# Release notes

> Changes to the CoSuite Connect v1 contract and the @cosuite/connect package, from 1.0 to 1.8. Every version is backward compatible.

Source: https://cosuite.io/en/developers/release-notes

All versions below belong to contract **v1** (`cosuite-connect/1.0`) and are backward compatible: an app built for an earlier version keeps working without changes. New features are opt-in through new optional fields or new capabilities. See the [versioning rules](https://cosuite.io/en/developers/contract#versioning).

## 1.8.0: customer API gateway {#v1-8-0}

*October 28, 2026*

- Customers call your module's API at `https://api.cosuite.io/v1/apps/{app}/{path}` with their CoSuite key; the gateway forwards to your app with a Connect signature and `X-CoSuite-Gateway`, `X-CoSuite-Tenant`, `X-CoSuite-Scopes`, `X-CoSuite-Api-Key-Id`. See [Gateway & customer API](https://cosuite.io/en/developers/customer-api).
- New exports: `verifyGatewayRequest`, `signGatewayRequest`, `gatewayServer`.
- The conformance test calls parameterless `GET` operations of modules with an `api`: answer for the test business, `404 tenant_not_found` for an unknown business, `401` without a signature.
- The `cosuite` security scheme is final (bearer, CoSuite API key).

## 1.7.0: module definition {#v1-7-0}

*October 28, 2026*

- Modules can describe themselves in the manifest: `description`, `features`, `api` (OpenAPI 3.1 document and scopes), `webhooks`, `provides`, `dataCategories` and `markets`. All fields are optional. See [module definition](https://cosuite.io/en/developers/module-definition).
- The conformance test checks the module definition (only the fields you fill in) and downloads and checks each module's OpenAPI document: every operation must require a declared scope through `security: [{ "cosuite": [...] }]`.
- New exports: `checkModuleDefinitions`, `checkOpenApi`, `loadOpenApi`, `PROVIDES`, `DATA_CATEGORIES`.
- The package is published under the MIT license.

## 1.6.0: detaching linked accounts {#v1-6-0}

*October 27, 2026*

- `DELETE /tenants/{tenantId}` for an account that was linked with a link code no longer deletes it. The account is **detached**: data, users and sign-in stay in your app, billing returns to you, and the response is `{ "deleted": false, "detached": true }`. See [DELETE /tenants](https://cosuite.io/en/developers/contract#tenants-delete).
- A linked account never counts as a test account.

## 1.5.0: linking existing accounts {#v1-5-0}

*October 27, 2026*

- New capability `link`: a business that already uses your app can connect its existing account to CoSuite with a one-time code instead of getting a new, empty account. `POST /tenants` carries `link: { code }`. See [linking an existing account](https://cosuite.io/en/developers/contract#link).
- New error code `invalid_link_code` (409).
- Conformance: every app must answer an unknown link code with `409 invalid_link_code` and must not create an account.

## 1.4.0 and 1.4.1 {#v1-4}

*October 27, 2026*

- No changes to the partner contract. Internal client additions in the package.

## 1.3.0: customer sync {#v1-3-0}

*October 26, 2026*

- New capability `customers`: `GET /tenants/{tenantId}/customers` (cursor pagination) and the `customer.upserted` and `customer.deleted` events. Your customers appear in CoSuite's customer list with your app's badge. See [customers](https://cosuite.io/en/developers/contract#customers).
- Contract base URLs fixed: CoSuite's side of the contract is at `https://api.cosuite.io/connect/v1`.

## 1.2.1: SSO through a landing page {#v1-2-1}

*October 26, 2026*

- Clarified that an app may establish its session through its own landing page (one-time ticket in the URL fragment) before going to `redirect`. The conformance test accepts both flows. See [SSO](https://cosuite.io/en/developers/contract#sso).

## 1.1.0 and 1.2.0 {#v1-1}

*October 26, 2026*

- No changes to the partner contract. Contract snapshot and automated breaking-change check (`contract:check`) added to the package.

## 1.0.0: first release {#v1-0-0}

*October 26, 2026*

- HMAC-SHA256 request signature with timestamp window and request-id replay protection, error envelope and codes.
- App endpoints: manifest, health, tenants (create, read, update, delete), entitlements with versioning, members, usage, summary, SSO.
- CoSuite endpoints: entitlements, events, JWKS.
- SSO with ES256 JWT and JWKS.
- `@cosuite/connect`: signing, schemas, SSO, clients, server shell, reference app and the conformance test.