Changelog and deprecation policy

The base path carries the major version: /api/v1. Within v1 we only add: new endpoints, new optional parameters, new fields in answers, new error codes, new webhook events. Ignore fields you do not know.
A breaking change gets a new major version, announced at least 12 months ahead. The old version keeps working until its sunset date.
Anything deprecated answers with Deprecation and Sunset headers and a Link to its migration guide, and is listed here.

The complete REST API: every area of the site under /api/v1, documented by an OpenAPI 3.1 document generated from the same registry that routes the requests.
OAuth 2.0: client credentials (service accounts), authorization code with PKCE and a consent screen, personal access tokens, rotating refresh tokens with reuse detection, introspection and revocation, private_key_jwt.
Fine-grained scopes on top of the identity's privileges and account permissions; confirmations for sign-off and natural-language commands.
Cursor pagination, sparse fieldsets, Idempotency-Key, ETag/If-Match, problem+json, RateLimit headers, 202 jobs.
Outbound webhooks signed with HMAC-SHA256, with retries and a delivery log.
The 1.2 data endpoints are now part of this API, unchanged.

What	Since	Sunset	Instead
Legacy API keys (`vst_...`)	1.4.0 (26 Oct 2026)	1 Nov 2027	OAuth service accounts