Changelog · crewQI Developer API

1.0.0 · 2026-08-02 · reusable contacts pre-adoption alignment

Added explicit organization /contacts and ordered location-contact relationship operations.
Added contacts:read and contacts:write; existing keys gain neither scope, and location-only keys receive no contact values.
Added idempotency, ETags, tenant-safe IDs, one primary link, redacted audit metadata, and contact-aware location search.
Kept a temporary legacy app projection without exposing singular fields as public API writable fields.
Kept /v1 and 1.0.0; issued-key and access-log proof of zero consumers remains a release gate.

Made /work-events read-only with an explicit safe evidence serializer; scan ingestion remains behind the employee validation RPC.
Moved /timesheets to canonical effective entries and added audited manual create, correction, and void operations with idempotency, reasons, ETags, and overlap control.
Added timesheets:write and safe organization audit:read; removed obsolete work_events:write.
Documented stale export manifests and explicit revision-specific payroll replacement. Payroll is never resent automatically.
Kept /v1 and 1.0.0. Issued keys and gateway/access logs must prove zero consumers; otherwise release stops for compatibility review.

Added nullable articleNumber, supplierName, supplierWebsiteUrl, and orderUrl to explicit material request/response schemas and runtime allowlists.
Added tenant-bound q search across name, article number, and supplier name with literal special-character semantics.
Aligned trim, blank-to-null, maximum-length, and absolute-HTTPS validation at API and database boundaries.
Kept stock/location links and the single preferred-source model unchanged; no supplier, pricing, purchase-order, or multi-source resource was introduced.
Kept /v1 and 1.0.0 under the pre-adoption exception. Issued keys and access logs must still prove zero external consumers immediately before release.

Classified the employer application’s shared Cards/List control as no API impact: it is versioned, per-resource, browser-local presentation state.
Added no card/list preference endpoint, scope, schema, server storage, or cross-browser synchronization contract. The stored value is only cards or list and contains no record, search, organization, or personal data.
Kept both presentations on the existing collection endpoints, stable record IDs, filtering, sorting, and pagination contracts.
Kept public API /v1 and OpenAPI info.version: 1.0.0 unchanged.

Added the dedicated individual GET/PUT /employees/{employeeId}/bank-account subresource.
Added dependent employees:read_financial and employees:write_financial scopes; existing keys gain no financial access.
Kept employee collections, general detail, SCIM, dashboard, activity, and search free of bank-account data.
Kept successful PUT responses masked so idempotency storage never duplicates a full IBAN; only the separately authorized GET returns the complete value.
Changed operation metadata to machine-readable x-required-scopes arrays.
Made health provenance explicit: version stays 1.0.0, while releaseId identifies the exact deployed Git release and appears in value-free operational metrics.
Kept v1 / 1.0.0 under the stated no-consumer assumption. Issued-key inventory and gateway/access logs remain a release gate; finding an external consumer requires compatibility and version review.

Initial versioned organization REST contract.
Added TEST/LIVE bearer keys, resource scopes, cursor pagination, idempotency, ETags, and RFC 9457 problem details.
Added SCIM 2.0 discovery and User provisioning/deactivation.
Established locations as the public product resource name.
Published the versioned /v1/ reference and pinned its renderer to the OpenAPI contract.

Use the interactive API reference for operation-level details, or download openapi.yaml for tooling and review.