Changelog and versioning

#Versioning

The version is in the address: /api/v1. A flow or an integration built on v1 is not rebuilt when AttendBeacon changes, so within v1:

• Added, never taken away. New operations, new fields in answers, new optional parameters, new values of a list such as a webhook type or an error code. Write code that ignores what it does not know.
• Never renamed or removed: a field, an operation, a scope, an error code or a webhook type, once shipped.
• A change that breaks is v2. It is announced here and by email to every workspace with a key at least six months before v1 changes, and v1 keeps working for those six months.
• What is deprecated is marked deprecated in the OpenAPI description and listed here, with the date it goes.

Not changes in this sense: the order of fields in a body, the text of detail (branch on code), new response headers, and fixing an answer that contradicted this documentation.

The OpenAPI 3.1 description at /api/v1/openapi.json is the API as it is now; info.version changes with every addition.

#2026-10-15: v1.1, the developer platform

• Scopes per area. A key's scopes are now an area and an access (events:read, attendees:write), and personal data has its own scope, people:read. Keys made before keep exactly what they could do.
• Keys expire and are logged. A key may expire after 30, 90, 180 or 365 days. Every call is in Activity of keys, refusals included.
• Problem details. Refusals are RFC 9457 application/problem+json with a stable code; error stays beside detail for flows built before.
• Cursors and sync. Every list answers nextCursor and hasMore; lists of things that change take updatedSince. page and pageSize still work where they did.
• Safe retries and changes. Idempotency-Key on every POST; ETag on single resources, If-None-Match and If-Match.
• Rate limit headers. RateLimit, RateLimit-Policy and X-RateLimit-* on every answer, Retry-After with a 429.
• New operations: the workspace; creating draft events, changing their basics and publishing them; event statistics and the sales pace; ticket types (and changing them), add-ons and discount codes (and creating them); an order; searching attendees; door counts; sessions (and adding and changing them), rooms, tracks and speakers; sponsors and sponsor levels; call-for-speakers proposals; crew and shifts; surveys, their results and session ratings; invoices and credit notes; the budget summary; the share kit's leaderboard; communities and their members; webhook endpoints, their deliveries, tests and secrets, and the event types with their payload schemas.
• Modules. An event's switched-off module answers 409 moduleOff on its endpoints. This also applies to doors, door scans and checking in (the check-in module) and to leads (the leads module), which answered before.
• People. Without people:read, attendees, buyers, crew and members are ids; leads and searching attendees need it. Somebody who deleted their data is erased, with nothing personal.
• Descriptions. /api/v1/openapi.json is now OpenAPI 3.1, with examples and every refusal; the Swagger 2.0 description Power Platform imports is at /api/v1/swagger.json.
• The MCP server at /mcp, for AI assistants.

#2026-10-12: v1.0

• Events, attendees with their answers, orders and door scans of a workspace, with updatedSince.
• Registering somebody with a free ticket, cancelling a ticket and checking somebody in.
• Subscriptions for Power Automate, Zapier and Make (/hooks), and webhooks signed the Standard Webhooks way.
• Registration questions, their JSON schema, ticket types, doors and recent leads, for flows' pickers and fields.