Project

Changelog

Additive changes are listed here. Breaking changes are versioned in the path. The current OpenAPI document version is 5.0.0.

2026-10-29 — API management hardening and contract corrections released

The running API now serves the corrected OpenAPI document and Postman collection (token endpoint /api/v1/auth/token; activation authenticated by pairing code and challenge; token refresh signature-only).
API client credentials and webhook subscriptions can be managed only by tenant or platform administrators, and only for the caller's own tenant (platform super administrators see all). Other tenants' records are not listed, revealed, revoked, deleted, tested or retried.
Creating a client with an unknown scope, or a webhook for an unknown event or invalid URL, now returns 400 instead of being stored. The scopes integrations:read and integrations:write can now be issued.
Audit entries for client, webhook and payout actions now name the person or client that performed them, and new records belong to the caller's tenant.
payout.dispatched events are delivered only to the paying tenant's subscribers.

This documentation site is published at rr-docs.medq.co.zw.
HTTPS is enforced for the API and public sites: plain HTTP requests receive a 308 redirect, and the connection from our CDN to the origin is validated (Full strict).
Edge rate limits are active on device activation and refresh, the public forms and record verification (see Errors & rate limits). A 429 from the edge has an HTML body and no Retry-After.
Device pairing is configured in production. Activation still depends on Google Play Integrity configuration.
Corrected in the source: the OpenAPI security schemes list the real client-credentials endpoint (POST /api/v1/auth/token) and mark device activation as authenticated by the pairing code and challenge rather than by a bearer token and request signature, and token refresh as signature-only.

Added the /api/v1/public endpoints and the /api/v1/mobile device API with its administration endpoints.
Device authentication hardened: Play Integrity tokens must be fresh (10 minutes) and bound to the registered key; timestamps are bounded to ±120 seconds; nonces are single use; comparison of non-hex input no longer fails with a server error; revoking a device also clears its stored refresh credential.