API Changelog

All notable additions and changes to the Bidyear REST API v1.

2026-07-12 — v1.0 Initial Release

Added — Public endpoints

  • GET /v1/auctions, /v1/auctions/{id}, /v1/auctions/{id}/lots — auction listing and detail
  • GET /v1/lots, /v1/lots/geojson, /v1/lots/{id}, /v1/lots/{id}/bids — lot resources with land filters and GeoJSON map support
  • GET /v1/categories (with tree support), /v1/categories/{id}, /children, /schema
  • GET /v1/subscription-plans — public pricing/marketing data
  • GET /v1/cross-listing-platforms — integration directory
  • GET /v1/help/categories, /v1/help/search — Help Center API

Added — Authenticated endpoints

  • GET /user, GET /v1/me, GET /v1/me/verification — profile and verification status
  • GET /v1/invoices, GET /v1/invoices/{id} — invoice access (ability: read)
  • POST /v1/lots/{lot}/bids — bid placement via ProxyBiddingService (ability: write)
  • POST/DELETE /v1/lots/{lot}/watchlist — watchlist management (ability: write)
  • POST /media/reorder, DELETE /media/{id} — media management with ownership enforcement (ability: write or session)
  • GET /v1/ad-campaigns — seller campaigns (ability: seller)
  • GET /v1/subscriptions/current — current subscription (ability: seller)
  • Full webhook subscription CRUD + delivery log (ability: seller)

Added — Inbound webhooks

  • POST /webhooks/stripe — Stripe events (Stripe-Signature verified)
  • POST /webhooks/bid/{platform} — simulcast bid events (HMAC verified)
  • POST /webhooks/sold/{platform} — simulcast sold events (HMAC verified)

Added — Token abilities

  • Sanctum abilities registered: read, write, seller, admin
  • EnsureTokenAbility middleware — SPA session users bypass token checks on media endpoints
  • ResolveApiTeam middleware — reads X-Team-Id header for multi-team seller context

Added — Outbound webhook events

  • lot.sold, lot.unsold, auction.published, bid.placed
  • invoice.paid, invoice.payment_failed
  • user.verified, seller.approved, subscription.updated

Added — Infrastructure

  • Rate limiter: 60 requests/minute per user/IP (throttle:api)
  • Consistent success / data / meta / message / errors / code envelope via RespondsWithApi trait
  • OpenAPI 3.1 specification at /docs/api/openapi.json
Versioning policy: Breaking changes will increment the major version prefix (e.g. /v2/). Non-breaking additions (new endpoints, new optional fields) will be documented here without a version bump.