API Changelog

Changes to the StateSet One API that affect callers — new endpoints, new headers, and behaviour you may need to adapt to.

API Changelog

Changes that affect you as a caller: new endpoints, new response headers, and behaviour changes. The API follows semantic versioning, and breaking changes are announced ahead of time.

This is deliberately not a complete engineering log. Internal refactors, test infrastructure, and CI changes are omitted because they change nothing about how you call the API. If a release is missing here, it shipped nothing caller-visible.

Unreleased

New response headers. Three additions, all safe to ignore but useful to read:

Header	What it does
RateLimit-*	Rate limit state in the RFC 9447 standard form, alongside the existing X-RateLimit-* headers
X-Correlation-ID	Propagates across service boundaries, so one ID traces a request through every internal hop
Deprecation warnings	Versioning middleware now emits a warning header when you call a deprecated endpoint

Bulk operations are rate limited per operation type. Limits are configured independently per bulk operation rather than sharing one global bucket.

If you drive bulk imports at a fixed rate, check RateLimit-Remaining rather than assuming your previous throughput still applies. A bulk endpoint may now throttle at a different threshold than the general API.

Security headers are now sent on all API responses: Content-Security-Policy, HSTS with a one-year max-age and preload, Permissions-Policy, X-Permitted-Cross-Domain-Policies, X-XSS-Protection, and Referrer-Policy: strict-origin-when-cross-origin. Cache-control headers prevent caching of sensitive responses, and the Server header now returns a generic StateSet-API rather than framework details.

0.1.6 — 2024-10-30

New endpoint groups:

• Work orders — manufacturing work order tracking
• Bill of materials
• Advanced shipping notices — ASN management
• Analytics endpoints, with permission-based access

Also: a Postman collection for the API, improved error handling, and fixes to inventory allocation edge cases and the return workflow.

0.1.5 — 2024-09-29

• Crypto payment integration
• AI-powered checkout
• Product feed specifications
• Inventory management gained lot tracking
• Improved shipment tracking and warranty claim processing
• Fixed rate limiting edge cases

0.1.4 — 2024-08-24

• Multi-factor authentication support
• RBAC with granular permissions
• Password policy enforcement
• Redis and in-memory caching, with cache warming
• Fixed JWT token refresh, and concurrent inventory reservation bugs

The concurrent-reservation fix matters if you built a workaround for double-allocation under concurrent load. That behaviour is corrected — a retry-and-compare workaround is now redundant, and may mask the correct result.

0.1.3 — 2024-08-11

• Request idempotency — send an Idempotency-Key on writes and a retried request replays the original result instead of repeating the effect
• Comprehensive health check endpoints
• Circuit breaker pattern for upstream calls
• OpenTelemetry integration
• Rate limiting gained per-path policies
• Improved error messages and codes

Idempotency keys arriving in 0.1.3 is the single most useful change on this page for anyone integrating agents. An agent that retries on timeout will otherwise create duplicate orders.

0.1.2 — 2024-07-24

• gRPC support with 30+ proto definitions
• Swagger UI
• Prometheus metrics endpoint
• stateset-cli for local development
• Fixed timeout handling on external service calls and memory usage on large result sets

0.1.1 — 2024-07-18

First functional surface: order management, inventory control with allocations, returns processing, warranties, and shipment tracking.

0.1.0 — 2024-07-01

Initial release. CRUD for orders, inventory, and returns; JWT authentication.

Related

• Overview — base URL, auth, errors, rate limits
• Rate limiting — every header and what to do with it
• Errors — the full error code catalogue