Changelog
Dated, human-readable entries for every change to the public API surface.
Every change to the published surface is recorded here, newest first. Additive changes ship without notice; anything else is announced with the deprecation window described in Versioning and deprecation.
If you integrate against this API, this page is the cheapest place to learn about a change before your logs do.
2026-09-06 — The public API becomes an opt-in contract
Added. This documentation site, and a generated
endpoint reference rendered from the published OpenAPI
document. The document itself is served at
/openapi/public-openapi.yaml if you would
rather generate a client than read a page.
Changed — the boundary is now declared, not subtracted. An endpoint is part
of the public API only if it declares itself so. Previously the surface reachable
by an fgd_live_ token was defined by a hand-maintained list of prefixes to
exclude, which answered “what did someone remember to forbid” rather than “what
should be reachable” — and the two lists that tried to answer it disagreed with
each other and with the documentation.
For you as an integrator this means: the reference is now the surface. What is documented is exactly what a token can reach, because both are generated from one declaration rather than derived separately. A route that is not in the reference answers 403 rather than working undocumented.
Added. Deprecation (RFC 9745) and Sunset (RFC 8594) response headers on
deprecated operations, and a published deprecation window of six months. See
Versioning and deprecation — the two
headers use different value syntaxes, which is worth reading before you parse
them.
Changed. API token management moved services internally. The public path
/v1/api-tokens is unchanged, as is the fgd_live_ token format and every
existing token — this entry is here because the move is visible in our
documentation and logs, not because anything you integrated against changed.
Retired. X-Foxguide-Signature, a body-only webhook signature variant with
no timestamp. The canonical scheme is X-Webhook-Signature over
${timestamp}.${raw-body}, documented in Webhooks. Nothing
emitted or accepted the retired header in production.