# Changelog

Subscribe to [changelog.xml](/changelog.xml). Breaking changes go to `/v2` and `/v1` keeps serving for at least six months with `Deprecation` and `Sunset` headers — see [versioning](/versioning).

## 2026-09-15 — Webhooks

Subscribe to thin events over `/webhooks`: create, rotate a secret with a 24-hour overlap, ping, read the last 100 deliveries, redeliver one.

Events carry an id and a type, never the object — the server cannot read your content. There is deliberately no `todo.completed`: `status` is encrypted, so the server cannot tell a completion from a rename. Fetch the object and decide.

Inbound is best-effort and at-most-once. Reconcile with `updated_since` polling.

## 2026-09-15 — v1

The first public version: containers, to-dos, inbox, tags, attachments, filters, views, search, trash and settings, plus `/keys`, `/grants` and `/sessions`.

Personal access tokens for your own scripts; OAuth 2.1 with PKCE and native approval for apps. Fine-grained scopes. RFC 9457 problem+json on every error. Cursor pagination in a stable order. `Idempotency-Key` on writes.