API changelog

Every API and webhook change is recorded here. Breaking changes only ship in a new version (/api/v2) and are announced here in advance.

1. 26 October 20262026-10-26
   Added

   Create or update a contact in one request

   • POST /contacts/upsert: updates the contact the business’s identity keys match (mobile, then email, by default), or creates one.
   • The response is { created, contact }.
2. 24 October 20262026-10-24
   Added

   Appointment events

   • Two new webhook events: booking.created and booking.cancelled.
3. 27 September 20262026-09-27
   Added

   Signed webhooks

   • 16 events for contacts, companies, leads, products, deals, orders and forms.
   • HMAC-SHA256 signature in the Reshta-Signature header.
   • Retries for about 24 hours; disabled after 20 failures in a row, without dropping deliveries.
4. 27 September 20262026-09-27
   Added

   Public API v1

   • Contacts, companies, deals and orders: list, retrieve, create and update; plus notes on contacts, companies and deals.
   • API keys with Read or Read & write access; 120 requests per minute per key.
   • Idempotency-Key is required on every write request.
   • Connection → Developer in the app: create and revoke keys, webhooks, delivery history and Replay.
   • OpenAPI file at /api/v1/public/openapi.json.