--- title: "Changelog" description: "What changed in the API, newest first." url: "https://openemail.uk/docs/api/changelog" area: "API" category: "Getting started" --- # Changelog What changed in the API, newest first. ## About this page Every change to the REST API and its webhooks is listed here, newest first: what was added, what changed and what was taken away. A change that could break code you already wrote follows the deprecation policy, which says how much notice it gets. The SDKs and the command line tool list their own releases. Changes up to 11 October 2026 are listed release by release in the TypeScript SDK changelog. - [Deprecation policy](https://openemail.uk/docs/api/deprecations.md): What can change, and how much notice you get. - [TypeScript SDK changelog](https://openemail.uk/docs/sdk/changelog.md): Every release of the package, newest first. ## October 2026 **Added** - Booking pages. `/booking-pages` makes, reads, changes and deletes the public pages where somebody books a meeting, `GET /booking-pages/{id}/times` lists their open times, and `PUT /booking-pages/{id}/background` puts a photo behind the card. `/bookings` reads what was booked and approves, declines or cancels a booking or sends its email again, and `GET /bookings/analytics` reports how the pages did. - Tasks. `/tasks`, `/task-runs` and `/task-approvals` give the assistant work it does by itself, on a schedule, when mail arrives or when asked, and let you approve or deny what a run asks to do. - Connectors. `/connectors`, `/connector-apps`, `/connector-categories` and `/connector-calls` connect outside apps, run their actions and list what was done through them. - Team inbox. `GET /threads/{id}/team`, `/threads/{id}/assignee`, `/threads/{id}/done`, `/threads/{id}/reopen` and `/threads/{id}/comments` give a thread to one person, mark it done for everyone and keep comments the sender never sees. - Messages in a fixed shape. `GET /threads/{id}/messages` and `GET /threads/{id}/messages/{messageId}` return each message with `from`, `to`, `cc`, `bcc`, `replyTo`, `date`, `messageId`, `text`, `html`, `attachments` and `headers`. These fields are added to and never renamed or taken away. - Signatures. `/signatures` keeps several named signatures for each address, and `POST /emails` takes `signatureId` to pick one. - Segments. `/segments` saves conditions on contacts under a name, and `POST /segments/preview` counts the contacts a set of conditions matches. - Contacts. `GET /contacts/cards/duplicates` and `POST /contacts/cards/{id}/merge` find and merge the cards of one person, `GET /contacts/birthdays` lists the birthdays between two dates, a card can be a group, and every contact carries its custom fields in `attributes`. - Broadcasts. `POST /broadcasts/drafts`, `PATCH /broadcasts/{id}` and `POST /broadcasts/{id}/send` save, change and send a draft, `POST /broadcasts/test` sends a test, `POST /broadcasts/{id}/duplicate` copies a broadcast, and `POST /broadcasts/{id}/resend` sends it again to the people who did not open it. - Marketing. `POST /broadcasts` takes `excludeAudienceIds`, `segmentId`, `utm` and `abTest`, a broadcast fills `{{attributes.}}` from each contact, `GET /broadcasts/{id}/stats` adds `links`, `clients`, `countries` and `abTest`, `POST /audiences/{id}/import` takes `attributes` on each row, a form field with `saveAs` saves its answer to a custom field, and an audience with `showOnPreferences` is listed on the email preferences page the unsubscribe link opens. - Unsubscribes. `/suppressions/unsubscribes` lists, records and takes back unsubscribes, which now hold for the whole workspace and outlast deleting a contact. - Automations. `GET /automations/analytics` and `GET /automations/{id}/runs` report how automations did and what each one did, and an automation can start when an email arrives and answer it. - Calendar. `GET /calendar/free-busy` reads when people are busy, `POST /calendar/events/{id}/hide` and `/unhide` take an event off your calendar and put it back, `GET /calendar/events` takes `q`, and `scope` changes one date of a repeating event or the dates after it. - Your account. `/account/sessions`, `/account/passkeys` and `/account/security-events` list the devices a person is signed in on and sign them out, manage their passkeys and read their security log, and `GET /account/connected-apps/{clientId}/requests` reads the calls a connected app made. `GET /security/events` reads the security log of the workspace. - Sent mail. `GET /emails` takes `since`, `until`, `recipient` and `tag`, and `GET /analytics/sending` takes the same four. - Attachments by address. `POST /emails` and `POST /emails/batch` take a file at an https address as `{ url }`, fetched once when the message is accepted. Inline files may come to 10 MB together and a message to 25 MB, and `attachmentDelivery: auto` sends anything larger as links. - SMTP. A message handed over with an API key takes `X-OpenEmail-Tags`, `X-OpenEmail-Scheduled-At`, `X-OpenEmail-Track-Opens` and `X-OpenEmail-Track-Clicks`, which set the `tags`, `scheduledAt` and `tracking` of the send. - API keys. `ipAllowlist` on `POST /keys` and `PATCH /keys/{id}` holds a key to some IP addresses and ranges, and a call or an SMTP sign-in from anywhere else is refused with 403 `ip_not_allowed`. - Webhook events. The OpenAPI document has a `webhooks` section with the data of every event. New events: `booking.*`, `broadcast.*`, `task.run.*`, `approval.requested`, `connector.*`, `contact.*`, `sending.paused`, `sending.resumed` and `automation.resumed`. - Webhook data. Every `email.*` event carries the `tags` of its send, and `email.received` and `email.replied` carry `messageId`, `from`, `fromName` and `date`, with the attachments of a received message listed without their bytes. - Webhook secrets. After `POST /webhooks/{id}/rotate-secret` the old secret keeps signing beside the new one for 24 hours, and `previousSecretExpiresAt` on the endpoint says until when. - Forms. `allowedSites` lists the sites that may use a form. - Mailbox. A rule condition can ask whether a message `bounced`, and `GET /threads/counts` returns `unlabelled`, the inbox without labelled mail. - Upload storage. `GET /files/stats` returns `uploadStorage`, the space the uploads of the whole workspace take beside what its plan allows, and each plan from `GET /billing/plans` carries `uploadStorageBytes`. **Changed** - A broadcast cannot go to the built-in audience of everyone the workspace has written to: `POST /broadcasts` and `POST /broadcasts/preview` answer 422 `audience_is_everyone`. - Every broadcast and automation email that does not place `{{unsubscribeUrl}}` itself ends with an unsubscribe footer. - `POST /forms` turns `settings.doubleOptIn` on unless it is sent as `false`. - The export operations need the read scope of everything an export holds, not `threads:read` alone. - `POST /domains/{id}/addresses/{addressId}/app-passwords` and `/mail-app-setup` are refused with 403 `insufficient_authority` unless the caller holds every scope the password would carry. - `GET /calendar/events` lists your own events. `includeTeam=true` adds the rest of the workspace, apart from events marked private. - Chats belong to the person who holds them, so an access token reaches the chats of the person who connected it, where it was refused with 403 `owner_only`. - `automation.webhook` goes only to the endpoint its step names, and `GET /webhooks/events` no longer lists it. - A 422 `invalid_parameter` message names the field and what it takes. Codes and `param` are unchanged. - Uploads are held to the storage of the plan instead of 10 GB on every plan: 10 GB on Free, 50 GB on Starter, 250 GB on Business and 1 TB on Enterprise. Past it an upload is a 507 `upload_storage_full`. **Removed** - The `developerMode` setting. `GET /settings` no longer returns it, and `PATCH /settings` ignores it, or answers 422 `not_per_address` when it comes with `address`.