Changelog

Changes to the public API, newest first. Additive changes ship as they land; anything that could break a client follows the versioning policy.

2026-09-23

Partner apps

Added

Partner apps: software that many merchants install from the App Store. A merchant approves an app through OAuth, and the app gets a numu_app_… token for that store. See Partner apps.

POST /api/v1/oauth/token and POST /api/v1/oauth/revoke.

data.store_id on every webhook delivery, so an integration that serves several stores knows which store an event is about.

Fixed in these docs

Errors are now documented as the API sends them: {"success": false, "error": {"code": …, "message": …}}. Earlier pages showed {"detail": …}, which the API does not send.

Links between pages that led to a "not found" page now open the right page.

2026-09-19

The public API, documented and gated

Added

GET /api/v1/public/openapi.json — the machine-readable contract for everything a token can call, generated from the running API. /api/v1/public/docs runs requests against it.

Idempotency-Key on POST, PUT and PATCH under /stores/…. A repeat of the same key returns the first response instead of writing twice, and a retry arriving while the first request is still running gets 409. See the quickstart.

Webhook management: PATCH a subscription, POST …/test for a signed test delivery, POST …/rotate-secret for a new signing secret.

X-NUMU-Signature-V1 on every webhook delivery — HMAC over <timestamp>.<body>, so a captured delivery cannot be replayed at you later. The original X-NUMU-Signature still ships.

GET /stores/{store_id}/access-tokens/access — whether this store may use the API, and whether that comes from its plan or from NUMU.

Changed

API access is now enforced. It is included in the Pro plan; on other plans NUMU enables it per merchant. A token on a store without access answers 403.

New tokens must name their scopes and expire after 90 days by default (up to 3650). Existing tokens are unaffected.

Rate limits are per token, not per IP: 300 requests a minute, with X-RateLimit-Limit and X-RateLimit-Remaining on every response.

Webhook subscriptions must point at a public HTTPS address. Loopback and private addresses are refused — develop against a tunnel.

A webhook endpoint that exhausts its retries is switched off and the merchant is told, instead of failing silently. A 410 Gone from your endpoint stops delivery immediately.

Removed

Thirteen webhook event types that were accepted at subscribe time and published by nothing: the return.*, refund.*, customer.* and review.* names, plus order.fulfilled, order.refunded and back_in_stock.notified. Subscribing returned 201 and then delivered nothing, ever. The events that do fire are listed under Webhooks; shipping is carried by order.status_changed.

Older changes predate this page. The OpenAPI document is always the current truth.

Partner apps#

The public API, documented and gated#

Partner apps

The public API, documented and gated