> ## Documentation Index > Fetch the complete documentation index at: https://docs.punchplay.tv/llms.txt > Use this file to discover all available pages before exploring further. # Changelog > Track externally visible changes to PunchPlay's developer platform. ## 2026-07-28 ### Added * Bulk writes at `POST /api/platform/v1/sync/history`, `/sync/ratings`, and `/sync/watchlist`, accepting up to 100 items and 512 KiB per request * A durable change feed at `GET /api/platform/v1/me/sync/changes` and per-resource backfill at `GET /api/platform/v1/me/sync/snapshot`, so large clients mirror an account instead of re-polling library endpoints. Cursors stay valid for 90 days * Required `Idempotency-Key` on every bulk write, with results replayed for 24 hours * Token revocation at `POST /api/platform/v1/oauth/revoke` (RFC 7009) * OAuth server metadata at `/.well-known/oauth-authorization-server` (RFC 8414), so standard OAuth libraries can discover the endpoints * `X-RateLimit-Limit`, `X-RateLimit-Remaining`, and `X-RateLimit-Reset` on every platform response, exposed via CORS for browser clients * Cursor pagination on `GET /api/platform/v1/me/collection` and `GET /api/platform/v1/me/lists` via `limit` and `cursor`, returning `nextCursor` ### Updated * Every authenticated endpoint now enforces a per-token bucket (300 reads or 120 writes per minute) and a per-app bucket (6,000 per minute across all its users). Endpoint-specific limits apply on top of these * Bulk sync accepts 512 KiB bodies rather than the general 64 KiB ceiling, so a full 100-item batch of long-titled entries is no longer rejected * Every `429` now carries `Retry-After` ### Fixed * `/.well-known/oauth-authorization-server` returned an `issuer` with a trailing slash. RFC 8414 requires it to match the string the well-known URI was built from, and strict OAuth clients abandoned discovery on the mismatch ### Breaking * `GET /api/platform/v1/me/collection` and `GET /api/platform/v1/me/lists` now return a bounded page (100 and 50 by default) plus `nextCursor`, where they previously returned the entire set. Follow `nextCursor` to retrieve everything * A stale `Idempotency-Key` whose original request died before recording its result now returns `409 idempotency_indeterminate` instead of silently re-running the write. That mutation may already have applied: reconcile through `/me/sync/changes` and retry with a **new** key ## 2026-07-27 ### Updated * Platform errors now consistently return `error`, `message`, and `request_id`, including delegated list, history, rating, collection, and profile failures * Platform JSON and form bodies are capped at 64 KiB with a 10-second read timeout; the OpenAPI contract now documents `408` and `413` responses * OAuth and device-flow status contracts now match production, including HTTP `400` for `authorization_pending`, `401` for invalid clients, and explicit `302` authorization redirects * List and collection writes now derive anime classification from canonical TVDB identity when clients omit the optional compatibility hint ## 2026-07-26 ### Added * Stable anime search, trending, and discovery through the public catalog API * Explicit anime classification on collection items while preserving their routable movie/show kind ### Updated * Anime titles use TMDB base identities with TVDB enrichment and official episode ordering for mapped series * Playback, list, collection, SDK, and OpenAPI contracts now distinguish anime category from movie/show kind * Legacy provider-ID translation remains an internal import and redirect compatibility concern ## 2026-07-23 ### Updated * All 16 developer-app scopes are now listed consistently across the Authentication guide, native-app guide, and OpenAPI reference * PunchPlay's APNs device-registration routes are enforced as first-party-only; third-party apps retain notification inbox, unread-state, and preference access * Authenticated Platform API operations now publish concrete request and success-response schemas instead of generic JSON placeholders * Public catalog and community rate limits are documented alongside the existing public-profile limit ## 2026-07-19 ### Added * Stable public catalog search, trending, and discovery endpoints * Stable public community overview and authenticated community-stat endpoints * Native notification inbox, unread count, mark-read, and notification-preference endpoints * First-party-only APNs push-device registration and removal endpoints * Native trophy, profile, and user-preference endpoints * Four least-privilege scopes: `notifications:read`, `notifications:write`, `trophies:read`, and `profile:write` ### Updated * Native clients can keep discovery, community, notifications, trophies, profile editing, and preferences inside the app * Sensitive account operations such as password, email, imports, connected services, and account deletion remain web-only * The recommended first-party mobile authorization set now contains 16 scopes ### Notes * Anime discovery was not yet included in that mobile-client release * Third-party apps can use the notification inbox and preference APIs, but PunchPlay's APNs device-registration routes are reserved for first-party clients ## 2026-07-18 ### Added * Platform title, season, and episode detail endpoints for native clients * Watch-history reads, logging, date editing, and deletion * Ratings, favourites, planning, and watch-status reads and writes * User list CRUD and list-item management * Physical and digital collection reads and writes * Calendar and Continue Watching endpoints * Public documentation for all 12 developer-app scopes ### Updated * Native clients can now implement the core PunchPlay movie and TV experience without linking to the web application * The OpenAPI reference now covers the complete `/api/platform/v1` route tree * OAuth guidance now recommends authorization code + PKCE for native apps that can receive a callback * The reserved `email:read` scope is no longer offered to developer apps ### Current boundary * Notifications, trophies, and account settings remain web experiences * Community endpoints are used by the first-party mobile client but are not yet part of the stable `/api/platform/v1` contract * Anime discovery was not yet included in that mobile-client release ## 2026-06-16 ### Added * Persistent platform request logging keyed by `request_id` for support and incident investigation * Open developer app registration in PunchPlay settings for confidential and public clients ### Updated * OAuth refresh responses now rotate and return a new `refresh_token` with `refresh_expires_in` * Device refresh responses now rotate and return a new `refresh_token` with `refresh_expires_in` * Playback and auth docs now document the current debugging and token rotation contract * OpenAPI reference now reflects the live refresh-token response shape ## 2026-06-09 ### Added * Authorization code + PKCE support for PunchPlay developer apps * App-level `allowed_scopes` policy for developer app registration * Request-scoped platform error IDs via `request_id` and `X-PunchPlay-Request-Id` * Scope enforcement updates across `/me`, playback, device auth, and OAuth token flows * Connected app revocation support in user settings ### Updated * Authentication docs now cover both OAuth and device code flows * Quickstart now reflects web, browser, native, desktop, and TV integration paths * Error docs now describe the current debugging and support contract * OpenAPI reference now reflects the current platform auth surface ## 2026-06-08 ### Added * Initial PunchPlay developer portal * Platform API documentation for device authentication * Platform playback documentation for `start`, `pause`, `resume`, `stop`, and `progress` * Live playback guides for now-playing, in-progress, and SSE updates * Public API documentation for public user profile data * Generated endpoint reference from the initial OpenAPI definition * Developer app registration with `client_id` issuance * Confidential and public client support * Scope-aware platform tokens ### Notes * The current public platform contract is `v1`. * Future work is expected in areas such as app registration automation, outbound webhooks, and richer read and write surfaces.