API changelog and versioning

Versioning policy and changes to the v1 API.

Versioning policy

The public API lives at /v1. Within a version things are only added: new optional fields, new endpoints and new values in response enumerations. Your integration doesn't break.
An incompatible change would go into a new version (/v2), with advance notice and a period where both coexist.
Ignore fields you don't know in responses, and treat unknown errCode values by their range: 1xxx access, 2xxx validation, 3xxx limits, 4xxx resources, 5xxx credentials and 9xxx platform.

Official SDKs for .NET MAUI (Pushtifly.Maui, NuGet) and Unity (the com.daertech.pushtifly package), with the same C# core. See .NET MAUI and Unity.
Image carousel: media.type: "carousel" with items (2 to 5 images, each with optional title and deepLink). Without an SDK that draws it (browsers, Huawei, apps without the SDK), the first image is shown. See Media.
New device capability carousel (audience filters and estimates) and the carousel_partial warning in the send preview.
Android SDK: the carousel arrives as a data message with _phtitle / _phbody. iOS SDK: new PushtiflyNotificationContent product (Notification Content Extension) and the notificationContentExtension option.
Hybrid SDKs: Flutter and React Native / Expo draw the carousel on Android (androidCarousel and handleBackgroundMessage); all five show it on iOS with the Notification Content Extension template (iosNotificationContentExtension). Capacitor and Cordova show the first image on Android.

Huawei phones without Google services: provider hms (Huawei Push Kit). They register with POST /v1/devices using platform: "android" and provider: "hms"; the credential (AppGallery Connect Client ID and Client Secret) is saved in the dashboard. See Huawei phones.
New delivery error codes: HMS_TOKEN_INVALID, HMS_OAUTH_ERROR, HMS_NO_PERMISSION, HMS_CLIENT_NOT_FOUND, HMS_TRAFFIC_CONTROL and HMS_<Huawei code>.
The status page adds the hms component (Huawei delivery).

PushHub is now called Pushtifly. The API lives at https://api.pushtifly.com/v1 (the previous addresses redirect).
Webhooks: the headers become X-Pushtifly-Event, X-Pushtifly-Delivery, X-Pushtifly-Timestamp, X-Pushtifly-Signature and X-Pushtifly-Attempt; the User-Agent is Pushtifly-Webhooks/1.0. The signature is computed the same way.
Official SDKs with the new name: @daertech/pushtifly-* (npm), pushtifly_flutter, com.daertech.pushtifly (Android) and Pushtifly (iOS). Devices that report a pushhub-* sdkName are still recognized as an official SDK.
Documentation available in English (/en/docs).

Web Push: notifications to browsers. Platform web and provider webpush; browsers register with POST /v1/devices using subscription (its endpoint acts as the token) and the public VAPID key is obtained from GET /v1/web-push/key. See Websites and PWAs.
/v1/devices/{token} also accepts the device id (needed on web: the token is a URL).
platforms, filters and estimates accept web.

An export download (downloadUrl) may redirect (302) to a temporary file-storage link. Follow the redirect (in curl, -L).
Media can be served from a CDN: always use the url returned by the API, without building it by hand.

Public status page (/estado, /en/status and status.<domain>) with the status of each component, 90 days of history and incidents. Data at GET /panel/public/status.
Public site in English (/en, /en/pricing, /en/contact) with sitemap.xml, robots.txt and per-language metadata.

Panel: passkeys (WebAuthn) to sign in without a password, answer 2FA and re-authenticate. See Passkeys.
New errCode 1115: the passkey couldn't be verified.

A/B tests (/v1/ab-tests): 2 to 4 variants to a sample of the audience; the winner by opens or clicks is sent automatically to the rest. See A/B tests.
Notifications include abTest: { id, variant } when they're a variant or the winner's send.

CSV exports (/v1/exports): devices, deliveries and hourly statistics, with a signed 24-hour link. See CSV exports.
Per-app marketing limits: maximum per device per day, and quiet hours in local time. Skipped ones appear as skipped (FREQUENCY_CAP) and postponed ones in stats.deferred.

Devices: the Firebase Installation ID (FID) is accepted as an FCM token; Pushtifly sends it in message.fid. See Firebase Installation ID.
data_only notifications: the title and text travel in data, in the keys each framework reads.
Devices with an official SDK no longer receive deepLink and imageUrl duplicated as flat keys (the SDKs read them from _ph).
Buttons on iOS: mutable-content is set so the SDK's extension registers them.

Devices: registration, user identification, tags, topics and test device pairing.
Notifications: targets by device, user, topic, segment, filters or everyone; content per language with variables and templates; data, deep links, buttons and sounds; validation without sending; idempotency.
Scheduling at a fixed time and at each device's local time; recurring campaigns.
Media: images, GIFs, audio and video (/v1/media).
App events (/v1/events) and analytics; signed webhooks.
Synchronous test console (/v1/notifications/test).
Plans and quotas (3001, 3002, 3004, 3011, 3012).
Content moderation: a send that links to a blocked domain responds 2002 with errors.content = ["blocked"].