Changelog

Newest first. Breaking changes are marked Breaking.

October 22, 2026

• POST /sessions/:id/complete refuses the same key twice in photos with a 400. Until this change it failed with a 500.

October 18, 2026

• POST /sets/:setId/sessions on the cloud refuses an event in venue mode with a 409, This event registers at the venue. Register on the venue server instead.

September 30, 2026

• GET /events and GET /events/:eventSlug/sets/:setSlug return venueMode, true when the event runs on the venue server. The routes are the same either way.
• GET /health also returns venue: true from the venue server, false from the cloud.
• New page, Venue mode: how an event runs on a venue server, and GET /venue/sync and POST /venue/sync for the booth to watch and start syncs to the cloud.
• Breaking: events without guest details are gone, for now. capture is no longer returned, and POST /sets/:setId/sessions takes 1–12 guests on every event; an empty guests is a 400, Add at least one guest. Labels are always the guests’ first names.
• POST /sessions/:id/complete takes up to 200 photos, as documented. Until this change a call with more than 14 failed with a 500 and the gallery stayed unpublished; call it again for any session that failed that way.

September 25, 2026

• Events can take no guest details. GET /events and GET /events/:eventSlug/sets/:setSlug return capture, "collect" or "none". On a "none" event, POST /sets/:setId/sessions takes { "guests": [] }, labels the session Session 1, Session 2 and so on, and refuses guests with a 400. The queue’s guests is then empty.
• An empty guests on an event that takes details is still a 400, now with the message Add at least one guest. instead of a validation error.

September 24, 2026

• POST /sets/:setId/sessions only registers while the event is running, the same window as GET /events: from a day before it starts until a day after it ends. Outside it you get 409.
• Breaking: these docs now cover the booth API only. Routes that were documented for other uses are no longer public.
• Breaking: the booth routes lose their /booth prefix: GET /events, GET /sets/:setId/sessions, POST /sessions/:id/uploads, POST /sessions/:id/complete and POST /sessions/:id/cancel. The old paths give 404.
• POST /sets/:setId/sessions creates a session from the booth, for events without a kiosk. It takes 1–12 guests, each with a first name and an email, a phone, or both, and is limited to 60 a minute per IP address.
• GET /events/:eventSlug/sets/:setSlug finds a set from the short names in its kiosk link.
• New photo keys are shorter: <event-id>/<session-id>/<photo>.jpg, without the events/ and sessions/ folders. Use the key you are given, as before; existing photos keep their old keys and URLs. A key from uploads issued before this change is refused by complete with a 422; upload that photo again.
• Breaking: the one shared booth key is gone. Each integration gets an API key tied to one of our accounts, sent the same way (Authorization: Bearer tlb_…). The old key now gives 401.
• Registration takes firstName and lastName per guest again, as typed. lastName may be empty or left out; a missing or blank firstName is a 400. The single name field is deprecated and will be removed.

September 23, 2026

• POST /booth/sessions/:id/uploads?count=n returns n signed uploads in one call. Without count the response is unchanged.
• PNG photos: POST /booth/sessions/:id/uploads?type=png signs for image/png and gives .png keys. JPEG stays the default.
• New photo keys sit in a folder per event: events/<event-id>/sessions/<session-id>/<photo>.jpg. Use the key you are given, as before; existing photos keep their old keys.
• Registration refuses a phone number without a leading + unless it is a real US or Canadian number, with a 400. Numbers from other countries need + and the country code.

September 22, 2026

Docs published. No API change.

September 18, 2026

• Rate limits added to some write routes (errors and limits). The booth routes are unaffected.
• Security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) on every response.

September 14, 2026

• Breaking: registration takes one name per guest instead of separate first and last names. The server splits on the first space.

September 11, 2026

• Gallery links are sent to guests on completion, by email and SMS, as part of POST /booth/sessions/:id/complete.

September 10, 2026

First booth API: /booth/events, /booth/sets/:setId/sessions, presigned JPEG uploads, complete and cancel.