# Changelog

URL: https://submitator.com/docs/changelog

> Every change to the v1 API that your code can notice, newest first, dated by the day it shipped.

Each entry is dated in UTC and lists what changed for your integration. [Versioning](https://submitator.com/docs/versioning) says which changes can come to v1 and which only to a new version.

## 2026-10-07: logins for your clients' directory accounts

- **Logins.** `GET /projects/{project_id}/logins` lists the accounts created for your client on directories that need one: where each signs in, its email and username, whether it is ready, and the one password they all use. `GET /listings/{listing_id}/emails` returns up to 25 emails the directory sent to a login, for a confirmation code or a password reset link. See [Logins](https://submitator.com/docs/api/logins).
- **Reports with logins.** `POST /projects/{project_id}/reports` takes `include_logins: true` to add the logins and their password: a Directory logins page in the PDF, a Logins sheet in the XLSX. A report's `include_logins` says which kind it is, and a share link's page never offers one with logins. See [Reports for clients](https://submitator.com/docs/guides/reports-for-clients#5-include-the-logins).
- **Read-only keys read everything but logins.** Both operations, and the file of a report with logins, answer a read-only key with 403 `permission_denied`.
- **Test mode** returns placeholder logins with a password made from the project's id, and sample emails whose links point to `login.test`; nothing signs up anywhere. A report with logins is the sample report with sample logins on `.test` addresses.

## 2026-10-07: v1 is generally available

- **The beta is over.** v1 now follows the [versioning policy](https://submitator.com/docs/versioning): a change that can break working code only ships in a new version, such as `/v2`, with 6 months of overlap.
- **`GET /openapi.json` reports `info.version` `1.0.0`**, where it said `1.0.0-beta`. Operations, fields and error codes stay as they were.

## 2026-10-07: share links for your clients

- **Share links.** `POST /projects/{project_id}/share_link` returns a read-only progress page you can send to your client: your agency's name and colors, the live listings with their links, what is still in progress, and the latest PDF and XLSX. A project has 1 active link; creating a new one turns the previous URL off, and `DELETE` turns it off. See [Share links](https://submitator.com/docs/api/share-links).
- **A new error code:** `invalid_query`, 400, when a query string cannot be read because a `%` is not followed by two hex digits.

## 2026-10-07: test mode, webhooks and idempotency keys

- **Test mode.** A `sbm_test_` key is free from the day you create your agency and runs every call on test data, where listings move on their own and nothing is spent. Two test helpers move a listing and set your test launches. See [Test mode](https://submitator.com/docs/test-mode).
- **Webhooks.** `POST /webhook_endpoints` registers an HTTPS URL that receives events as they happen, signed as Standard Webhooks describes. A delivery is tried up to 7 times over about 33 hours. See [Signatures](https://submitator.com/docs/webhooks/signatures), [Event types](https://submitator.com/docs/webhooks/event-types) and [Retries and failures](https://submitator.com/docs/webhooks/retries-and-failures).
- **Idempotency-Key.** Creating a project, launching, adding directories, building a report and adding a webhook endpoint accept the header. A retry with the same key and body within 24 hours returns the first response and changes nothing twice.
- **Read-only keys.** `key.permissions` can be `read_only`. Such a key reads everything and gets 403 `permission_denied` on any write.
- **New error codes:** `permission_denied`, `test_mode_only`, `idempotency_key_in_use`, `endpoint_url_invalid`, `idempotency_key_reused` and `quota_exceeded`.
- **A new event type:** `ping`, sent only when you test an endpoint.
- **New id prefixes:** `we_` for webhook endpoints and `wd_` for deliveries.

## 2026-10-06: v1 beta

- **v1 opens in beta** at `https://api.submitator.com/v1`, for agencies: projects, images, the readiness preview, launches, listings, the badge, reports, events and the directory catalog.
- **Keys start with `sbm_live_`** and come with your first purchase. Create them in the console under Developers.
- **The docs are public** at submitator.com/docs. The reference is built from the same contract the API serves at `GET /openapi.json`.
- **The partner API at `/api/partner/v1` is retired** and answers 410 `gone`.