FastSend Partner API changelog

2026-07-16 — dedicated API entry point

All `partner_*` actions moved to `/partner-api.php`; the shared `/api.php` now rejects them fail-closed. This lets the reverse proxy enforce a 1 MiB JSON-body limit before PHP or API-key validation runs.

Versioning

Current contract version: `2026-07-16`. The server returns it in the `X-FastSend-API-Version` response header. A client may send the same header; an unknown version receives HTTP 406 plus `supported_version`.

Adding an optional response field, a new event or a new optional request field is backward-compatible. Removing or renaming a field, changing its meaning, tightening the format of a previously valid value or changing a side effect requires a new version.

For planned incompatible changes, FastSend publishes a new version and migration guidance at least 90 days in advance. Critical security restrictions may be introduced faster with separate notice and, where safe, a short explicitly disableable compatibility window.

2026-07-16

• Finite server-side file, transfer and retention limits were formalized.
• `external_id` became the transfer-create idempotency key; retries with a changed payload receive HTTP 409.
• `partner_create_transfer` no longer creates an S3 object/multipart upload or returns a presigned URL. It returns canonical `upload_requests[]`; each file passes a separate DB reservation through `initialize_endpoint`.
• Stable `client_file_id`, scoped `upload_resume_key`, staging, actual size/ETag verification, antivirus/quarantine and immutable promotion were introduced.
• Read-scoped responses no longer expose webhook secrets. A new secret is returned only by an explicit rotation operation with the required scope.
• Webhook delivery uses `X-FastSend-Delivery`, `X-FastSend-Timestamp` and `X-FastSend-Signature: sha256=…`; receivers must deduplicate the delivery ID.
• An OpenAPI 3.1 contract was added in `openapi.yaml`.