Changelog

Consumer-facing changes, newest first.

Consumer-facing changes to the Bridge API, newest first. Internal refactors don't appear here; anything wire-visible must. Deprecations follow the deprecation policy.

1.0.0-rc1 — 2026-08-20 (testing phase)

The complete /v1 surface, in pre-GA testing. The additive-only freeze (deprecation policy) takes effect at GA; until then breaking changes remain possible with ordinary review.

Surfaces

• Companies — read (disabled visible with status, deleted 404), create, update, and the full lifecycle (disable / enable / delete / restore).
• General ledger — chart of accounts, cursor-paginated GL lines with stable line ids, trial balance (opening, monthly movements, closing).
• VAT — filing terms with reconciliation status and decimal NOK totals.
• Users — org membership reads and per-user effective access.
• Access management (system clients only) — policy documents with rules, assignment and revocation, converging automatically to the authorization layer.
• Documents — two-step signed-URL uploads, signed downloads, metadata, lifecycle; binaries never pass through the API.
• Bank & reconciliation — accounts, transaction feed with computed reconciliation status, reconciliation groups, per-period summary, and the two mutations: reconcile and unmatch.
• Jobs — 202-and-poll for heavy operations, one in-flight per scope.
• Webhooks — signed thin events mirroring the audit catalog, verification handshake, retries with dead-lettering and auto-disable, delivery log.

Platform guarantees

• OAuth 2.0 (client credentials; authorization code + PKCE for interactive, read-only for now), resource:action scopes.
• Idempotency-Key on every mutation with byte-identical replays.
• Opaque signed cursors; keyset pagination everywhere.
• RFC 9457 errors with a documented catalog.
• Rate plans: standard 300 req/min (burst 60), premium 1200 req/min (burst 240).