> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lazyapp.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> What shipped, newest first.

**2026-10-23**

v1

**Flat plans.** Flat monthly plans (Starter, Growth and Pro) replace the per-message charge. LazyApp adds 0% to Meta's rates: Meta bills each message to the business's own payment method, and the plan is what pays LazyApp. Test mode stays free. See [Plans and limits](https://docs.lazyapp.in/billing/pricing-and-tiers.md).

**Live keys need Pro.** A `sk_live_` key on a workspace below Pro gets `402` with `code: plan_limit_reached`. A broadcast past the month's live broadcast sends, or a number past the plan's numbers, returns `422` with a plain message. Test keys are never plan-limited. See [Errors](https://docs.lazyapp.in/concepts/errors.md#402-plan-limit-reached).

**Platform customers.** `/v1/platform/customers` no longer stores or returns `markup_bps`, `pricing_mode`, `category_markups` or `platform_fee`. Values you still send are ignored, and the request succeeds. Customer usage no longer includes `wholesale_total` or `marked_up_total`.

**Fixes from building real apps on the API.**

* Free-form replies in an open conversation count against the contact's last message (10 each), not the hourly per-recipient cap, so a bot no longer stops answering mid-conversation. See [Rate limits](https://docs.lazyapp.in/reference/rate-limits.md#send-velocity-abuse-guards).
* `POST /v1/flows` returns the data-endpoint `endpoint_secret` once, and `POST /v1/flows/{flow}/rotate-endpoint-secret` replaces it. See [Flows](https://docs.lazyapp.in/guides/flows.md#verify-the-signature).
* `flow.response_received` reaches endpoints restricted to the number the flow was completed on.
* `PATCH /v1/webhooks/{webhook}` updates an endpoint in place. The OpenAPI `subscribed_events` enum now lists every event.
* Message webhooks carry `contact.profile_name`. `commerce.order` is in the [event reference](https://docs.lazyapp.in/webhooks/events.md).
* A plain "yes" (in any language) no longer restores marketing consent after STOP. START and UNSTOP still do.
* OTP: refusals carry a `code`, waiting is a `429` with `Retry-After`, the per-IP rule uses the optional `client_ip`, send and verify have separate limits, `language` is accepted, a code needs an authentication template outside the 24-hour window, and a locked number stays locked for the right code too. See [Verify](https://docs.lazyapp.in/sending/verify.md#limits).
* Contact `attributes` are merged instead of replaced.
* Segments filter tags by `names` or `uuids`. Broadcasts validate `variable_map` and document `header_media`.
* `POST /v1/events` takes `"deliver": false` to record an event without sending, and `/v1/event-definitions` defines your own event types.
* `PATCH /v1/conversations/{id}` assigns, sets status and tags; `/v1/conversations/{id}/notes` adds internal notes.
* `POST /v1/templates` accepts `header.example_url` and `carousel_cards[].example_url` instead of a separate sample upload.

**2026-10-08**

v1

**API reference.** The OpenAPI spec now includes groups, `POST /v1/calls`, catalog sync, WhatsApp funding, and the rest of the Meta-compatible proxy: media retrieve and delete, business profile, and block users.

**2026-09-02**

v1

**Wave 3 API gaps.** Voice notes (`voice` on audio messages), conversation search / typing / workspace archive-pin, flow starters + duplicate, connection block-users / business-profile / insights, broadcast per-recipient `variable_map` + append recipients, contact segments / tags / bulk import, `GET /v1/pricing/rates`, and `GET /v1/analytics/messaging`.

**2026-09-01**

v1

**Retrieve a message.** `GET /v1/messages/{uuid}` returns LazyApp's local message record (status, timestamps, body, metadata). Scope `messages:read`. Prefer webhooks in production; this is for confirmation and debugging.

**Customer API key scopes.** `POST /v1/platform/customers/{customer}/api-keys` accepts an optional `scopes` array and returns the granted scopes with the plaintext key.

**Platform guides.** Docs now cover the multi-tenant model plus tenant messaging, usage dashboards, and inbox recipes under Platforms.

**2026-08-25**

v1

**Call history API.** `GET /v1/calls` and `GET /v1/calls/{call}` return WhatsApp call records (direction, status, duration, related conversation). Scope `messages:read`. Live WebRTC answer is not included.

**2026-08-25**

v1

**Automation packs.** `PUT /v1/automation-packs/provision` seeds event-to-template mappings, starter workflows and Flows for a vertical pack (starting with `real_estate`). See [automation packs](https://docs.lazyapp.in/sending/automation-packs.md).

**Event mapping API.** `GET /v1/event-mappings` lists workspace mappings. `PUT /v1/event-mappings/provision` creates or updates them from a pack or an explicit list.

**Capabilities fields.** `GET /v1/capabilities` returns `connection_uuid`, `quality_rating` and `messaging_limit_tier` per connection.

**2026-08-22**

v1

**Webhook resume and secret rotation.** Paused endpoints can be turned back on with `POST /v1/webhooks/{webhook}/resume`. Lost signing secrets can be rotated with `POST /v1/webhooks/{webhook}/rotate-secret` without deleting the endpoint. Listing now includes `pause_reason`.

**Inbound media download.** `GET /v1/messages/{message}/media` returns the bytes of media a contact sent in. Returns `409` while the download is still queued.

**Contact consent API.** `POST /v1/contacts/{contact}/consent` records consent collected outside LazyApp — for example from a website opt-in box. Granting marketing consent lifts a matching suppression.

**Starter template sets.** `GET /v1/templates/sets` lists the template sets this installation supports. Pass `template_set` when creating a setup link.

**`customers:act` scope.** Platforms can act on a customer's behalf with `X-LazyApp-Customer` without holding `customers:write`.

**Stable send refusal codes.** Refused sends now include a `code` — `customer_service_window_closed`, `contact_suppressed`, `marketing_opt_out`, or `no_connection`. Contacts report `service_window` on read.

**2026-08-19**

v1 · breaking, pre-launch

**One shape for one object.** The Platform API wrapped single objects in a `data`
envelope while every other single-object response was bare. All of them are bare now;
`data` wraps lists only. See [conventions](https://docs.lazyapp.in/concepts/conventions.md#response-shape).

**Every `DELETE` answers `204`.** Four endpoints previously returned `200` with
`{"deleted": true}` or `{"cancelled": true}`. A successful delete has no body.

**`GET /v1/workflows` cursor-paginates** like every other list, so a workspace with
more than 100 workflows can read all of them.

> [!NOTE]
>
> These three are breaking, and they are shipping before the API has integrators.
> Nothing after this point changes an existing response shape inside `v1` — see
> [versioning](https://docs.lazyapp.in/reference/versioning.md).

**2026-08-19**

v1

**Idempotency on every write.** `Idempotency-Key` is now honoured on all `/v1` write endpoints, not just messages and events. A retry replays the recorded response; reusing a key with a different body is refused. See [idempotency](https://docs.lazyapp.in/concepts/idempotency.md).

**Cursor pagination everywhere.** Broadcasts, events, media, templates, flows, scheduled messages and webhook endpoints now paginate like contacts and conversations, so a caller with more than one page can reach all of it.

**Media access history.** `GET /v1/media/{media}` returns `access_history` — who read, uploaded or deleted a file, when, and from where. The history outlives the asset.

**Events accept workspace-defined types and contact recipients.** `type` now validates against the event definitions in your workspace, and `recipient.type: contact_id` addresses a contact directly.

**`contact_information_request`.** Ask a contact for a phone number inside a conversation and have the reply attach to their record.

**Added `GET /v1/capabilities`** so clients can check what a connection supports instead of hard-coding assumptions.

**Scheduled sending.** `send_at` and `ttl_seconds` on `POST /v1/messages`, plus `GET` and `DELETE /v1/messages/scheduled`.

**Added** `/v1/templates`, `/v1/contacts`, `/v1/conversations`, `/v1/workflows`, `/v1/broadcasts`, `/v1/webhooks` and `/v1/flows`.

**Added the Meta-compatible proxy** at `/meta/whatsapp/{version}/...`. See [migrating](https://docs.lazyapp.in/migrating/from-cloud-api.md).

**Added `POST /v1/integrations/{source}/events`** for external systems.

**Every response now carries** `X-RateLimit-*` and `X-LazyApp-Api-Version`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.