Zum Inhalt springen
DebtFlow

Changelog

New features and changes to the API. The version is included in every response in the DebtFlow-Version header.

Versioning

  • New endpoints, new optional parameters and new fields in responses are not breaking changes.
  • Removed or renamed fields, changed types or changed error codes are breaking changes. They receive a new version (date) and are announced here in advance.
  • New event types may be added at any time. Webhook receivers should ignore unknown type values.
2026-11-04

Research, creditor AI, activities and new events

  • No breaking changes; DebtFlow-Version stays 2026-11-01.
  • New scopes research:read|write, ai:read|write and activity:read|write.
  • Research: /contacts/{id}/address-research, residents’ registration office requests (Melderegisteranfragen) under /contacts/{id}/residence-registry-inquiries (charged; protection against duplicate orders with 409 inquiry_in_progress) and social media profiles under /contacts/{id}/social-profiles.
  • Creditor AI: POST /debts/{id}/recommendations generates a recommended course of action from the stored data (limited quota, 429 ai_rate_limited / ai_quota_exhausted); read them under /debts/{id}/recommendations and /contacts/{id}/recommendations.
  • Financial analysis of a contact (/contacts/{id}/finances), communication log (/contacts/{id}/communications), activity log across all objects (/activities) and key figures of the receivables overview (/reports/receivables).
  • Debts now include isTitled and inCourt (also editable via PATCH), payments the field verified; messages accept the type sms.
  • The events debt.overdue, installment.due and installment.missed are now emitted (once per occurrence); new are installment_plan.updated, installment_plan.deleted, communication.created, residence_registry_inquiry.created and recommendation.created. debt.phase_changed now also comes from the automatic reminder run and from letter dispatch.
  • Webhook delivery log: responses are truncated to 200 characters, sensitive header values and tokens are removed.
  • Webhook endpoints: new field payloadFormat (json by default, text = same body as text/plain, e.g. for signature verification in Make).
  • CORS for /api/v1: any origin without credentials (Bearer token), preflight with OPTIONS. Token and revocation endpoints only from the redirect origins of public apps.
  • Bank reconciliation against invoices additionally requires invoices:write, against receipts receipts:write. Processed events (/events) are deleted after 30 days.
  • Contacts: GET /contacts with sort and open; imported contacts and invoices trigger the same events (with source: "import").
  • The dashboard uses the same v1 endpoints for contacts, debts, payments, instalment plans, letters, clients, research and AI.
  • OAuth: PKCE (S256) is now mandatory for all apps, including confidential ones; exceptions only after review by DebtFlow. Apps show pkceRequired.
  • OAuth: parallel refreshes with the same refresh token within 30 seconds receive the same token pair (grace period) instead of revoking the token chain.
  • The consent page /oauth/authorize can no longer be embedded in third-party pages (frame-ancestors 'none').
  • Error messages (message) in German or English depending on Accept-Language (default English), header Content-Language; the codes in error are unchanged.
  • Contacts have the field language (de | en) for reminders and documents; invoices and quotes have the field language (document language).
2026-11-01

API v1

  • REST API under /api/v1 with an OpenAPI 3.1 description.
  • Authentication with API keys (df_live_…) and OAuth 2.0 with PKCE and refresh tokens (dfo_…, dfr_…).
  • Uniform error format, cursor pagination, Idempotency-Key for POST, rate limits with X-RateLimit-* headers.
  • Webhooks with the DebtFlow-Signature signature and an event catalogue.

Questions about changes? Write to [email protected]. Please report security vulnerabilities according to our security policy.