API changelog

Changes to the Public API and the Extensions API, newest first.

2026-11-04

Breaking changes

• Added the lock_event.created webhook, sent alongside action_log.created
  • lock_event.created is experimental, like extension communication: its payload can change. action_log.created stays stable
  • Extensions without a manifest receive lock_event.created for every event of their locks, including hidden events and except their own
  • A visible history entry is sent in both webhooks, with the same data.actionLog. Handlers that react to any webhook containing data.actionLog without checking event react twice
  • Check event, answer 2xx to event types you do not handle, and deduplicate on data.actionLog._id or data.eventId, never on requestId
  • Documentation: Lock events and action logs
• Granular OAuth scopes for the Public API
  • 18 new area:read / area:write scopes. locks, shared_locks, keyholder and messaging keep working with no end date, each counting as its read and write pair
  • OAuth apps and developer tokens no longer receive email addresses. GET /auth/profile returns email and billingEmail as null, and ID tokens and userinfo no longer carry them
  • The email scope is removed: an authorize URL that still requests it fails with invalid_scope before the consent screen
  • Some endpoints change scope or close to OAuth apps, see OAuth scopes: action needed
  • Documentation: OAuth scopes

New features

• Added extension communication, experimental
  • The manifest, commands, queries, lock events, endpoints and webhooks can change in incompatible ways or be removed. Changes are listed in this changelog
  • Extensions publish a manifest of their commands, queries and events, with JSON Schemas
  • Extensions discover what a lock offers and call other extensions through Chaster
  • Every lock has an ordered event stream, delivered by the lock_event.created webhook and readable with GET /api/extensions/sessions/:sessionId/events
  • New endpoints:
    • PUT /api/developers/extensions/:extensionId/manifest - Upload the manifest of your extension
    • GET /api/extensions/:slug/manifest - Read the public manifest of an extension
    • GET /api/extensions/sessions/:sessionId/capabilities - List the capabilities of a lock
    • POST /api/extensions/sessions/:sessionId/actions/:commandId - Call a command or a query
    • POST /api/extensions/sessions/:sessionId/events - Emit an event
    • PUT /api/extensions/sessions/:sessionId/subscriptions - Change the subscriptions of a session
  • New webhook action.invoke, for calls to your commands and queries
  • Lock actions and the Tasks, Penalties, Hygiene opening, Verification picture and Pillory endpoints keep their formats, and share the new rate limits
  • Documentation: Extension communication
• Webhook history is kept for 7 days

OAuth scopes: action needed

1. Your authorize URL requests email: remove it, or sign-in fails with invalid_scope.
2. You call extension actions, or task or pillory votes, with a token: make sure it has locks:read and locks:write, or the legacy locks.
3. You call blocks, reports, the badge count or calendar statistics: request the scope listed in Endpoints that changed scope. Users authorize your app again.
4. You call PUT /locks/shared-locks/:sharedLockId/extensions: switch to PUT /shared-locks/:sharedLockId/extensions. The old route keeps working and is deprecated.
5. New apps: request granular scopes. Existing apps hold them alongside their legacy scopes and can switch at any time.

Endpoints that changed scope

Endpoints	Before	Now
GET /blocks, GET /blocks/block-interaction/:targetUserId, GET /locks/user/:userId	any valid token	users:read
POST /blocks, POST /blocks/unblock, POST /reports	any valid token	users:write
GET /users/badge/count	any valid token	notifications:read
GET /user-profile/calendar-statistics	profile	profile:read
GET /locks/:lockId/extensions/:extensionId, with a token	any valid token	locks:read
POST /locks/:lockId/extensions/:extensionId/action, POST /extensions/tasks/:lockId/vote, POST /extensions/pillory/:lockId/vote, with a token	any valid token	locks:write

Anonymous calls to endpoints that accept them behave as before.

Endpoints closed to OAuth apps and developer tokens

• GET /auth/totp/status, POST /auth/totp/disable and GET /auth/profile/update return 403 and are removed from the API reference
• GET /users/search/by-discord-id/:discordId returns 401
• Profile edits that change the email return 400

Newly available endpoints

These endpoints were listed but returned 403, or were not listed:

Endpoints	Scope
Calendar events: GET, POST /calendar/events, PATCH, DELETE /calendar/events/:id	calendar:read / calendar:write
Notifications: counts, search, channel health, read, act, read all, seen, Discord channel	notifications:read / notifications:write
Kink profile: GET, PUT /current-user/kink-profile, predefined list	profile:read / profile:write
GET /lock-stats/reset-config, POST /community-event/details	profile:read
Profile edits: PATCH /current-user, POST /auth/profile	profile:write
POST /lock-stats/reset	profile:write
Academy enrollment and lesson progress	profile:write
Member search: POST /users/search, /users/search/by-username	users:read
Activity feed and posts: POST /posts, GET /posts/:postId, subjects, cancel	posts:read / posts:write
Keyholder applications: apply, withdraw	keyholder:write
Keyholder applications on a lock: list / answer	locks:read / locks:write
Combination image verification and combination upload	locks:write
Extension schedules: GET, PATCH /locks/:lockId/extensions/:extensionPartyId/schedule	locks:read / locks:write
PUT /shared-locks/:sharedLockId/extensions, POST /shared-locks/:sharedLockId/unarchive	shared_locks:write
GET /extensions/tasks/votes/:taskVoteId	locks:read, or anonymous
GET /data/countries, GET /data/countries/:code	none

Removed from the API reference

These endpoints were never callable by OAuth apps: partner configuration creation, extension tester join, GET /users/profile-completeness, /user-pictures/*, and the /health, /live and /ready probes.

Other changes

• New developer tokens use a stronger random generator. Existing tokens keep working.

2026-02-03

New features

• Added Verification Picture API for extensions
  • Extensions can now request verification pictures from wearers
  • New endpoint: POST /api/extensions/sessions/:sessionId/verification-picture/request
  • Documentation: Verification Picture

2026-01-27

New features

• Added extension icon editing
  • Developers can now edit their extension icons directly from the extension configuration page
• Added Actor system for extensions
  • For some endpoints, extensions can now specify who is performing an action: wearer, keyholder, or the extension itself
  • This enables proper attribution in action logs and the Chaster user interface
  • Documentation: Actor System
• Added Pillory API for extensions
  • Extensions can now retrieve the current pillory status for a lock session
  • New endpoint: GET /api/extensions/sessions/:sessionId/pillory/status
  • Check if a user is in the pillory and get details about active votes
  • Documentation: Pillory
• Added Tasks API for extensions
  • Extensions can now programmatically interact with the Tasks extension
  • New endpoints:
    • POST /api/extensions/sessions/:sessionId/tasks/assign - Assign tasks to wearers
    • POST /api/extensions/sessions/:sessionId/tasks/start-timer - Start timers for timed tasks
    • POST /api/extensions/sessions/:sessionId/tasks/complete - Complete or fail tasks
  • Documentation: Tasks
• Added Hygiene Opening API for extensions
  • Extensions can now temporarily unlock locks using the Hygiene Opening extension
  • New endpoint: POST /api/extensions/sessions/:sessionId/temporary-opening/open
  • Documentation: Hygiene Opening

2025-11-20

New features

• Added Testers management for extensions
  • You can now add testers to your extension through the Testers tab in the extension configuration page
  • Testers can use your extension in test mode without requiring application ownership access
  • This is now the recommended method for allowing users to test your extension
  • Application ownership should only be granted to trusted team members who require administrative access
  • Documentation: Testers

2025-03-29

New features

• Added Penalties API for extensions
  • Extensions can now create habits (recurring or time-limited actions)
  • New endpoints to manage penalties:
    • POST /api/extensions/sessions/:sessionId/penalties/increment
    • POST /api/extensions/sessions/:sessionId/penalties/time-limit/create
    • POST /api/extensions/sessions/:sessionId/penalties/time-limit/cancel
  • Documentation: Penalties

2024-07-08

Minor changes

• Removed deprecated endpoint POST /locks/shared-locks/:sharedLockId/archive
  • For information, all routes starting with /locks/shared-locks are deprecated.
  • Please use the routes starting with /shared-locks instead.
• Rate limits are now per user when using an OAuth token.

Bug fixes

• Fixed: The "Start timeout" option in extensions configuration is now working for cumulative mode.
• Fixed: Time updates are now provided to webhooks when time updates are hidden for the wearer.

2024-03-17

New features

• Added support for handlebars-helpers in configuration descriptions.
  • You can now use handlebars helpers in the configuration description template.
  • Documentation: Configuration page
• Added a custom helper for Handlebars templates
  • durationFromSeconds: Convert a number of seconds to a human-readable duration
  • Documentation: Configuration page

Bug fixes

• Fixed: The field availableHomeActions is correctly marked as optional on the API documentation.
• Fixed: Improved latency for endpoints using the developer token as authentication method.

2024-02-27

New features

• New endpoint PATCH /api/extensions/sessions/{sessionId} to update session information.
  • You can now update session config.
  • You can now update session data, metadata using the PATCH method, instead of the PUT methods.
• Following endpoints are now deprecated. Please use the new PATCH method instead.
  • PUT /api/extensions/sessions/{sessionId}/metadata
  • PUT /api/extensions/sessions/{sessionId}/data
• Add basic authentication for webhooks
  • Configure Basic HTTP authentication for your webhooks.
  • When you configure a webhook, you can now provide a username and password.

Bug fixes

• Fixed: The provided configuration token was not valid when the user opened the configuration modal for another extension before.
• Fixed: Any update of a running session done by a keyholder was overriding the configuration of all external extensions, if the configuration modal has not been opened before.
• Fixed: The Discord /lock slash command was not working for locks with an external extension.

2024-01-16

New features

• Webhooks are now available for extensions.
  • You can configure webhooks in the Developer interface.
  • Available events: extension_session.created, extension_session.updated, extension_session.deleted, action_log.created.
  • Documentation: Webhooks
• Resize the configuration iframe to the content height.
  • The configuration iframe can now resize to the height of the content.
  • You need to use the iframe-resizer library in your configuration page.
  • Documentation: Adapt the iframe height
• Added geolocation permission to the main and configuration pages.

Bug fixes

• Fixed: The configuration description template was not rendered in the lock extension settings.

2023-10-13

New features

• You can now modify the users who have access to your application.
  • Users with access can use your private test extensions.
  • You can add up to 20 accounts to an application.

2023-07-09: Extensions API Launch in Test Mode

Hi everyone! We're thrilled to announce that the Extensions API is now live in test mode. 🎉 You can access the complete documentation.

During this phase, we invite you to dive into the documentation, explore the API, and start building and testing your extensions. This is an exciting opportunity for you to unleash your creativity and integrate new features into the Chaster platform.

📚 Documentation and Feedback We encourage you to thoroughly review the documentation and provide us with your valuable feedback. If you encounter any bugs, missing features, or have suggestions for improvement, please don't hesitate to reach out. Your input will play a vital role in shaping the final version of the Extensions API.

🛠️ Test Mode and Limited Access During this test phase, extensions will be limited to test mode, meaning only you as the developer (and any limited users you choose) will be able to load and interact with your extensions. This allows you to experiment, fine-tune, and ensure everything works seamlessly before releasing to the wider Chaster community.

🚀 Next Steps If all goes well with testing and implementation, our plan is to officially release the Extensions API for public access in Q4. We're excited to see the first set of working extensions in action and witness the value they bring to the Chaster platform.

📩 Contact and Support For any questions, assistance, or when you're ready to request a review to validate your extension, our dedicated support channel is #api-support. Please create a thread per user and use it as your point of contact with our team. We'll be there to provide guidance, address queries, and help you throughout the process.

Thank you for being part of this journey as we expand the possibilities of Chaster with the Extensions API. We can't wait to see the innovative extensions you create!

Happy coding! 💪🚀