Skip to content
Blueticked
Start free

API changelog

/api/v1 is additive: new endpoints, fields, and headers ship without a version bump, and we do not remove or rename existing ones. Parse responses leniently — ignore fields you do not recognise — so new additions never break your integration. On the rare occasion a change could fail an existing integration, it lands here marked Breaking in the same deploy, with migration guidance.

2026-10-18

  • AddedSDK 0.8.0. The client now reaches all 126 documented API operations (0.7.0 reached 104). New: tables and their rows, tickets, wallet invoices, business API keys, commerce product history (product sales and stock movements), documents (a PDF for one contact, sent with messages.send), message media, template submission, and webhook replay of every failed delivery since a time. messages.send also takes to.createto create a new number's contact in the same call. Upgrade with npm install @blueticked/sdk@latest.
  • FixedSDK 0.8.0 keeps the API key in the client. A transport or proxy message the SDK passes into its own error has the key redacted, and util.inspect(client, { showHidden: true }) no longer prints it.

2026-08-31

  • FixedSDK 0.7.0 — security release, please upgrade.In SDK versions up to 0.6.1 the client object's configuration was enumerable, so passing the client through JSON.stringify, a logger, or any generic serializer could expose your live API key. 0.7.0 makes the credential non-enumerable; every earlier version is deprecated on npm. Upgrade with npm install @blueticked/sdk@latest— no code changes needed — and if a client object may have reached your logs, rotate the key in Developers → API keys.

2026-08-10

  • BreakingPOST /v1/events/send: channelno longer silently defaults to email. Omit it and your workspace's own live automations decide — the one channel whose automation matches the event and can reach the contact fires, and the response says which. When more than one channel qualifies the request fails with validation_failed asking for an explicit channel. If you relied on the old email default, pass channel: "email". (We briefly shipped channel as required on 2026-08-09 without an entry here — breaking changes now always land in this changelog, marked, in the same deploy.)
  • AddedSandbox (blu_test_) keys can now create WhatsApp templates with no channel connected. They are born approved — the simulator stands in for Meta — and are immediately usable in test sends, so the whole template lifecycle rehearses without touching a live Meta asset. Live sends refuse a sandbox-born template with the actual reason instead of a Meta template-not-found.
  • Addedmessage.received webhooks now carry a media field — {type, filename} or null — so an inbound photo or voice note no longer looks like an empty message. Fetch content via the conversations API; the webhook carries no URLs.
  • ChangedThe OpenAPI spec for POST /v1/events/sendnow encodes "exactly one of contact_id, email or phone" as a oneOf, so generated clients enforce it, not just the docs.

2026-08-09

  • AddedPlatforms can onboard their own customers over the API: POST /v1/businesses creates a customer and can mint a credential scoped to it in the same call; POST /v1/businesses/{id}/keyshandles rotation. Minted keys are always pinned to one business, can never create more, and inherit the minter's test/live environment. SDK 0.6.0 ships bt.businesses.
  • AddedPOST /v1/channels/connect-sessions mints a single-use link your customer opens to connect their own WhatsApp — no Blueticked login. A channel.connected webhook fires on completion, echoing your reference.
  • AddedEvery error now carries error.next_steps — the remedy as data, each step marked caller, human or waiting. Sandbox keys can rehearse any of fourteen failures with the X-Simulate-Error header, so error handling is testable before production.
  • ChangedGET /v1/readiness answers per business: pass ?business_id=, and the response's scope says what the answer covers. message.* webhooks now carry business_id so a platform can route receipts without calling back.

2026-08-03

  • AddedRemote MCP server at app.blueticked.com/api/mcp — browser-approved OAuth, nothing to install. Agent-readable docs at llms.txt and llms-full.txt, public and generated from the same source as the OpenAPI document.

2026-07-13

  • AddedEvery authenticated response now returns x-ratelimit-limit, x-ratelimit-remaining, and x-ratelimit-reset headers, so you can pace before a 429 — see Rate limits and retries.
  • ChangedRotating an API key now keeps the previous secret valid for a 24-hour grace window. The rotation response includes previous_key_expires_at so you can finish rolling the new key out with no downtime.
  • AddedNew endpoints: GET /v1/wallet/ledger, DELETE /v1/contacts/{id}, POST /v1/contacts/{id}/erase, GET/PATCH/DELETE /v1/groups/{id}, and PUT/DELETE /v1/groups/{id}/members.
  • ChangedSandbox (blu_test_) keys no longer submit templates or publish Flows to Meta — those calls are simulated so test integrations never touch your live Meta assets.
  • FixedList endpoints now return an error on a database failure instead of silently returning an empty page, so a transient outage can no longer look like "no results".

2026-07-12

  • AddedThe OpenAPI spec now documents real 201/202 statuses, the full error-code set, query parameters, and per-event webhook payload schemas.
  • FixedThe marketing-email docs example is now a valid request.