API
Build the whole integration with an API key
- Contacts, lists, segments, the Inbox and webhook subscriptions all accept an API key now, not only a dashboard login. A server integration can build the audience, target it, read replies and subscribe to events without ever holding a session — which is what the platform-event webhooks were for in the first place.
- Key scopes are enforced end to end: a read-only key gets 403 with the scope it needs, and a viewer role can no longer create or delete segments, lists, journeys, templates or campaigns — a gap that had been open.
- Failure reasons are safe to show a user. A transport error used to surface raw internals in `failed_reason`; it now reports an actionable message, with the raw detail kept in our logs.
- Billing corrections worth naming: add-ons in zero-decimal currencies such as JPY were charged 100× the intended amount, and a retried card top-up could credit a balance twice. Both are fixed and guarded.
- An inbound reply to a sender ID that two accounts share could land in the wrong account's Inbox — including a STOP, which would then suppress the wrong contact. Replies are now attributed to whichever account most recently messaged that number.