Skip to content

Changelog

Newest first. Breaking entries would also open a new version tree.

Docs published. No API change.

  • Rate limits added to the four unauthenticated write routes and to staff sign-in (errors and limits). /booth/* is unaffected.
  • Security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) on every response.
  • Breaking, kiosk: registration takes one name per guest instead of separate first and last names. The server splits on the first space.
  • GET /gallery/events/:slug replaced the all-events feed. Private events answer 404 here; their session links still work.
  • POST /contact added for the website’s form.
  • Gallery links are sent to guests on completion, by email and SMS, as part of POST /booth/sessions/:id/complete.

First booth API: /booth/events, /booth/sets/:setId/sessions, presigned JPEG uploads, complete and cancel.