Changelog & versioning

Versioning policy

The API version is a date, currently 2026-06-23. It appears as api_version on every webhook event.

Additive changes are not breaking. New endpoints, new optional request fields, and new response fields ship without a version bump. Write clients that ignore unknown fields — the SDKs already do.
Breaking changes get a new major path (/v2). /v1 keeps working; we announce a deprecation window here and via Deprecation / Sunset response headers before anything is removed.
Deprecation contract. A deprecated surface keeps working for at least the window stated in its Sunset header, and its removal is logged below.

/v1 REST API. Read + write for operators, devices, locations, and sessions; keyset pagination; a standard error envelope; per-key rate limits; and idempotent writes. Live and test namespaces, isolated by the bqr_live_ / bqr_test_ key prefix.
API keys. Self-service mint / list / revoke (/v1/api-keys), scoped read_only or full. Secrets are shown once.
Self-service webhooks. Register endpoints (/v1/webhook-endpoints), subscribe to events, verify signed deliveries (X-BriefQR-Signature), rotate secrets with an overlap window, and inspect + resend deliveries (/v1/events, /v1/webhook-deliveries/{id}/resend).
Official SDKs. @briefqr/sdk (TypeScript) and briefqr (Python) — typed resources, auto-pagination, typed errors, and a webhook verification helper.
Developer dashboard. Mint keys, manage webhook endpoints, watch the delivery log, and reset test data from the manager app.

sessions-export (pull JSON/CSV export). Superseded by GET /v1/sessions and session.completed webhooks. It now returns Deprecation and Sunset headers and remains available through the announced window. See the export-hours recipe.