Changelog

Compatibility promise

Within 1.x we only add: no endpoint is removed, no field becomes required, no existing field changes meaning. Any of those means 2.0, and 1.x stays available for 12 more months.

• ChangedMCP now exposes **business actions** instead of mirroring 43 endpoints: check_stock, find_products, get_statement, quote_order / place_order / cancel_order, and quote_dropship / place_dropship / release_dropship. One action may chain several calls internally and returns the answer (what is short, what it costs, which document was created). Nothing was removed: list_endpoints and call_endpoint still reach every endpoint, with exactly the same permissions.

• AddedThe missing reconciliation set is here: GET /api/v1/balances, /transactions (each with the balance after it), /bills, /refunds and /freight-bills. Until now these existed only on the OMS website, so month-end had to be reconciled by hand.

• AddedDrop-shipping now has a two-step flow: POST /api/v1/dropship-orders/allocation-preview tells you line by line what can be allocated, what is short, when it arrives and what it costs; then POST /api/v1/dropship-orders/submit. Note the preview holds stock — release it with DELETE /api/v1/dropship-orders/{dropship_order_id}/allocation if you decide not to submit.
• AddedWholesale orders get the same pair: POST /api/v1/orders/{order_id}/allocation-preview and /submit. Payment method can be balance / invoice / wechat / alipay, defaulting to pay-on-invoice.
• AddedVoiding added: DELETE /api/v1/orders/{order_id} and DELETE /api/v1/dropship-orders/{dropship_order_id}, releasing any stock they were holding (already-shipped documents cannot be voided).
• ChangedWhen signed in with an OMS account, creating wholesale and drop-ship orders goes through the OMS front-office chain (lines are validated against your sellable catalogue; a blocked SKU is rejected up front). Channel-secret sign-in is unchanged.

• AddedToken exchange now accepts grant_type=password: sign in with your OMS website account and password ({username, password}); permissions follow the OMS account, and the upstream session stays encrypted inside the gateway. The channel code + secret path is unchanged.
• AddedNew GET /api/v1/me: who this token is — account, channel, usable warehouses, permissions, business switches.

• ChangedThe whole surface moved to /api/v1/*: 27 endpoints renamed under one naming spec — lowercase kebab plural nouns, ownership in the path (/warehouses/{warehouse_code}/stock), snake_case params and fields, one name per concept (term dictionary). Every legacy /Api/* path returns 410 with the new address in error.hint.
• ChangedEnvelope is now {data, …} on success and {error: {code, message, hint, request_id, doc_url}} on failure: the HTTP status is the only success signal — no code / result / msg, no "sucesss".
• ChangedToken exchange is POST /api/v1/auth/token with {client_id, client_secret} in the body — credentials never appear in URLs or access logs. ?token= is no longer accepted on /api/v1/*; use Authorization: Bearer.
• AddedWarehouse master data at GET /api/v1/warehouses: real ERP codes (AUSYD2 / AUSYD1 / CHNZJ1) plus two company-level aggregate views (AU / CN); gateway-invented aliases such as AuStock / SydrhStock are gone. The warehouse allowlist now applies to every request carrying a warehouse_code.
• ChangedStock fields renamed: sku / product_code / quantity_on_hand / quantity_available / price_wholesale / price_retail / currency, and every row carries its warehouse_code; full-warehouse, by-style (?product_code=) and by-SKU (?sku=) queries are one endpoint, GET /api/v1/warehouses/{warehouse_code}/stock.
• ChangedOrders, reservations and carts use lines[{sku, quantity}] (items for carts); a drop-ship order carries one SKU (sku + quantity), the recipient is one object recipient{name, phone, address, country_code, state, city, postal_code} and shipping_method is normal / express; requests and responses share the same shape.
• ChangedReads are GET everywhere: order / drop-ship / shipment / reservation lists take ?start_date=&end_date=; pagination is page / page_size with has_more in the response; drop-ship lookups by client order no. / serial no. are GET /api/v1/dropship-orders?client_order_number= / ?serial_number=.
• ChangedStatuses are readable enums, verified against live ERP data: wholesale orders draft / confirmed / cancelled, reservations reserved / cancelled / confirmed, shipments shipped, drop-ship pending / shipped / intercepted / cancelled; the raw code stays in status_raw; drop-ship payment is the paid boolean. The status query parameter takes the same words.
• AddedIncremental stock sync GET /api/v1/warehouses/{warehouse_code}/stock/changes: only rows changed since the cursor; response {data, version, since, latest, has_more, needs_full_sync}, cursor also in the X-Stock-Version header.
• AddedWebhooks for stock.changed / order.created: payload {event_id, type, channel_code, occurred_at, data}, signed with X-Ever-Signature; retries at 30s → 2m → 10m → 1h → 6h, dead-letter after 6 attempts.
• AddedWrite endpoints honour an Idempotency-Key header; every response carries X-API-Version and X-Request-Id.
• AddedRemote MCP at POST /mcp, the ever CLI (ever login --sandbox, ever stock changes AU --since 0) and AI-readable /llms.txt plus Markdown for every page; tool names are resource_action (stock_list, order_create …) everywhere.
• ChangedRate limiting is point-based: 600 points/min by default; a full-warehouse pull costs 60 (5 when paged), product lists 30, incremental sync is charged by rows actually returned (1 when up to date), writes 2.
• DeprecatedTokens issued by the legacy gateway are accepted until 2026-11-30; after that only tokens obtained with a secret from this site are accepted.