Added webhook events for the Session lifecycle,
note.approved, claim.*, payout.settled and practitioner.verified, signed with HMAC-SHA256 over the raw body.Added Idempotency-Key on write requests. Replaying a key returns the original response instead of creating a second Session, Claim or Payment.Added rate-limit headers (X-RateLimit-Limit, -Remaining, -Reset) on every response, and Retry-After on 429.Added the six core resources, each with a stable ID prefix:
per_, prc_, ses_, not_, clm_, led_.Added the Session lifecycle (booked → delivered → note_approved → settled) and the money state attached to each transition.Added cursor pagination on list endpoints via limit and starting_after, returning has_more.Changed monetary fields to integers in the currency’s smallest unit. 350000 is KES 3,500.00. Decimal amounts are rejected.Added a single error envelope for every failure, with a stable
error.code, a human error.message and an error.docs link. Branch on the code; the message may change.Added WWW-Authenticate on 401, distinguishing a missing key (error="invalid_request") from a rejected one (error="invalid_token").Added environment scoping by key prefix:
sk_test_ for Sandbox, sk_live_ for Production. A key is valid in one environment only, and using the wrong one returns api_key_invalid rather than an empty result.Changed authentication to prefer Authorization: Bearer. x-api-key remains supported for clients that cannot set an Authorization header.Added
https://api.heyrafiki.space/v1, served over HTTPS only. Requests over plain HTTP are rejected rather than redirected, so a key sent that way is never forwarded.