POXYRAMAPI

Changelog

Every release of the Poxyram backend API, newest first. For live uptime and incidents, see the status page.

v0.12.0

Security hardening, product catalog, and status page redesign

Sep 2, 2026
  • AddedProduct catalog endpoints — GET /api/v1/products and GET /api/v1/products/{slug} for the Shopify-integrated shop.
  • AddedNewsletter confirm and unsubscribe endpoints are now public (no X-Poxyram-Client-Key required) so email links work without credentials.
  • ImprovedAPI responses no longer include Sanity-internal fields (_type, _key, _ref) in ContentBlock responses — cleaner payloads for frontend consumers.
  • ImprovedSubscriber IDs are now opaque random UUIDs instead of email-derived values — unsubscribe links no longer expose the subscriber's email address.
  • ImprovedSecurity hardening across all API routes: host-based auth bypass fixed, input validation enforced on all slug/token/origin parameters, Content-Type validation on POST routes, bot protection (honeypot) on forms, and rate limiting is now fail-closed in production.
  • ImprovedContent-Security-Policy and Permissions-Policy headers added to all responses.
  • ImprovedStatus page redesigned with 90-day check-level uptime history, degraded partial credit, average latency per service, and a day-by-day incident timeline.
  • FixedHealth-check cron endpoint now requires authentication (fail-closed) — previously accepted unauthenticated requests when CRON_SECRET was not configured.
  • FixedContact API no longer double-counts checks — GET and POST probes are merged into a single result per day.
v0.11.0

SEO Metadata, Open Graph & Settings Section

Aug 17, 2026
  • AddedSEO metadata fields (seo_title, seo_description, og_image_url) on news articles, characters, FAQ, and contact pages. Localized in EN and ES.
  • AddedOpen Graph image support for social media previews on news articles, characters, FAQ, and contact pages.
  • Addedsettings_section on the /home response — setting page previews for the landing page carousel without a second request.
  • AddedWeekly automated Sanity dataset backup to Cloudflare R2 (Sundays 04:00 UTC, 90-day retention).
  • ImprovedOpenAPI spec and TypeScript types synced with all shipped endpoints and new SEO fields.
  • ImprovedLoad test completed: 16,600 requests, 0 failures, P95 47ms, peak 280 RPS on public GET routes.
v0.10.0

Content pages, newsletter double opt-in, and status page improvements

Aug 7, 2026
  • AddedWorld and background setting pages are now served from the CMS. Each setting page has a bilingual title, excerpt, thumbnail for the carousel, hero image for the detail view, and rich text content. Browse all settings at GET /api/v1/settings or a single page by slug at GET /api/v1/settings/{slug}.
  • AddedGeneric content pages for legal, support, and info categories. Privacy Policy, Terms of Service, and About Us are now managed entirely from the CMS with bilingual content, cover images, and SEO metadata. Browse all pages at GET /api/v1/pages or a single page by slug at GET /api/v1/pages/{slug}.
  • AddedFAQ content is now served from the CMS with categories and bilingual question/answer pairs, ready for accordion-style display on the frontend. Available at GET /api/v1/faq.
  • AddedContact page content (intro text, FAQ teaser, email, and expected response time) is now served from the CMS at GET /api/v1/contact, separate from the contact form submission endpoint.
  • AddedNewsletter subscriptions now use double opt-in. New subscribers receive a confirmation email with a verification link and must click it before being marked as confirmed. Confirmation and unsubscribe links are token-based and work idempotently — confirming twice or unsubscribing twice both return a friendly "already done" page instead of an error.
  • AddedFooter now includes banner image, title, and description from the CMS, so the frontend can render the footer's right side with branded content instead of placeholders.
  • AddedStatus page now monitors the pages, settings, FAQ, and contact endpoints alongside the existing services.
  • ImprovedAPI responses now include cache control headers so CDN and browser caches can serve repeated requests faster without hitting the origin. Public GET endpoints benefit most from this.
  • ImprovedStatus page now measures and displays response latency for each service, so you can see not just whether an endpoint is up but how fast it's responding.
  • ImprovedStatus page loads faster and feels smoother with optimized data fetching and rendering.
  • ImprovedChangelog and homepage now use collapsible components with tighter spacing, making long lists of releases and endpoints easier to scan.
  • ImprovedAPI reference and landing page synced to v0.10.0 with all new endpoints documented, including request/response schemas and security requirements.
  • ImprovedOverview page now lists all endpoint groups (Health, Home, News, Characters, Newsletter, Pages, Settings, FAQ, Contact) so the full API surface is visible at a glance.
  • FixedNewsletter subscription consent field is now required in the API type definition, matching the Zod validation that was already enforcing it. Previously the type allowed omitting consent, creating a mismatch between the documented contract and the actual validation.
v0.9.0

Characters and news now live from the CMS

Jul 16, 2026
  • AddedCharacters are now managed entirely from the CMS. Each character has a name, title, description, element, specialty, and images for full body art, thumbnail, and background. Characters are grouped by city, and each city can have its own emblem, image, and thumbnail.
  • AddedCities now have their own CMS documents with localized names (English and Spanish), a display order, and optional images for emblem, full image, and thumbnail.
  • ImprovedNews no longer falls back to placeholder content when the CMS has no articles. The feed now shows only real published content, or an empty list if there is nothing to show yet.
  • ImprovedThe characters and home pages now pull all content from the CMS in the language you request (English or Spanish), replacing the earlier hardcoded character data.
  • ImprovedThe status page is now more reliable. When a service check fails, it retries once before marking it as down, so brief network blips no longer cause false outages on the status page.
v0.8.0

Full news experience — categories, pages, and article detail

Jul 15, 2026
  • AddedNews can now be filtered by category—News, Notices, and Events—with a "Latest" view that shows everything by date. Long lists are split into pages so the feed stays fast and easy to browse.
  • AddedEvery news item now has its own page with the full story, including rich text and images. Opening a link that doesn't exist shows a clear "article not found" message instead of an error.
  • ImprovedNews is now served entirely from the CMS in the language you request (English or Spanish), replacing the earlier placeholder content.
v0.7.0

API access now requires a client key

Jul 12, 2026
  • AddedAPI requests now require an X-Poxyram-Client-Key header. Every /api/v1/* endpoint is now gated behind a client key to prevent unauthorized scraping, with the public /api/v1/health endpoint left open so status and uptime monitoring keep working without credentials.
v0.6.0

Stronger input validation and honest write failures

Jul 7, 2026
  • ImprovedNewsletter and contact form submissions are now validated more strictly and consistently, so invalid input is rejected with clearer, more reliable errors.
  • FixedNewsletter and contact submissions no longer report success when the backend can't persist them; affected requests now return a proper "service unavailable" error instead of a false confirmation.
v0.5.0

Home Page Polish & Newsletter

Jul 1, 2026
  • AddedNewsletter subscription endpoint (POST /api/v1/newsletter) with GDPR consent capture and duplicate-safe subscribes.
  • AddedHome page sections: characters, news, and background, plus top-level social channels.
  • AddedEditable footer legal links (Privacy, Terms, About, Contact, Help) managed from Sanity.
  • AddedRate limiting on the contact and newsletter endpoints to protect against spam.
  • Addednewsletter-api added to the status page monitoring.
  • ImprovedNews now served from Sanity with a mock fallback instead of hardcoded data.
  • ImprovedCharacter data now carries a location/city label and full-art image for the home preview.
  • ImprovedAPI reference and landing page synced to v0.5.0 (all endpoints, no stale "mock" labels).
  • FixedStatus page Edge Cache now probes a distinct static asset instead of duplicating the Home API probe, so it reports independently.
  • FixedContact API monitoring no longer flags rate-limit (429) responses as outages.
v0.4.0

Analytics, accessibility, and health check infrastructure

Jun 30, 2026
  • AddedVercel Analytics for page view tracking.
  • AddedVercel Speed Insights for real-user performance metrics (LCP, FCP, CLS, INP).
  • AddedGitHub Actions workflow for health checks every 5 minutes (replaces Vercel cron).
  • AddedUptime percentage display on service cards.
  • AddedFocus indicators on all interactive elements for keyboard navigation.
  • AddedDescriptive aria-label on endpoint Test links.
  • ImprovedColor contrast with darker *-strong text variants across all components.
  • ImprovedPast incidents timeline redesign with colored status dots and clean layout.
  • Improvedbrowserslist config to reduce unnecessary transpilation (~12 KiB savings).
  • FixedRemoved unused styled-components dependency (~20 KiB savings).
  • FixedMobile nav padding for narrow screens.
v0.3.0

Status page, changelog, and live health checks

Jun 29, 2026
  • AddedStatus page with live health checks and 90-day uptime history.
  • AddedChangelog page with releases from Sanity CMS.
  • AddedVercel cron job for daily uptime tracking.
  • AddedPublic health check endpoint (GET /api/health).
  • AddedSanity schemas for incidents, changelog releases, and uptime records.
  • ImprovedSanity Studio deployed at poxyram-production.sanity.studio.
  • ImprovedAll components now use real data (no mocks).
v0.2.1

i18n parity, lang consistency, and SEO metadata

Jun 23, 2026
  • Added?lang=en|es query param support for /news and /characters with localized fields.
  • AddedSEO metadata with OpenGraph and Twitter card support for social sharing.
  • ImprovedReplaced duplicated language validation with shared getLang utility across all endpoints.
  • ImprovedSimplified endpoint handlers with reusable createLangHandler utility to reduce duplication.
  • FixedRemoved global Access-Control headers from next.config.ts that caused CORS conflicts.
v0.2.0

CORS, mock APIs, and contact form

Jun 15, 2026
  • AddedMock endpoints for /news, /characters, and /contact with schema validation and CORS headers.
  • AddedPOST /api/v1/contact endpoint with email validation and Sanity persistence.
  • ImprovedCentralized versioning via VERSION export with dynamic injection into API responses.
  • ImprovedModularized data builders and email validation for stricter input handling.
  • FixedAdded required fields to OpenAPI schema objects for stricter validation and data integrity.
v0.1.1

Scalar interactive API reference

Jun 9, 2026
  • AddedInteractive Scalar-based API reference at /reference with OpenAPI spec served from /reference/spec.
  • ImprovedMigrated from Mintlify to Scalar for better developer experience and live API testing.
v0.1.0

Initial API release

Jun 9, 2026
  • AddedSanity CMS integration with GROQ queries, localized hero section, navigation, and carousel assets.
  • AddedGET /api/v1/home endpoint returning dynamic homepage content from Sanity with mock fallback.
  • AddedCompliance matrix and project README documenting architecture and setup instructions.
  • AddedSpanish-language API documentation for accessibility.
  • ImprovedDynamic social links and auto-generated footer copyright from site settings.