Changelog

VUZ's public API is versioned at /api/v1 and changes additively — existing fields and behavior are never removed or repurposed within v1. A breaking change ships as /api/v2, announced here well in advance.

2026-07-06 — Developer portal launch

• New: this portal documents the full public /api/v1/* surface — 439 operations across 62 resource groups (documents incl. finalize/cancel/share/charge, clients & CRM, products & inventory, expenses & OCR, payments & mandates, ledger, reports, webhooks, and more) — alongside the reseller Partner API.
• New: a real, isolated sandbox at https://sandbox-api.vuz.co.il — its own database, no shared state with production; no email/SMS/WhatsApp leaves it, Tax Authority calls are routed to the Authority's own test environment, no card is ever charged, and PDFs are watermarked. Every response carries X-Vuz-Environment: live|sandbox.
• New: both credential types (X-Api-Key and OAuth vuz_at_* bearer tokens) work interchangeably on the same routes, enforced by one shared 50-scope model.
• New: per-key/token rate limiting (X-RateLimit-* headers, 429 + Retry-After) and a per-key audit log (GET /api-keys/{id}/usage).
• Documented gap: POST /api/v1/documents and POST /api/v1/clients do not currently accept an idempotency key — see Concepts → Idempotency for the workaround and the /integrations/* alternative if you need it today.
• Bilingual: portal chrome and guides are available in Hebrew (מדריכים tab); the API reference stays English-only.

Earlier

• The /integrations/* compatibility alias (OAuth-bearer only, externalReference idempotency, built for the WooCommerce plugin) remains live and unchanged.
• The Partner/Reseller API (/api/v1/partner/*) remains live and unchanged — see Partner / Reseller API.