Changelog

Developer docs v2

A new home for the docs at docs.norreach.app.

• Search every page and operation with ⌘K, and ask the docs assistant a question — it answers from these pages and links the ones it used.
• Try it on every operation page: send a real request to https://api.norreach.app/v1 from your browser with your own API key. Writes that reach people, spend or publish ask you to confirm and start as a dry run.
• The API answers CORS for the docs' own address only (Authorization, Content-Type and Idempotency-Key headers; never credentials), so the playground can call it. Other websites still can't call the API from a browser.
• Request examples in cURL, Python, JavaScript, PHP, Go, Java and Ruby, and an example answer for every status an operation can give.
• This changelog as an RSS feed: https://docs.norreach.app/changelog/rss.xml.

v1, Phase D

• Phone numbers: the workspace's numbers, searching numbers to buy, business verification (requirements, submit, status) and buying numbers — its own scope numbers:buy (in no preset), a daily limit and a monthly-cost ceiling enforced by the database (429 number_cap_reached), and every purchase waiting in Approvals unless an owner switched that off. Event number.purchased.
• Ads: live campaigns (list, pause, switch back on within the plan's daily cap — 422 ad_switch_blocked otherwise) and Meta ad accounts' spending limits (read, set, remove, reset). Other ad networks answer 422 ad_network_unsupported. Events ad_campaign.paused and ad_campaign.resumed.
• Templates: WhatsApp templates (list, submit for review, sync) and saved message templates (create, change, delete). Event template.status_changed.
• Calls: voices, voice agents (get, create, change), and inbound call routing (rules, and whether the AI agent or the call menu answers a number).
• Team and workspace: people's working hours and availability, the team's requests (list, decide, reply) and the workspace's name, company name and time zone.
• New scopes: numbers:read, numbers:verify, numbers:buy, templates:read, templates:write, voice:write, calls:routing, team:schedules, team:requests, workspace:settings, ads:limits.

v1 (early access)

• Keys with scopes, expiry, IP allowlists, rotation and usage.
• Contacts, lists, tags and do-not-contact; erasing a person.
• Landing pages: sites, pages, versions, publishing, leads, analytics and custom domains.
• Webhooks and GET /events.
• Approvals, campaigns and automations, plans and briefs (with jobs), the inbox and messages, AI calls, meetings, deals, outreach pause and senders.
• The MCP server at /mcp (API keys).
• Chat assistants connect to /mcp with OAuth as a custom connector: /mcp answers 401 with WWW-Authenticate resource_metadata, so the assistant finds the sign-in on its own; disconnecting in Settings stops it on its next request.
• Ads: ad accounts, Nora's ad launches (budget, schedule, name, publish, back to draft) and ad results.
• Social: connected profiles, and posts with your own text and media — create, change, delete, upload media, schedule and unschedule (scheduling respects the outreach pause).
• Analytics (overview, channels, AI calls, one campaign), credits (balance, ledger, prices), the audit log, companies, and Nora: ask a question, give her a task and follow it.
• Team: members, pending invites, inviting and cancelling invites, changing roles and switching people off — never to owner, never above the key creator's own role, never their own row or the owner's.
• OAuth 2.1 for apps that connect with a sign-in: metadata, dynamic client registration and client ID metadata documents, PKCE, resource-bound tokens with rotating refresh tokens, revocation, and Connected apps in Settings.
• Hardening: key formats and checksums documented for secret scanners; keys and connected apps are suspended after unusual activity (403 key_suspended) until an owner or admin resumes them; owners and admins are told when a key is first used from a new country.