API changelog

August 2026

API hardening

A hardening pass across the v1 surface ahead of general availability.

Correctness

• Invoices approved via the API (including auto_approve) now post to the general ledger and draw their numbers from the company's unified document number sequence.
• auto_approve now requires customer_id; requests without it fail with 400 invalid_request.
• Cross-company references (for example a customer_id belonging to another company) are rejected.
• Malformed query parameters, UUIDs and dates now return 400 problem+json responses instead of 500.

Contract

• DELETE responses now return the standard envelope: {"data": {"id": "...", "deleted": true}}.
• The transitional duplicate error field was removed from error responses. Use code and detail — see Errors.
• Rate-limit headers (X-RateLimit-*) are now present on all authenticated responses, including errors and the 429 itself.
• CORS is enabled for browser-based integrations. Credentials must still be kept server-side.

Webhooks

• invoice.overdue is now a subscribable event, bringing the catalog to 21 events.
• Webhook subscriptions are capped at 25 active subscriptions per company.

Security

• API keys were re-issued as part of a credential-storage upgrade. Existing keys have been revoked — key holders must generate a new key under Indstillinger → API-nøgler (Settings → API keys).

Pre-GA · current release

v1.0.0 — integration launch

Public contract

Published the OpenAPI 3.1 contract and English API reference. API keys and approved OAuth 2.0 confidential clients are documented as alternative authentication methods.

Reliability and security

Added distributed rate-limit semantics, OAuth PKCE and client-secret requirements, least-privilege API keys, signed webhook delivery, retries, delivery history, replay, and secret rotation.

Compatibility

Additive changes may be released in v1. Non-security breaking changes will move to a new major API path and receive at least six months' notice after general availability.