Changelog
What changed in the API and webhooks, newest first. Within v1 we only add things, so nothing here will break an integration that ignores fields it does not know.
Security hardening
v1.0.1- An API key now stops working when the person who created it is deactivated or removed, and its scopes shrink if that person's role loses the matching permission. Create keys under a person who will stay, or rotate them when staff change.
- An Idempotency-Key is now private to the API key that used it, so another key can never be given a stored response. A request that died part-way no longer locks its Idempotency-Key for 24 hours: after 2 minutes it can be retried.
- Request bodies over 1 MB are now refused even when sent in chunks.
- Webhooks: setting up or re-pointing an endpoint now needs read access to the data the chosen events carry. A suspended workspace, or one whose plan no longer includes webhooks, receives nothing.
- Webhooks: an endpoint with more than 2,000 undelivered events stops queuing new ones until it catches up, and each endpoint gets a fair share of every retry run.
- Webhooks: new End old secret now action to stop honouring a rotated secret immediately, instead of waiting 24 hours.
First release
v1.0.0- Public REST API under /api/public/v1, authenticated with API keys that carry scopes.
- Read endpoints for customers, policies, renewals, claims, agencies and insurers, with filters and an updatedSince parameter for incremental sync.
- Write endpoints to create and update customers, policies and claims, and to add notes to a claim's timeline.
- Idempotency-Key support on every POST, stored for 24 hours.
- Per-key rate limit of 60 requests a minute, with X-RateLimit headers and Retry-After.
- Signed webhooks for 13 events across customers, policies, renewals and claims, with retries, secret rotation and a delivery log.
- OpenAPI 3.1 description at /developers/openapi.json.