> ## Documentation Index
> Fetch the complete documentation index at: https://offergrid.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Dated record of changes to the Offergrid API

Every change to the public API — new endpoints, new fields, corrected
documentation, and any deprecation — is recorded here, newest first. See
[Versioning](/docs/api-reference/versioning) for what counts as a breaking change
and how deprecations work.

<Note>
  This changelog starts on 2026-08-28. Changes made before that date are not
  listed individually; the [OpenAPI specs](/docs/openapi/openapi-provider.json) are
  the authoritative record of the current surface.
</Note>

<Update label="2026-08-28" description="Reseller webhooks">
  **Added — reseller webhooks**

  Resellers can now register webhook endpoints and receive order events for the
  orders their team placed, at
  [`POST /reseller/webhooks`](/docs/reseller-api-reference/reseller-webhooks/register-a-webhook)
  and the usual list/get/update/delete/deliveries operations alongside it.

  The contract is identical to the provider side — same four subscribable event
  types (`order.created`, `order.item.created`, `order.item.status_changed`,
  `order.cancelled`), same `X-Offergrid-Signature` scheme, same `{ id, type,
    version, data }` envelope, same at-least-once delivery and delivery log. What
  differs is scoping: a provider receives events for items built on its own
  offers, a reseller for orders its own team placed.

  A **hybrid** team's single webhook now covers both roles and receives each
  event exactly once, rather than twice.

  <Note>
    This is additive. Existing provider webhooks are unaffected: no provider
    endpoint, payload, or subscription changes, and no provider begins receiving
    an event type it did not subscribe to.
  </Note>

  See [Reseller webhooks](/docs/resellers/webhooks) for the full guide.
</Update>

<Update label="2026-08-28" description="Documentation and specification accuracy">
  **Fixed — webhook signature verification docs were wrong**

  The provider webhooks guide described an `x-offergrid-timestamp` request header
  that the API has never sent. The timestamp is carried in the `t=` component of
  `X-Offergrid-Signature`. Any verifier written against the old documentation
  would have rejected every delivery. The [verification examples](/docs/providers/webhooks#verifying-signatures)
  are now tested against the signing implementation.

  The same page also corrected the webhook envelope (the event type field is
  `type`, not `event`; there is a `version` field and no top-level `timestamp`),
  the subscribable event list, and the delivery timeout (10 seconds, not 5).

  **Fixed — reseller webhooks were documented but did not exist**

  The reseller webhooks page described a registration flow and four event types
  that had no implementation at the time. The page was corrected to describe
  polling instead — and reseller webhooks then shipped the same day (see the
  entry above), so the [page](/docs/resellers/webhooks) now documents the real
  endpoints.

  **Fixed — rate limits were documented but not enforced**

  The authentication guide published a burst limit, a sustained limit, and
  `X-RateLimit-*` response headers, none of which the API implements. See
  [Rate limits](/docs/api-reference/rate-limits) for what is genuinely enforced: the
  two public `/shop` write endpoints, per IP.

  **Changed — OpenAPI specs now document error responses**

  Every operation in the published specs now declares `401`, `403`, and `500`
  alongside its documented error cases, and every `4xx`/`5xx` response carries a
  schema rather than a bare description. Two new component schemas, `ErrorResponse`
  and `ValidationErrorResponse`, model the shapes described on the
  [Errors](/docs/api-reference/errors) page. Five operations that documented only a
  `404` now declare their success response as well.

  **Removed — `http://localhost:3000` from the published specs**

  The specs listed a local development server that a generated client or agent
  could select. Production is now the only server entry; local development is
  described in prose on the [Introduction](/docs/api-reference/introduction) page.

  **Added — new documentation pages**

  [Errors](/docs/api-reference/errors), [Rate limits](/docs/api-reference/rate-limits),
  [API conventions](/docs/api-reference/conventions),
  [Versioning](/docs/api-reference/versioning), this changelog, and per-role reference
  indexes for the [Provider](/docs/api-reference/provider),
  [Reseller](/docs/api-reference/reseller), and [Public](/docs/api-reference/public) APIs.
</Update>