ThreadzSocial
Log in
Developers

Changelog

Changelog

Breaking changes will be called out here with migration notes. Additive fields and new endpoints are preferred within a major version.

v1 — batch, Sandbox Hub, idempotencycurrent

July 2026

Added

  • Login with ThreadzSocial — OAuth 2.0 authorization code: GET /oauth/authorize, POST /oauth/token, GET /oauth/userinfo. Opaque stz_oauth_… tokens accepted on /api/v1/* (same scopes as keys; seller = authorizing user). See OAuth docs.
  • POST /listings/batch — bulk create/upsert up to 25 listings per request (items[]). Partial success: per-index ok / error; meta created, updated, failed, max_per_request. HTTP 200 if any succeed, 422 if all fail. See Listings.
  • Sandbox Hub (/developers/sandbox) — signed-in view of sandbox API inventory with counts, status filters, and photo grid. Never on Discover. Linked from Developers home.
  • Idempotency-Key header on POST /listings — maps to external_id (max 128 chars); unique per seller + environment; retries upsert instead of duplicating; header must match body external_id when both are set.
  • Developers home health note for GET /health (data.ok, data.dbreadiness signal).

v1.0.0 — initial public API

July 2026

Added

  • Versioned base path /api/v1 with success/error envelopes
  • GET /health — liveness + optional DB ping (ok, db, supabase_configured)
  • GET /listings — live active feed (anonymous) or own sandbox inventory (sandbox key); cursor pagination
  • GET /listings/{id} — listing detail with environment isolation
  • POST /listings, PATCH /listings/{id}, DELETE /listings/{id} (archive) — scope listings:write; optional external_id upsert
  • GET /profiles/{username} — public closet summary
  • GET /me — authenticated key owner profile
  • API keys: stz_live_… / stz_sandbox_…, Bearer auth, scopes (read, listings:write), revoke, optional pepper hashing
  • Postgres-backed rate limits (shared across instances) with in-memory fallback; headers and 429 rate_limited
  • Outbound webhooks for listing events (listing.created, listing.updated, listing.archived) with X-ThreadzSocial-Signature HMAC — see Webhooks
  • CORS for GET/POST/PATCH/DELETE; app + key management at /developers/apps
  • Public docs portal at /developers/docs
  • Sandbox isolation for listings (api_environment) and go-live milestones on developer apps
  • API Terms

Policy

  • Deprecation: endpoints removed only after a deprecation notice in this changelog and a reasonable migration window within v1 when possible.
  • Versioning: breaking surface changes move to /api/v2 (or a new major).
  • Sandbox first: production keys remain gated by milestones — see Go live.

Stay updated