> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stateset.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Changelog

> Changes to the StateSet One API that affect callers — new endpoints, new headers, and behaviour you may need to adapt to.

# API Changelog

Changes that affect you as a caller: new endpoints, new response headers, and behaviour changes. The
API follows semantic versioning, and breaking changes are announced ahead of time.

<Note>
  This is deliberately not a complete engineering log. Internal refactors, test infrastructure, and CI
  changes are omitted because they change nothing about how you call the API. If a release is missing
  here, it shipped nothing caller-visible.
</Note>

## Unreleased

**New response headers.** Three additions, all safe to ignore but useful to read:

| Header               | What it does                                                                                                                             |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| `RateLimit-*`        | Rate limit state in the [RFC 9447](https://www.rfc-editor.org/rfc/rfc9447) standard form, alongside the existing `X-RateLimit-*` headers |
| `X-Correlation-ID`   | Propagates across service boundaries, so one ID traces a request through every internal hop                                              |
| Deprecation warnings | Versioning middleware now emits a warning header when you call a deprecated endpoint                                                     |

**Bulk operations are rate limited per operation type.** Limits are configured independently per
bulk operation rather than sharing one global bucket.

<Warning>
  If you drive bulk imports at a fixed rate, check `RateLimit-Remaining` rather than assuming your
  previous throughput still applies. A bulk endpoint may now throttle at a different threshold than the
  general API.
</Warning>

**Security headers** are now sent on all API responses: `Content-Security-Policy`, `HSTS` with a
one-year max-age and `preload`, `Permissions-Policy`, `X-Permitted-Cross-Domain-Policies`,
`X-XSS-Protection`, and `Referrer-Policy: strict-origin-when-cross-origin`. Cache-control headers
prevent caching of sensitive responses, and the `Server` header now returns a generic
`StateSet-API` rather than framework details.

## 0.1.6 — 2024-10-30

**New endpoint groups:**

* [Work orders](/api-reference/workorder/list) — manufacturing work order tracking
* [Bill of materials](/api-reference/billofmaterials/list)
* [Advanced shipping notices](/api-reference/asns/list) — ASN management
* Analytics endpoints, with permission-based access

Also: a Postman collection for the API, improved error handling, and fixes to inventory allocation
edge cases and the return workflow.

## 0.1.5 — 2024-09-29

* Crypto payment integration
* AI-powered checkout
* Product feed specifications
* Inventory management gained **lot tracking**
* Improved shipment tracking and warranty claim processing
* Fixed rate limiting edge cases

## 0.1.4 — 2024-08-24

* **Multi-factor authentication** support
* [RBAC](/api-reference/authentication) with granular permissions
* Password policy enforcement
* Redis and in-memory caching, with cache warming
* Fixed JWT token refresh, and concurrent inventory reservation bugs

<Note>
  The concurrent-reservation fix matters if you built a workaround for double-allocation under
  concurrent load. That behaviour is corrected — a retry-and-compare workaround is now redundant, and
  may mask the correct result.
</Note>

## 0.1.3 — 2024-08-11

* **[Request idempotency](/api-reference/overview#your-first-request)** — send an `Idempotency-Key`
  on writes and a retried request replays the original result instead of repeating the effect
* Comprehensive [health check endpoints](/api-reference/v1/health-list)
* Circuit breaker pattern for upstream calls
* OpenTelemetry integration
* Rate limiting gained per-path policies
* Improved error messages and codes

<Tip>
  Idempotency keys arriving in 0.1.3 is the single most useful change on this page for anyone
  integrating agents. An agent that retries on timeout will otherwise create duplicate orders.
</Tip>

## 0.1.2 — 2024-07-24

* **[gRPC support](/api-reference/grpc-framework)** with 30+ proto definitions
* Swagger UI
* Prometheus metrics endpoint
* `stateset-cli` for local development
* Fixed timeout handling on external service calls and memory usage on large result sets

## 0.1.1 — 2024-07-18

First functional surface: [order management](/api-reference/orders/list),
[inventory control](/api-reference/inventory/get) with allocations,
[returns processing](/api-reference/return/list), [warranties](/api-reference/warranty/list), and
[shipment tracking](/api-reference/shipments/get).

## 0.1.0 — 2024-07-01

Initial release. CRUD for orders, inventory, and returns; JWT authentication.

## Related

* [Overview](/api-reference/overview) — base URL, auth, errors, rate limits
* [Rate limiting](/api-reference/rate-limiting) — every header and what to do with it
* [Errors](/api-reference/errors) — the full error code catalogue