Changelog

Every change to the REST API and its webhooks is listed here, newest first: what was added, what changed and what was taken away. A change that could break code you already wrote follows the deprecation policy, which says how much notice it gets.

The SDKs and the command line tool list their own releases. Changes up to 11 October 2026 are listed release by release in the TypeScript SDK changelog.

**Added**

• —Booking pages. /booking-pages makes, reads, changes and deletes the public pages where somebody books a meeting, GET /booking-pages/{id}/times lists their open times, and PUT /booking-pages/{id}/background puts a photo behind the card. /bookings reads what was booked and approves, declines or cancels a booking or sends its email again, and GET /bookings/analytics reports how the pages did.
• —Tasks. /tasks, /task-runs and /task-approvals give the assistant work it does by itself, on a schedule, when mail arrives or when asked, and let you approve or deny what a run asks to do.
• —Connectors. /connectors, /connector-apps, /connector-categories and /connector-calls connect outside apps, run their actions and list what was done through them.
• —Team inbox. GET /threads/{id}/team, /threads/{id}/assignee, /threads/{id}/done, /threads/{id}/reopen and /threads/{id}/comments give a thread to one person, mark it done for everyone and keep comments the sender never sees.
• —Messages in a fixed shape. GET /threads/{id}/messages and GET /threads/{id}/messages/{messageId} return each message with from, to, cc, bcc, replyTo, date, messageId, text, html, attachments and headers. These fields are added to and never renamed or taken away.
• —Signatures. /signatures keeps several named signatures for each address, and POST /emails takes signatureId to pick one.
• —Segments. /segments saves conditions on contacts under a name, and POST /segments/preview counts the contacts a set of conditions matches.
• —Contacts. GET /contacts/cards/duplicates and POST /contacts/cards/{id}/merge find and merge the cards of one person, GET /contacts/birthdays lists the birthdays between two dates, a card can be a group, and every contact carries its custom fields in attributes.
• —Broadcasts. POST /broadcasts/drafts, PATCH /broadcasts/{id} and POST /broadcasts/{id}/send save, change and send a draft, POST /broadcasts/test sends a test, POST /broadcasts/{id}/duplicate copies a broadcast, and POST /broadcasts/{id}/resend sends it again to the people who did not open it.
• —Marketing. POST /broadcasts takes excludeAudienceIds, segmentId, utm and abTest, a broadcast fills {{attributes.<key>}} from each contact, GET /broadcasts/{id}/stats adds links, clients, countries and abTest, POST /audiences/{id}/import takes attributes on each row, a form field with saveAs saves its answer to a custom field, and an audience with showOnPreferences is listed on the email preferences page the unsubscribe link opens.
• —Unsubscribes. /suppressions/unsubscribes lists, records and takes back unsubscribes, which now hold for the whole workspace and outlast deleting a contact.
• —Automations. GET /automations/analytics and GET /automations/{id}/runs report how automations did and what each one did, and an automation can start when an email arrives and answer it.
• —Calendar. GET /calendar/free-busy reads when people are busy, POST /calendar/events/{id}/hide and /unhide take an event off your calendar and put it back, GET /calendar/events takes q, and scope changes one date of a repeating event or the dates after it.
• —Your account. /account/sessions, /account/passkeys and /account/security-events list the devices a person is signed in on and sign them out, manage their passkeys and read their security log, and GET /account/connected-apps/{clientId}/requests reads the calls a connected app made. GET /security/events reads the security log of the workspace.
• —Sent mail. GET /emails takes since, until, recipient and tag, and GET /analytics/sending takes the same four.
• —Attachments by address. POST /emails and POST /emails/batch take a file at an https address as { url }, fetched once when the message is accepted. Inline files may come to 10 MB together and a message to 25 MB, and attachmentDelivery: auto sends anything larger as links.
• —SMTP. A message handed over with an API key takes X-OpenEmail-Tags, X-OpenEmail-Scheduled-At, X-OpenEmail-Track-Opens and X-OpenEmail-Track-Clicks, which set the tags, scheduledAt and tracking of the send.
• —API keys. ipAllowlist on POST /keys and PATCH /keys/{id} holds a key to some IP addresses and ranges, and a call or an SMTP sign-in from anywhere else is refused with 403 ip_not_allowed.
• —Webhook events. The OpenAPI document has a webhooks section with the data of every event. New events: booking.*, broadcast.*, task.run.*, approval.requested, connector.*, contact.*, sending.paused, sending.resumed and automation.resumed.
• —Webhook data. Every email.* event carries the tags of its send, and email.received and email.replied carry messageId, from, fromName and date, with the attachments of a received message listed without their bytes.
• —Webhook secrets. After POST /webhooks/{id}/rotate-secret the old secret keeps signing beside the new one for 24 hours, and previousSecretExpiresAt on the endpoint says until when.
• —Forms. allowedSites lists the sites that may use a form.
• —Mailbox. A rule condition can ask whether a message bounced, and GET /threads/counts returns unlabelled, the inbox without labelled mail.
• —Upload storage. GET /files/stats returns uploadStorage, the space the uploads of the whole workspace take beside what its plan allows, and each plan from GET /billing/plans carries uploadStorageBytes.

**Changed**

• —A broadcast cannot go to the built-in audience of everyone the workspace has written to: POST /broadcasts and POST /broadcasts/preview answer 422 audience_is_everyone.
• —Every broadcast and automation email that does not place {{unsubscribeUrl}} itself ends with an unsubscribe footer.
• —POST /forms turns settings.doubleOptIn on unless it is sent as false.
• —The export operations need the read scope of everything an export holds, not threads:read alone.
• —POST /domains/{id}/addresses/{addressId}/app-passwords and /mail-app-setup are refused with 403 insufficient_authority unless the caller holds every scope the password would carry.
• —GET /calendar/events lists your own events. includeTeam=true adds the rest of the workspace, apart from events marked private.
• —Chats belong to the person who holds them, so an access token reaches the chats of the person who connected it, where it was refused with 403 owner_only.
• —automation.webhook goes only to the endpoint its step names, and GET /webhooks/events no longer lists it.
• —A 422 invalid_parameter message names the field and what it takes. Codes and param are unchanged.
• —Uploads are held to the storage of the plan instead of 10 GB on every plan: 10 GB on Free, 50 GB on Starter, 250 GB on Business and 1 TB on Enterprise. Past it an upload is a 507 upload_storage_full.

**Removed**

• —The developerMode setting. GET /settings no longer returns it, and PATCH /settings ignores it, or answers 422 not_per_address when it comes with address.