The API contract is now fully readable without an account, and the published webhook catalog matches what the platform actually sends.
✨ Changes:
- OpenAPI spec, Swagger console, and Postman collection are reachable anonymously; they previously returned 403
- Changelog, webhook catalog, and API tester no longer redirect anonymous visitors to login
- Postman collection is generated from the live endpoint registry instead of a stale static file
- Webhook catalog rewritten to the 17 events the platform actually dispatches, with payload examples taken from the delivery code
- Corrected the documented replay-protection header to X-Request-ID and the canonical signing string to METHOD|PATH|TIMESTAMP|BODY
🚫 Deprecated:
- Documentation previously referenced an X-Nonce header. The API has always read X-Request-ID; update any integration that was written against the incorrect docs.