Changelog

Dated, human-readable entries for every change to the public API surface.

Every change to the published surface is recorded here, newest first. Additive changes ship without notice; anything else is announced with the deprecation window described in Versioning and deprecation.

If you integrate against this API, this page is the cheapest place to learn about a change before your logs do.


2026-09-06 — The public API becomes an opt-in contract

Added. This documentation site, and a generated endpoint reference rendered from the published OpenAPI document. The document itself is served at /openapi/public-openapi.yaml if you would rather generate a client than read a page.

Changed — the boundary is now declared, not subtracted. An endpoint is part of the public API only if it declares itself so. Previously the surface reachable by an fgd_live_ token was defined by a hand-maintained list of prefixes to exclude, which answered “what did someone remember to forbid” rather than “what should be reachable” — and the two lists that tried to answer it disagreed with each other and with the documentation.

For you as an integrator this means: the reference is now the surface. What is documented is exactly what a token can reach, because both are generated from one declaration rather than derived separately. A route that is not in the reference answers 403 rather than working undocumented.

Added. Deprecation (RFC 9745) and Sunset (RFC 8594) response headers on deprecated operations, and a published deprecation window of six months. See Versioning and deprecation — the two headers use different value syntaxes, which is worth reading before you parse them.

Changed. API token management moved services internally. The public path /v1/api-tokens is unchanged, as is the fgd_live_ token format and every existing token — this entry is here because the move is visible in our documentation and logs, not because anything you integrated against changed.

Retired. X-Foxguide-Signature, a body-only webhook signature variant with no timestamp. The canonical scheme is X-Webhook-Signature over ${timestamp}.${raw-body}, documented in Webhooks. Nothing emitted or accepted the retired header in production.

← All documentation