API changelog

The public API is the one under /v1 (authentication). Within v1 we only add: new operations, new optional fields, new answer fields, new error codes. Read unknown fields and codes gracefully. A change that would break a working client (removing or renaming an operation or a field, making an optional field required) ships as /v2, announced here first, with /v1 kept alongside. The one exit within v1 is an operation marked Deprecated: it is announced here with its replacement, which works from that day, and with its sunset date; until then it answers as it always has.

The routes under /api/… and /_x/query/… belong to the panel and are not covered by this page.

Each entry is dated (America/Bogotá) and marked Added, Changed, Deprecated or Removed.

2026-10-09: one name per pagination field

Removed

• endCursor and hasNextPage are no longer in a paged answer. Since 30 September they carried the same values as nextCursor and hasMore, which every paged answer still carries and which are the only names from today. Read nextCursor and hasMore; nothing else about paging changes. They went without a deprecation period because they were second names for fields the same answer keeps, removed by the framework the API is built on; a field with no replacement in the same answer will always get one.

Changed

• On the last page nextCursor is null: it is null exactly when hasMore is false. A client that loops while it has a nextCursor now stops at the last page instead of asking for an empty one after it.

2026-09-30: single-object reads, one pagination envelope, more idempotent creates

Added

• Four single-object reads: getCase (GET /v1/get-case, cases:read), getNotification (GET /v1/get-notification, notifications:read), getSendConfirmation (GET /v1/get-send-confirmation, notifications:read) and getImport (GET /v1/get-import, cases:read). They answer the object itself, not a list of one row. When it does not exist, or is not your firm's, the answer is 404 X_NOT_FOUND (errors).
• evidenceDownloadInfo (evidence:read): the file name, size in bytes, SHA-256 and format version (zipVersion) of a notification's evidence package, with the HTTP call that downloads it. It records nothing; the download (POST /v1/download-evidence) does. See The perito package.
• One pagination envelope on every list: with _first=<rows> the answer carries rows, nextCursor (what you send as _after to ask for the next page) and hasMore (whether there is one). endCursor and hasNextPage stay in the answer with the same values, for clients that already read them. caseList, notificationList, listImports, ledgerList and orgActivity now walk the whole list with _first and _after; their limit and cursor still work. From today bounceAlerts, caseRecipients, caseMemorials, partyAddresses, importSendables and listDeadlines are paged too. exportNotifications delivers up to 5,000 lines per file; when there are more it answers truncated: true and a nextCursor, sent back as cursor, with the same filters, for the next file.
• Idempotency-Key on seven more operations: send-notification, create-message-template, save-party-address, attach-document, confirm-upload, request-import-upload and confirm-import-upload. A retry with the same key and the same body answers the first response; the same key with another body, 409 X_IDEMPOTENCY_CONFLICT (idempotent retries). create-webhook-endpoint still takes no key: its answer carries the signing secret, which is never stored for a replay.
• In openapi.json, every operation declares in security the exact scope its token needs.

Changed

• A limit or a _first above a list's maximum is refused with 400 X_INPUT_INVALID, naming the maximum; no list cuts it down silently. Page sizes and their maximums are in Limits.
• send-notification with the same Idempotency-Key answers the first pending request instead of filing another.
• listDeadlines takes its position as cursor. after is its earlier name and is still accepted; both with different values answer 422 X_DEADLINE_CURSOR_CONFLICT.
• downloadEvidence is no longer an MCP tool: an assistant asks evidenceDownloadInfo and downloads over HTTP. On /v1, POST /v1/download-evidence is unchanged.
• In a webhook delivery, links.notification now points to GET /v1/get-notification?notificationId=…&orgId=… (webhooks); it pointed to notification-detail, removed below.

Removed

Four reads that answered an array of one row were removed on 30 September 2026, the day their single-object replacements shipped. No token outside our own panel had ever called them, so they went without a deprecation period; an operation a client uses will always get one. A call to one of them now answers 404.

• From the MCP catalog: downloadEvidence (see Changed).

2026-09-27: v1

Added

• The versioned API at https://www.notificado.co/v1, authenticated only by Authorization: Bearer <token> with an agent token from /cuenta/api. The same token and the same six scopes as the MCP server.
• Readable paths: each operation at /v1/<its name in kebab-case>: createCase → POST /v1/create-case, caseList → GET /v1/case-list.
• The operations of the six scopes: cases and parties, uploads, draft notifications and attachments, memoriales, requesting a send (a lawyer confirms it in the panel), notification and evidence reads, deadlines.
• An operation outside the token's scopes answers 404, as if it did not exist; no or an invalid token, 401 with WWW-Authenticate.
• A limit of 120 requests a minute per token, with RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset on every answer and 429 + Retry-After past it.
• Idempotency-Key on create-case, add-party, request-upload, create-notification and create-memorial (idempotent retries).
• Every refusal as application/problem+json with a stable code, a cause and a fix (errors), each code listed in the error catalog.
• The OpenAPI document of exactly this API, with its bearer security scheme, at https://www.notificado.co/v1/openapi.json.
• A quickstart with curl and TypeScript for the whole flow.

Changed

• The panel's routes moved from derived paths (/api/cases/create) to readable ones (/api/create-case). They were never a public contract; integrations belong on /v1.