOperations`
+* Added: `proxy.createInvalidation` for purging cached edge responses, plus the `InvalidationType` enum
+* Added: `apps.deleteInstallation`
+* Added: `users.getMFAChallenge` and the `MfaChallengeSecret` model
+* Added: `project.updateMFAFactorsPolicy` and the `PolicyMfaFactors` model
+* Added: `client.setOrganization` for organization-scoped requests
+* Added: `folder` parameter to `storage.createFile`
+* Added: `syncMode` parameter to `tablesDB.create` and `tablesDB.update`, and `specification` to `tablesDB.update`
+* Added: `installationScopes` parameter to `project.updateOAuth2Server`
+* Added: `custom` authentication factor, `node-26` runtime, `mfa-factors` project policy, and the `embeddings.write` and `proxy.invalidations.write` key scopes
+* Updated: response format to `1.9.6`
+
 ## 27.1.0
 
 * Added: `Apps` service for managing OAuth2 applications, keys, and installations

diff --git a/README.md b/README.md
@@ -1,7 +1,7 @@
 # Appwrite PHP SDK
 
 ![License](https://img.shields.io/github/license/appwrite/sdk-for-php.svg?style=flat-square&v=1)
-![Version](https://img.shields.io/badge/api%20version-1.9.5-blue.svg?style=flat-square&v=1)
+![Version](https://img.shields.io/badge/api%20version-1.9.6-blue.svg?style=flat-square&v=1)
 [![Build Status](https://img.shields.io/travis/com/appwrite/sdk-generator?style=flat-square)](https://travis-ci.com/appwrite/sdk-generator)
 [![Twitter Account](https://img.shields.io/twitter/follow/appwrite?color=00acee&label=twitter&style=flat-square)](https://twitter.com/appwrite)
 [![Discord](https://img.shields.io/discord/564160730845151244?label=discord&style=flat-square)](https://appwrite.io/discord)

diff --git a/docs/account.md b/docs/account.md
@@ -150,19 +150,6 @@ DELETE https://cloud.appwrite.io/v1/account/identities/{identityId}
 | identityId | string | **Required** Identity ID. |  |
 
 
-```http request
-POST https://cloud.appwrite.io/v1/account/jwts
-```
-
-** Use this endpoint to create a JSON Web Token. You can use the resulting JWT to authenticate on behalf of the current user when working with the Appwrite server-side API and SDKs. The JWT secret is valid for 15 minutes from its creation and will be invalid if the user will logout in that time frame. **
-
-### Parameters
-
-| Field Name | Type | Description | Default |
-| --- | --- | --- | --- |
-| duration | integer | Time in seconds before JWT expires. Default duration is 900 seconds, and maximum is 3600 seconds. | 900 |
-
-
 ```http request
 GET https://cloud.appwrite.io/v1/account/logs
 ```
@@ -280,7 +267,7 @@ POST https://cloud.appwrite.io/v1/account/mfa/challenges
 
 | Field Name | Type | Description | Default |
 | --- | --- | --- | --- |
-| factor | string | Factor used for verification. Must be one of following: `email`, `phone`, `totp`, `recoveryCode`. |  |
+| factor | string | Factor used for verification. Must be one of following: `email`, `phone`, `totp`, `recoveryCode`, `custom`. |  |
 
 
 ```http request
@@ -293,7 +280,7 @@ POST https://cloud.appwrite.io/v1/account/mfa/challenges
 
 | Field Name | Type | Description | Default |
 | --- | --- | --- | --- |
-| factor | string | Factor used for verification. Must be one of following: `email`, `phone`, `totp`, `recoveryCode`. |  |
+| factor | string | Factor used for verification. Must be one of following: `email`, `phone`, `totp`, `recoveryCode`, `custom`. |  |
 
 
 ```http request
@@ -561,7 +548,7 @@ GET https://cloud.appwrite.io/v1/account/sessions/{sessionId}
 
 | Field Name | Type | Description | Default |
 | --- | --- | --- | --- |
-| sessionId | string | **Required** Session ID. Use the string 'current' to get the current device session. |  |
+| sessionId | string | **Required** Session ID. Use the string 'current' to get the current device session. | current |
 
 
 ```http request
@@ -574,7 +561,7 @@ PATCH https://cloud.appwrite.io/v1/account/sessions/{sessionId}
 
 | Field Name | Type | Description | Default |
 | --- | --- | --- | --- |
-| sessionId | string | **Required** Session ID. Use the string 'current' to update the current device session. |  |
+| sessionId | string | **Required** Session ID. Use the string 'current' to update the current device session. | current |
 
 
 ```http request
@@ -587,7 +574,7 @@ DELETE https://cloud.appwrite.io/v1/account/sessions/{sessionId}
 
 | Field Name | Type | Description | Default |
 | --- | --- | --- | --- |
-| sessionId | string | **Required** Session ID. Use the string 'current' to delete the current device session. |  |
+| sessionId | string | **Required** Session ID. Use the string 'current' to delete the current device session. | current |
 
 
 ```http request

diff --git a/docs/activities.md b/docs/activities.md
@@ -11,7 +11,7 @@ GET https://cloud.appwrite.io/v1/activities/events
 
 | Field Name | Type | Description | Default |
 | --- | --- | --- | --- |
-| queries | string | Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/databases#querying-documents). Maximum of 100 queries are allowed, each 4096 characters long. You may filter on attributes such as userId, teamId, etc. | [] |
+| queries | array | Array of query strings generated using the Query class provided by the SDK. [Learn more about queries](https://appwrite.io/docs/databases#querying-documents). Maximum of 100 queries are allowed, each 4096 characters long. You may filter on attributes such as userId, teamId, etc. | [] |
 
 
 ```http request

diff --git a/docs/apps.md b/docs/apps.md
@@ -70,7 +70,7 @@ GET https://cloud.appwrite.io/v1/apps/{appId}
 
 | Field Name | Type | Description | Default |
 | --- | --- | --- | --- |
-| appId | string | **Required** Application unique ID or HTTPS client ID metadata document URL. |  |
+| appId | string | **Required** Application unique ID. |  |
 
 
 ```http request
@@ -101,7 +101,7 @@ PUT https://cloud.appwrite.io/v1/apps/{appId}
 | postLogoutRedirectUris | array | Post-logout redirect URIs for OpenID Connect RP-Initiated Logout. Each must be an https URL, an http loopback URL, or a private-use scheme URI, and must not contain a fragment. After ending the user session, the logout endpoint only redirects to URIs in this list. | [] |
 | type | string | OAuth2 client type. Use `public` for SPAs, mobile, and native apps that cannot keep a `client_secret` — PKCE is then required at the token endpoint. Use `confidential` for server-side clients that present a `client_secret`. Defaults to `confidential`. | confidential |
 | deviceFlow | boolean | Allow this client to use the OAuth2 Device Authorization Grant (RFC 8628) for input-constrained devices such as TVs and CLIs. Defaults to false. |  |
-| installationScopes | array | Scopes the application requests when installed on a team. Organization-level and project-level scopes only; use the list scopes endpoint with `type=installation` to discover available values. Maximum of 100 scopes are allowed. | [] |
+| installationScopes | array | Scopes the application requests when installed on a team. Only scopes allowed by the project's OAuth2 server installation scopes configuration are accepted; use the list installation scopes endpoint to discover available values. Maximum of 100 scopes are allowed. | [] |
 | installationRedirectUrl | string | URL users are redirected to after creating or updating an installation of this application. Must be an https URL, an http loopback URL (localhost, 127.0.0.1, [::1]), or a private-use scheme URI, and must not contain a fragment. Leave empty for no redirect. |  |
 
 
@@ -122,7 +122,7 @@ DELETE https://cloud.appwrite.io/v1/apps/{appId}
 GET https://cloud.appwrite.io/v1/apps/{appId}/installations
 ```
 
-** List installations of an application. Requires an app key sent in the `X-Appwrite-Key` header alongside the `X-Appwrite-App` header. **
+** List installations of an application. Requires an app key sent in the `X-Appwrite-Key` header alongside the `X-Appwrite-App` header, or a caller with update access to the app. **
 
 ### Parameters
 
@@ -137,7 +137,21 @@ GET https://cloud.appwrite.io/v1/apps/{appId}/installations
 GET https://cloud.appwrite.io/v1/apps/{appId}/installations/{installationId}
 ```
 
-** Get an installation of an application by its unique ID. Requires an app key sent in the `X-Appwrite-Key` header alongside the `X-Appwrite-App` header. **
+** Get an installation of an application by its unique ID. Requires an app key sent in the `X-Appwrite-Key` header alongside the `X-Appwrite-App` header, or a caller with update access to the app. **
+
+### Parameters
+
+| Field Name | Type | Description | Default |
+| --- | --- | --- | --- |
+| appId | string | **Required** Application unique ID. |  |
+| installationId | string | **Required** Installation unique ID. |  |
+
+
+```http request
+DELETE https://cloud.appwrite.io/v1/apps/{appId}/installations/{installationId}
+```
+
+** Delete an installation of an application by its unique ID. Requires a caller with update access to the app. Previously issued installation access tokens are revoked. **
 
 ### Parameters
 
@@ -151,7 +165,7 @@ GET https://cloud.appwrite.io/v1/apps/{appId}/installations/{installationId}
 POST https://cloud.appwrite.io/v1/apps/{appId}/installations/{installationId}/tokens
 ```
 
-** Create a token for an installation of an application. Requires an app key sent in the `X-Appwrite-Key` header alongside the `X-Appwrite-App` header. The returned token carries the scopes and authorization details granted to the installation, and can be used as an `Authorization: Bearer` header everywhere OAuth2 access tokens are accepted. Multiple tokens can be active for the same installation at once; each token stays valid until it expires or the installation is updated or deleted. **
+** Create a token for an installation of an application. Requires an app key sent in the `X-Appwrite-Key` header alongside the `X-Appwrite-App` header, or a caller with update access to the app. The returned token carries the scopes and authorization details granted to the installation, and can be used as an `Authorization: Bearer` header everywhere OAuth2 access tokens are accepted. Multiple tokens can be active for the same installation at once; each token stays valid until it expires or the installation is updated or deleted. **
 
 ### Parameters
 

diff --git a/docs/backups.md b/docs/backups.md
@@ -135,13 +135,13 @@ POST https://cloud.appwrite.io/v1/backups/restoration
 
 ** Create and trigger a new restoration for a backup on a project.
 
-For a backup of one database, the restoration resolves its destination before it is queued. Pass `newResourceId` to restore into that database ID, including the archived database ID to overwrite it. When `newResourceId` is omitted, a new database ID is generated and returned in `options`.
+For a backup of one database, the restoration resolves its destination before it is queued. When `newResourceId` is omitted, the archived database is restored in place and its own ID is returned in `options`. Pass a different `newResourceId` to restore alongside it as a new database instead.
 
 The restoration migration records the archived database in `resourceId` and `resourceType`, and the resolved database in `destinationResourceId` and `destinationResourceType`. Database types are stored canonically as `database`, `documentsdb`, or `vectorsdb`. Project-wide restorations leave these fields empty because they do not have a single source or destination database.
 
 To list every migration related to one database, use its canonical type in a nested `OR(AND(...), AND(...), AND(...))` across the root, parent, and destination relation pairs: `(resourceType, resourceId)`, `(parentResourceType, parentResourceId)`, and `(destinationResourceType, destinationResourceId)`. Legacy and TablesDB databases use `database`; the operational `resourceType` of a table migration is not rewritten to `tablesdb`.
 
-When restoring a DocumentsDB or VectorsDB database to a new resource from a dedicated source, the restore provisions a fresh dedicated backing database at the source database&#039;s own specification.
+When restoring a DocumentsDB or VectorsDB database from a dedicated source, the restore provisions a fresh dedicated backing database at the source database&#039;s own specification and lands the data there. An in-place restore swaps the database onto that backing only once the restore has succeeded, and retires the backing it displaced only once that swap is confirmed, so the source keeps serving its own data until the restored data is in place and any failure leaves it untouched. A serverless source has no dedicated backing to clone and restores onto the archived database instead.
  **
 
 ### Parameters
@@ -150,7 +150,7 @@ When restoring a DocumentsDB or VectorsDB database to a new resource from a dedi
 | --- | --- | --- | --- |
 | archiveId | string | Backup archive ID to restore |  |
 | services | array | Array of services to restore |  |
-| newResourceId | string | Destination resource ID. Omit to generate a new ID, or pass the archived resource ID to overwrite it. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can't start with a special char. Max length is 36 chars. |  |
+| newResourceId | string | Destination resource ID. Omit to restore the archived resource in place, or pass a different ID to restore alongside it as a new resource. Valid chars are a-z, A-Z, 0-9, period, hyphen, and underscore. Can't start with a special char. Max length is 36 chars. |  |
 | newResourceName | string | Database name. Max length: 128 chars. |  |
 
 

diff --git a/docs/databases.md b/docs/databases.md
@@ -186,7 +186,7 @@ POST https://cloud.appwrite.io/v1/databases/{databaseId}/collections
 | permissions | array | An array of permissions strings. By default, no user is granted with any permissions. [Learn more about permissions](https://appwrite.io/docs/permissions). |  |
 | documentSecurity | boolean | Enables configuring permissions for individual documents. A user needs one of document or collection level permissions to access a document. [Learn more about permissions](https://appwrite.io/docs/permissions). |  |
 | enabled | boolean | Is collection enabled? When set to 'disabled', users cannot access the collection but Server SDKs with and API key can still read and write to the collection. No data is lost when this is toggled. | 1 |
-| attributes | array | Array of attribute definitions to create. Each attribute should contain: key (string), type (string: string, integer, float, boolean, datetime), size (integer, required for string type), required (boolean, optional), default (mixed, optional), array (boolean, optional), and type-specific options. | [] |
+| attributes | array | Array of attribute definitions to create. Each attribute should contain: key (string), type (string: string, varchar, text, mediumtext, longtext, integer, bigint, double, boolean, datetime, point, linestring, polygon, email, url, ip, enum), size (integer, required for string and varchar types), required (boolean, optional), default (mixed, optional), array (boolean, optional), and type-specific options. | [] |
 | indexes | array | Array of index definitions to create. Each index should contain: key (string), type (string: key, fulltext, unique, spatial), attributes (array of attribute keys), orders (array of ASC/DESC, optional), and lengths (array of integers, optional). | [] |
 
 
@@ -765,11 +765,11 @@ POST https://cloud.appwrite.io/v1/databases/{databaseId}/collections/{collection
 | databaseId | string | **Required** Database ID. |  |
 | collectionId | string | **Required** Collection ID. |  |
 | relatedCollectionId | string | Related Collection ID. |  |
-| type | string | Relation type |  |
+| type | string | Relationship type. Possible values are: oneToOne, oneToMany, manyToOne, manyToMany. |  |
 | twoWay | boolean | Is Two Way? |  |
 | key | string | Attribute Key. |  |
 | twoWayKey | string | Two Way Attribute Key. |  |
-| onDelete | string | Constraints option | restrict |
+| onDelete | string | Delete constraint. Possible values are: cascade, restrict, setNull. | restrict |
 
 
 ```http request
@@ -786,7 +786,7 @@ PATCH https://cloud.appwrite.io/v1/databases/{databaseId}/collections/{collectio
 | databaseId | string | **Required** Database ID. |  |
 | collectionId | string | **Required** Collection ID. |  |
 | key | string | **Required** Attribute Key. |  |
-| onDelete | string | Constraints option |  |
+| onDelete | string | Delete constraint. Possible values are: cascade, restrict, setNull. |  |
 | newKey | string | New Attribute Key. |  |
 
 

diff --git a/docs/embeddings.md b/docs/embeddings.md
@@ -0,0 +1,17 @@
+# Embeddings Service
+
+
+```http request
+POST https://cloud.appwrite.io/v1/embeddings/text
+```
+
+** Generate vector embeddings for an array of text using the selected embedding model. Use the returned vectors to power semantic search and similarity queries against your vector collections.
+ **
+
+### Parameters
+
+| Field Name | Type | Description | Default |
+| --- | --- | --- | --- |
+| texts | array | Array of text to generate embeddings. |  |
+| model | string | The embedding model to use for generating vector embeddings. | nomic-embed-text |
+
diff --git a/docs/examples/activities/list-events.md b/docs/examples/activities/list-events.md
@@ -12,5 +12,5 @@ $client = (new Client())
 $activities = new Activities($client);
 
 $result = $activities->listEvents(
-    queries: '' // optional
+    queries: [] // optional
 );```
diff --git a/docs/examples/apps/create-installation-token.md b/docs/examples/apps/create-installation-token.md
@@ -7,7 +7,7 @@ use Appwrite\Services\Apps;
 $client = (new Client())
     ->setEndpoint('https://<REGION>.cloud.appwrite.io/v1') // Your API Endpoint
     ->setProject('<YOUR_PROJECT_ID>') // Your project ID
-    ->setKey('<YOUR_API_KEY>'); // Your secret API key
+    ->setSession(''); // The user session to authenticate with
 
 $apps = new Apps($client);
 

diff --git a/docs/examples/account/create-jwt.md → docs/examples/apps/delete-installation.md b/docs/examples/account/create-jwt.md → docs/examples/apps/delete-installation.md
@@ -2,15 +2,16 @@
 <?php
 
 use Appwrite\Client;
-use Appwrite\Services\Account;
+use Appwrite\Services\Apps;
 
 $client = (new Client())
     ->setEndpoint('https://<REGION>.cloud.appwrite.io/v1') // Your API Endpoint
     ->setProject('<YOUR_PROJECT_ID>') // Your project ID
     ->setSession(''); // The user session to authenticate with
 
-$account = new Account($client);
+$apps = new Apps($client);
 
-$result = $account->createJWT(
-    duration: 0 // optional
+$result = $apps->deleteInstallation(
+    appId: '<APP_ID>',
+    installationId: '<INSTALLATION_ID>'
 );```
diff --git a/docs/examples/apps/get-installation.md b/docs/examples/apps/get-installation.md
@@ -7,7 +7,7 @@ use Appwrite\Services\Apps;
 $client = (new Client())
     ->setEndpoint('https://<REGION>.cloud.appwrite.io/v1') // Your API Endpoint
     ->setProject('<YOUR_PROJECT_ID>') // Your project ID
-    ->setKey('<YOUR_API_KEY>'); // Your secret API key
+    ->setSession(''); // The user session to authenticate with
 
 $apps = new Apps($client);
 

diff --git a/docs/examples/apps/list-installations.md b/docs/examples/apps/list-installations.md
@@ -7,7 +7,7 @@ use Appwrite\Services\Apps;
 $client = (new Client())
     ->setEndpoint('https://<REGION>.cloud.appwrite.io/v1') // Your API Endpoint
     ->setProject('<YOUR_PROJECT_ID>') // Your project ID
-    ->setKey('<YOUR_API_KEY>'); // Your secret API key
+    ->setSession(''); // The user session to authenticate with
 
 $apps = new Apps($client);
 

diff --git a/docs/examples/embeddings/create-text-embeddings.md b/docs/examples/embeddings/create-text-embeddings.md
@@ -0,0 +1,18 @@
+```php
+<?php
+
+use Appwrite\Client;
+use Appwrite\Services\Embeddings;
+use Appwrite\Enums\EmbeddingModel;
+
+$client = (new Client())
+    ->setEndpoint('https://<REGION>.cloud.appwrite.io/v1') // Your API Endpoint
+    ->setProject('<YOUR_PROJECT_ID>') // Your project ID
+    ->setKey('<YOUR_API_KEY>'); // Your secret API key
+
+$embeddings = new Embeddings($client);
+
+$result = $embeddings->createTextEmbeddings(
+    texts: [],
+    model: EmbeddingModel::NOMICEMBEDTEXT() // optional
+);```