Changelog

Version 1 only ever adds: new endpoints, fields, events and permissions. A deprecation is listed here at least six months before it takes effect, and the affected responses carry Deprecation and Sunset headers. See Versioning.

October 2026: the API grows

Everything here is additive. Nothing in the catalog or FFL Checkout API changed in meaning.

Added

• Scoped private keys. A private key can be made with a list of permissions (catalog:read, catalog:cost:read, orders:read, orders:write, inventory:read, inventory:write, distributor_orders:read, distributor_orders:write, webhooks:manage). Keys made before this keep their meaning exactly. Authentication.
• GET /me: the key, the store and what the key may do.
• Orders: GET /orders, GET /orders/{id}, POST /orders, POST /orders/{id}/match, /cancel, /ready, /ship, /deliver, lines (POST, PATCH, DELETE) and GET /orders/{id}/fill.
• Distributor orders: read them, and make and extend drafts. Sending is not in the API.
• Inventory: GET /inventory/items, PUT, PATCH, DELETE and POST …/zero on /inventory/items/{external_id}, and POST /inventory/batch for up to 500 items. FastBound items are read only.
• Webhooks: endpoints, events order.* and distributor_order.status_changed, signed deliveries, a delivery log, resend and test.
• Cursor pagination on every list, with next_cursor; updated_since on products, orders, distributor orders and inventory; removed in the products sync. The products search keeps limit (up to 60) and total and adds next_cursor.
• Idempotency-Key on every write, kept 24 hours; required on POST /orders/{id}/ship and POST /inventory/batch.
• Response headers on every call: X-Request-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, and Retry-After on a 429. Deprecation and Sunset when something is deprecated (nothing is).
• One error envelope { "error": { "code", "message", "request_id" } }. The three catalog routes keep their bare error word and add error_detail.
• GET /api/v1/openapi.json and this documentation, made from the same definition.

Notes

• The offers[].cost on GET /staff/products/{key} is a decimal string (for example "51.25"), as it always was; the product-level cost, map and msrp are numbers. The definition now says so.
• Private catalog keys made before permissions are now counted at 600 calls a minute and the count is reported in the headers. It is not enforced yet; before it is, it will be announced here with the six months' notice.

Not in the API, on purpose. Sending, marking ready, confirming, cancelling and receiving a distributor order; FastBound items; the store's cost and pricing rules; hand-entered transfers (they pick a specific gun from FastBound).