API changelog and versioning

Versioning

The version is in the path: /api/v1/ext.

Inside /v1 we only add:

• new fields in responses and webhook payloads,
• new optional request fields and query parameters,
• new endpoints,
• new values in status, and new error codes.

We don't remove or rename a field, change its type or meaning, or make an optional field required. Write your client so it ignores fields it doesn't know and treats an unknown status as "still in progress".

A change that would break an existing client goes into a new version, /v2. We announce it ahead of time by email to the owners of every organization with an active API key, and /v1 keeps working alongside it for a period stated in that notice.

Changelog

October 2026 — Key restrictions

• Each key can have an IP allowlist (addresses or CIDR ranges, up to 20). Requests from other addresses get 403 ip_not_allowed.
• Each key has scopes: cases:read and cases:write. A request outside them gets 403 insufficient_scope. Existing keys have both.
• The console shows the IP address a key was last used from, and owners and admins can edit a key's name, allowlist and scopes.

v1 — October 2026

First release.

• POST /cases opens a takedown case for a URL, with Idempotency-Key support.
• GET /cases/{id} and GET /cases (cursor pagination, status filter).
• API keys in Settings > API keys: create, expire after 30, 90 or 365 days or never, revoke.
• Webhook URLs must use https://.
• Enterprise plan only. 60 requests per minute per key; 16 KB request bodies.