Changelog
Every change to the API, webhooks, and SDKs — newest first.
Changelog
Every change to the API, webhooks, and SDKs — newest first. /v1 changes are additive; anything
breaking ships as /v2.
How entries work
Each entry is a dated heading with one or more tagged changes — Added · Changed · Deprecated · Sunset · Fixed — always a text label, never colour alone. A deprecation reads:
Deprecated {date} · sunset {date} — see the migration guide.
See Conventions for the full versioning and
deprecation policy — what's additive vs. breaking, and the Deprecation/Sunset response headers.
/v1 only ever grows additively (a new endpoint, a new optional field, a new enum value, a new
event type); a change that would break an existing integration ships as /v2 instead, announced
here with its own migration guide, per StoreBay's versioning and deprecation policy.
6 Jul 2026
Added
- The complete
/v1public REST API — catalogue, commerce, billing, CRM, compliance, access, integrations, comms, and platform resources — with a generated, interactive API reference and a try-it panel on every endpoint. - Signed, versioned webhooks with the full v1 event catalogue (including
deal.*,task.*,note.*,import.*, andwebhook_endpoint.disabled), ~8-attempt exponential-backoff retries, manual redelivery, and auto-disable on sustained failure. OAuth2client-credentials and authorization-code + PKCE (for marketplace apps), plus therefresh_tokengrant.- A free sandbox — Stripe test mode and GoCardless sandbox, on by default, with identical isolation to a live operator.
- The booking-flow guide — the full availability → contact → reservation → order → agreement → payment → subscription chain, worked end to end.
Note
Subscribing to this changelog (RSS/Atom) is planned but not built yet — check back here for now.
Readiness probe GET
Unauthenticated **readiness** check (`GET /v1/ready`) — the deep sibling of `/health`, not a replacement for it. Where `/health` reports only that the process is serving, this one verifies the dependency every other endpoint needs. It pings the database inside a short timeout, then answers `503` (`status: degraded`) when it is unreachable and `200` (`status: ok`) otherwise. Use `/health` to ask "is the process alive?" (liveness — e.g. a restart decision) and `/ready` to ask "can it actually serve?" (readiness — e.g. load-balancer rotation or an uptime monitor). It requires no credential and returns no tenant data, but it is rate-limited per source IP, so poll it on the order of once a minute rather than continuously.
SDKs & client libraries
Thin, typed wrappers over the same /v1 API — same keys, scopes, and idempotency.