on the job
Developers

API changelog

Every change to the API, webhooks, MCP server and developer documentation, dated as it ships. Newest first. Machine-readable feed: changelog.xml (Atom). Live availability: status.flexonthejob.com.

Additive onlyNew fields, endpoints, events and tool parameters may appear at any time. Nothing existing is renamed, removed or changes type inside /api/v1.
12 months' noticeA breaking change ships as a new prefix (/api/v2); the old one keeps working for at least a year after a dated notice here.
Generated from codeThe OpenAPI document and llms-full.txt are built from the running server, so they never lag the contract.

Rate-limit headers, richer OpenAPI metadata, status page Added

  • Every /api/v1 and /mcp response now carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (seconds until the key's one-minute window resets), so clients can pace themselves instead of discovering the limit by hitting it. 429 + Retry-After is unchanged.
  • /openapi/v1.json gains info.contact, info.termsOfService, info.license and a servers[] list (production and sandbox, with the host that served the document first).
  • GET /health on the app and sandbox hosts: anonymous liveness with the running version.
  • Public status page at status.flexonthejob.com — web app, API, MCP, sandbox, sync and website, checked every minute, with incident history.
  • This page. /changelog on either host now lands here; the standard Data Processing Addendum is published at /dpa.

Public sandbox and webhooks in the spec Docs

  • Sandbox at https://sandbox.flexonthejob.com with a published read-only key — every GET and every read MCP tool works without an account; writes return 403. Details on the developer page.
  • Outbound webhooks are now part of the OpenAPI document as x-webhooks (OpenAPI 3.1 webhooks shape): one post per event with the signed envelope and a component schema per payload. The same catalogue is in llms.txt and llms-full.txt.
  • Sandbox demo organization scrubbed of real-person data.

Four change-driven webhook events Added

  • invoice.sent, transfer.completed, inventory.low_stock, item.updated. Additive — existing subscriptions are unchanged until you tick the new events. Twelve events in total.
  • Public developer documentation, security page and AI/roadmap page. /api, /docs, /openapi.json and /developers on either host redirect to the right place. robots.txt and security.txt published on both hosts.

MCP server and webhooks Added

  • Streamable-HTTP MCP server at /mcp (16 tools, 2 resources) under the same API keys, permissions and rate limits as /api/v1.
  • Webhooks: job.created, job.status_changed, job.scheduled, job.assigned, job.completed, invoice.created, invoice.paid, customer.created. X-Flex-Signature HMAC-SHA256 over the raw body; retry with backoff; delivery log in Settings.

API v1 initial release Added

  • /modules, /customers (read, create, update, locations), /items, /invoices (read, from-job, mark-sent), /jobs (read, create, status, assignees, reschedule, cancel), /schedule, /schedule-groups, /users.
  • API keys with per-key permissions and rate limits; cursor paging; updatedSince on every list endpoint; ETags; Idempotency-Key required on writes; RFC 7807 errors.
  • /docs (Scalar), /openapi/v1.json, /llms.txt, /llms-full.txt.

Planned work is on the roadmap. Questions about a change: developers@flexonthejob.com.