Guide

Versioning & changelog

The API version is in the path: /v0/…. Within v0 we only make changes that keep working clients working.

What we promise within v0

We do not remove or rename an operation, a field, a query parameter or an error code that is in this documentation.
We do not change the type or meaning of a documented field, and we do not make an optional request field required.
We do not tighten what a token can do without notice, except to fix a security problem (see below).

Write your client so that these never break it:

New operations, new optional request fields and new query parameters.
New fields in answers — ignore fields you do not know.
New values in enums that are marked as open (for example alert action, event categories, device platforms) — handle unknown values gracefully.
New error codes for new situations, and wording changes in title and detail.
The order of keys in JSON objects and of items in unsorted lists.
Lists that are not paged today becoming paged (follow next_cursor when it is not null).

A deprecated operation or field is marked deprecated in the reference and in openapi.yaml, with what to use instead.
It keeps working for at least 6 months after the deprecation notice in the changelog below.
Security fixes are the one exception: if a call turns out to be unsafe, we may restrict it right away and say so here.
A future /v1 will run beside /v0 for at least 12 months.

Date	Change
2026-10-13	Fixes: audit entries written with an API token now say `via: "api"` (SCIM: `"scim"`) instead of `"panel"`; webhook categories `audit` and `billing` are refused (`400 category-not-available-yet`) because nothing was ever sent to them; `POST /enrollments` checks `delivery` (`400 invalid-delivery`) and answers with `Cache-Control: no-store`; `GET /customer-report` refuses an invalid `month` (`400 invalid-month`); `PATCH /connections/{id}` is all-or-nothing.
2026-10-13	Public API documentation published (document version 0.1.0): 123 operations across workspace, people and groups, devices and enrollments, connectors and updates, apps and private networks, access rules, device trust, just-in-time access, sessions, audit log, alerts, webhooks, log streaming, support cases and reports. Downloadable OpenAPI 3.1 description.
2026-10-12	API tokens act with the role of the admin who created them as a ceiling; tokens of unknown roles are refused. Connector remove / disable / enable / restore are console-only (second-factor check).
2026-10-08	API tokens expire (default 90 days, at most 365). Only an owner can create a full-access token. Answers that carry a secret are never replayed for an `Idempotency-Key` (`409 already-issued`).