Changelog & versioning

What we promise about change: you can build on /v1 and it won't move under you.

The versioning policy

Major versions live in the URL (/v1/, /v2/). A breaking change means a new major version, run in parallel with the old one — never a silent change to the one you're on.
Change within a major version is additive only. New optional fields and new resources can appear; nothing that already exists changes shape. A new accepted file type or a new purpose value is additive — it can't break you.
Deprecations come with a window. Before any version is retired, we publish a sunset period (at least 12 months), send Deprecation and Sunset response headers, and post a changelog entry here.
Each supported version is pinned by contract tests. An internal change that would alter a public response fails our tests, not your integration.

Releases

v1.0.0 — initial release

The first public contract. Ring 1 — a partner writes files to a consented elder and reads back the coarse status of its own submissions.

POST /oauth/token — OAuth2 client-credentials, scopes connections:write and files:write.
POST /v1/connections, GET /v1/connections/{id}, DELETE /v1/connections/{id} — request, poll, and sever a connection.
POST /v1/files, GET /v1/files/{id} — send a file and poll its status.
Signed connection.approved and connection.revoked webhooks, with polling as the fallback of record.
Sandbox / test mode: a test credential and a sandbox elder that auto-approves, isolated from all real data.

The always-current machine-readable contract is the API reference, generated from our OpenAPI spec. When something changes, it changes there first, and lands here as a release note.