# Changelog and versioning

What changed in the API, newest first, and how we change it without breaking your code.

Rookery for developers · Updated October 11, 2026 · https://userookery.com/developers/changelog/

## How versions work

The API is **v1**, and v1 is stable. The version is in every address (`/api/v1/…`), so you always know which one you're calling.

Within v1 we only make changes that keep working code working:

- new endpoints and new MCP tools;
- new optional parameters and body fields;
- new fields in answers. Ignore fields you don't know;
- new values where a field says it can grow, like timeline `event` names;
- clearer wording in `error` messages. Use the status code, not the words.

A breaking change, like removing or renaming a field or endpoint, or changing what a field means, only happens with **at least 6 months' notice**. We'll write to the person who made each key, mark it in the [reference](https://userookery.com/developers/reference/), and list it here with the date it ends. Fixes for security problems are the one exception, and we'll explain them here.

## Changes

### Sun 11 Oct 2026: the sandbox

- **Test keys** (`rk_test_…`) and a [sandbox](https://userookery.com/developers/sandbox/) to use them on: its own inbox, where nothing is ever sent. New live keys start `rk_live_`; `rk_` keys keep working as live keys.
- `POST /sandbox/inbound`, test keys only: simulate an incoming email.
- Magic `.test` addresses simulate a delivery, a bounce, a spam complaint, a reply, a reply with a document, and an out-of-office.
- `GET /me` answers with `livemode`.
- Webhooks: every event has `livemode`. Sandbox events go only to new **test endpoints**.
- **Try it** works with test keys, and with one it can send (in the sandbox).

### Sun 11 Oct 2026

- Developer docs: these guides, and a reference with **Try it** for every endpoint.
- The OpenAPI 3.1 spec, at `https://app.userookery.com/api/v1/openapi.json` and [userookery.com/developers/openapi.json](https://userookery.com/developers/openapi.json). It's made from the same definitions the API runs on.
- The API answers browser requests from userookery.com, for **Try it**. Other websites still can't call it from a browser.
- `GET /me`, to check a key, is now in the reference. It needs `read`, which every key has.
- Webhooks: ten signed events, from `client.replied` to `booking.cancelled`, set up in **Settings → Integrations → Webhooks**, with retries for about a day, a delivery log and **Resend**. See [Webhooks](https://userookery.com/developers/webhooks/) and the [event reference](https://userookery.com/developers/reference/#webhook-events).

### Sat 10 Oct 2026

- v1 opens: the REST API and the MCP server, with API keys scoped to `read`, `write`, `draft` and `send`.
- Ask customers for documents, with `request_documents` or `documents` on a reply.
- A key sees the team inboxes and its maker's private inboxes. Anyone else's private conversations answer `404`.