Changelog · Planlined for Developers

Partner API v1 collection contracts Announced 2026-08-10

Added Three additive cursor-paginated operations in the stable /api/v1 namespace: listPartnerCasesV1, listPartnerCasePlansV1, and listPartnerPlanLibraryV1. These aliases have no Sunset date.
Changed Opaque cursor pagination is the preferred integration path. Offset pagination remains supported on the historical collection routes during the compatibility window.
Deprecated getPlans at GET /api/plans is deprecated in favor of case-scoped GET /api/v1/cases/{caseId}/plans. No Sunset date is currently scheduled; migrate by listing plans within each authorized case and following pageInfo.nextCursor until it is null.

This entry records the contract addition and deprecation announcement only; it does not indicate deployment or general availability.

addedPer-event payload reference under /developers#webhooks: 8 real data shapes grepped from actual dispatchEvent call sites (case.created, case.bulk_imported, plan.linked, report.generated, report.viewed, export.completed, parse.completed, parse.failed).
addedOAuth app inline edit form on /developers/apps: per-row Edit button expands a form with name, description, homepage URL, redirect URIs, rate limits, and an Active toggle. PUTs /api/external-apps/oauth/apps/:appId.
addedWebhook subscription inline edit form on /developers/webhooks: per-row Edit button with name, URL, event-types checklist, timeout, and active/paused status. PUTs /api/webhooks/subscriptions/:id.
changedEvent-type table now marks 5 declared-but-not-emitted events (case.updated, case.deleted, plan.created, plan.updated, plan.deleted) with an explicit "Declared, not yet emitted" status — these are valid subscription targets but no call sites currently dispatch them.

addedAPI key expiration field (1-365 days, blank = never) on /developers — applies to both sandbox and service-account generators. Existing keys show their expiry date in the Used column.
addedAPI key per-scope picker on /developers under "Advanced — choose scopes". Defaults to cases:read/write + webhooks:write; partners can narrow or broaden the scope set per key.
fixedWebhook docs audited against WebhookService.js — corrected header names from X-Signature-256/X-Timestamp to the actual X-Webhook-Signature/X-Webhook-Timestamp/X-Webhook-Event/X-Webhook-Delivery-Id sent by the server. Updated full payload envelope (id/type/created_at/data/context).
fixedRetry policy now correctly documents both axes: 6 attempts per delivery (initial + 5 retries) AND 10 consecutive failures auto-pauses the subscription. Added Success Codes section.
changedQuickstart Step 4 references corrected to use actual header names. Webhook subscription creation success-block updated.

addedPer-key usage drilldown on /developers: click "Usage" on any key to see the last 7 days of daily request volume (bar chart), error counts, average response time, and top 10 called endpoints.
added/developers/status placeholder page documenting current health-check options and the path to a public status page.
added/developers/terms placeholder page with interim operating norms (authorized use, quotas, idempotency, signature verification, credential confidentiality, reporting).
changedDeveloper portal footer now links to Status, Terms of Service, and Changelog.

addedWebhook delivery log on /developers/webhooks: last 50 attempts with status, HTTP code, round-trip time, retry count, and per-row Retry button for failed/cancelled deliveries.
addedQuickstart now ends with a "verify the signature" step + summary callout — completes the end-to-end "your first integration" walkthrough.
addedPlans & quotas section: surfaces what is free today, what to ask about for production, and honestly marks pricing as not-yet-finalized.
fixedOAuth flow walkthrough audited against external-apps.js: corrected to include PKCE, the consent-screen placeholder caveat, and the actual token-endpoint response shape.
fixedError reference replaced fabricated slugs (forbidden_scope, admin_required) with real ones from the codebase (insufficient_scope, admin_only).
fixedWebhook test handler now sends only {subscriptionId} and renders the real {httpStatus, responseTimeMs} fields from the response.
fixedQuickstart curl examples now send the correct webhook subscription payload: {name, url, eventTypes} instead of {url, events}.

addedPer-row operational actions on /developers: Revoke API key, Delete OAuth app, Rotate OAuth app client secret, Rotate webhook signing secret, Test webhook delivery.
addedAPI key usage column on /developers: last-used date + total call count for each key.
addedErrors documentation section: response shape and HTTP status code reference.
addedPagination documentation: limit/offset convention with default 50 and max 100.
addedOAuth 2.0 partner-app flow walkthrough: authorize URL, code exchange, refresh, revoke.
addedVersioning policy: 60-day deprecation window for breaking changes; webhook event type v2 naming convention.

added/developers/webhooks page: list, create, and delete webhook subscriptions with the event-type checklist from /api/webhooks/event-types.
addedService-account API key type (org-scoped, not tied to a person) — issue via "Generate service-account key" on /developers.
changedIntegrationsModal API Keys / External Apps / Webhooks tabs now redirect to the developer portal. The portal is the canonical surface for API platform management.
fixedJWT auth middleware now passes through `Authorization: Bearer bart_sk_*` cleanly so both auth header forms work as documented.

addedDeveloper portal at /developers with Quickstart, Authentication, Idempotency, Webhooks, Scopes, Sandbox sections.
addedSigned-in API key management panel: list keys and generate sandbox keys without leaving /developers.
addedLive "Try it" sandbox: send real requests to /api/cases/bulk against your sandbox org from the browser.
addedOAuth app registration UX at /developers/apps and /developers/apps/new.
addedMulti-language webhook signature verification examples: Node.js, Python, Ruby, PHP, Go.
fixedPOST /api/cases/bulk now correctly persists cases to S3 + Postgres. Previously crashed with "S3CaseStorage is not a constructor" on every call.
fixedAuthorization: Bearer bart_sk_* now correctly authenticates. Previously collided with the JWT verifier middleware and returned 401.