# Changelog > Changes to the Cevoid API, Storefront API, webhooks, widgets, Analytics SDK and MCP server that developers need to know about, newest first. Updated: 2026-10-20 Docs index: https://docs.cevoid.com/developers/llms.txt ## October 2026 ### Rotate API keys with a grace period Date: 2026-10-16 · Type: Added · Areas: API Link: Rotating a secret API key creates a successor with the same name, scopes and owner, and keeps the old key working for 0, 1, 24 or 168 hours, so you can deploy the new secret without downtime. Choose Rotate from the key's menu or its details in the dashboard. The new secret is shown once. A grace period of 0 revokes the old key at once. Revoked, expired and already rotated keys cannot be rotated. ### Storefront reviews and rich snippets need Reviews in the workspace plan Date: 2026-10-13 · Type: Changed · Areas: Storefront API Link: The Storefront API's review endpoints and GET /v1/products/{productRef}/rich-snippet return 403 when the workspace's plan does not include Reviews, with the message that Reviews is not included in the plan. Review reads and rich snippets carry review content, so they follow the Reviews plan. Workspaces whose plan includes Reviews see no change. See [Rich snippets](https://docs.cevoid.com/developers/storefront-api/rich-snippets.md). Operations: [`GET /v1/products/{productRef}/rich-snippet`](https://docs.cevoid.com/developers/storefront-api/storefront-rendering/render-a-product-rich-snippet.md), [`GET /v1/products/{product_id}/reviews`](https://docs.cevoid.com/developers/storefront-api/reviews/list-product-reviews.md), [`GET /v1/product-reviews/{review_id}`](https://docs.cevoid.com/developers/storefront-api/reviews/get-product-review.md), [`GET /v1/product-reviews/ratings`](https://docs.cevoid.com/developers/storefront-api/reviews/get-product-ratings.md), [`GET /v1/product-reviews/summaries`](https://docs.cevoid.com/developers/storefront-api/reviews/get-product-review-summaries.md), [`GET /v1/product-reviews/summaries/{product_id}`](https://docs.cevoid.com/developers/storefront-api/reviews/get-product-review-summary.md), [`GET /v1/company-reviews`](https://docs.cevoid.com/developers/storefront-api/reviews/list-company-reviews.md), [`GET /v1/company-reviews/{review_id}`](https://docs.cevoid.com/developers/storefront-api/reviews/get-company-review.md), [`GET /v1/company-reviews/summary`](https://docs.cevoid.com/developers/storefront-api/reviews/get-company-review-summary.md) ### API v1 endpoint limits are shared per workspace Date: 2026-10-11 · Type: Changed · Areas: API · Version: v1 Link: On API v1, the inbox, single post and collection posts endpoints each allow 20 requests per second with bursts of up to 40, shared by all of a workspace's keys, so more keys no longer add capacity. The three endpoints are `GET /v1/inbox`, `GET /v1/posts/{id}` and `GET /v1/collections/{id}/posts`. Before, the inbox and single post endpoints allowed 5 requests per second per key. Since September 24, every key also has a safety limit of 200 requests per second, with bursts of up to 400, across all API v1 data routes. See [API v1 rate limits](https://docs.cevoid.com/developers/api/v1.md#rate-limits). Operations: [`GET /v1/inbox`](https://docs.cevoid.com/developers/api/v1/inbox/get-inbox-posts.md), [`GET /v1/posts/{id}`](https://docs.cevoid.com/developers/api/v1/posts/get-post-by-id.md) ### Full access and read-only presets for API keys and MCP connections Date: 2026-10-09 · Type: Added · Areas: API, MCP Link: API keys and MCP connections can be granted Full access (\*) or Read only (\*:read), which also cover scopes added later, and their access can now be edited instead of revoked and recreated. A preset is stored as the preset itself, not as the scopes that exist today, so a read-only key gains read access to new resources as they ship. Custom scope lists stay explicit, and existing credentials keep the scopes they had. A changed scope applies from the next request; MCP clients see a changed tool list after they reconnect. See [secret key scopes](https://docs.cevoid.com/developers/api/authentication.md#scopes). ### MCP authorization metadata at the path-suffixed URL Date: 2026-10-08 · Type: Fixed · Areas: MCP Link: The MCP server also serves its OAuth authorization server metadata at /.well-known/oauth-authorization-server/mcp, the RFC 8414 location clients such as Claude Code look up, and clients with a stale token can authorize again. Before, the metadata was only at `/.well-known/oauth-authorization-server`, and spec-following clients such as Claude Code could fail to connect. Both locations now answer. See [MCP](https://docs.cevoid.com/developers/mcp.md) for the discovery documents. ### Order buyers are set only when an order is created Date: 2026-10-06 · Type: Removed · Areas: API · Breaking change · Version: v2 Link: PATCH /v2/orders/{id} no longer accepts buyer, so an update cannot reassign or unlink an order's buyer, and POST /v2/orders works out fulfillment_status from the order lines when you leave it out. Buyer details are create-only: once loyalty processing has used an order's buyer, an API update can no longer reassign or unlink it. Before this change, `fulfillment_status` defaulted to `PENDING` when omitted. #### Migration Send `buyer` with `POST /v2/orders`, and remove it from `PATCH /v2/orders/{id}` requests, which now fail validation when they include it. Send `fulfillment_status` on create when you want a specific status rather than the one the lines imply. Operations: [`PATCH /v2/orders/{id}`](https://docs.cevoid.com/developers/api/orders/update-order.md), [`POST /v2/orders`](https://docs.cevoid.com/developers/api/orders/create-order.md) ### Post includes and more post filters in API v2 Date: 2026-10-02 · Type: Added · Areas: API · Version: v2 Link: GET /v2/posts filters by profile_id and can require all labels with label_match=all, and both post operations return the posts' products and profiles in the same response with include. `include=products` returns the tagged products localized to a `market`, which it then requires, and needs `products:read`. `include=profiles` returns the profiles the posts reference and needs `profiles:read`; profile fields are secret-key data, so keep them on your server. `label_match` is `any` by default and needs `label_id`. Operations: [`GET /v2/posts`](https://docs.cevoid.com/developers/api/posts/list-posts.md), [`GET /v2/posts/{id}`](https://docs.cevoid.com/developers/api/posts/get-post.md) ### Storefront API posts Date: 2026-10-02 · Type: Added · Areas: Storefront API Link: GET /v1/posts and GET /v1/posts/{post_id} on the Storefront API return a workspace's public posts for custom storefronts, called with a publishable key. `GET /v1/posts` requires `market`, filters by `product_ref`, `gallery_id`, `profile_id` and `label_id` among others, and pages with a cursor, up to 50 posts per page. Every Storefront operation now shares one limit per publishable key: 20 requests per second, with bursts of up to 40. See [Custom UGC](https://docs.cevoid.com/developers/storefront-api/custom-ugc.md) and [rate limits](https://docs.cevoid.com/developers/storefront-api/caching-and-rate-limits.md#rate-limits). Operations: [`GET /v1/posts`](https://docs.cevoid.com/developers/storefront-api/storefront-ugc/list-posts.md), [`GET /v1/posts/{post_id}`](https://docs.cevoid.com/developers/storefront-api/storefront-ugc/get-post.md) ### API v2 rate limits are per workspace, for reads and writes Date: 2026-10-02 · Type: Changed · Areas: API · Breaking change · Version: v2 Link: API v2 now allows 25 reads and 10 writes per second per workspace, shared by all its keys, and GET /v2/me reports them as rate_limits.reads and rate_limits.writes. Every request counts once, whatever its page size. The per-key budgets and the separate costs for light, normal and heavy reads and for order writes are gone, so creating more keys no longer adds capacity. See [Rate limits](https://docs.cevoid.com/developers/api/rate-limits.md). #### Migration If you read `data.rate_limits` from `GET /v2/me`, use `reads` and `writes` instead of `cheap_read`, `normal_read`, `expensive_read`, `expensive_read_workspace` and `high_risk_mutation`. If you spread traffic across several keys for more capacity, plan for the shared workspace limit and back off on `429` using `Retry-After`. Operations: [`GET /v2/me`](https://docs.cevoid.com/developers/api/authentication/get-authentication-details.md) ## September 2026 ### MCP clients can edit BrandKit Date: 2026-09-29 · Type: Added · Areas: MCP Link: New BrandKit tools let an MCP client read and change the styling, color schemes, fonts and icons that reviews and emails use, behind the new brandkit:read and brandkit:write scopes. Find the tools with `tool-search`, for example `brandkit.get`. Since September 30, changes go to a shared draft: `brandkit.preview` renders it, and `brandkit.publish` (or the BrandKit editor) makes it live. See [BrandKit changes](https://docs.cevoid.com/developers/mcp.md) on the MCP page. ### Import order history without starting Flows Date: 2026-09-25 · Type: Added · Areas: API · Version: v2 Link: POST /v2/orders accepts ingestion_mode. Orders sent as historical start no automatic Flows and earn no purchase-incentive points, so you can import order history safely. `ingestion_mode` is `live` by default, which keeps the behaviour new orders always had. Send `historical` for orders that already happened; such an order stays out of automatic purchase incentives even after later live updates. `PATCH /v2/orders/{id}` also accepts `ingestion_mode`. Operations: [`POST /v2/orders`](https://docs.cevoid.com/developers/api/orders/create-order.md), [`PATCH /v2/orders/{id}`](https://docs.cevoid.com/developers/api/orders/update-order.md) ### MCP tools are found with tool-search and run with execute-tool Date: 2026-09-23 · Type: Changed · Areas: MCP · Breaking change Link: The MCP server now exposes four tools, list-workspaces, tool-search, execute-tool and execute-batch, and the analytics tools are found through tool-search under names such as analytics.run-report. Clients see a short tool list that stays the same as the server gains tools. `tool-search` returns matching tools with their input schemas; `execute-tool` runs one, and `execute-batch` runs independent reads together. #### Migration Clients that pick tools from the list need no change. If a prompt, script or client configuration calls an analytics tool by its old name, such as `run-report`, call `tool-search` to find it and run `analytics.run-report` through `execute-tool` instead. The current tools are listed on [MCP](https://docs.cevoid.com/developers/mcp.md). ### Post hotspot positions in API v2 Date: 2026-09-22 · Type: Fixed · Areas: API · Version: v2 Link: Tagged products on API v2 posts now keep the hotspot positions merchants placed, as x and y from 0 to 1. Before, every placed hotspot was dropped and only tags at the corner remained. Positions are stored as percentages and were checked against the published 0 to 1 range instead of being converted, so only values of exactly 0 or 1 survived. They are now divided by 100. No change is needed on your side; `tagged_products` simply carries the positions it always promised. Operations: [`GET /v2/posts`](https://docs.cevoid.com/developers/api/posts/list-posts.md), [`GET /v2/posts/{id}`](https://docs.cevoid.com/developers/api/posts/get-post.md) ### Reviews in API v2 Date: 2026-09-20 · Type: Added · Areas: API · Version: v2 Link: API v2 reads product and company reviews, their ratings and summaries, review requests and an order's review status, and imports reviews from other platforms. New scopes reviews:read, reviews:write and review-requests:read control access. Reads take `market` for localized text and `include` for related resources and original content. `GET /v2/orders/{order_id}/review-status` returns the reviews an order already has and what its lines can still be reviewed for. Imports create a pending review and take an `Idempotency-Key`; see [Idempotency](https://docs.cevoid.com/developers/api/idempotency.md). Grant the new scopes as described in [secret key scopes](https://docs.cevoid.com/developers/api/authentication.md#scopes). Operations: [`GET /v2/product-reviews`](https://docs.cevoid.com/developers/api/reviews/list-product-reviews.md), [`GET /v2/product-reviews/{review_id}`](https://docs.cevoid.com/developers/api/reviews/get-product-review.md), [`POST /v2/product-reviews`](https://docs.cevoid.com/developers/api/reviews/create-product-review.md), [`GET /v2/product-reviews/ratings`](https://docs.cevoid.com/developers/api/reviews/get-product-ratings.md), [`GET /v2/product-reviews/summaries`](https://docs.cevoid.com/developers/api/reviews/get-product-review-summaries.md), [`GET /v2/product-reviews/summaries/{product_id}`](https://docs.cevoid.com/developers/api/reviews/get-product-review-summary.md), [`GET /v2/company-reviews`](https://docs.cevoid.com/developers/api/reviews/list-company-reviews.md), [`GET /v2/company-reviews/{review_id}`](https://docs.cevoid.com/developers/api/reviews/get-company-review.md), [`POST /v2/company-reviews`](https://docs.cevoid.com/developers/api/reviews/create-company-review.md), [`GET /v2/company-reviews/summary`](https://docs.cevoid.com/developers/api/reviews/get-company-review-summary.md), [`GET /v2/review-requests`](https://docs.cevoid.com/developers/api/reviews/list-review-requests.md), [`GET /v2/review-requests/{request_id}`](https://docs.cevoid.com/developers/api/reviews/get-review-request.md) ### Storefront API reviews Date: 2026-09-20 · Type: Added · Areas: Storefront API Link: The Storefront API reads a workspace's public product and company reviews, their ratings and summaries, for custom storefronts, called with a publishable key. Pass `market` for localized text and `include=localization` for the original content beside it. Review responses are never cached; see [Caching](https://docs.cevoid.com/developers/storefront-api/caching-and-rate-limits.md#caching). Operations: [`GET /v1/products/{product_id}/reviews`](https://docs.cevoid.com/developers/storefront-api/reviews/list-product-reviews.md), [`GET /v1/product-reviews/{review_id}`](https://docs.cevoid.com/developers/storefront-api/reviews/get-product-review.md), [`GET /v1/product-reviews/ratings`](https://docs.cevoid.com/developers/storefront-api/reviews/get-product-ratings.md), [`GET /v1/product-reviews/summaries`](https://docs.cevoid.com/developers/storefront-api/reviews/get-product-review-summaries.md), [`GET /v1/product-reviews/summaries/{product_id}`](https://docs.cevoid.com/developers/storefront-api/reviews/get-product-review-summary.md), [`GET /v1/company-reviews`](https://docs.cevoid.com/developers/storefront-api/reviews/list-company-reviews.md), [`GET /v1/company-reviews/{review_id}`](https://docs.cevoid.com/developers/storefront-api/reviews/get-company-review.md), [`GET /v1/company-reviews/summary`](https://docs.cevoid.com/developers/storefront-api/reviews/get-company-review-summary.md) ### Post labels in API v1 Date: 2026-09-10 · Type: Added · Areas: API · Version: v1 Link: GET /v1/posts returns the ids of each post's labels when you add include=labels. Labels are left out by default, so responses stay as they were. Use the label ids to filter posts by label. See [Includes](https://docs.cevoid.com/developers/api/v1.md#includes) in the API v1 guide. Operations: [`GET /v1/posts`](https://docs.cevoid.com/developers/api/v1/posts/list-posts.md) ### Labels in API v2 Date: 2026-09-09 · Type: Added · Areas: API · Version: v2 Link: API v2 can list, read, create, update and delete labels, and GET /v2/posts filters posts by label with label_id. New scopes labels:read and labels:write control access. Grant `labels:read` to read labels and `labels:write` to manage them; see [secret key scopes](https://docs.cevoid.com/developers/api/authentication.md#scopes). Filtering posts by label is described in [Filtering](https://docs.cevoid.com/developers/api/filtering.md). Operations: [`GET /v2/labels`](https://docs.cevoid.com/developers/api/labels/list-labels.md), [`GET /v2/labels/{id}`](https://docs.cevoid.com/developers/api/labels/get-label.md), [`POST /v2/labels`](https://docs.cevoid.com/developers/api/labels/create-label.md), [`PATCH /v2/labels/{id}`](https://docs.cevoid.com/developers/api/labels/update-label.md), [`DELETE /v2/labels/{id}`](https://docs.cevoid.com/developers/api/labels/delete-label.md), [`GET /v2/posts`](https://docs.cevoid.com/developers/api/posts/list-posts.md) ### Review replies can trigger webhooks Date: 2026-09-09 · Type: Added · Areas: Webhooks Link: Flows can start when you reply to a review, with the new product-review\.replied and company-review\.replied events, and deliver them to a webhook destination through the Send notification action. Both events use the same signed envelope as every other webhook. See [Set up a webhook](https://docs.cevoid.com/developers/webhooks/set-up.md). Events: `product-review.replied`, `company-review.replied` ### UGC and loyalty events can trigger webhooks Date: 2026-09-08 · Type: Added · Areas: Webhooks Link: Flows can start from five new events and deliver them to a webhook destination through the Send notification action, so your endpoint hears about uploads, tiers, rewards and expiring points. The new triggers are `upload.completed`, `tier.earned`, `reward.fulfilled`, `tier.evaluation-approaching` and `points.expiration-approaching`. Deliveries use the same signed envelope as every other webhook; set one up as described in [Set up a webhook](https://docs.cevoid.com/developers/webhooks/set-up.md). Events: `upload.completed`, `tier.earned`, `reward.fulfilled`, `tier.evaluation-approaching`, `points.expiration-approaching` ### API v2 and the Storefront API get versioned contracts Date: 2026-09-08 · Type: Added · Areas: API, Storefront API · Version: v2 Link: API v2 and the Storefront API's /v1 routes now have released contracts that CI protects, so a breaking change ships under a new route version instead of changing an existing operation. The compatibility check rejects removed paths, operations, responses and properties, newly required parameters or body fields, and stricter request schemas. New operations, optional fields and looser request rules stay compatible. The release also settled how the APIs are called: - API v2 authenticates with `Authorization: Bearer` and a secret key (`cev_sk_…`); see [Authentication](https://docs.cevoid.com/developers/api/authentication.md). - Resources have stable public ids with a type prefix, such as `prf_` for profiles and `pst_` for posts. - `POST /v2/orders` and `PATCH /v2/orders/{id}` take an `Idempotency-Key` header. An identical retry within seven days replays the first response; reusing the key for a different request returns `409`. - The Storefront API's rich snippet operation moved under `/v1`, at `GET /v1/products/{productRef}/rich-snippet`. Operations: [`GET /v2/me`](https://docs.cevoid.com/developers/api/authentication/get-authentication-details.md), [`POST /v2/orders`](https://docs.cevoid.com/developers/api/orders/create-order.md), [`PATCH /v2/orders/{id}`](https://docs.cevoid.com/developers/api/orders/update-order.md), [`GET /v1/products/{productRef}/rich-snippet`](https://docs.cevoid.com/developers/storefront-api/storefront-rendering/render-a-product-rich-snippet.md) ## August 2026 ### A smaller webhook envelope and separate review events Date: 2026-08-11 · Type: Changed · Areas: Webhooks · Breaking change Link: Webhook bodies now carry version, id, type, created_at, data and origin.flow only, and review\.submitted is split into product-review\.submitted and company-review\.submitted. The envelope no longer has `apiVersion`, `payloadVersion`, `context` or the `flow` block with run and attempt ids. `data` holds the public resources the event concerns, and `origin.flow` names the Flow that sent it, so you can tell two Flows on one endpoint apart. #### Migration Read the event from the new envelope: `type` for what happened, `data` for the resources and `created_at` for when. Handle `product-review.submitted` and `company-review.submitted` where you handled `review.submitted`; a Flow now triggers on one of the two. The envelope is described on [Webhooks](https://docs.cevoid.com/developers/webhooks.md). Events: [`product-review.submitted`](https://docs.cevoid.com/developers/webhooks/product-review-submitted.md), [`company-review.submitted`](https://docs.cevoid.com/developers/webhooks/company-review-submitted.md) ### Webhooks from Flows Date: 2026-08-03 · Type: Added · Areas: Webhooks Link: A Flow can now send signed webhooks to your HTTPS endpoint when an order is fulfilled or delivered or a review is submitted, with test sends, retries and replays. Each delivery is a `POST` signed with [Standard Webhooks](https://www.standardwebhooks.com/) headers (`webhook-id`, `webhook-timestamp`, `webhook-signature`). The launch triggers were `order.fulfilled`, `order.delivered` and `review.submitted`. A retry sends the same event with the same `webhook-id`; a replay creates a new delivery to the destination's current URL. During a signing secret rotation, deliveries carry a signature for each secret. Start with [Webhooks](https://docs.cevoid.com/developers/webhooks.md) and [Verify signatures](https://docs.cevoid.com/developers/webhooks/verify-signatures.md). Events: [`order.fulfilled`](https://docs.cevoid.com/developers/webhooks/order-fulfilled.md), [`order.delivered`](https://docs.cevoid.com/developers/webhooks/order-delivered.md) ## July 2026 ### MCP OAuth scopes are analytics:read and analytics:write Date: 2026-07-15 · Type: Changed · Areas: MCP · Breaking change Link: The MCP server's OAuth scopes are now analytics:read and analytics:write. Clients that request the old mcp:tools or mcp:analytics:write scopes by name are refused with an invalid scope error. A client that requests no scopes still gets read access, now as `analytics:read`. Only clients that list scopes by name are affected. #### Migration Request `analytics:read` for queries and reports, and add `analytics:write` when the client should create or update reports and dashboards. Remove `mcp:tools` and `mcp:analytics:write` from the client's configuration. ### Scoped secret API keys Date: 2026-07-15 · Type: Added · Areas: API Link: New API keys are secret keys (cev_sk\_…) that grant only the scopes you choose and can expire. API v1 accepts them too; existing legacy v1 keys keep full v1 access until you revoke them. Create a key in the dashboard, pick its scopes and, optionally, when it expires. The secret is shown once. On API v1, post and inbox requests need `posts:read` and the members endpoint needs `members:read`. Legacy keys can no longer be created. See [secret key scopes](https://docs.cevoid.com/developers/api/authentication.md#scopes) and [API v1 authentication](https://docs.cevoid.com/developers/api/v1.md#authentication). Operations: [`GET /v1/posts`](https://docs.cevoid.com/developers/api/v1/posts/list-posts.md), [`GET /v1/inbox`](https://docs.cevoid.com/developers/api/v1/inbox/get-inbox-posts.md) ### MCP clients can query analytics and manage reports and dashboards Date: 2026-07-14 · Type: Added · Areas: MCP Link: The MCP server covers UGC, Loyalty and Profiles analytics, and clients can now create and update reports and read dashboards, with write access behind a separate consent. New tools include `create-report`, `update-report`, `list-dashboards` and `get-dashboard`, next to the query tools. Report and dashboard writes need explicit write consent when you authorize the client. Report runs, queries and writes are limited to 20 calls per minute. ## June 2026 ### MCP connections stay signed in and can cover several workspaces Date: 2026-06-04 · Type: Added · Areas: MCP Link: The MCP server now issues rotating refresh tokens, lets one authorization cover several workspaces, accepts Client ID Metadata Documents and Dynamic Client Registration, and supports token revocation. Access tokens last 15 minutes. Refresh tokens rotate on every use and expire 30 days after the latest refresh, so a client that keeps using its connection does not have to sign in again. Reusing a refresh token that was already rotated is rejected. Clients should read the advertised Protected Resource Metadata and send the MCP endpoint as the OAuth `resource`. Client implementer details are on [MCP](https://docs.cevoid.com/developers/mcp.md). ## May 2026 ### The Cevoid MCP server is available Date: 2026-05-01 · Type: Added · Areas: MCP Link: AI clients such as Claude Desktop and Cursor can connect to Cevoid's hosted MCP server at https\://mcp.cevoid.com/mcp with OAuth 2.1 and answer analytics questions from saved reports. The first tools search saved analytics reports (`search-reports`), read a report (`get-report`), run it for a date range (`run-report`) and list the metric catalog (`list-metrics`). Access is scoped to the workspace you authorize. See [MCP](https://docs.cevoid.com/developers/mcp.md) to connect a client. --- Canonical: https://docs.cevoid.com/developers/changelog