diff --git a/CHANGELOG.md b/CHANGELOG.md
index f1a2351..cda80e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,12 @@
-<!-- file generated with AI assistance: Claude Code - 2026-10-05 10:25:39 UTC -->
+<!-- file generated with AI assistance: Claude Code - 2026-10-08 13:38:06 UTC -->
 
 # Changelog
 
-## Unreleased
+All notable changes to this bundle. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow [SemVer](https://semver.org/) and come from the Git tags.
 
-Secure storage and transport of the credentials in `configJson` ([Issue #8](https://github.com/dmstr/api-configuration-bundle/issues/8)) and a slimmer client contract ([Issue #9](https://github.com/dmstr/api-configuration-bundle/issues/9)). Release as a new minor version: the changes below break consumers in the ways listed under "Breaking changes".
+## [0.5.0] - 2026-10-10
+
+Secure storage and transport of the credentials in `configJson` ([Issue #8](https://github.com/dmstr/api-configuration-bundle/issues/8)) and a slimmer client contract ([Issue #9](https://github.com/dmstr/api-configuration-bundle/issues/9)). The changes break consumers in the ways listed under "Breaking changes". 0.5.0-beta1 contained everything below except the removal of `order[id]` ("Changed").
 
 ### Breaking changes
 
@@ -27,6 +29,10 @@ Secure storage and transport of the credentials in `configJson` ([Issue #8](http
 - `HealthProbeInterface` (Issue #9): a health check per type without the project-management client methods, autoconfigured. Schema-only types (no `ApiExtensionInterface`) answer the health route and command instead of "Unsupported API name"; a probe takes precedence over the client-based check.
 - `ApiConfigurationHealthChecker`: the health check shared by the health route, the health command and application dashboards.
 
+### Changed
+
+- `GET /api/admin/api_configurations` no longer offers `order[id]`. The identifier is a random UUID v4, so sorting by it has no meaning; admin UIs that derive sortable columns from the offered `order[...]` parameters no longer show a sort control for it. Requests that still send `order[id]` are not sorted by it.
+
 ### Fixed
 
 - `GET /api/admin/api_configurations/{id}/health` in JSON-LD returned `metadata` and `error` as `hydra:Collection` without their keys (Issue #9); the operation now normalizes nested arrays raw (`api_sub_level`).
@@ -37,4 +43,6 @@ Secure storage and transport of the credentials in `configJson` ([Issue #8](http
 
 ## 0.4.0 and earlier
 
-See git history.
+See the git history.
+
+[0.5.0]: https://github.com/dmstr/api-configuration-bundle/compare/0.4.0...0.5.0
diff --git a/README.md b/README.md
index 0a3140c..3634456 100644
--- a/README.md
+++ b/README.md
@@ -4,15 +4,15 @@
 
 Manage external API connections as Doctrine entities.
 
-## Features (planned)
-
-- `ApiConfiguration` entity — type, credentials (encrypted at rest, masked on read), endpoint config
-- Custom operations: `health`, `authorize`, `test-connection`
-- `ApiExtensionRegistry` — discoverable adapter pattern via tag
-- `ApiExtensionInterface` / `AuthorizableExtensionInterface` — adapters
-  implement these to plug in
-- OAuth callback controller for `authorize` flow
-- CLI mirrors: `api-configuration:create`, `:health`, `:test-connection`
+## Features
+
+- `ApiConfiguration` entity (`name`, `type`, `endpointType`, `configJson`, `active`) under `/api/admin/api_configurations`, `configJson` validated against the JSON schema of its type
+- Secrets in `configJson` encrypted at rest and masked on read, see [Security](#security)
+- Sub-resources `GET /api/admin/api_configurations/{id}/health` and `GET /api/admin/api_configurations/{id}/authorize`, OAuth callback at `/api/oauth/callback`
+- `ApiExtensionRegistry`: extensions implement `ApiExtensionInterface` (and `AuthorizableExtensionInterface` for OAuth) and are registered by tag
+- Console commands `app:api:create`, `app:api:test-connection`, `app:api:validate-file`, `app:api-configuration:health` and `app:api-configuration:encrypt-secrets`
+
+Changes per version are listed in [CHANGELOG.md](CHANGELOG.md).
 
 ## API clients
 
diff --git a/src/Entity/ApiConfiguration.php b/src/Entity/ApiConfiguration.php
index e27a6a5..29ff28e 100644
--- a/src/Entity/ApiConfiguration.php
+++ b/src/Entity/ApiConfiguration.php
@@ -1,5 +1,5 @@
 <?php
-// file generated with AI assistance: Claude Code - 2026-10-05 10:25:39 UTC
+// file generated with AI assistance: Claude Code - 2026-10-08 13:38:06 UTC
 
 declare(strict_types=1);
 
@@ -72,7 +72,7 @@
 ])]
 #[ApiFilter(BooleanFilter::class, properties: ['active'])]
 #[ApiFilter(DateFilter::class, properties: ['createdAt', 'updatedAt'])]
-#[ApiFilter(OrderFilter::class, properties: ['id', 'name', 'type', 'endpointType', 'active', 'createdAt', 'updatedAt'])]
+#[ApiFilter(OrderFilter::class, properties: ['name', 'type', 'endpointType', 'active', 'createdAt', 'updatedAt'])]
 class ApiConfiguration implements JsonSchemaProviderInterface
 {
     #[ORM\Id]