VSign in

Changelog

What changed

Everything that changes the API surface is recorded here and emailed to partner admins. Read the policy below once, and you can tell from any entry whether it needs work from you.

Deprecation policy

The contract behind every entry on this page.

  • Additive changes land in /v1 without notice. New fields, new optional parameters, new enum values, new endpoints, new webhook events, new response headers. Your integration must ignore unknown fields and tolerate unknown enum values.
  • Breaking changes only ever appear as a new major version at a new path — /v2. Nothing is removed, renamed, narrowed or given a new meaning inside /v1.
  • A retired version runs in parallel for at least six months. That is a floor, not a plan; in practice we expect to leave considerably longer.
  • The superseded version says so in its responses. A Deprecation header and a Sunset header with the date it stops answering. Alert on them — that is the earliest automatic warning you get.
  • Every deprecation is announced here and by email to your partner admins, with a migration guide, on the day the parallel period starts.
  • Security is the one exception. A change required to close a vulnerability is made as narrowly as possible and communicated directly, without waiting out a notice period.

The full detail, including what counts as additive, is on errors and versioning.

Entries

v1

Developer portal and v1 conventions

The portal goes live with the documentation and the cross-cutting rules of the API. The endpoints themselves are still in development — nothing is callable yet, and no key issued today can book anything.

  • addedPublic documentation covering authentication, idempotency, search quota, settlement modes, webhooks, the sandbox and the error envelope.
  • addedThe v1 conventions are now fixed: an Idempotency-Key on every POST, the { error: { type, message, requestId, docUrl } } envelope, X-Request-Id on every response, the X-Search-Quota-* headers, integer minor units with an ISO 4217 currency, and cursor pagination.
  • addedWebhook signatures are defined: X-Vacabee-Signature with t and v1, HMAC-SHA256 over `${t}.${rawBody}`, a five-minute timestamp tolerance and a rotatable secret per endpoint.
  • addedThe sandbox contract is defined, including the six forced failures sbx_offer_expired, sbx_payment_failed, sbx_supplier_error, sbx_price_changed, sbx_insufficient_funds and sbx_slow.
  • addedThe deprecation policy below now applies to everything published on this site.