Changelog

2026-01-30

Public /v1/* API surface (34 endpoints across 10 modules): vessels, equipment, maintenance, inventory, expenses, documents, crew/STCW, charter, trips, compliance (drill cadences, permits to work, MARPOL regulatory records), fleet aggregations.
Hand-authored OpenAPI 3.1 spec (openapi/v1.yaml) covering all 34 endpoints on the public surface, with express-openapi-validator enforcing request-shape conformance on every /v1/* call and response-shape conformance in NODE_ENV=test as a drift-detection mechanism.
Idempotency support via Idempotency-Key header on POST/PATCH/DELETE (24h window, full-response-body cache, per architect spec §6).
Cursor pagination on list endpoints (opaque (createdAt, id) tuple, per architect spec §5).
Webhook delivery infrastructure (all 16 events live, HMAC signing, retry + DLQ, Settings → Webhooks CRUD, secret rotation).
Error code VALIDATION_ERROR — a /v1/* request that doesn't match the published spec returns a structured 400 with the specific field/schema violation in meta.errors, instead of falling through to a handler or a generic 500.
Feature gate on every /v1/* request — the API key's creator-user must hold the developer_api feature (Developer API add-on or Enterprise tier). Unlicensed requests get 403 ADDON_REQUIRED before rate limiting or scope enforcement run.

?page=&limit= on /v1/* list endpoints — use ?cursor= instead. Sunset and Deprecation response headers are added when a request uses ?page= without ?cursor=. Sunset: 2027-01-30.