[ketanyekale]

Why

ENG-41037, ticket #45862: a customer asked for WhatsApp-style "hide group history from new members". The support AI said the feature doesn't exist and proposed a client-side workaround. It exists: the SBAC permission listMessages.historyBeforeJoin. Its only mention was one row in the SBAC table, with none of the words customers use, so search never found it.

What changed

• rest-api/rbac-overview.mdx: new section Hide Group Messages Sent Before a Member Joined (#hide-group-messages-sent-before-a-member-joined), placed after the SBAC example configuration. It names the permission, shows the Set Scope Permissions curl with the body {"permissions": {"listMessages.historyBeforeJoin": "deny"}} (shape taken from the OpenAPI spec), explains deny / allow (default allow), says it applies per scope only, and links List and Unset Scope Permissions. The SBAC Messages table links to the section.
• One-line cross-link <Note> in the Message History section of the current SDK pages: sdk/javascript/receive-message.mdx, sdk/react-native/receive-messages.mdx, sdk/ios/receive-message.mdx, sdk/android/v5/receive-messages.mdx, sdk/flutter/receive-messages.mdx. All point at the section anchor.
• No new page and no docs.json change (an earlier commit added a standalone page; it was folded into the overview on request).

Confirmed (Ketan, 2026-11-03)

• With deny, pre-join messages are silently left out of the list; the request succeeds.
• Leaving and rejoining resets the join time: the member sees history from the rejoin onward.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
cometchat	🟢 Ready	View Preview	Nov 10, 2026, 12:04 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[jitvarpatil]

The request itself is right: path, method, apikey header and {"permissions": {...}} body match chat-apis.json, and the key, values and default match the SBAC table. The SDK pages are the right ones too. Requesting changes because the page's main behaviour is unconfirmed and one step may not work. I didn't run any of this against the API, so items 1, 2 and 4 need one test call.

Resolve before merge

1. What deny does on a fetch. You flagged this already. The overview says deny returns ERR_PERMISSION_DENIED, so readers will assume that here too.

   • If the whole list request fails, turning this on could break group message history for those members, and the page needs to warn about it.
   • If pre-join messages are just filtered out, the page should say so, since that is what the customer asked for.
   • ENG-41037 says Hritika confirmed deny hides pre-join history, but not how.

2. Step 2 may not be able to confirm the setting. It tells readers to use List Scope Permissions to confirm the key is deny. The example response in chat-apis.json only shows permission definitions (id, availableValues, defaultValue), with no current value. That example is shortened (3 of 11 items), so it isn't conclusive, but a reader may only see defaultValue: allow and think the change failed. The Set Scope Permissions response does echo a permissions object, so that may be the better check.

Please also address

3. Say that the setting is per group. I found no app-wide version in the docs: the key appears only in the group-scope table. A customer who wants this everywhere has to call it for every group, including each new one. The page says "on a group", but the closing line only covers scope, member and date. One more sentence would fix it.

4. Rejoining. You flagged this too: does a member who leaves and rejoins lose access to messages from their first membership? The test call for item 1 can answer it. Please document the result.

5. The description reads awkwardly. "Restrict history for new members with WhatsApp-style group history" sounds like the reverse of what it means, and it names a competitor. Suggestion: "Hide messages sent before a member joined a group using the SBAC permission listMessages.historyBeforeJoin."

The preview was still deploying when I checked, so I haven't seen how the page renders.

[ketanyekale]

Per Ketan: folded the standalone page into rest-api/rbac-overview.mdx as the section Hide Group Messages Sent Before a Member Joined (#hide-group-messages-sent-before-a-member-joined). The SDK cross-links and the SBAC table now point at that anchor; docs.json is unchanged from main.

[ketanyekale]

@jitvarpatil thanks for the review. Where each point stands, as of 7b551fdc:

1. What deny does: confirmed. Pre-join messages are silently left out of the list and the request succeeds. The section now says so.
2. Checking the setting: the step now uses the Set Scope Permissions response, which returns the scope's current values in data.permissions, instead of List Scope Permissions, which only returns definitions.
3. Per group: the section now says the permission is set per group and per scope, that there is no app-wide setting, and that you call Set Scope Permissions for every group, including each new one, and for each scope in it.
4. Rejoining: confirmed. Rejoining resets the join time, so the member sees history only from the rejoin onward. Documented.
5. description: no longer applies. The standalone page was folded into rest-api/rbac-overview as the section Hide Group Messages Sent Before a Member Joined, so it has no description of its own.

[jitvarpatil]

All five are addressed in 7b551fd:

1. deny: the section now says pre-join messages are left out and the request succeeds.
2. The check uses data.permissions from the Set response, which matches the example in chat-apis.json.
3. Per group and per scope, no app-wide setting, new groups need their own call: stated.
4. Rejoining resets the join time: stated.
5. Moot now that it's a section.
   Checked the preview: the section link works and the five SDK notes sit in their Message History sections. Approving.

Optional: the SBAC value-behaviour list still says deny returns ERR_PERMISSION_DENIED. Naming the exception in the new section would stop readers carrying that over.

[raj-dubey1]

Approving. I checked the section against chat-api (MessageCore::getSentAtClosureForConvo and the permissions seed data):

• listMessages.historyBeforeJoin is a scope-level Messages permission with allow/deny values and a default of allow.
• On deny, the list is cut off at the later of the member's joinedAt and the conversation reset time. The request still succeeds, so "silently filters" is accurate.
• Joining sets joinedAt to the current time, so "most recent join" holds.
• The Set and Unset Scope Permissions links, the new anchor, and the SDK Message History notes all resolve. There are no nav or redirect changes.

Two notes, neither blocking:

1. chat-api also has an internal server setting, RESTRICT_MESSAGES_HISTORY_BEFORE_JOINED, that applies this app-wide. It isn't exposed through any public API, so "no app-wide setting" is right for customers. Support may still be able to turn it on for the customer on #45862; worth confirming with the backend team.
2. I didn't check whether the conversation list's last-message preview or unread counts honour this permission. The filter is in the message-list query.

The branch is 154 commits behind main but merges cleanly.