API changelog

Every change to the public API, newest first. Additive changes ship within v1; anything that would break a client needs a new version path (versioning). The SDK's own changes are in its CHANGELOG.

2026-11-07: Shopify privacy webhooks

/v1/integrations/shopify/compliance/customers-data-request, /customers-redact and /shop-redact, for Akteora's own Shopify app. Each takes shop_domain, Shopify's webhook_id and Shopify's payload, answers 202 with status (queued, duplicate or no_data), and does the work in the background. A repeated webhook_id is a no-op. Integration key only, like /install.

2026-11-06: text previews, and the Shopify integration

text_preview on every item of GET /v1/submissions, searched or not: the start of the testimonial's own words (the text it is shown with, or the transcript of a video or audio), up to 200 characters, cut at a word boundary and ending in … when cut. null when there are no words yet. Never rewritten. Additive.
/v1/integrations/shopify/install and /uninstall, for Akteora's own Shopify app. They take an integration key (integrationKey in the spec), not an API key, and are not open to other integrations.
An organization billed by Shopify may set show_attribution: false on a widget on every plan.

2026-09-28: unlimited testimonials on paid plans

quotas.submissions_per_month is null (unlimited) for starter, core and plus. It is still counted, and still limited on free.
The plan with id core is now named Agency (name). Its id is unchanged everywhere.
A plan's features lists only what is built today; custom_domain, white_label, sub_accounts and priority_render appear when they ship.

2026-09-27: importing reviews

POST /v1/imports, GET /v1/imports. Bring existing reviews into a brand as text testimonials, up to 500 rows a request, with an attestation. Scope submissions:write; for members, owners and admins. Importing reviews.
Testimonials have an origin: collected or imported, with source and reviewed_at for imported ones. New origin filter on GET /v1/submissions and on exports.
collect_link_id is now null for an imported testimonial, in the testimonial and, as link_id, in webhook events (which also gain origin). Collected testimonials are unchanged. A client that assumed the field was always a string should check for null; there were no outside integrations when this shipped.
Widget and wall items gain source, null unless imported.
Public ratings count collected testimonials only: the wall's rating, the widget heading's rating, and AggregateRating markup.
New quota imported_reviews in GET /v1/billing and /v1/billing/usage, and as a limit.name on 402.
Exports: CSV gains origin, source, source_url and reviewed_at as the last four columns; JSON gains origin, source and reviewed_at.

Operators can sign in with Google or GitHub as well as with an email and a password, which is unchanged. Five session-only routes, listed in the reference for completeness: GET/POST /v1/auth/social, GET /v1/auth/callback/{provider}, and GET/POST/DELETE /v1/me/auth-methods….

Nothing here changes how an integration authenticates. API keys are the only way in for software, and these routes refuse keys as every session-only route does. They are documented because the dashboard has no private endpoints (ADR 0003), not because there is anything to call: a browser and a person are needed for all of them.

2026-09-15: the public API

API keys. Authorization: Bearer rk_live_…, with eleven scopes, made and revoked in the dashboard (GET, POST /v1/api-keys, DELETE /v1/api-keys/{id}, for signed-in owners and admins, never for keys). Authentication.
Test mode. rk_test_… keys work on a separate sandbox with small allowances of its own.
Webhooks. submission.created, submission.ready, submission.approved, submission.rejected, reel.ready, reel.failed, export.ready; signed with HMAC-SHA256; retried for 21 hours; a delivery log with every attempt, and replay. /v1/webhooks…. Webhooks.
Per-key and per-organisation rate limits, with RateLimit-* headers on every response.
Errors: new insufficient_scope (403, with required_scope).
The OpenAPI document describes every event in its webhooks section, and every request, response and path parameter has a real example.
@akteora/sdk 1.0.0 on npm.

2026-09-14: plans and billing

GET /v1/billing, GET /v1/billing/usage, POST /v1/billing/checkout, /portal, /change-plan; limit.upgrade_url on every 402; closed-link reason paused. Plans and billing.

2026-09-14: reels

/v1/reels and its clips, render and share routes; GET /v1/reels/music; the limit render_seconds_per_month. Reels.

2026-09-13: public walls

public_wall_url on brands; GET /public/walls, /public/walls/{slug}, /public/walls/{slug}/testimonials/{id}; POST /public/removals and /public/removals/lookup. Public walls.

/v1/widgets and POST /v1/widgets/preview; the public widget document format. Widget.

2026-09-13: moderation, tags and exports

POST /v1/exports/preview; /v1/tags; tagging a testimonial; tag_id and is_public filters; rejected_at and rejection_reason; public_media and GET /v1/submissions/{id}/media/{variant}; the plan_limit_exceeded error. Exports, media.

2026-09-12: transcripts, search, written testimonials

Transcripts with word timings (GET, PATCH /v1/submissions/{id}/transcript); sentiment; search with q; written and spoken-then-written testimonials (text_input, text_source, original_text).

2026-09-10: the first routes

Brands, collect links, the capture routes, and submissions with direct-to-storage uploads.