> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mareaalcalina.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Marea API release notes — RSS available at /changelog.rss

# Changelog

<Update label="2026-05-15" description="Self-serve user keys from the dashboard">
  **Added — One-click `mk_user_*` issuance for verified users.**

  Verified users can now mint and list their own `mk_user_*` keys directly from the dashboard at [mareaalcalina.com/developers/keys](https://mareaalcalina.com/developers/keys) — no partner bootstrap required. Keys issued this way start with the full post-verify scope set (catalog read/write, storefront publish), so you can drive the API against your own storefronts in a single click.

  What this means for you:

  * **No more "you must be bootstrapped by a partner" path** for solo builders. Sign up, verify, then issue a key.
  * **Multiple keys per user.** Mint one per environment or per integration; list and revoke them from the same page.
  * **The raw key is shown once.** Copy it on issuance — only the SHA-256 hash is stored server-side.

  See [Concepts → Keys](/concepts/keys) for the full key model, and the [quickstart](/quickstart/bootstrap) to wire your first request.
</Update>

<Update label="2026-05-12" description="PRD-14 — Stripe-style webhook endpoints (model unification)">
  **Added — Webhook endpoints as first-class objects.**

  Stripe-style endpoint model: each endpoint owns its URL, its `subscribedEvents[]` list, and its own 64-char-hex `signingSecret`. Up to 16 endpoints per account.

  * **REST CRUD**: `POST /v1/webhook_endpoints`, `GET /v1/webhook_endpoints`, `GET /v1/webhook_endpoints/:id`, `POST /v1/webhook_endpoints/:id` (update), `DELETE /v1/webhook_endpoints/:id`. Required scope: `developer:webhooks` (new keys) or `developer:bootstrap` (existing keys continue to work via any-of).
  * **Order events on developer endpoints**: a single developer endpoint receives `order.*` events from every storefront your key bootstrapped — no per-merchant endpoint registration needed.
  * **Signing**: HMAC-SHA256 with the endpoint's raw 64-char-hex `signingSecret` for every event type.
  * **Envelope** carries `eventId` (UUID v4 — receiver dedup key) + `apiVersion: 2026-05-12`. Headers: `X-Marea-Endpoint-Id`, `X-Marea-Signing-Version`.
  * **Dashboard** at `/developers/webhooks` manages endpoints (create / edit / pause / rotate / delete / test fire / view recent deliveries).
  * **Phase B (deferred)**: the same multi-endpoint model will roll out for merchant-configured page webhooks in a follow-up release.
</Update>

<Update label="2026-05-10" description="Docs site accuracy + DX overhaul">
  **Improved — comprehensive docs audit + Stripe-style cleanup.**

  Following the first public publish, a senior-engineer pass cross-checked every claim in the docs against the cloud-functions Zod contracts as ground truth.

  * **API Reference** now covers all 13 v1 operations (previously a Phase-1 stub with `/v1/me` only). `openapi.json` is script-generated from the cloud-functions Zod schemas via `@asteasolutions/zod-to-openapi` (zero drift): tags, operationIds, both security schemes (Bearer + X-API-Key), rate-limit response headers, idempotency headers, and full `$ref` to `ApiErrorResponse` on every 4xx/5xx.
  * **Stripe-style URL slugs.** API reference pages now ship at clean URLs like `/api/storefronts/create-storefront` and `/api/identity/get-current-identity` (previously they were verbose auto-slugified sentences).
  * **Plan limits corrected.** `plan.limits` shape is `{storefronts, products, publishable}` (not the docs' previous `{maxStorefronts, maxProducts, canPublish}` invention). Free plan has two variants (`FREE_NEW` 1 storefront, `FREE_OLD` legacy 3 storefronts). Pre-paywall accounts have a 2,000 draft-product cap. Single-product POST returns `plan_max_products_reached`, not `products_over_limit` (the latter is the 207-batch path).
  * **Scopes corrected.** Eight real scopes: `developer:bootstrap`, `developer:read`, `developer:issueUserKey`, `catalog:read`, `catalog:write`, `storefront:publish`, `me:verify`, `me:resendVerification`. Earlier docs referenced a non-existent `users:bootstrap` — now removed everywhere.
  * **Error codes**: \~40 real `error.code` values cross-checked against `grep ApiError` across `src/api/`. Removed fabricated codes (`validation_failed`, `product_not_found`, `invalid_request_body`, `rpd_exceeded`-as-code) that the docs invented; replaced with the real ones (`invalid_request`, `storefront_not_found`, `rate_limit_exceeded`). `rpd_exceeded`/`rpm_exceeded` continue to surface inside `error.message` only.
  * **MCP quickstart**: install path now uses the `mcp-remote` bridge (verified package). Tool count corrected to 7 (verify + resend are REST-only by design).
  * **Four concept pages** that were placeholders are now real content: `verification-flow`, `tos-jurisdiction`, `arco-procedures`, `versioning`. Each is sourced from cloud-functions handlers, with TTLs, lockouts, cancel reasons, and breaking-change rules from code.
  * **Homepage**: removed redundant H1 + intro paragraph that duplicated frontmatter title/description (Mintlify renders both automatically). Added a "Webhook surfaces" CardGroup so first-time readers see both surfaces.
  * **Receiver helpers**: `concepts/webhooks` now ships full JS + Python verifiers in `api/webhooks/*.mdx`, with the `X-Marea-Source` (`developer` vs `merchant`) header disambiguating event sources.

  19 files changed; Mintlify validate + broken-links both green.
</Update>