Changelog

2026-07-21

• Added VRP-admin message-overwrite administration under /internal/message-overwrites. The collection supports pagination, total counts, deterministic ordering, and case-insensitive partial search across patterns and replacement messages; create, replace, and delete operations reject blank fields and return not found for missing resources.
• Owner statement summary list, detail, and exports now allocate manual listing payouts tagged to a non-owner payee across the ownership-period percentages. Payouts tagged directly to an owner still belong fully to that owner.

2026-07-19

• PRO-16794: added team-name search, pagination, and status-count ordering to GET /partner/owner-statements. Partner dashboards can traverse regional VRT teams with page and limit, or offset and limit, use pagination.total for the complete matching count, and order by draft, inReview, or published counts. Search is a case-insensitive partial match.
• Added GET /partner/owner-statements for regional partner dashboards. It returns VRT child teams with persisted owner-statement counts for draft, inReview, and published; VRI and manager statements are excluded.
• GET /me now includes the resolved team's dataRegion and apiBaseUrl. When the resolved team is a partner, it also includes partnerContext.managedTeamRegions with regional API URLs and active/inactive managed-team counts.
• Regional partner portfolio reads now accept x-data-region. The header selects one storage partition without changing the authenticated partner or team context. Initial support covers team lists/lookups, team issues, and partner-user reads.
• Portfolio pages and cursors remain regional. Clients that combine a multi-region portfolio call each advertised region independently.

2026-07-17

• Added compact, source-versioned connection.changed, sync.status.changed, reservation.changed, listing.changed, statement.status.changed, and transaction.changed webhook contracts. Current authenticated API reads remain the source of truth.
• Webhook creation now requires an explicit verification test after the receiver stores its secret. URL/event-set changes and reactivation require a test of the current subscription revision.
• Secret rotation now emits signatures from the new and previous secrets for a 24-hour overlap. Added webhook administration quotas, 90-day terminal delivery retention, and one-minute delivery recovery.
• Outbound delivery now uses private resolve-and-pin egress. Every attempt rejects mixed or non-public DNS answers, dials one validated numeric address, preserves the original TLS hostname, and never follows redirects. Public enablement remains gated on pre-release failure drills.
• Embedded-session bearer tokens now authenticate on GET /me and preserve their issued team binding when x-team-id is omitted.
• GET /me now returns user.email: null for embedded identities, which use the partner-provided sub instead of an email address. Email remains required for ordinary authenticated users.
• Team-member reads no longer fail for users created with an empty secondary email list; stored values are constrained to JSON arrays.
• Added onLocked=nextOpen to reservation adjustment creation. It resolves books-closed and statement-period conflicts to the earliest valid concrete posting date; onLocked=error remains the default.
• Reservation adjustment dry runs now return the resolved generalLedgerPostingAt without saving the adjustment.
• Clarified that reservation line exclusion is set through a mapping with accountId: null; status=excluded and line isExcluded are derived.

2026-07-16

• Retired partner edge hosts; the public API is served only at https://api.vrplatform.app.
• Removed machine-to-machine credential references from public documentation; public authentication is x-api-key and Authorization: Bearer as listed in the Authentication summary.
• Documented the webhook signature headers and HMAC-SHA256 signed-string format in Webhooks.
• Documented the rate-limit policy in the Error contract: no enforced limits currently, and the API never emits 429.

2026-07

• Added materialized, versioned GET /teams/issues snapshots.
• Added team-owned outbound webhook subscriptions, delivery history, retries, secret rotation, testing, and replay.
• Added team.issues.changed as the first subscribable public event.
• Published generated issue and webhook catalogs from typed runtime registries.

Exact endpoint schemas are generated from current OpenAPI. Historical design context remains in repository RFCs and version logs rather than in current behavior pages.

Documentation

• 2026-07: Consolidated UI business rules, concepts, partner setup, imports, and operations into task-oriented journeys while preserving old documentation URLs with permanent redirects.