Changelog

Every change to the v1 API that your code can notice, newest first, dated by the day it shipped.

Each entry is dated in UTC and lists what changed for your integration. Versioning says which changes can come to v1 and which only to a new version.

2026-10-07: logins for your clients' directory accounts

Logins. GET /projects/{project_id}/logins lists the accounts created for your client on directories that need one: where each signs in, its email and username, whether it is ready, and the one password they all use. GET /listings/{listing_id}/emails returns up to 25 emails the directory sent to a login, for a confirmation code or a password reset link. See Logins.
Reports with logins. POST /projects/{project_id}/reports takes include_logins: true to add the logins and their password: a Directory logins page in the PDF, a Logins sheet in the XLSX. A report's include_logins says which kind it is, and a share link's page never offers one with logins. See Reports for clients.
Read-only keys read everything but logins. Both operations, and the file of a report with logins, answer a read-only key with 403 permission_denied.
Test mode returns placeholder logins with a password made from the project's id, and sample emails whose links point to login.test; nothing signs up anywhere. A report with logins is the sample report with sample logins on .test addresses.

The beta is over. v1 now follows the versioning policy: a change that can break working code only ships in a new version, such as /v2, with 6 months of overlap.
GET /openapi.json reports info.version 1.0.0, where it said 1.0.0-beta. Operations, fields and error codes stay as they were.

Share links. POST /projects/{project_id}/share_link returns a read-only progress page you can send to your client: your agency's name and colors, the live listings with their links, what is still in progress, and the latest PDF and XLSX. A project has 1 active link; creating a new one turns the previous URL off, and DELETE turns it off. See Share links.
A new error code: invalid_query, 400, when a query string cannot be read because a % is not followed by two hex digits.

Test mode. A sbm_test_ key is free from the day you create your agency and runs every call on test data, where listings move on their own and nothing is spent. Two test helpers move a listing and set your test launches. See Test mode.
Webhooks. POST /webhook_endpoints registers an HTTPS URL that receives events as they happen, signed as Standard Webhooks describes. A delivery is tried up to 7 times over about 33 hours. See Signatures, Event types and Retries and failures.
Idempotency-Key. Creating a project, launching, adding directories, building a report and adding a webhook endpoint accept the header. A retry with the same key and body within 24 hours returns the first response and changes nothing twice.
Read-only keys. key.permissions can be read_only. Such a key reads everything and gets 403 permission_denied on any write.
New error codes: permission_denied, test_mode_only, idempotency_key_in_use, endpoint_url_invalid, idempotency_key_reused and quota_exceeded.
A new event type: ping, sent only when you test an endpoint.
New id prefixes: we_ for webhook endpoints and wd_ for deliveries.

v1 opens in beta at https://api.submitator.com/v1, for agencies: projects, images, the readiness preview, launches, listings, the badge, reports, events and the directory catalog.
Keys start with sbm_live_ and come with your first purchase. Create them in the console under Developers.
The docs are public at submitator.com/docs. The reference is built from the same contract the API serves at GET /openapi.json.
The partner API at /api/partner/v1 is retired and answers 410 gone.