← Developer docs

API changelog

Last updated 2026-11-03

What changed in the HyperDM API, newest first. Anything being retired is announced here, under the deprecation policy.

The API isn't open to every workspace yet. It's switched on one workspace at a time, and there's no public sign-up. Where it's on, the workspace's owner and admins see Developers under Settings.

  1. Added

    Draft replies and reading conversations, for AI assistants

    Switched on per workspace with the MCP server; elsewhere both answer 404 route_not_found. POST /contacts/{id}/drafts (drafts:write) stores a draft reply for a teammate to review and sends nothing. GET /contacts/{id}/messages (conversations:read, a new permission nothing else includes) returns the last 30 days of a contact's messages with their text, newest first.

    • POST /api/v1/contacts/{id}/drafts
    • GET /api/v1/contacts/{id}/messages

  2. Added

    Sign-in with a Client ID Metadata Document

    A known AI app that HyperDM has set up can use its metadata document's URL as client_id. It signs in as a public client: PKCE (S256) is required, and the token endpoint takes code_verifier instead of a client secret.

  3. Policy

    This changelog and a written deprecation policy

    The API now has a public record of what changed and a written promise about how anything gets retired. No endpoint changed.

  4. Changed

    start_refused can mean a WhatsApp message may have arrived

    When HyperDM can't confirm whether a WhatsApp first message reached the person, a start answers 422 start_refused and the message says so. It is never sent again, so check the conversation before starting that automation for them again.

    • POST /api/v1/automations/{id}/starts

  5. Changed

    Email addresses left the contacts list

    An email address now lives under the person it was captured from, so GET /contacts leaves those rows out and a page is always that many people. channel=email on GET /contacts or GET /automations answers 400 invalid_request rather than an empty list.

    • GET /api/v1/contacts
    • GET /api/v1/automations

  6. Added

    Version 1 of the API

    API keys and installable apps with OAuth 2.0 authorization code, plus contacts, tags, custom fields and live automations. Read and change permissions are separate. Errors share one shape with a request id, lists use cursors, and writes take an Idempotency-Key (required on automation starts).

    • GET /api/v1/me
    • GET /api/v1/contacts
    • GET /api/v1/contacts/{id}
    • PATCH /api/v1/contacts/{id}/fields
    • POST /api/v1/contacts/{id}/tags
    • DELETE /api/v1/contacts/{id}/tags/{tag_id}
    • GET /api/v1/tags
    • POST /api/v1/tags
    • GET /api/v1/fields
    • POST /api/v1/fields
    • GET /api/v1/automations
    • POST /api/v1/automations/{id}/starts