API Changelog

Portal: Public overview · Authenticated docs · OpenAPI 3.1 (login required)

Entries follow Added / Changed / Fixed / Security / Deprecated / Removed / Migration notes. Breaking changes to stable endpoints are announced at least 30 days in advance.

2026-07-25 v1.1.0-demo — Documentation completeness + GBP tiering

Added

• Public developer overview page (/developers) now documents: current API version, supported integrations, authentication summary, Google user-data policy, account disconnection and deletion, and a login/create-account CTA.
• Authenticated documentation now includes dedicated guides for Scopes & Permissions, Businesses and Locations, Pagination, Idempotency, Signature Verification, Data Retention and Deletion, and Troubleshooting.
• Google Business Profile documentation now distinguishes: Implemented, Feature-flagged, Requires Google approval, Requires owner configuration, and Future / planned.
• Sample code for HMAC-SHA256 signature verification (raw body, timestamp tolerance) plus a fixed test vector for automated verification.

Changed

• Authenticated docs are delivered only to signed-in sessions via /app/developers. Direct requests to /developers/index-full.html, quickstart.html, and openapi.yaml return a 302 to /auth?redirect=%2Fapp%2Fdevelopers.
• API reference is regenerated from the authoritative OpenAPI 3.1 specification; routes and schemas are kept in sync with implemented handlers under src/routes/api/v1/ and src/routes/api/oauth/.
• Google-operation endpoints (/api/gbp/*) are documented separately from the public /api/v1 surface and are not exposed as an unrestricted pass-through API.

Fixed

• Removed imaginary or unverified endpoints from user-visible documentation. Unavailable routes are now explicitly labelled Unavailable or Feature-flagged.

Security

• Documentation clarifies raw-body-only HMAC verification, timestamp tolerance, replay protection, and secret rotation using the previous_secret grace window.
• All examples use fake credentials only. No live secrets appear anywhere in the docs bundle.

Deprecated

• None.

Removed

• None.

Migration notes

• No runtime behaviour changes. Existing brr_test_* keys, OAuth client-credentials clients, Zapier private-app installations, and webhook subscriptions continue to work unchanged.
• If you had bookmarked /developers/index-full.html for detailed reference, update it to /app/developers (login required).

2026-07-23 Docs: OpenAPI consistency + Production vs Demo

Added

• OpenAPI 3.1 now documents GET /api/v1/public-config (unauthenticated feature-flag surface used by the Zapier runtime) and POST /api/oauth/revoke (RFC 7009, gated behind oauth_authcode_enabled).
• Quickstart adds a "Production vs Demo" section and flag-gated cURL examples for authorization-code + PKCE, refresh-token grant, and token revocation. All authorization-code examples are marked as not part of the current demo surface.

Security

• Reaffirmed that brr_live_* keys, authorization-code OAuth, and public Zapier submission remain off by default.

Migration notes

• No backend behaviour changes.

2026-07-23 Docs: OAuth + full cURL coverage

Added

• Documented POST /api/oauth/token (client_credentials) alongside the existing API-key methods.
• cURL examples for every /api/v1/* endpoint, including webhook CRUD, secret rotation, test event, delivery history, resend, and events polling.
• Expanded response examples for 401 unauthorized, 403 api_access_required, 403 insufficient_scope, 429 rate_limited, 500 db_error.
• Documented rate-limit headers (X-RateLimit-Limit, -Remaining, -Reset, Retry-After) and standard request headers.
• Zapier "private demo vs future production" comparison table.

Changed

• Live-key gating clarified: brr_live_* is accepted only when live_keys_enabled is on. Default remains off.

Migration notes

• Docs-only release.

2026-07-19 v1.0.0-demo — Client demo baseline

Added

• Private demo API surface under /api/v1.
• API-key authentication with brr_test_ prefix.
• Scopes: businesses:read, analyses:read, analyses:write, reports:read, recommendations:read, review_replies:write, webhooks:manage.
• Endpoints: integration-test, businesses, analyses (with Idempotency-Key), reports, competitors, recommendations, review-replies.
• Webhook platform: endpoint CRUD, secret rotation, test event, delivery history, manual resend, polling /events. HMAC-SHA256 signing with hash-only secret storage.
• Rate limits: per-IP, per-user, per-key. Rate-limit headers on every response.
• Stable response envelope: { data, meta } with request_id, plan, quota, page.

Security

• Access requires the api_demo entitlement — Free Starter and standard paid plans are not automatically enrolled.
• Live keys not yet issued.