API changelog · current version 2026-08-22
What changed, when, and how much warning you get.
Additive changes ship without a version bump. A breaking change is announced here, marked deprecated in the specification with a Sunset date at least 180 days out, and only then removed. Nothing is removed without appearing on this page first.
2026-08-22version 2026-08-22- Added — POST /pharmacy/callbacks/{partnerId} — a partner-only status endpoint with raw-body HMAC, five-minute replay protection, stable event identity, strict chronology, and immutable receipts. It returns 202 only after the event is durably accepted for application or identified as a replay.
- Changed — The authentication description now distinguishes scoped developer keys, first-party console sessions, and versioned pharmacy partner signatures.
2026-08-12version 2026-08-12- Added — GET /formulary and GET /formulary/{slug} — the platform's published position on every substance, with the provision that governs it and, for a refusal, the reason in plain language. Public and unauthenticated; alias lookup resolves brand names to their substance.
- Added — GET /rulebook — every marketing-claim rule the platform enforces, with its citation and reasoning. Published so the gate can be audited rather than discovered at publish time. Rule patterns are deliberately omitted.
- Added — POST /claims/scan — evaluates copy against the same engine and the same rulebook version that gates publication, so a result here is the result you get at launch. Requires the claims.scan scope.
- Added — Self-serve API keys. Sandbox keys are created in the console with no sales contact; only a SHA-256 digest is stored, and the secret is shown once. Production keys still require a platform administrator.
- Changed — The OpenAPI document at /api/v1/openapi is now rendered from the same Zod schemas the handlers validate with, rather than maintained by hand. It can no longer describe a shape the API does not enforce.
2026-08-09version 2026-08-09- Added — POST /sandbox/orders — deterministic synthetic order previews with Idempotency-Key replay. Nothing is prescribed, transmitted, or charged.
What counts as breaking
Removing an endpoint or a response field; narrowing an accepted input; adding a required request field; changing an error code; or changing the meaning of an existing field. Adding an endpoint, an optional input, a response field, or a new enum member in a response is not breaking — clients must ignore fields they do not recognise.