Changelog

v2.9 — July 2026

• Added — Maker-checker approval policies, thresholds, multi-approver decisions, expiry, cancellation, delegation, immutable evidence, payload fingerprints, and idempotent execution binding.
• Changed — Organization policies may now require independent approval for material payouts, API-key lifecycle operations, webhook changes, security policy, corporate-action elections, and proxy votes.
• Added — Enterprise SAML/OIDC configuration with platform activation and enforced federated console login.
• Added — Organization-scoped SCIM 2.0 Users, Groups, and ServiceProviderConfig resources with hashed bearer tokens and immediate deprovisioning.
• Added — Manual and scheduled access certifications with confirm, change-required, and revoke decisions.
• Added — Downloadable security/compliance evidence bundles with credential redaction and SHA-256 integrity evidence.

v2.8 — July 2026

• Added — Partner-console RBAC with organization membership, ten default roles, custom roles, verified-email invitations, immediate permission changes, last-owner protection, and revocable human sessions. Machine credentials remain governed separately by API scopes.
• Added — Team & Access console operations under /team, /team/invites, /team/members/{memberId}, /team/roles, and /sessions.
• Added — Organization-scoped Help & Support cases under /support, including P0–P3 severity, acknowledgement and update clocks, operational references, partner-visible messages, escalation, assignment, resolution, and closure.
• Added — Optional privileged-role MFA enforcement for Owner, Administrator, Treasury, and Compliance console sessions.

All notable API changes. Entries marked Deprecated will be removed on the date listed in the Sunset header — see API Versioning for the deprecation policy.

v2.7 — July 2026

• Added — Resting orders on the master account. POST /trade now accepts orderType: LIMIT | STOP | STOP_LIMIT (previously master orders could only be MARKET). Like sub-account resting orders, they are not quote-gated, may be placed while the market is closed, and escrow at the trigger price.
• Added — PATCH /orders/{orderId} modifies a resting master order in place (limitPrice, stopPrice, quantity), matching the existing PATCH /users/{userId}/orders/{orderId}. Requires Idempotency-Key; emits order.replaced.
• Changed — DELETE /orders/{orderId} now cancels WORKING resting master orders as well as PENDING market orders, refunding BUY escrow and releasing SELL unit reservations.
• Added — Price alerts: POST/GET /price-alerts and GET/DELETE /price-alerts/{alertId}, backing a new price.alert webhook event. Thresholds are in the instrument's local trading currency and are evaluated against the latest delayed price observation while the exchange is open.
• Added — Quote freshness contract. Every quote now carries asOf (when the price was captured upstream), stale, and a dataQuality block (delayMode, delayMinutes, refreshIntervalSeconds, provider). GET /market/exchanges publishes the same policy per exchange. Quotes are delayed — polled every 15 minutes between 08:00–16:00 UTC on weekdays — and were never real-time; this makes the existing behaviour explicit. Price your trades against asOf.
• Added — 503 maintenance handling: MAINTENANCE and SERVICE_UNAVAILABLE error codes, always with Retry-After. A read_only mode serves GETs normally while refusing mutations, so you can reconcile during a settlement incident.
• Added — Public status page at mystocks.africa/status, rendering the existing GET /api/v1/status registry.
• Added — Concurrent GET /stream connection cap, published per tier (Starter 2, Growth 5, Enterprise 20). Exceeding it returns 429 rather than opening a stream that immediately dies.
• Changed — Order rejection codes are now documented with retry semantics (which are safe to resubmit and which are not) and validated against a single source of truth. The set is unchanged and exhaustive: INSUFFICIENT_FUNDS, KYC_REQUIRED, MARKET_CLOSED, COMPLIANCE_HOLD, TECHNICAL_ISSUE, OTHER.

v2.6 — July 2026

• Fixed — Asset-detail endpoints (GET /bonds/{id}, /funds/{id}, /opportunities/{id}, /market-intel/{id}) now return a clean 404 for any unresolvable id, including Firestore-reserved patterns (e.g. __x__) that previously threw a 500.
• Added — Sandbox parity: PATCH /settings and the SMTP test now work in sandbox, and POST /api-keys/rotate rotates your sandbox key in place. Both were previously 422 stubs.
• Changed — Enterprise scoped-key enforcement is now enforced, not advisory. With scopedKeysRequired enabled, a key with no scopes is denied (403); a full-access key must hold the "*" scope.
• Changed — Signed requests now cover the query string: HMAC-SHA256(apiKey, "{timestamp}.{METHOD}.{path}{?query}.{sha256(body)}"). Signing without the query string is deprecated.
• Fixed — mTLS verification is stricter: a bare or spoofed x-forwarded-client-cert no longer counts as a verified certificate. Use x-client-cert-verified: success or a genuine Envoy XFCC with a Hash=.
• Fixed — API reference corrected: data keys access market data via /market/*; the deprecated /market-data/* aliases are not in the data-key allowlist.

v2.5 — July 2026

• Changed — Integration test tools renamed: POST /test-tools/deposit, POST /test-tools/trade, GET /test-tools/orders are the new canonical live-key testing paths. The old /sandbox/* paths remain supported aliases but are deprecated.
• Added — Security guidance: avoid embedding API keys (including pk_data_) in production bundles; proxy through your backend or mint short-lived tokens via POST /oauth/token.
• Fixed — OpenAPI spec: the data-key prefix is pk_data_ (earlier text showed dk_).
• Changed — Market data unified under /market/*: GET /market/exchanges and GET /market/ohlcv are the new canonical paths; /market-data/* remain deprecated aliases.
• Added — camelCase pagination meta on GET /market/movers (totalCount, perPage, hasNext); snake_case aliases deprecated, removal 2026-10-01.
• Added — Typed response-header components in the spec (X-RateLimit-*, Retry-After) and documented webhook request headers.
• Added — Webhook delivery semantics documented: at-least-once, possible duplicates/out-of-order, dedupe-by-eventId, gap reconciliation.
• Added — Retry-guidance table in Authentication.
• Fixed — Webhook retry policy corrected to the actual scheduler: up to 6 attempts with exponential back-off (immediate, 5 s, 30 s, 5 min, 30 min, 2 h).
• Added — Concepts & Glossary (15 terms with stable #term-<slug> anchors), Architecture & Custody, and Order & Money Lifecycles sections.
• Added — Recipes: eight implementation guides at /partners/docs/recipes, each on its own shareable URL.
• Fixed — Build a Trading App guide now shows the correct two-step GET /quote/{symbol} → POST /trade sequence.
• Fixed — Cash-mode (fractional) trading now works with the quote gate: GET /quote/{symbol} accepts cashValue.
• Fixed — Sandbox GET /buying-power endpoints now exist; quote quantities accept fractional values.
• Added — Sandbox webhooks reach full production parity (real endpoints, HMAC signing, retries, delivery log, test-fire).
• Fixed — Sandbox parity sweep: duplicate externalId returns the existing sub-account (200); structured batch/validation errors.
• Added — Sandbox top-ups (POST /topup) auto-approve and fire topup.confirmed.
• Added — OpenAPI: GET /dividends/{symbol}/history documented.
• Fixed — GET /stocks documented as a full, non-paginated filtered list with a search param.
• Fixed — Quick Start step 1 corrected: POST /register authenticates with a Firebase ID token.

v2.4 — July 2026

• Added — Real-time event stream: GET /stream (Server-Sent Events) — every webhook event, also streamed, with resume via Last-Event-ID / ?since=.
• Added — Self-serve pricing: GET /pricing + PATCH /pricing (default markup bps + per-symbol/exchange/asset-class overrides + promo window).
• Added — Webhook corporateaction.declared (split, rights issue, bonus, merger, delisting, symbol change) with affectedSubAccounts[].
• Added — Tax lots + realized-gain reporting: GET /users/{userId}/tax-lots and GET /users/{userId}/gains.
• Added — GET /float + PATCH /float (master funding headroom); webhooks topup.confirmed and float.low; optional credit line.
• Added — Native LIMIT / STOP / STOP_LIMIT orders on sub-account trades (rest in WORKING, fire order.triggered).
• Added — GET /buying-power endpoints — settlement-aware balances (withdrawableUsd excludes unsettled SELL proceeds).
• Changed — Sub-account withdrawals can enforce a settlement hold: over-withdrawal returns 400 UNSETTLED_FUNDS.
• Changed — Unified stock/quote response shape across /market/quotes, /market/movers, /stocks.
• Deprecated — snake_case aliases on /market/quotes and /market/movers; removal 2026-10-01.
• Added — price returned alongside deprecated currentPrice on /stocks/{symbol} and /companies/{symbol}.

v2.3 — June 2026

• Added — GET /market/movers — paginated top gainers/losers per exchange.
• Changed — List endpoints use cursor pagination (cursor + nextCursor + hasMore).
• Fixed — Batch-quote volume returns integer 0 (not null); overflow returns BATCH_LIMIT_EXCEEDED; malformed symbols return 400 INVALID_SYMBOL.
• Fixed — ?symbols[]= array bracket notation returns a clear VALIDATION_ERROR pointing to ?symbols=A,B,C.
• Changed — Error-codes table expanded (MISSING_PARAM, INVALID_SYMBOL, UNKNOWN_EXCHANGE, INVALID_TYPE, BATCH_LIMIT_EXCEEDED).

v2.2 — June 2026

• Added — OHLCV in chart endpoints: open, high, low, close, volume on every candle plus parallel arrays.
• Added — open field on stock and ETF detail responses.
• Fixed — Missing logo SVGs return a branded placeholder instead of an error page.

v2.1 — May 2026

• Added — ETF support: GET /etfs, /etfs/{symbol}, /etfs/{symbol}/history, /etfs/{symbol}/chart.
• Added — Price charts: GET /stocks/{symbol}/chart and /etfs/{symbol}/chart.
• Added — Multi-symbol batch quotes (up to 50 symbols).
• Added — Sandbox simulation headers X-Sandbox-Force-Status / X-Sandbox-Force-Error.
• Changed — Structured error model {"error": {"code", "message"}}.
• Added — Timing-safe HMAC signature-verification examples (Express, FastAPI).

v2.0 — May 2026

• Added — Sandbox endpoints: POST /sandbox/deposit, POST /sandbox/trade, GET /sandbox/orders.
• Added — All sandbox webhook payloads include isSandbox: true.
• Added — Sandbox tab in the Partner Dashboard; cheat codes (quantity 100 → auto-fill, 999 → auto-reject).

v1.9 — May 2026

• Added — POST /auto-register, GET /quote/{symbol}, GET /market/status, GET /webhooks/{id}/deliveries.
• Added — Webhook events wallet.credited, incident.declared, incident.resolved.
• Changed — Deposit body accepts localAmount, localCurrency, fxRate.
• Fixed — Webhook signature example uses timingSafeEqual.

v1.8 — April 2026

• Added — Company endpoints; GET /usage; GET /audit; partner markupBps; SMTP settings.

v1.7 — March 2026

• Added — GET /report/revenue, GET /report/invoice, POST /api-keys/rotate & revoke, GET /api-keys/data-key.
• Changed — Trade body accepts optional stopLoss and takeProfit.

v1.6 — January 2026

• Added — POST /users/{userId}/subscribe & redeem, GET /dividends/calendar, GET /report/dividends, webhook dividend.paid.

v1.5 — November 2025

• Added — Bonds & fixed income, funds & ETFs, private credit & pre-IPO, POST /users/{userId}/kyc.

v1.0 — September 2025

• Added — Initial release: equity trading, sub-accounts, USD wallets, deposits, withdrawals, webhooks, core stock/portfolio/user/trade/webhook endpoints.