October 2026 (2026.10)

This release adds SKU-location deletion with an approval step, OAuth 2.0 and Basic authentication for webhook destinations, partial updates to webhook settings, and extended-data webhook filters.

New Features ✨

SKU-Location Deletion

• POST /skus-locations/delete requests the deletion of SKU-location records. Because a deleted SKU-location cannot be restored, nothing is deleted until you approve the request.
• The task answers PendingReview. Approve or reject it with PUT /tasks/{TaskId}: Status is approved or rejected, with optional Comments. An approved request continues through Queued, Processing and Completed; a rejected one ends at RejectedNotApproved with nothing deleted.
• Follow the outcome with GET /tasks/{TaskId} or the task_status_update webhook trigger. While the task is still PendingReview, POST /tasks/{TaskId}/cancel withdraws the request.

Webhook Destination Authentication

• A webhook destination can now authenticate with Basic, a fixed Header, OAuth2ClientCredentials (client ID and secret), or OAuth2PrivateKeyJwt (a signed JWT assertion). Set exactly one under Authorization in POST /webhook/settings.
• Webhook credentials are stored encrypted and are never returned by the API.

Partial Webhook Settings Updates

• PATCH /webhook/settings/{configurationId} changes only the fields you send. Everything omitted keeps its stored value, credentials included, so you can rename a webhook or change its triggers without resending secrets. Triggers and RetryHandling are replaced as a whole when present.

Extended Data in Webhook Filters

• Trigger filters can now name outbound extended-data fields as ExtendedData.<ApiLabel>, for example ExtendedData.Region = 'EU', with the =, !=, IN and NOT IN operators.

Enhancements 🔨

Webhooks

• GET /webhook/history now records the body your destination answered with, so a refused delivery shows the destination's own explanation.
• GET /webhook/settings/history now includes FieldNamingConvention for each change.

Bug Fixes 🐜

• POST /webhook/test and POST /webhook/reset now accept the documented trigger names, such as POSubmit.
• Resolved an issue where a webhook settings change made shortly after another one was not correctly applied.