API changelog

v1 update - July 2026

Additive error-code and response-field additions to the existing v1 contract.

• New 422 withdrawal_consent_required error on the order download-urls endpoint: returned when the shop has EU withdrawal-right consent enabled and the order has no consent record yet; download URLs are issued once the customer consents.
• New 422 key_limit_reached error when creating API keys: a shop can hold at most 25 active API keys; revoke one first.
• New 409 delivery_not_yet_released error on the order download-urls and resend endpoints: returned when the product has a download delivery delay configured and the buyer's files have not unlocked yet. No download URLs are minted and no email is sent until the delay elapses.
• New error.details object on the error envelope: present only on codes that carry caller-safe context. Today delivery_not_yet_released is the only producer, and it carries release_at, the ISO 8601 instant the downloads unlock. Treat the object as open - new keys may appear without a major version.
• New delivery_pending and release_at fields on the order-status purchase object: delivery_pending is true while a purchase is still held by a download delivery delay, and release_at is the ISO 8601 unlock instant, or null when nothing is pending.
• The grant-downloads endpoint now releases held purchases on the order immediately, so a merchant can override a download delivery delay through the API.

v1.0.0 - June 2026

Initial pilot API surface behind approval-only access.

• API keys for approved shops.
• Required idempotency keys on write requests.
• Remote URL asset import, direct uploads, asset listing, asset updates, and asset deletion.
• Flat categories, product mappings, packs, and license-key tags.
• Order assignments that make mapped downloads visible in Shopify customer accounts.
• Order access controls: revoke, restore, grant downloads, and resend email.
• Job and order status endpoints.
• OpenAPI spec and Postman collection downloads.

Versioning policy

The v1 contract is additive-only: new endpoints, optional fields, and new error codes may be added. Breaking changes will use a future /api/v2 path.