Changelog

This page lists every meaningful change to the Public API surface. Additive changes (new fields, new endpoints, new optional parameters) ship without a version bump; breaking changes ship as a new major version (/v2/) and are announced here well in advance.

Each entry tags whether it is:

• Added — new endpoint, field, scope, or event
• Changed — behaviour modified in a backwards-compatible way
• Deprecated — still works, but slated for removal in a future major
• Removed — endpoint or field gone (only in a major bump)
• Fixed — bug fix that changes observable behaviour
• Security — hardening worth flagging to integrators

2026-08-16

Added — GET /{tenant}/api/v1/settings/api-keys/scopes returns the scope vocabulary and the named presets the backend honours (scopes, wildcard, presets). The dashboard's key-creation form now renders from it instead of keeping its own copy.

Fixed — POST /contacts/search now applies the tag filter. The field has always been part of the request schema, but the handler was not forwarding it, so a tagged search returned an unfiltered result set with no error. If you were compensating by filtering client-side, you can stop.

Fixed (dashboard) — the API-key Read Only preset now includes campaigns:read, and the Campaigns preset is selectable. Keys previously minted from the dashboard as "read only" lacked campaigns:read and returned 403 on GET /campaigns, disagreeing with the preset table in Authentication. Rotate any affected key to pick up the corrected scopes.

Fixed (docs) — a content audit against the deployed code corrected:

• The webhook event catalogue is 24 events, not 22 as the developer-hub landing card said. The Webhooks page itself was already correct.
• The endpoint-reachability probe is POST /api/v1/integrations/webhooks/endpoints/verify (dashboard-only, JWT). It was previously documented as POST /webhooks/verify, which does not exist on the Public API.
• Custom daily quotas are offered on the Business plan; the rate-limit page referred to an "enterprise" plan that has never existed.
• The hub landing no longer claims every dashboard action is exposed over REST. Six resources are; the shared inbox is receive-only, via webhooks.

2026-07-27

Fixed — POST /webhooks/{id}/test now sends the test event synchronously and returns what your endpoint actually answered.

Previously it queued the event and returned {"message": "Test webhook queued", "delivery_id": …} — a 200 that told you nothing about the outcome. Worse, if the endpoint had been auto-disabled after 20 consecutive failures, the queued delivery was dropped immediately with "Endpoint not found or disabled" while the API still reported success.

Changed (response shape) — the endpoint now returns delivered, status_code, response_time_ms, response_body, error and endpoint_disabled alongside delivery_id. The old message field is still present, now describing the outcome. Branch on delivered, not on the HTTP status of the call itself. Test sends also run against disabled endpoints (so a fix can be confirmed before re-enabling) and never count toward auto-disable. See Webhooks API.

2026-06-28

Fixed — A parity audit against the deployed API corrected several docs and fixed bugs:

• Docs — Errors now documents the real envelope ({ "success": false, "error": { "code", "message" }, "meta": … }), not {"detail": …}; validation failures return 400 (VALIDATION_ERROR), not 422. Rate Limits corrected to the real model — a flat 120 req/min burst plus a plan-based daily quota (the per-plan minute tiers and the "default 60/1000" note were never accurate). Authentication: IP allowlist & expiry are enforced but not yet settable via the create API. Pagination only applies to Contacts & Templates lists.
• Fixed (API) — POST /messages/template, POST /templates, POST /templates/{id}/submit, POST /contacts, POST /webhooks, POST /campaigns/{id}/{send,schedule,resume}, and GET /campaigns/{id}/audience/preview returned 401/500 due to internal wiring bugs; all now function. Error messages no longer leak stringified internal dicts. Duplicate contact phone/email now returns 409 (was 500). The contact.deleted webhook now fires reliably.
• Changed (docs) — Base URL is https://lynkist.io/api/v1/public (the api.lynkist.io host was never live). Removed references to a "sandbox" environment — there is none; live/test keys hit the same API. Documented the campaign variable_mapping shape in full. Added an importable Postman collection.

2026-06-01

Security — openapi.json, /docs (Swagger UI), and /redoc are now disabled in production. The Lynkist backend hosts internal, dashboard and Public API routers in a single FastAPI process, so a public OpenAPI document would enumerate every internal route, request schema, and field name. A filtered, public-API-only OpenAPI explorer is on the roadmap. In dev/staging the explorers continue to work.

Added — First comprehensive Developer Hub release, covering the existing API surface:

• Per-resource API reference pages: Contacts, Templates, Messages, Media, Campaigns, Webhook management.
• Rate Limits page documenting per-plan quotas and the five X-RateLimit-* headers emitted on every response.
• Authentication rewritten with the real key format (lk_sk_{env}_{40-hex}), the 12-scope catalogue, the 4 preset bundles, and IP-allowlist behaviour.
• Webhooks rewritten with the real 22-event catalog (contacts, follow-ups, messages, campaigns, lifecycle), the actual signature recipe (sha256(secret, "{ts}.{body}") → sha256=<hex>), the five X-Lynkist-* headers, and the real retry curve (1m / 5m / 30m / 2h / 6h, then abandon).
• Errors page added (later corrected on 2026-06-28 to the real success/error/meta envelope).

Earlier

Prior to this release, the Public API surface evolved in lockstep with the dashboard and was documented only in code. The endpoint catalogue documented today reflects the deployed surface as of 2026-06-01.

Anything older than the dates above is not separately enumerated — open a GitHub issue if you need a specific historical confirmation.

Roadmap (not yet shipped)

These are tracked elsewhere; this list is included to set expectations and reduce duplicate support questions. Dates are not committed — they shift.

• Template approval webhooks (template.approved, template.rejected, template.disabled). The events exist in the catalogue plan but the domain code does not emit them yet.
• Per-resource OpenAPI explorer. A FastAPI sub-app containing only public_api_router, mounted at a public URL with Swagger UI.
• Live plan-tier resolution. Today every tenant gets the default (60/min, 1000/day) budget; the wiring from billing to get_rate_limits_for_tenant is queued.
• Cursor-based pagination for list endpoints. Offset pagination works fine at current scales but will start to bite once tenants cross seven-figure object counts.
• OAuth-style delegated access for third-party integrations operating across multiple tenants.
• Conversations API — read inbound messages and reply within the 24-hour session window from the API.

If something here is blocking your integration, mention it in a support ticket — concrete demand moves dates.