unPLUGDevelopers
/

Changelog

Every change to the API, webhooks, data exports and these docs, newest first. Check it before you upgrade an integration, and when something you rely on moves from Coming soon to available.

How entries are written#

  • Each entry has a date and says what changed, which endpoints, fields or event types it touches, and whether you need to do anything.
  • Additive changes (new endpoints, new fields, new event types, new values on fields documented as "may grow") ship within /v1 and appear here on the day they go live. Write your code to ignore fields and event types it doesn't know.
  • Breaking API changes ship only as a new version, such as /v2, with at least 12 months of overlap. See Versioning.
  • Data export schema changes are announced here 30 days before they happen.
  • When a Coming soon feature ships, its entry says so and the docs drop the badge.

There is no RSS feed yet.

October 30, 2026: App API and Management API#

  • The reference is now two APIs. The App API has everything your app, website and server need to run loyalty for guests. The optional Management API automates what the unPLUG Dashboard does: offers, creating and running challenges, points adjustments, merging members and reports. Each has its own OpenAPI file: openapi.yaml and openapi-management.yaml.
  • Old links to moved pages redirect to their new place. No endpoint, field or path changed.
  • New server-side versions for a server-to-server integration: GET /v1/challenges with member_id, GET /v1/members/{id}/challenges, POST /v1/members/{id}/challenges/{challenge_id}/join, GET /v1/members/{id}/messages/next and POST /v1/members/{id}/messages/{message_id}/events Coming soon.

October 29, 2026: first public draft of the docs, API in development#

The first public version of these docs. The API is still being built, so everything here describes what we plan to ship. Shapes can still change before release; any change will be listed on this page.

Available at launch#

  • Authentication: secret keys with scopes, issued by support; member tokens (15 minutes) from POST /v1/member_tokens; token revocation.
  • Program and catalog: GET /v1/program, /v1/locations, /v1/rewards.
  • Members: create, look up by external_id, email or phone, update, delete; linking guests who already earn at the register by verified phone.
  • Activity and adjustments: points history and POST /v1/members/{id}/points_adjustments (now in the Management API).
  • Wallet: rewards issued to a member.
  • Checkout: POST /v1/checkouts/preview, redemptions with a 15-minute hold (one per order), orders, refunds; shared and unique promo codes.
  • Push and in-app messages: device registration, full-screen in-app messages, push open tracking, communication preferences. Push credentials uploaded through support.
  • App events: POST /v1/app_events.
  • Webhooks: endpoint management, Standard Webhooks signatures, retries for 3 days, event log and redelivery for 30 days, and 12 event types.
  • Sandbox: the demo environment on unPLUG's Square sandbox, test phone numbers and test helpers.
  • Basics: RFC 9457 errors, idempotency keys, cursor pagination, rate limits, /v1 versioning.
  • OpenAPI: openapi.yaml covering every endpoint, including Coming soon ones.

Coming soon#

  • unPLUG-hosted sign-in for brands without their own login: OAuth 2.0 with PKCE and SMS codes.
  • Developer dashboard for keys, webhook endpoints, push credentials and request logs.
  • Offer management: create, publish, grant and budget offers; unique code batches.
  • Challenges and their webhooks (challenge.joined, challenge.progressed, challenge.completed).
  • Points expiry and points.expiring.
  • Referrals and referral.completed.
  • Member merge and in-store identification codes.
  • Stacking more than one reward or code on an order, and claiming guest orders later.
  • Tracked links and order attribution from unPLUG messages.
  • Data sharing: Reports API, daily file exports, Snowflake Secure Data Share.
  • GitHub secret scanning for leaked unPLUG keys.