Skip to main content

​
2026-07-27

​
Updated

  • Platform errors now consistently return error, message, and request_id, including delegated list, history, rating, collection, and profile failures
  • Platform JSON and form bodies are capped at 64 KiB with a 10-second read timeout; the OpenAPI contract now documents 408 and 413 responses
  • OAuth and device-flow status contracts now match production, including HTTP 400 for authorization_pending, 401 for invalid clients, and explicit 302 authorization redirects
  • List and collection writes now derive anime classification from canonical TVDB identity when clients omit the optional compatibility hint

​
2026-07-26

​
Added

  • Stable anime search, trending, and discovery through the public catalog API
  • Explicit anime classification on collection items while preserving their routable movie/show kind

​
Updated

  • Anime titles use TMDB base identities with TVDB enrichment and official episode ordering for mapped series
  • Playback, list, collection, SDK, and OpenAPI contracts now distinguish anime category from movie/show kind
  • Legacy provider-ID translation remains an internal import and redirect compatibility concern

​
2026-07-23

​
Updated

  • All 16 developer-app scopes are now listed consistently across the Authentication guide, native-app guide, and OpenAPI reference
  • PunchPlay’s APNs device-registration routes are enforced as first-party-only; third-party apps retain notification inbox, unread-state, and preference access
  • Authenticated Platform API operations now publish concrete request and success-response schemas instead of generic JSON placeholders
  • Public catalog and community rate limits are documented alongside the existing public-profile limit

​
2026-07-19

​
Added

  • Stable public catalog search, trending, and discovery endpoints
  • Stable public community overview and authenticated community-stat endpoints
  • Native notification inbox, unread count, mark-read, and notification-preference endpoints
  • First-party-only APNs push-device registration and removal endpoints
  • Native trophy, profile, and user-preference endpoints
  • Four least-privilege scopes: notifications:read, notifications:write, trophies:read, and profile:write

​
Updated

  • Native clients can keep discovery, community, notifications, trophies, profile editing, and preferences inside the app
  • Sensitive account operations such as password, email, imports, connected services, and account deletion remain web-only
  • The recommended first-party mobile authorization set now contains 16 scopes

​
Notes

  • Anime discovery was not yet included in that mobile-client release
  • Third-party apps can use the notification inbox and preference APIs, but PunchPlay’s APNs device-registration routes are reserved for first-party clients

​
2026-07-18

​
Added

  • Platform title, season, and episode detail endpoints for native clients
  • Watch-history reads, logging, date editing, and deletion
  • Ratings, favourites, planning, and watch-status reads and writes
  • User list CRUD and list-item management
  • Physical and digital collection reads and writes
  • Calendar and Continue Watching endpoints
  • Public documentation for all 12 developer-app scopes

​
Updated

  • Native clients can now implement the core PunchPlay movie and TV experience without linking to the web application
  • The OpenAPI reference now covers the complete /api/platform/v1 route tree
  • OAuth guidance now recommends authorization code + PKCE for native apps that can receive a callback
  • The reserved email:read scope is no longer offered to developer apps

​
Current boundary

  • Notifications, trophies, and account settings remain web experiences
  • Community endpoints are used by the first-party mobile client but are not yet part of the stable /api/platform/v1 contract
  • Anime discovery was not yet included in that mobile-client release

​
2026-06-16

​
Added

  • Persistent platform request logging keyed by request_id for support and incident investigation
  • Open developer app registration in PunchPlay settings for confidential and public clients

​
Updated

  • OAuth refresh responses now rotate and return a new refresh_token with refresh_expires_in
  • Device refresh responses now rotate and return a new refresh_token with refresh_expires_in
  • Playback and auth docs now document the current debugging and token rotation contract
  • OpenAPI reference now reflects the live refresh-token response shape

​
2026-06-09

​
Added

  • Authorization code + PKCE support for PunchPlay developer apps
  • App-level allowed_scopes policy for developer app registration
  • Request-scoped platform error IDs via request_id and X-PunchPlay-Request-Id
  • Scope enforcement updates across /me, playback, device auth, and OAuth token flows
  • Connected app revocation support in user settings

​
Updated

  • Authentication docs now cover both OAuth and device code flows
  • Quickstart now reflects web, browser, native, desktop, and TV integration paths
  • Error docs now describe the current debugging and support contract
  • OpenAPI reference now reflects the current platform auth surface

​
2026-06-08

​
Added

  • Initial PunchPlay developer portal
  • Platform API documentation for device authentication
  • Platform playback documentation for start, pause, resume, stop, and progress
  • Live playback guides for now-playing, in-progress, and SSE updates
  • Public API documentation for public user profile data
  • Generated endpoint reference from the initial OpenAPI definition
  • Developer app registration with client_id issuance
  • Confidential and public client support
  • Scope-aware platform tokens

​
Notes

  • The current public platform contract is v1.
  • Future work is expected in areas such as app registration automation, outbound webhooks, and richer read and write surfaces.