Blueticked
Start free

API changelog

/api/v1 is additive: new endpoints, fields, and headers ship without a version bump, and we do not remove or rename existing ones. Parse responses leniently — ignore fields you do not recognise — so new additions never break your integration. On the rare occasion a change could fail an existing integration, it lands here marked Breaking in the same deploy, with migration guidance.

2026-08-31

  • FixedSDK 0.7.0 — security release, please upgrade.In SDK versions up to 0.6.1 the client object's configuration was enumerable, so passing the client through JSON.stringify, a logger, or any generic serializer could expose your live API key. 0.7.0 makes the credential non-enumerable; every earlier version is deprecated on npm. Upgrade with npm install @blueticked/sdk@latest— no code changes needed — and if a client object may have reached your logs, rotate the key in Developers → API keys.

2026-08-10

  • BreakingPOST /v1/events/send: channelno longer silently defaults to email. Omit it and your workspace's own live automations decide — the one channel whose automation matches the event and can reach the contact fires, and the response says which. When more than one channel qualifies the request fails with validation_failed asking for an explicit channel. If you relied on the old email default, pass channel: "email". (We briefly shipped channel as required on 2026-08-09 without an entry here — breaking changes now always land in this changelog, marked, in the same deploy.)
  • AddedSandbox (blu_test_) keys can now create WhatsApp templates with no channel connected. They are born approved — the simulator stands in for Meta — and are immediately usable in test sends, so the whole template lifecycle rehearses without touching a live Meta asset. Live sends refuse a sandbox-born template with the actual reason instead of a Meta template-not-found.
  • Addedmessage.received webhooks now carry a media field — {type, filename} or null — so an inbound photo or voice note no longer looks like an empty message. Fetch content via the conversations API; the webhook carries no URLs.
  • ChangedThe OpenAPI spec for POST /v1/events/sendnow encodes "exactly one of contact_id, email or phone" as a oneOf, so generated clients enforce it, not just the docs.

2026-08-09

  • AddedPlatforms can onboard their own customers over the API: POST /v1/businesses creates a customer and can mint a credential scoped to it in the same call; POST /v1/businesses/{id}/keyshandles rotation. Minted keys are always pinned to one business, can never create more, and inherit the minter's test/live environment. SDK 0.6.0 ships bt.businesses.
  • AddedPOST /v1/channels/connect-sessions mints a single-use link your customer opens to connect their own WhatsApp — no Blueticked login. A channel.connected webhook fires on completion, echoing your reference.
  • AddedEvery error now carries error.next_steps — the remedy as data, each step marked caller, human or waiting. Sandbox keys can rehearse any of fourteen failures with the X-Simulate-Error header, so error handling is testable before production.
  • ChangedGET /v1/readiness answers per business: pass ?business_id=, and the response's scope says what the answer covers. message.* webhooks now carry business_id so a platform can route receipts without calling back.

2026-08-03

  • AddedRemote MCP server at app.blueticked.com/api/mcp — browser-approved OAuth, nothing to install. Agent-readable docs at llms.txt and llms-full.txt, public and generated from the same source as the OpenAPI document.

2026-07-13

  • AddedEvery authenticated response now returns x-ratelimit-limit, x-ratelimit-remaining, and x-ratelimit-reset headers, so you can pace before a 429 — see Rate limits and retries.
  • ChangedRotating an API key now keeps the previous secret valid for a 24-hour grace window. The rotation response includes previous_key_expires_at so you can finish rolling the new key out with no downtime.
  • AddedNew endpoints: GET /v1/wallet/ledger, DELETE /v1/contacts/{id}, POST /v1/contacts/{id}/erase, GET/PATCH/DELETE /v1/groups/{id}, and PUT/DELETE /v1/groups/{id}/members.
  • ChangedSandbox (blu_test_) keys no longer submit templates or publish Flows to Meta — those calls are simulated so test integrations never touch your live Meta assets.
  • FixedList endpoints now return an error on a database failure instead of silently returning an empty page, so a transient outage can no longer look like "no results".

2026-07-12

  • AddedThe OpenAPI spec now documents real 201/202 statuses, the full error-code set, query parameters, and per-event webhook payload schemas.
  • FixedThe marketing-email docs example is now a valid request.