Changelog

August 8, 2026

Partner API v1 / 2026-08-08

Security and simplification

• Retired remote form-definition create and update operations. Forms continue to be configured in ClassFlow; integrations can read definitions and submit responses.
• Booking cancellation now requires bookings:cancel, separate from booking creation. Existing active live keys that already had booking write access retain their prior cancellation capability.
• Writes are limited to 30 requests per minute and 10 per 10 seconds. Reads remain at 120 per minute and 30 per 10 seconds.
• New credentials start with public studio, schedule, and catalog reads instead of every data-reading scope.

August 2, 2026

Partner API v1 / 2026-08-02

Added

• 37 operations across studio, locations, schedule, products, forms, submissions, leads, members, memberships, bookings, waitlist, and purchases.
• Studio-scoped API credentials with granular scopes, location restrictions, expiration, rotation, revocation, and one-time secret display.
• Read-only test credentials and live credentials for governed writes.
• 24-hour idempotency for booking creation and cancellation.
• Signed webhooks with attempt history, eight retries, dead-letter state, replay, and signing-secret rotation.
• Studio Developer settings and public OpenAPI schema.

Contract boundaries

• No payment credential, refund, payroll, private staff-note, or internal AI mutation endpoints.
• Test keys read current permitted studio data; they do not create a separate sandbox tenant.
• Every resource lookup is bound to the credential’s studio and optional location allowlist.