Skip to main content
Every change to the public API — new endpoints, new fields, corrected documentation, and any deprecation — is recorded here, newest first. See Versioning for what counts as a breaking change and how deprecations work.
This changelog starts on 2026-08-28. Changes made before that date are not listed individually; the OpenAPI specs are the authoritative record of the current surface.
​
Reseller webhooks
Added — reseller webhooksResellers can now register webhook endpoints and receive order events for the orders their team placed, at POST /reseller/webhooks and the usual list/get/update/delete/deliveries operations alongside it.The contract is identical to the provider side — same four subscribable event types (order.created, order.item.created, order.item.status_changed, order.cancelled), same X-Offergrid-Signature scheme, same { id, type, version, data } envelope, same at-least-once delivery and delivery log. What differs is scoping: a provider receives events for items built on its own offers, a reseller for orders its own team placed.A hybrid team’s single webhook now covers both roles and receives each event exactly once, rather than twice.
This is additive. Existing provider webhooks are unaffected: no provider endpoint, payload, or subscription changes, and no provider begins receiving an event type it did not subscribe to.
See Reseller webhooks for the full guide.
​
Documentation and specification accuracy
Fixed — webhook signature verification docs were wrongThe provider webhooks guide described an x-offergrid-timestamp request header that the API has never sent. The timestamp is carried in the t= component of X-Offergrid-Signature. Any verifier written against the old documentation would have rejected every delivery. The verification examples are now tested against the signing implementation.The same page also corrected the webhook envelope (the event type field is type, not event; there is a version field and no top-level timestamp), the subscribable event list, and the delivery timeout (10 seconds, not 5).Fixed — reseller webhooks were documented but did not existThe reseller webhooks page described a registration flow and four event types that had no implementation at the time. The page was corrected to describe polling instead — and reseller webhooks then shipped the same day (see the entry above), so the page now documents the real endpoints.Fixed — rate limits were documented but not enforcedThe authentication guide published a burst limit, a sustained limit, and X-RateLimit-* response headers, none of which the API implements. See Rate limits for what is genuinely enforced: the two public /shop write endpoints, per IP.Changed — OpenAPI specs now document error responsesEvery operation in the published specs now declares 401, 403, and 500 alongside its documented error cases, and every 4xx/5xx response carries a schema rather than a bare description. Two new component schemas, ErrorResponse and ValidationErrorResponse, model the shapes described on the Errors page. Five operations that documented only a 404 now declare their success response as well.Removed — http://localhost:3000 from the published specsThe specs listed a local development server that a generated client or agent could select. Production is now the only server entry; local development is described in prose on the Introduction page.Added — new documentation pagesErrors, Rate limits, API conventions, Versioning, this changelog, and per-role reference indexes for the Provider, Reseller, and Public APIs.