Changelog
Every entry states the date of the change. The specification revision is the date of the latest entry that affects the description of the API (currently 2026-10-20); it appears in openapi.json as info.x-revision. How we announce changes and what is possible within v1 is described under Versioning.
| Date | Change |
|---|---|
| 2026-10-20 | Webhooks: three more subscribable event types. contract.terminated (termination confirmed, data.lease_id), invoice.cancelled (invoice cancelled, data.invoice_id = the cancelled original invoice) and damage.updated (case file changed, data.damage_id). They apply only to webhooks that list them explicitly in events; existing webhooks do not change. damage.updated and contract.terminated can report the same object several times. The enum of events and event_type grows by three values (regenerate code generators with a closed enum); the same applies to the sandbox simulation. New in the starter project, the Postman collection and the webhooks handbook. |
| 2026-10-15 | Security contact: report vulnerabilities to security@manage2hero.com; the pages Security & support and Security & threat model describe the reporting path, including what a report should and should not contain. In addition, the API host serves the security.txt according to RFC 9116 at /.well-known/security.txt. Behaviour and messages of the API do not change. |
| 2026-10-15 | Security & threat model: the new page describes what the API protects, who might attack it, which protections stand against it, which limits and residual risks are known (including: no independent penetration-test certificate) and what customers should do. Linked from the introduction, Security & support, the webhooks handbook and the error catalog. Behaviour and messages of the API do not change. |
| 2026-10-15 | Specification and docs, consistency (2nd external review): the Node.js example of the webhooks handbook now points to GET /v1/payments/by-ids?ids=<payment_id> for loading a payment. Idempotency: the default rule (same key with different content = 409 idempotency_conflict) is marked as such; the exception retry-failed (another filter = new operation) is explained right next to it. POST /v1/webhooks and PATCH /v1/webhooks/{id}: events is described as uniqueItems in the OpenAPI (duplicates are rejected). The error code payload_too_large no longer names a blanket size but points to error.details.max_bytes (differs per endpoint, e.g. 4096 for the bulk replay). Paginated lists: the exception GET /v1/webhooks is stated in the general rule already. Limits: the import limits (20 new imports per account in 10 minutes, 500 imports per organization) are shown completely in the tables. The retry examples of the reference store the Idempotency-Key durably (file) and reuse it on every restart. The OpenAPI and the webhooks handbook explicitly point to the section webhooks (note for code generators). New: integration checklist in the webhooks handbook. Status page: availability states the start of measurement and the measured days (“measured since …: X of 90 days”); the time before measurement began is no basis. API behavior and messages do not change. |
| 2026-10-15 | Change sync for contracts and damages: …/contracts/changes/cursor, …/contracts/changes, …/contracts/by-ids and …/damages/changes/cursor, …/damages/changes, …/damages/by-ids (scopes contracts:read and damages:read). The stream also reports deleted or marked-for-deletion contracts, reset countersignatures, deleted terminations, amendments, damage documents and reports, and deleted damages; the response of /v1/damages/by-ids has the list shape without documents. The starter project now reconciles both resources through the stream. |
| 2026-10-15 | Sandbox docs and security review. The Sandbox (test mode) page now leads to the first response in four steps, shows the response of the event simulation, compares sandbox and real data and explains the typical error responses (including 403 sandbox_unavailable). The Postman collection has a folder Sandbox (test mode) with its own variable sandbox_token. The OpenAPI points to the sandbox page and names 403 sandbox_unavailable in the bearer scheme. Behaviour and messages of the API do not change. |
| 2026-10-14 | Starter project download: the webhook starter project (Node.js, no third-party dependencies, with signature verification, inbox table, reconciliation, simulator and the shared test vectors) is now available as a ZIP without sign-in at /downloads/manage2hero-webhook-starterprojekt.zip on this host. The example code is under the MIT license; the API itself is subject to the terms of use. The messages and endpoints of the API do not change. |
| 2026-10-14 | Specification and docs, consistency (after an external review): POST /v1/webhooks describes the 200 response (retry, without secret) separately from 201 (creation, secret required). Maximum span of list calls stated uniformly as calendar days counting from and to (366 for bookings and payments, 1,831 for invoices, dunning notices, net revenue and monthly occupancy; to − from at most 365 and 1,830). The example message of the webhooks guide carries livemode and X-M2H-Livemode. webhook_limit_reached names limit and used (sandbox: limit only). GET /v1/webhooks is explicitly noted as having no next_cursor; note for code generators to tolerate unknown enum values. The behavior of the API does not change. |
| 2026-10-14 | Sandbox: webhooks and event simulation. Test tokens may carry the scope webhooks:manage; sandbox webhooks run through the same delivery service (signature, retries, replay, https on port 443 only). New: POST /v1/sandbox/events (scope webhooks:manage, sandbox token only, Idempotency-Key) simulates an event for a sample object. New in EVERY webhook message: the field livemode in the body and the header X-M2H-Livemode (false for sandbox events, true for all others) - the messages gained this field, older receivers ignore it. Deliveries that were already queued before the field was introduced keep their previous body without livemode (treat a missing field as true). At most 3 webhooks per sandbox; sandbox deliveries are deleted after 7 days. |
| 2026-10-14 | Sandbox: more sample data. A new or reset sandbox additionally contains charges, three monthly rents per contract (three tenants in arrears), 27 incoming payments, three invoices, three dunning notices, six meters with readings, damages, appointments, prospects, document metadata (without a file) and an e-mail history (log rows only, nothing is sent). Bookings, payments, open items, invoices, dunning notices, meters, damages, appointments, prospects, documents and e-mails therefore return sample data as well. The messages and endpoints of the API do not change. |
| 2026-10-13 | Sandbox (test mode): under Administration → API access → Sandbox an organization creates its own test organization with made-up sample data and generates test tokens (prefix m2h_test_). Same address as for real tokens; test tokens only see the sample data, real tokens never see the sandbox. Every response to a test token carries the header X-M2H-Sandbox: true. Tighter limits (60 read and 10 write requests per minute and token, 500 write requests per day), no e-mails, webhooks not yet available. The messages and endpoints of the API do not change. |
| 2026-10-13 | Status page: the new page Status (/docs/en/status) shows publicly and without sign-in whether the API and webhook delivery are working right now – per component the state, availability over the last 30 and 90 days, incidents with start, end and a short text, and a few key figures (delivery delay, delivery latency, API response time), aggregated only and without any information about individual customers. The description (info of the OpenAPI) links to the page; the messages and endpoints do not change. |
| 2026-10-13 | Webhooks: pausing instead of discarding. When a webhook is disabled, open deliveries are paused (new status paused, also a filter in the delivery history) instead of discarded; as long as the API is enabled, new events keep being recorded (up to 10,000 per webhook, 29 days at most). After PATCH active: true the server resumes them by itself (at most 60 per minute per webhook, oldest first, same event id); PATCH field paused_deliveries (resume | discard, only with active: true). New fields on the webhook: pending_deliveries, paused_deliveries, recording_gap (gap in the recording, reconcile via updated_since); new reason paused for delivery_not_replayable. The delivery with the sixth failed attempt stays failed. The messages themselves do not change. |
| 2026-10-12 | Specification and docs: the OpenAPI now describes the webhook messages formally (section webhooks, OpenAPI 3.1) for the seven events and webhook.test. All endpoints register the response 500 internal_error; error.details is typed and described per endpoint. Error codes carry advice on what to do. New or reworked: quickstart with a webhook path, idempotency flow with a table per endpoint, versioning and deprecation, special cases of the rate limits, notes on list fetch and change sync. New field info.x-revision in openapi.json. Corrected: a test delivery is only the same one for as long as it stays in the delivery history (30 days). |
| 2026-10-12 | Webhooks: send deliveries again (replay). POST /v1/webhooks/{id}/deliveries/{delivery_id}/retry queues a failed or abandoned delivery again, POST /v1/webhooks/{id}/deliveries/retry-failed up to 100 at once (filters by time range, status and event type; scope webhooks:manage, Idempotency-Key). Same event id, new timestamp and new signature; at most 1000 per webhook and hour. New field replay_count in the delivery history, new error code delivery_not_replayable (409). |
| 2026-10-10 | Tenant timeline: GET /v1/tenants/{id}/timeline (scope timeline:read) with events from emails, dunning notices, payments, documents and contract. A source only appears if the token additionally has its read scope; timeline:read alone returns an empty list. |
| 2026-10-10 | Webhooks: GET/POST /v1/webhooks, GET/PATCH/DELETE /v1/webhooks/{id}, rotate-secret, test and delivery history (scope webhooks:manage). Events payment.received, dunning.sent, contract.signed, invoice.created, document.created, email.sent and damage.created; signed, thin messages with retries. New error codes webhook_url_invalid and webhook_limit_reached. New: the webhooks handbook with signature examples. |
| 2026-10-10 | Contracts: GET /v1/contracts and /v1/contracts/{id} (scope contracts:read) with signature state, terminations and amendments; CSV and Excel possible. |
| 2026-10-10 | Units and garages: GET /v1/units and /v1/units/{id} (scope units:read) with status, current contract, tenant and base rent. |
| 2026-10-10 | Utilities and meters: GET /v1/utility/statements, /v1/meters, /v1/meters/{id}/readings (scope utility:read) and POST /v1/meters/{id}/readings to enter a meter reading (scope utility:write, Idempotency-Key, plausibility check). |
| 2026-10-10 | DATEV: POST /v1/datev/exports, GET /v1/datev/exports, GET /v1/datev/exports/{id} and POST /v1/datev/exports/{id}/download-link (scope datev:export); link valid for 5 minutes, file available for 24 hours, at most 30 new exports per organization and hour. New error code export_not_ready. |
| 2026-10-10 | Contractors: GET /v1/contractors and GET /v1/contractor-orders (scope contractors:read); CSV and Excel possible. |
| 2026-10-10 | Damage reports: GET /v1/damages and /v1/damages/{id} (scope damages:read) and POST /v1/damages and PATCH /v1/damages/{id}/status (scope damages:write, Idempotency-Key). |
| 2026-10-10 | Appointments: GET /v1/appointments and /v1/appointments/{id} (scope appointments:read, with upcoming=true) and POST /v1/appointments (scope appointments:write, Idempotency-Key; no emails and no notifications). New error code appointment_conflict. |
| 2026-10-10 | Prospects: GET /v1/prospects, /v1/prospects/{id} and /v1/waitlist (scope prospects:read, without contact details) and POST /v1/prospects (scope prospects:write; 30 enquiries per token and hour, 5 per email address in 24 hours). |
| 2026-10-09 | Emails to tenants: GET /v1/emails, /v1/emails/{id} and change sync (scope emails:read; full text only with the add-on scope emails:read_body). 38 approved templates, without recipient address and without credential emails. |
| 2026-10-09 | Access log: GET /v1/usage (scope usage:read) with filters by token, status and path; 90 days retention. |
| 2026-10-09 | CSV and Excel: bookings, invoices, payments, dunning notices, open items and emails as a file via ?format=csv|xlsx; separator via delimiter; cursor in the header X-Next-Cursor; error code unsupported_format. |
| 2026-10-09 | Shared time filter for the new lists: period, date or from/to; without any the last 30 days. New error codes period_conflict and range_invalid. |
| 2026-10-09 | Documents: GET /v1/documents, /v1/documents/{id}, change sync and short-lived download links (scopes documents:read and documents:download). A token may now carry up to 40 scopes. |
| 2026-10-07 | Cancel an import: DELETE /v1/tenant-imports/{id} (scope tenants:import); new error code session_has_transferred_records (409). The takeover now also reports contract_number for already_transferred; its body is limited to 64 KB (413 payload_too_large, previously up to 1 MB was accepted). |
| 2026-10-07 | Uniform, readable errors: error.details maps every field to fixed codes (required, invalid_uuid, unknown_parameter, too_many_ids …), error.message states the first problem; unknown parameters and fields are named. from after to is reported as range_invalid everywhere (details.to = before_from). Invalid identifier in the path: 400 instead of 404. Unknown addresses: 404 route_not_found in the standard format with request_id. New error code invalid_authorization_scheme (401). New header X-RateLimit-Reset; X-RateLimit-* now on all responses with a known token. GET /v1/openapi.json like /openapi.json; servers of the OpenAPI lists the hosts of the environment. Change-sync cursors only work for their own resource. |
| 2026-09-29 | Change sync for bookings, invoices, incoming payments and dunning notices: …/changes/cursor, …/changes and …/by-ids; new error code cursor_expired (410). |
| 2026-09-29 | Request log: every request is logged for 90 days, including rejected sign-ins with a known token ID; history per token in the administration. |
| 2026-09-28 | Invoices (GET /v1/invoices, scope invoices:read) and incoming payments (GET /v1/payments, scope payments:read). Bank details and payment reference of payers only with the add-on scope payments:read_counterparty. |
| 2026-09-28 | Open items (GET /v1/open-items, /v1/open-items/summary, scope open_items:read) and dunning read-only (GET /v1/dunning/leases, /v1/dunning/notices, scope dunning:read). |
| 2026-09-28 | Finance: booking journal (GET /v1/bookings) and net revenue (GET /v1/revenue), scope bookings:read. One tenant, also without a running lease (GET /v1/tenants/{id}, scope tenants:read). |
| 2026-09-28 | Occupancy rate: history per day or month (GET /v1/occupancy/history) and breakdown by garage type (?group_by=storage_type); new error code range_too_large. |
| 2026-09-25 | Takeover via the API: POST /v1/tenant-imports/{id}/commit (scope tenants:import_commit). Own limits for imports; tokens only work while their creator has the API access permission. |
| 2026-09-25 | Documentation also available in English (/docs/en); OpenAPI in English via ?lang=en. |
| 2026-09-24 | Tenant import: POST /v1/tenant-imports and GET /v1/tenant-imports/{id} (scope tenants:import). |
| 2026-09-24 | v1 published (pilot): garage parks, occupancy rate, current tenants. |