Back to Developers

API Changelog

Every change to the public REST API, webhooks, and SDKs. We announce breaking changes 90 days in advance via email to all active API key owners.

RSS
· v1.0.0FEATURE

Official Node.js + TypeScript SDK released

  • npm install @guestos/node — zero config for Node 18+, Bun, Deno, Cloudflare Workers.
  • Typed responses for all 4 REST endpoints (events.stats, events.guests, events.notify, events.notifyGuest).
  • Auto-retry on 429 with Retry-After tracking; built-in Idempotency-Key helper.
  • verifyWebhook() helper for HMAC signature verification (constant-time compare).
  • Working examples: Express receiver, Next.js route handler, HubSpot sync, basic polling.
  • Source: packages/node in the monorepo. MIT license.
· v1.0.0LAUNCH

Public API v1 released

  • GET /events/{id}/stats — aggregated guests, RSVP, payment stats.
  • GET /events/{id}/guests — paginated list with rsvpStatus, paymentStatus, checkedIn filters.
  • POST /events/{id}/notify — build bulk notification recipient list (rsvp_reminder / payment_reminder / event_reminder).
  • POST /events/{id}/guests/{gid}/notify — single-guest variant.
  • Stripe-style error format: { error: { type, code, message, doc_url, request_id } }.
  • Tiered rate limits: BUSINESS 3k/min + 100k/day, ENTERPRISE 10k/min + 1M/day. Dual-window enforcement.
  • X-RateLimit-Limit / Remaining / Reset + X-Request-Id on every response.
  • Idempotency-Key header on POST endpoints — Stripe semantics, 24h cache, 409 on payload mismatch.
  • CORS locked to null origin (server-to-server only).
· v1.0.0FEATURE

Outbound webhooks (HMAC-SHA256)

  • 8 event types: guest.checked_in, guest.updated, rsvp.submitted, rsvp.updated, event.published, event.closed, photo.approved, payment.received.
  • Stripe-style signature header: GuestOS-Signature: t=<unix>,v1=<hmac>.
  • Retry with exponential backoff: 1m, 5m, 30m, 2h, 12h (5 attempts max).
  • Auto-disable endpoint after 50 consecutive failures.
  • Webhook delivery log + replay UI coming to /dashboard/settings.
· v1.0.0FEATURE

OpenAPI 3.1 spec published

  • Served publicly at GET /api/v1/openapi (cacheable).
  • Interactive reference at /docs/api (Scalar-powered).
  • Auto-generate SDKs with Fern, Speakeasy, openapi-typescript, openapi-generator.
· v1.0.0FEATURE

API key lifecycle management

  • Prefix `gos_` for public secret-scanning partner detection.
  • SHA-256 hashed at rest — irreversible. If lost, generate a new one.
  • Instant revocation from /dashboard/settings.
  • lastUsed tracking for rotation hygiene (rotate keys every 90 days).
  • Per-request audit log in ActivityLog with method + path + request_id.

Want to be notified when we ship new endpoints, breaking changes, or deprecations?

Subscribe to API email updates →