Історія змін

An event stranded by an auto-disable is now dead-lettered, so it can be replayed once the endpoint is back. Recovering from a bad afternoon is supposed to be: the platform pauses the endpoint, you fix it, you re-enable it, you redeliver what never arrived. Redelivery only accepts a dead-lettered delivery, and the queue of an auto-disabled endpoint was being terminated as merely failed — so there was nothing to replay and nothing said so. The arithmetic hid it: a delivery gets 8 attempts and an endpoint is paused after 10 consecutive failures, so a single event in flight always dead-letters first. The counter is per endpoint, and one ordinary session emits three events. Deliveries for an endpoint its owner REMOVED are still terminated without a dead letter: nobody is coming back for those.

Three corrections found by driving this API the way an integration does. A bad request body now answers the envelope this surface documents ({ error, code: INVALID_REQUEST_BODY, invalid_fields }) naming the PUBLISHED field: it used to fall through to a shape the API emits nowhere else, which named the internal property (TargetUrl for target_url) and carried no error member for a generated client to read. session.ended is delivered ONCE per close; closing a live session through this API delivered it twice, so anything that posts a summary or books a room did it twice, and the event now always names presentation_id whichever surface closed the session. And enabling an endpoint only revives one the platform paused after failures: it used to undo a DELETE too, so a connector's unsubscribe could be reversed by one call while the connector itself could no longer remove it. Enabling an endpoint that was removed now answers 400 WEBHOOK_NOT_AUTO_DISABLED; register it again instead.

question_id is now published as REQUIRED on per-question results, which is what the endpoint has always enforced: it answers 400 without one. The document said optional, so an integrator who believed it did not send the value and found out from a failed call — and the failed call counted against the organization's quota. Nothing about the endpoint's behaviour changed, and no request that worked before stops working; what changed is that the reference now describes it. Generated clients and MCP tools derived from this document will ask for the question up front instead of discovering the rule at runtime.

The participant roster now says how each person was let in: identity_seal is VERIFIED when an identity provider vouched for them, GUEST when they came through the invited-guest link, and UNVERIFIED when neither happened. Without it an integrator reading a roster of names could not tell which of them anyone had actually checked. Additive: no existing field changed. The same release finishes naming two closed domains the document was already enforcing but never said out loud: the export format (csv, xlsx) and the webhook connector (ZAPIER, POWER_AUTOMATE) — until now the only way to learn either was to send a wrong value and read the 400.

Per-question results now carry the spinner wheel's spin log (spin_outcomes) and, for ordering questions, how many people put each item in each position (placement_accuracy[].counts_by_position). Both were produced internally and never published; a spinner wheel's results envelope used to arrive empty. Additive: no existing field changed.

Discovery without a credential: the enforced rate limits, the webhook retry schedule and the published event catalogue, plus this changelog itself.

Self-serve webhooks: register, remove and re-enable endpoints, list them, read their delivery history including dead-lettered attempts, and redeliver one manually.

Content management with a content:write credential: create sessions from a presentation, open, close and schedule them, author and update questions, and put a question on the room's screen.

Public API v1: read an organization's presentations, sessions, KPIs, per-question results, Q&A, exports and participants with a results:read credential.