> ## Documentation Index
> Fetch the complete documentation index at: https://docs.breakcold.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API changelog

> Breaking changes, new capabilities, and migration guidance for the Breakcold REST API and MCP.

Follow this page for production-affecting changes to the Breakcold REST API and MCP. Product updates remain available from **What's New** inside Breakcold, and related product posts link back here when developer action is relevant.

Use the RSS button at the top of this page to subscribe, or add `https://docs.breakcold.com/api/changelog/rss.xml` to your RSS reader.

<Update
  label="October 6, 2026"
  description="Async payment events are now handled"
  tags={["REST", "Webhooks", "Changed"]}
  rss={{
title: "Payment Webhook and Billing Updates",
description: "REST integrations now receive processing for successful or failed asynchronous checkout payments, while billing settlement uses the updated usage flow.",
}}
>
  ## Payment Webhook and Billing Updates

  REST integrations now receive processing for successful or failed asynchronous checkout payments, while billing settlement uses the updated usage flow.

  ### Changes

  * Checkout session asynchronous payment success events now use the completed-checkout handler.
  * Checkout session asynchronous payment failure events now use the completed-checkout handler.
  * Public API billing settlement now routes usage debits through the current settlement flow.
</Update>

<Update
  label="October 6, 2026"
  description="Authenticated grant ownership checks"
  tags={["REST", "New"]}
  rss={{
title: "Add Nylas ownership endpoint",
description: "A new authenticated REST endpoint reports active workspace ownership for batches of Nylas grant IDs.",
}}
>
  ## Add Nylas ownership endpoint

  A new authenticated REST endpoint reports active workspace ownership for batches of Nylas grant IDs.

  ### Changes

  * Added POST /cross-region/nylas-grant-ownership.
  * Accepts 1 to 25 unique grant IDs per request.
  * Returns the Nylas application ID and active link count for each grant.
  * Requires the x-cross-region-token header.

  ### Migration

  1. Configure the shared cross-region check token.
  2. Send authenticated POST requests with a grantIds array containing up to 25 unique IDs.
</Update>

<Update
  label="September 22, 2026"
  description="CRM metadata updates retain field editability"
  tags={["REST", "Fixed", "Changed"]}
  rss={{
title: "Preserve Field Read-Only State",
description: "CRM field updates now preserve read-only behavior for automatic and formula fields.",
}}
>
  ## Preserve Field Read-Only State

  CRM field updates now preserve read-only behavior for automatic and formula fields.

  ### Changes

  * Automatic system fields remain read-only when their metadata is updated.
  * Disabling a custom formula makes the field editable.
  * CRM metadata updates now apply the same read-only rules as the application.
</Update>

<Update
  label="September 22, 2026"
  description="Permission checks for inbox reads"
  tags={["REST", "MCP", "Changed", "Fixed"]}
  rss={{
title: "Inbox read authorization",
description: "REST and MCP inbox read endpoints now enforce conversation-level access for user actors.",
}}
>
  ## Inbox read authorization

  REST and MCP inbox read endpoints now enforce conversation-level access for user actors.

  ### Changes

  * Record conversation lists filter out conversations the authenticated user cannot read.
  * Message list and message detail requests reject inaccessible conversations.
  * Explicit conversation permissions allow authorized user reads.
  * Application actors retain organization-scoped inbox access.
</Update>

<Update
  label="September 22, 2026"
  description="Receive Fireflies meeting events"
  tags={["Webhooks", "New"]}
  rss={{
title: "Add Fireflies Webhook Endpoint",
description: "A new production webhook route accepts Fireflies meeting events for native connections.",
}}
>
  ## Add Fireflies Webhook Endpoint

  A new production webhook route accepts Fireflies meeting events for native connections.

  ### Changes

  * Added POST handling for Fireflies webhook URLs.
  * Legacy or retired Fireflies connections now return HTTP 404.

  ### Migration

  1. Configure Fireflies to send events to the new webhook URL for native connections.
  2. Stop using legacy Fireflies webhook connections before retirement.
</Update>

<Update
  label="September 10, 2026"
  description="Preserves webhook request quotas"
  tags={["Webhooks", "Changed"]}
  rss={{
title: "Webhook Rate Limit Tracking",
description: "Webhook delivery processing continues using the existing workspace quota while rate-limit tracking is distributed across shards.",
}}
>
  ## Webhook Rate Limit Tracking

  Webhook delivery processing continues using the existing workspace quota while rate-limit tracking is distributed across shards.

  ### Changes

  * Webhook endpoints continue enforcing a 350-request burst capacity per workspace.
  * Rate-limit accounting now distributes requests across ten internal workspace shards.
  * Existing webhook delivery statistics include both legacy and newly sharded rate-limited records.
</Update>

<Update
  label="September 9, 2026"
  description="Internal deletion bookkeeping changed"
  tags={["REST", "Changed"]}
  rss={{
title: "Object Deletion Count Handling",
description: "Deleting objects no longer updates the removed internal record-count aggregate.",
}}
>
  ## Object Deletion Count Handling

  Deleting objects no longer updates the removed internal record-count aggregate.

  ### Changes

  * Object deletion continues removing records and their field values.
  * The removed internal aggregate is no longer updated during deletion.
</Update>

<Update
  label="September 9, 2026"
  description="Internal session coordination endpoint"
  tags={["REST", "New"]}
  rss={{
title: "Added internal SSO store endpoint",
description: "Added an authenticated internal REST endpoint for central SSO session coordination.",
}}
>
  ## Added internal SSO store endpoint

  Added an authenticated internal REST endpoint for central SSO session coordination.

  ### Changes

  * Added POST /internal/sso/store for authenticated internal SSO reads and writes.
  * Requests require signed authentication and replay protection.
  * Invalid requests return structured authentication or availability errors.
</Update>

<Update
  label="September 4, 2026"
  description="Authenticated catalogue routes added"
  tags={["REST", "New"]}
  rss={{
title: "Integration Catalogue Endpoint",
description: "External developers can retrieve published integration catalogue data through new authenticated HTTP routes.",
}}
>
  ## Integration Catalogue Endpoint

  External developers can retrieve published integration catalogue data through new authenticated HTTP routes.

  ### Changes

  * Added GET /public/integrations/crm for the published integration list.
  * Added GET /public/integrations/crm/\{slug} for integration details.
  * Responses expose public catalogue fields, including logos and screenshots, without internal identifiers.
</Update>

<Update
  label="September 2, 2026"
  description="Adds verified Granola webhook ingestion"
  tags={["Webhooks", "New", "Changed"]}
  rss={{
title: "Secure Granola Webhooks",
description: "Granola webhook deliveries now require signature verification and use event identifiers for idempotent processing.",
}}
>
  ## Secure Granola Webhooks

  Granola webhook deliveries now require signature verification and use event identifiers for idempotent processing.

  ### Changes

  * Granola webhook requests are authenticated using Standard Webhooks signatures.
  * Granola event identifiers are used to derive stable request identities.
  * Webhook enablement is evaluated using the provider-specific recording feature flag.
</Update>

<Update
  label="September 1, 2026"
  description="Receive Aircall call events"
  tags={["REST", "Webhooks", "New"]}
  rss={{
title: "Aircall Webhook Endpoint Added",
description: "Production now accepts Aircall webhook events through a dedicated calling webhook route.",
}}
>
  ## Aircall Webhook Endpoint Added

  Production now accepts Aircall webhook events through a dedicated calling webhook route.

  ### Changes

  * Added POST support for Aircall webhook requests under /calling/webhooks/.
  * Processes call lifecycle events for calling integrations.

  ### Migration

  1. Configure Aircall to send call webhooks to the new production endpoint.
</Update>

<Update
  label="August 29, 2026"
  description="Large listings hydrate in smaller batches"
  tags={["MCP", "Changed"]}
  rss={{
title: "More Reliable MCP Record Listing",
description: "MCP record listings now split hydration into batches of up to 50 records.",
}}
>
  ## More Reliable MCP Record Listing

  MCP record listings now split hydration into batches of up to 50 records.

  ### Changes

  * The records.list MCP operation limits each hydration batch to 50 record IDs.
  * Requests can still ask for up to 100 listed records; only hydration is batched internally.
</Update>

<Update
  label="August 28, 2026"
  description="Record attachment downloads are unavailable"
  tags={["REST", "Changed", "Deprecated"]}
  rss={{
title: "Remove Attachment Download Endpoint",
description: "The record email attachment download route has been removed from production.",
}}
>
  ## Remove Attachment Download Endpoint

  The record email attachment download route has been removed from production.

  ### Changes

  * GET /record-email-attachment-download is no longer available.
  * Requests to the removed route will no longer download record email attachments.

  ### Migration

  1. Stop calling the removed route and remove dependent attachment-download workflows.
</Update>

<Update
  label="August 28, 2026"
  description="New objects receive filter indexing"
  tags={["REST", "Changed"]}
  rss={{
title: "Initialize Object Filtering",
description: "Creating a custom object now schedules its filter index initialization.",
}}
>
  ## Initialize Object Filtering

  Creating a custom object now schedules its filter index initialization.

  ### Changes

  * The CRM object-creation operation now initializes filtering for the newly created object.
  * Index initialization runs asynchronously after the object is created.
</Update>

<Update
  label="August 18, 2026"
  description="Regional MCP requests use universal gateway"
  tags={["MCP", "Changed"]}
  rss={{
title: "Regional MCP OAuth Compatibility",
description: "Legacy regional MCP endpoints now proxy MCP traffic and discovery requests through the universal gateway.",
}}
>
  ## Regional MCP OAuth Compatibility

  Legacy regional MCP endpoints now proxy MCP traffic and discovery requests through the universal gateway.

  ### Changes

  * Regional MCP requests are forwarded to the universal MCP gateway.
  * Regional OAuth discovery endpoints advertise the universal gateway.
  * Existing MCP request methods, query parameters, authorization, sessions, and bodies are preserved.
</Update>

<Update
  label="August 13, 2026"
  description="Safer creates and managed-task updates"
  tags={["REST", "Changed", "Fixed"]}
  rss={{
title: "Identity Resolution API Safeguards",
description: "REST APIs now prevent ambiguous record creation and reject direct changes to source-managed tasks.",
}}
>
  ## Identity Resolution API Safeguards

  REST APIs now prevent ambiguous record creation and reject direct changes to source-managed tasks.

  ### Changes

  * Record creation now blocks identity matches requiring review instead of silently creating a potentially duplicate record.
  * Repeated requests with the same idempotency key can return the existing operation without emitting a duplicate creation event.
  * Updates to source-managed tasks reject changes to title, description, due date, or status.
  * Manual deletion of source-managed tasks is rejected.
  * Identity-resolution conflicts are returned as structured HTTP 409 conflict errors.

  ### Migration

  1. Handle HTTP 409 conflicts for identity matches and route them to review.
  2. Do not update or delete source-managed tasks directly; resolve them through the task workspace.
</Update>

<Update
  label="August 12, 2026"
  description="Explicit approved scopes required"
  tags={["Breaking", "REST", "MCP", "Changed"]}
  rss={{
title: "OAuth scopes are now required",
description: "OAuth-authenticated REST and MCP requests now require recognized Breakcold API scopes.",
}}
>
  ## OAuth scopes are now required

  OAuth-authenticated REST and MCP requests now require recognized Breakcold API scopes.

  ### Changes

  * Authorization requests reject empty or unsupported scopes with invalid\_scope.
  * Access tokens retain only scopes approved in the grant.
  * Gateway-authenticated requests reject missing or unknown-only scopes with insufficient\_scope.
  * Verified OAuth JWTs must contain at least one recognized public API scope.

  ### Migration

  1. Update OAuth authorization requests to include one or more supported Breakcold API scopes.
  2. Ensure clients handle invalid\_scope and insufficient\_scope responses.
</Update>

<Update
  label="August 12, 2026"
  description="MCP task timestamps preserve exact times"
  tags={["MCP", "Changed"]}
  rss={{
title: "Support Task Due Timestamps",
description: "MCP task creation and updates now preserve supplied due timestamps.",
}}
>
  ## Support Task Due Timestamps

  MCP task creation and updates now preserve supplied due timestamps.

  ### Changes

  * Task creation accepts and stores exact due timestamps.
  * Task updates preserve exact due timestamps.
  * Clearing a due timestamp removes the associated time metadata.
</Update>

<Update
  label="August 12, 2026"
  description="Use cryptographically secure secrets"
  tags={["Webhooks", "Zapier", "Make", "Changed"]}
  rss={{
title: "Strengthen Webhook Secrets",
description: "New outbound webhook and integration signing secrets now contain 256 bits of cryptographically secure randomness.",
}}
>
  ## Strengthen Webhook Secrets

  New outbound webhook and integration signing secrets now contain 256 bits of cryptographically secure randomness.

  ### Changes

  * New signing secrets use the whsec\_ prefix followed by 64 hexadecimal characters.
  * Outbound webhook signature verification remains HMAC-SHA256 compatible.
  * New bearer secret identifiers are 64-character hexadecimal values.
</Update>

<Update
  label="August 10, 2026"
  description="Restricts record-only conversation visibility"
  tags={["REST", "Changed"]}
  rss={{
title: "Record-Scoped Inbox Access",
description: "Public API conversation access now requires record links for record-scoped permissions.",
}}
>
  ## Record-Scoped Inbox Access

  Public API conversation access now requires record links for record-scoped permissions.

  ### Changes

  * Users with record-scoped read permission can access only conversations linked to a CRM record.
  * Users with record-scoped reply permission can reply only to conversations linked to a CRM record.
  * Users with all-message permissions retain access without a record link.
</Update>

<Update
  label="August 9, 2026"
  description="Delete tasks through integrations"
  tags={["New", "REST", "MCP", "Zapier"]}
  rss={{
title: "Add Task Deletion",
description: "A new task deletion action is available across REST, MCP, Zapier, and Make.",
}}
>
  ## Add Task Deletion

  A new task deletion action is available across REST, MCP, Zapier, and Make.

  ### Changes

  * Added DELETE /tasks/\{taskId} requiring the tasks:write scope.
  * Added the tasks\_delete MCP tool.
  * Added task deletion actions to Zapier and Make.
  * Deletion is idempotent and returns deletedId.
</Update>

<Update
  label="August 8, 2026"
  description="Higher concurrency for API requests"
  tags={["REST", "Changed"]}
  rss={{
title: "Public API Rate Limit Scaling",
description: "Public API rate limiting now distributes capacity across multiple shards to better handle concentrated request traffic.",
}}
>
  ## Public API Rate Limit Scaling

  Public API rate limiting now distributes capacity across multiple shards to better handle concentrated request traffic.

  ### Changes

  * Public API rate-limit capacity is distributed across 20 shards.
  * Concurrent API traffic is less likely to contend on a single rate-limit record.
</Update>

<Update
  label="August 6, 2026"
  description="New GET and POST unsubscribe routes"
  tags={["REST", "New"]}
  rss={{
title: "Email Unsubscribe Endpoint Added",
description: "Production email unsubscribe handling is now available through a public HTTP endpoint.",
}}
>
  ## Email Unsubscribe Endpoint Added

  Production email unsubscribe handling is now available through a public HTTP endpoint.

  ### Changes

  * Added GET /email/unsubscribe for displaying unsubscribe confirmation.
  * Added POST /email/unsubscribe for human-confirmed and RFC 8058 one-click unsubscribe requests.
  * POST requests return idempotent success responses for repeated unsubscribe actions.
</Update>

<Update
  label="July 30, 2026"
  description="Outbound tools default to drafts"
  tags={["MCP", "Changed"]}
  rss={{
title: "MCP Sending Requires Confirmation",
description: "MCP outbound message tools now return a draft preview unless delivery is explicitly requested.",
}}
>
  ## MCP Sending Requires Confirmation

  MCP outbound message tools now return a draft preview unless delivery is explicitly requested.

  ### Changes

  * inbox\_conversations\_compose accepts sendMode="draft" or "send".
  * inbox\_messages\_send accepts sendMode="draft" or "send".
  * Omitting sendMode returns a non-sending preview.
  * sendMode="send" preserves immediate delivery behavior.
  * Invalid sendMode values return an error.

  ### Migration

  1. Add sendMode="send" to calls intended to deliver messages immediately.
  2. Handle draft responses with sent=false and confirmationRequired=true.
</Update>

<Update
  label="July 29, 2026"
  description="Preserves component relationship metadata"
  tags={["Make", "Changed", "Fixed"]}
  rss={{
title: "Make Synchronization Handles Relationships",
description: "Make app synchronization now reads and maintains connection and webhook relationships when comparing or updating components.",
}}
>
  ## Make Synchronization Handles Relationships

  Make app synchronization now reads and maintains connection and webhook relationships when comparing or updating components.

  ### Changes

  * Webhook connection relationships are retrieved when list responses omit them.
  * Instant-trigger module webhook relationships are retrieved before synchronization.
  * Component updates preserve configured connections, CRUD settings, and webhook associations.
  * Deployment drift errors include the specific actions required to reconcile differences.
</Update>

<Update
  label="July 29, 2026"
  description="MCP lists now return partial pages"
  tags={["MCP", "Changed", "Fixed"]}
  rss={{
title: "MCP Pagination Behavior Updated",
description: "MCP list tools now return partial pages when filtering exhausts a raw batch, allowing callers to continue with the returned cursor.",
}}
>
  ## MCP Pagination Behavior Updated

  MCP list tools now return partial pages when filtering exhausts a raw batch, allowing callers to continue with the returned cursor.

  ### Changes

  * List operations perform one paginated query per invocation.
  * Filtered results may contain fewer items than the requested limit.
  * Returned cursors continue from the next raw page or remaining batch position.
  * Callers should keep requesting pages until pagination indicates no more results.

  ### Migration

  1. Continue following returned cursors until hasMore is false or the cursor is null.
  2. Do not assume every page contains the requested number of items.
</Update>

<Update
  label="July 29, 2026"
  description="Manage private inbox drafts"
  tags={["REST", "Zapier", "Make", "New"]}
  rss={{
title: "Conversation Draft API",
description: "New REST, Zapier, and Make operations let authenticated users manage conversation drafts.",
}}
>
  ## Conversation Draft API

  New REST, Zapier, and Make operations let authenticated users manage conversation drafts.

  ### Changes

  * Added endpoints to create or update a conversation draft.
  * Added an endpoint to retrieve the authenticated user's draft.
  * Added an endpoint to clear the authenticated user's draft.
  * HTML draft content is accepted for email conversations only.
</Update>

<Update
  label="July 28, 2026"
  description="REST modules and instant triggers"
  tags={["Make", "REST", "Webhooks", "New"]}
  rss={{
title: "Make integration available",
description: "Make users can access Breakcold REST operations and event triggers through a generated integration.",
}}
>
  ## Make integration available

  Make users can access Breakcold REST operations and event triggers through a generated integration.

  ### Changes

  * Added 57 Make REST modules covering supported Breakcold operations.
  * Added 14 instant webhook triggers for supported event types.
  * Added a universal module for relative Breakcold API paths.
  * Webhook subscriptions now enforce event and object-type filters before delivery.
</Update>

<Update
  label="July 28, 2026"
  description="Selectors and structured inputs now work consistently"
  tags={["Zapier", "Changed", "Fixed"]}
  rss={{
title: "Zapier Integration Behavior Updates",
description: "The generated Zapier integration now exposes dynamic choices and normalizes request and response data for production workflows.",
}}
>
  ## Zapier Integration Behavior Updates

  The generated Zapier integration now exposes dynamic choices and normalizes request and response data for production workflows.

  ### Changes

  * Adds dynamic Zapier choices for workspaces, records, CRM fields, conversations, messages, meetings, notes, and tasks.
  * Parses JSON-formatted array and object inputs before sending requests.
  * Maps the Zapier idempotencyKey field to the API clientMessageId field.
  * Normalizes search and action responses for Zapier compatibility.
  * Updates authentication setup help with a direct developer documentation link.
</Update>

<Update
  label="July 27, 2026"
  description="Download linked email attachments"
  tags={["REST", "New"]}
  rss={{
title: "Add Attachment Download Endpoint",
description: "A new authenticated REST endpoint serves prepared record email attachments for production clients.",
}}
>
  ## Add Attachment Download Endpoint

  A new authenticated REST endpoint serves prepared record email attachments for production clients.

  ### Changes

  * Added GET /record-email-attachment-download.
  * Requires bearer authentication.
  * Returns the prepared attachment stream with its content metadata.
</Update>

<Update
  label="July 27, 2026"
  description="Cleans linked conversations after deletion"
  tags={["REST", "Changed", "Fixed"]}
  rss={{
title: "CRM Deletion Cleanup Added",
description: "Deleting a CRM object now schedules cleanup of conversation links associated with that object type.",
}}
>
  ## CRM Deletion Cleanup Added

  Deleting a CRM object now schedules cleanup of conversation links associated with that object type.

  ### Changes

  * CRM object deletion schedules removal of associated conversation-record links.
  * Cleanup runs asynchronously after the deletion request.
</Update>

<Update
  label="July 26, 2026"
  description="Reliable filtered conversation pagination"
  tags={["MCP", "Changed"]}
  rss={{
title: "Paginated Inbox Results",
description: "MCP-backed inbox conversation listing now supports selective indexes and stable cursors for filtered views.",
}}
>
  ## Paginated Inbox Results

  MCP-backed inbox conversation listing now supports selective indexes and stable cursors for filtered views.

  ### Changes

  * Filtered conversation views use matching lifecycle, channel, mailbox, status, and account indexes when available.
  * Pagination cursors retain filter scope and resume correctly after post-filtering.
  * Large restricted conversation views check permissions only for candidate conversations instead of scanning unrelated memberships.
</Update>

<Update
  label="July 14, 2026"
  description="Record creation validation"
  tags={["Breaking", "REST", "MCP"]}
  rss={{
title: "Record creation now requires complete initial fields",
description: "Record creation rejects empty payloads and enforces required fields.",
}}
>
  ## Record creation now requires complete initial fields

  Record creation now rejects empty field payloads and enforces fields configured as required for the target object.

  ### Action required

  * REST `POST /records` requires a non-empty `fields` object.
  * Include every required field unless it has a configured default.
  * REST retries may use the optional `Idempotency-Key` header.
  * MCP `records_create` requires a stable `idempotencyKey` tool argument.

  ### Migration

  1. List fields with `GET /crm/objects/{objectTypeId}/fields`.
  2. Include values for required fields without defaults.
  3. Reuse the same idempotency value when retrying the same logical request.

  See [Create a record](/api-reference/records/create-a-record) and [List CRM fields](/api-reference/crm/list-crm-fields).
</Update>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.