# Changelog

## August 17, 2026 — OAuth2-protected webhooks

- Added OAuth 2.0 client-credentials authentication for webhook deliveries.
- HMAC remains the default when `auth` is omitted. OAuth2 deliveries use a
  bearer token instead of HMAC signature headers.
- Added four delivery attempts with exponential retry delays and stable
  delivery IDs.

See [Webhooks](/webhooks) for configuration and verification details.

## August 13, 2026 — Audit and API safeguards

- Added `GET /v1/integrations/audit/events` with the new `audit:read` scope for
  account security and integration activity.
- Added per-API-key, per-category rate limits and `Retry-After` guidance.
- Updated photo uploads with request and image limits. Order photos now use
  managed URLs returned by `POST /photos`.

See the [API Reference](/api/audit), [Rate limits](/rate-limits), and
[Photos](/photos).

## August 10, 2026 — LegitGrails API v1

Introduced the server-to-server LegitGrails API at
`https://api.legitgrails.com/v1/integrations`:

- Live and Test API-key management with explicit scopes in
  [LegitGrails Account](https://account.legitgrails.com/settings/integrations).
- Integration orders use the existing LegitGrails Account balance and
  centralized billing managed through `account.legitgrails.com`.
- Catalog discovery for categories, brands, models, answer times, and photo
  requirements, with English and Japanese localized display fields.
- Multipart photo upload, order creation and retrieval, Test-order outcomes,
  and additional-photo submission.
- Account balance reads and signed webhook notifications for order outcomes and
  photo requests.
- Stable error envelopes, request IDs, environment isolation, and scoped access
  to account data.

Start with the [Quickstart](/quickstart) or browse the [API Reference](/api).