Registo de alterações da API

As alterações da API de integração, da mais recente para a mais antiga. A política de versões está em Versões e descontinuações.

[1.1.0] — 2026-11-01

Scoped API keys on /api/v1. Authorization: Bearer nhk.<keyid>.<secret> (or X-NH-API-Key). Keys are created per tenant from Integrations → API keys and are bound to that tenant.
Scopes enforced on /api/v1: tickets:create, tickets:read, tickets:comment (tickets:* and * are wildcards). A key with no scopes keeps full v1 access.
Rate-limit headers on every /api/v1 response: RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset, plus Retry-After on 429.
Machine-readable error code on every /api/v1 error, for example missing_api_key, invalid_api_key, insufficient_scope, rate_limited, validation_error or not_found.
X-Exo-API-Version: 1 header on /api/v1 responses.
Timestamped webhook signatures: X-Exo-Timestamp and X-Exo-Signature: v1=HMAC-SHA256(secret, "<timestamp>.<body>") protect against replay. See [WEBHOOK-SIGNATURES.md].
X-Exo-Event and X-Exo-Delivery headers on outbound webhooks.
Canonical webhook envelope with id, type, created_at, api_version, tenant_id and data.
Outbound webhooks now fire for every event in the public catalog (ticket.created, ticket.status_changed, …), whether or not a notification rule exists.
A webhook subscription created without a secret gets one generated and returned once.
Inbound connector webhooks accept X-Exo-Signature + X-Exo-Timestamp.
SDK downloads /sdk/exocortex.js, /sdk/exocortex.py and /sdk/exo-cli.

GET /api/v1/tickets/{key} and POST /api/v1/tickets/{key}/comment return 404 for tickets that do not belong to the API key’s tenant.
GET and comment on /api/v1 now check that the key is enabled and apply the per-key rate limit, like POST /api/v1/tickets already did.
Webhook payload source is now exoCortex (was NH-Platform). The test event is webhook.test (was nh.webhook.test). The webhook User-Agent is exoCortex-Webhooks/1.0.
SDKs send Authorization: Bearer and no longer send tenant, which the server always took from the key. The SDK widgets and mapping helpers were removed: they called operator-console endpoints that never accepted API keys.
Inbound X-NH-Connector-Signature is compared in constant time and also accepts the sha256= prefix.

Legacy API keys nh_…. Responses carry Deprecation, Sunset: Wed, 30 Jun 2027 23:59:59 GMT and Link headers.
X-NH-Signature (outbound) and X-NH-Connector-Signature (inbound): signatures without a timestamp.
Legacy webhook payload fields: event, timestamp, source and the context spread at top level.
SDK classes NHClient / NHError. Use ExoClient / ExoApiError.

First REST API v1 (/api/v1/tickets), widget, outbound webhooks (X-NH-Signature), inbound connectors, SNMP gateway, SCIM 2.0.