Changelog

Track breaking changes, new features, and improvements to the Pixee PIM API.

v6.19.x — September 18, 2026 (contract fixes)

A contract test suite now exercises every public operation against its own spec. It found the following, all fixed on September 18, 2026.

Breaking changes

• 503 is no longer used for a missing configuration. Nine operations answered 503 Service Unavailable when a per-instance dependency was simply not set up (Odoo connection, connector webhook secret, AI provider, price-monitoring shared key, vector search engine). They now answer 409 Conflict with an error_code from the *_NOT_CONFIGURED family and a details.how_to_fix. 503 is reserved for a configured dependency that is momentarily unreachable, and always carries Retry-After. Affected: POST /brands/import-from-odoo, POST /connectors/{shopify,woocommerce,bigcommerce}/webhook, POST /enrichment/products/{product_id}, GET /prices/export-watchlist, POST /prices/observations, GET /search/products/{product_id}/similar. See Errors → Dependency not configured.
• GET /prestashop/config behaves like the other connector config endpoints: 200 {"configured": false} when nothing is configured (was 404), and the configured boolean is always present. (Internal module; listed here because integrations built on the old 404 will see a change.)
• template_id is an integer on DELETE /mapping-templates/code2asin/{template_id} and POST /mapping-templates/code2asin/{template_id}/set-default. A non-numeric value now yields 422 (was 500).

Fixed

• File downloads declare their real content type in the public spec — text/csv, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet, application/xml, image/png — instead of the FastAPI default application/json: GET /categories-manager/mappings/export-csv, GET /compliance/export, GET /compliance/gdsn/catalog, GET /compliance/dpp/{id}/qr, GET /imports/export, GET /prices/map/export, GET /products/export/csv, GET /products/export/excel. Regenerate any client you generated from the earlier spec.
• Three categories-manager read endpoints (/attributes/{attribute_id}, /categories/{category_id}/attributes, /mappings/suggestions) declared an object and returned a list, which surfaced as 500 once the list was empty. The spec now declares the list; the payload did not change.
• PATCH /prices/monitored/{product_id} returns 404 PRODUCT_NOT_FOUND for an unknown product (was 500).
• POST /enrichment/web/price-bot/run and GET /enrichment/web/price-bot/status were broken in every environment by an internal import error and answered 503 / {"status": "unknown"}. Fixed.

v6.19.x — September 2026

This release covers what changed on the public API surface between June 19 and September 17, 2026.

Breaking changes

• Public spec now reports the real version. GET /api/v1/openapi-public.json had been frozen at "6.2.1" since March; it now reports the actual running version (6.19.x). If you compared this field to detect API changes, re-check your assumptions.
• Public reference is now an allowlist (fail-closed), effective since August 19, 2026. Only these families appear on /api/v1/openapi-public.json and this site: Authentication, Products (+ Brands, Categories, Suppliers, Product Tags, Search, Product Search), Imports, Exports, AI Enrichment, Connectors, Pricing, Compliance, EAN Lookup, Code2ASIN, External API, Webhooks. The WooCommerce and Magento 2 sync modules, Dolibarr, Sage X3, PrestaShop, and Odoo integrations are no longer part of the public reference — they are documented on docs.pixeepim.com. (Their inbound webhook/push endpoints under /api/v1/connectors/* remain public — see Connectors.)
• Price entry update/delete moved off the per-product path. PATCH /products/{product_id}/prices/{price_id} no longer exists. Use PATCH /prices/{price_id} and the new DELETE /prices/{price_id} instead — see Price Monitor.
• GET /connectors/ now returns a plain array, not the { items, meta } paginated envelope. It is not paginated.
• /auth/register requires an invitation token. It completes a subscription created through an emailed, signed token — it is not an open self-signup endpoint. If you were probing this route for generic account creation, that never worked as a public signup flow and won't going forward.

New: Price Lists API

A full price-list system was added under /api/v1/price-lists/*: create channel-scoped price lists (with priority and validity window), add priced entries per product (with tiered min_quantity pricing), bulk-create up to 500 entries, and resolve the effective price for a product across all matching lists. See Price Monitor → Price lists.

New: Repricing

/api/v1/prices/repricing/* (10 endpoints): define rules that automatically adjust prices from conditions (competitor price, margin floor, category, supplier, product), simulate a rule (and its revenue impact) before it ever touches a live price, run repricing manually or let it run on schedule, and revert any individual automated change from its history. See Price Monitor → Repricing.

New: WinDev in the public reference

/api/v1/windev/* (12 endpoints) is now included in the public OpenAPI spec, grouped under the External API tag. It was previously a real, working surface documented only internally — it now shows up in /reference and on this site's WinDev Integration page like any other public family.

New and expanded endpoints

• Connectors — platform catalog (GET /connectors/platforms, /platforms/{id}, /platforms/{id}/field-map, /platforms/{id}/guide), an aggregated GET /connectors/sync-status dashboard feed, full connector CRUD (POST/PATCH/DELETE /connectors/{id}, previously read-only in this reference), sync job history (GET /connectors/{id}/jobs) and per-job status (GET /connectors/{id}/sync/jobs/{job_id}), and four inbound webhook endpoints (Shopify, WooCommerce, BigCommerce, Magento 2 push) — each HMAC/token-verified with a 24-hour Redis replay-protection window.
• Price Monitor — GET /analytics/price-sources, GET /products/{id}/stock/history, GET/POST /prices/export-watchlist and /prices/observations (B2C scraper hub ingestion), a validation queue for low-confidence competitor matches (GET /prices/validation, POST /prices/validation/{item_id}), competitor blacklisting (POST/DELETE /prices/competitors/blacklist*), per-alert history (GET /prices/alerts/{id}/history), a MAP violations export, and bulk MAP price setting.
• Webhooks — GET /webhooks/events (discover subscribable event types instead of hardcoding them), POST /webhooks/{id}/toggle, DELETE /webhooks/{id}, and page/per_page pagination on list and delivery-log endpoints (previously skip/limit on logs).
• External API — API key management (GET/POST /api-keys, GET/PATCH/DELETE /api-keys/{id}, POST /api-keys/{id}/rotate) is now documented alongside /ext/* and /windev/* under the same public tag. See External API → API key management.
• Authentication — GET /auth/me, POST /auth/logout, GET /auth/csrf-token, GET /auth/test, POST /auth/login/json, GET /auth/lockout/status/{email}, POST /auth/lockout/unlock/{email} are now documented. Refresh-token rotation includes reuse detection: presenting an already-rotated refresh token revokes the entire token family. Cookie-based session clients must now send a CSRF double-submit header (X-CSRF-Token, fetched from /auth/csrf-token) on mutating requests — API-key and bearer-token clients are exempt.
• Errors — the error envelope itself (error.code, error_code, type, message, details, path, request_id, timestamp) is unchanged, but message is now genuinely localized via Accept-Language (French and English), and Content-Language in the response always announces the language actually served rather than the one requested. MODULE_DISABLED (403) and LICENSE_SUSPENDED (403, read-only mode) are documented as distinct, non-enveloped error shapes — see Errors.

Rate limiting rebalanced

All 26 tiers were reviewed; most read/write/bulk limits increased 5–10× to support large catalogs (100k+ products) — e.g. READ_STANDARD and READ_ADMIN to 1000/min, WRITE_STANDARD/WRITE_CONFIG/WRITE_UPLOAD/WRITE_USER_MGMT to 100/min, all BULK_* tiers to 500/min. AI_BATCH moved the other way, tightening from 5/min to 1/hour (cost control). Three tiers not previously documented here are now covered: AUTH_REGISTER, AUTH_LOGOUT, EXPORT_SCHEDULE. See Rate Limiting for the full table.

v6.19.x — Breaking changes for integrators (June 2026)

Authentication changes (SEC-01, SEC-02, SEC-03)

• Refresh token mechanism changed — Refresh tokens are now server-side, DB-backed (rotation + family revocation on reuse detection). The POST /auth/refresh endpoint no longer accepts a Bearer token in the header — it reads the refresh_token HttpOnly cookie set at login. Clients that passed a JWT in Authorization to refresh must migrate to cookie-based refresh.

• Access token TTL reduced: 120 min → 15 min — Review your token handling to ensure clients refresh before expiry.

• API key header changed: Authorization: Bearer → X-API-Key — The API key authentication header is now X-API-Key: pm_live_.... The previous Authorization: Bearer pm_live_... format is no longer valid for API key authentication.

• Code2ASIN exports: JWT query param → presigned URL — Export downloads now require a presigned URL obtained via POST /code2asin/exports/{job_id}/download-url (valid 5 min). The old ?token=<jwt> query parameter is removed.

API changes

• External API (/api/v1/ext/*) — New M2M integration surface with 8 endpoints. Auth: X-API-Key. Scopes: ext:products:read, ext:products:write. See External API.

• WinDev Integration (/api/v1/windev/*) — New WinDev-optimized sync surface with 12 endpoints and WinDev-friendly envelope. Auth: X-API-Key. See WinDev Integration.

• Pagination standardized — All paginated endpoints now use page/per_page parameters (default: 20, max: 100). The skip/limit parameters are deprecated legacy aliases.

• Workflow Engine (/api/v1/workflow/*) — Product publication workflow: draft → review → approved → published → archived. Completeness gate ≥ 70%. 10 endpoints.

Removals

• GraphQL/Hasura proxy removed — The /api/v1/graphql proxy has been removed. Headless integrations should use the External API REST surface (/api/v1/ext/*) instead.

v4.5 — May 2026

Major platform update.

• Rebranding: Products Manager → Pixee PIM. Base URL updated to https://api.pixeepim.com/api/v1/
• Authentication: Added JWT Bearer Token support (120-minute TTL, refreshable). API keys now prefixed pm_live_ / pm_test_ with granular scopes
• Products: New bulk endpoints (POST /products/bulk, PATCH /products/bulk). Products now identified by UUID; EAN remains unique index. Added cost_price, weight, is_active fields
• Imports: Jobs moved to /imports/jobs. Added pause/resume/cancel controls. Added /preview endpoint for pre-flight validation. New automated recurring imports via /imports/automations
• Exports: Format-specific endpoints (/exports/csv/products, /exports/json/products, /exports/excel/products, /exports/zip/products). New export platforms (Google Drive, S3, MinIO, SFTP). Scheduled exports via /exports/schedules
• AI Enrichment: New multi-provider job system at /ai-enrichment/jobs. Support for OpenAI, Anthropic Claude, and configurable models. Cost tracking per job. Provider recommendation engine at /ai-services/recommendations/{use_case}
• Price Monitor: New endpoint structure at /prices/products/{id}. Added competitor price management, price history, stats, and best-price endpoints. Margin tracking
• EAN Lookup: Changed from GET /ean-lookup/{ean} to POST /ean-lookup/lookup with provider selection. Batch limit raised to 500 EANs. Added cache stats and pending queue management
• Webhooks: New events: import.started, supplier.created, supplier.updated, ean.resolved. Added delivery logs with per-entry retry (POST /webhooks/{id}/logs/{log_id}/retry)
• Code2ASIN: Full job lifecycle: create → start → pause/resume/cancel. Added results with confidence scoring, manual accept/reject, global statistics, and CSV/JSON export
• Rate Limiting: Replaced plan-based limits with per-tier system (AUTH, READ_STANDARD, WRITE_STANDARD, EXPORT_STANDARD, etc.) backed by Redis
• Pagination: Standardised to skip/limit parameters. Response wrapper changed from data to items. meta object enriched with has_next and has_previous
• Errors: Response format updated — detail field replaces error/message. Added 202 Accepted for async operations, 423 Locked for account lockout

v1.0 — March 2024

Initial public release.

• Products CRUD API (GET, POST, PATCH, DELETE)
• Bulk import via CSV and JSON (/imports)
• Export catalog to CSV/Excel (/exports)
• AI enrichment for descriptions and attributes (/enrichment)
• Connector sync for Shopify, WooCommerce, PrestaShop (/connectors)
• EAN lookup and validation (/ean-lookup)
• Price monitoring and alerts (/price-monitor)
• Code2ASIN mapping (/code2asin)
• Compliance & Digital Product Passport endpoints (/compliance)
• Webhook support for real-time event notifications
• API key authentication

API versioning

The current API version is v1. The version is included in the base URL:

https://api.pixeepim.com/api/v1/

When breaking changes are introduced, a new version (v2, etc.) will be released. The previous version will remain available for at least 12 months after the new version is published.