# Changelog
URL: https://musicapi.com/docs/changelog.md

> Changes to the MusicAPI partner API and its docs that partners see.

Product: MusicAPI Core and MusicAPI Managed Transfers. Section: API reference.

## 2026-10-16

### New docs site

- The docs moved to a new site, grouped by task: get started, connect users, the user's library, the catalog, Managed Transfers, webhooks and alerts, billing, and guides for AI.
- The hosted transfer product is now called **MusicAPI Managed Transfers**. The REST API is **MusicAPI Core**. Every page carries a badge for its product.
- A setup page for each of the 12 services, now with [Audius](https://musicapi.com/docs/connect-users/configure-audius.md) and [Qobuz](https://musicapi.com/docs/connect-users/configure-qobuz.md) in the nav, and the exact callback URL to register.
- Every page has a Markdown twin (add `.md` to its URL), plus [/llms.txt](https://musicapi.com/llms.txt), [/llms-full.txt](https://musicapi.com/llms-full.txt) and [/openapi.json](https://musicapi.com/openapi.json) for AI agents.
- The old docs URLs redirect to the new pages.

### Webhooks and settings

- Every delivery has an `id` (`evt_<uuid>`). A retry sends the same `id`: dedupe by it.
- Every event that names a transfer carries `endUserId`, `batch` and the two integration types. See [Route an event to your user](https://musicapi.com/docs/webhooks/set-up-and-verify.md#route-an-event-to-your-user).
- `transfer.failed` and `transfer.cancelled` carry the counts. `transfer.failed` also carries `failureReason`, `failureSide` and, after a failed step, `errorName`.
- New event [`transfer.synced`](https://musicapi.com/docs/reference/events/transfer.synced.md). `transfer.progress` is sent more often: at most once every 15 seconds per transfer.
- The MusicAPI-branded transfer email is a [setting](https://musicapi.com/docs/managed-transfers/turn-on-and-brand.md#transfer-emails), off by default.
- New setting **Browser logins can only attach**: [attach-only tokens for browser sign-ins](https://musicapi.com/docs/connect-users/raw-tokens-and-refresh.md#attach-only-tokens-for-browser-sign-ins).
- Napster is no longer supported. Napster closed its music streaming service in January 2026. Its old pages redirect to [Services and features](https://musicapi.com/docs/get-started/services-and-features.md).

### Docs sign-in and Try it

- Sign in on the docs with your dashboard account. The examples then show your slug, your Client ID and your return URL, and **Try it** calls the API as your account. Your Client Secret never reaches the docs.
- A docs session lasts 8 hours, or until the browser tab closes. Your dashboard settings list the active sessions, with a revoke button.
- Signed out, **Try it** uses a 1-hour sandbox session for the catalog calls. Connect your own music account through the hosted sign-in of our `demo` account, and the sandbox also runs the library calls on that account.
- `POST /public/docs-sessions/sandbox` takes an optional `authModelUUID` (the `authModel.uuid` of `data64`). The spec marks the sandbox operations with `x-docs.sandbox: "catalog"` or `"connectedUser"`.
- New scheme `Authorization: DocsSession <token>` on `/public/*` and `/api/{integrationUserUUID}/*`. It acts as your account but never as your Client Secret.

### MCP server

- New [MusicAPI MCP server](https://musicapi.com/docs/ai/mcp-server.md) at `https://api.musicapi.com/mcp`, with OAuth 2.1 sign-in and 26 tools to set up and run your account from Claude, Cursor or ChatGPT.

### API spec fixes

- The spec now comes from the API code and is tested against it.
- Credentials are alternatives: any one accepted scheme is enough. The old spec required all of them together.
- `POST /public/search` takes `type` = `track`, `album` or `artist`.
- `POST /public/embed/url` and `GET /app/integrations/byUniqueId/{uniqueId}` need no credential. `byUniqueId` documents `tokenOnly`.
- The rate limit is documented as it works: 300 requests per minute per account, in a fixed 60-second window, with `429` and `Retry-After`.
- The Client-Secret-only routes are named: `DELETE /public/integrations/user/{uuid}` and the Match Results API.
- The `transfer.cancelled` webhook event is documented.

### Newly documented endpoints

- [`POST /public/search/match`](https://musicapi.com/docs/reference/match-catalog-items.md)
- [`GET /public/integrations/user/{integrationUserUUID}`](https://musicapi.com/docs/reference/get-integration-user.md)
- [`GET /public/integrations/auth/{authModelUUID}`](https://musicapi.com/docs/reference/get-sign-in-result.md)
- [`POST /public/integrations/refreshAuthToken`](https://musicapi.com/docs/reference/refresh-integration-user-token.md)
- [`GET /app/integrations/{authModelUUID}`](https://musicapi.com/docs/reference/get-hosted-sign-in.md)
- [`GET /public/embed/{resourceType}/{resourceId}`](https://musicapi.com/docs/reference/get-embed-player.md)
- [`GET /app/users/{slug}`](https://musicapi.com/docs/reference/get-partner-profile.md)
- The hosted sign-in parameters `requestOneTimeToken`, `uniqueId`, `forwardFailures` and `merchantUserId` on [`GET /{slug}`](https://musicapi.com/docs/reference/start-sign-in.md)
- The [webhook events](https://musicapi.com/docs/webhooks/set-up-and-verify.md#the-events), each with its own reference page