The wthaiq API evolves continuously without breaking your integration. We pin the version with a dated header Wthaiq-Version: 2026-07-01: changes non-breaking — such as a new endpoint, an optional field or an event type — ship continuously on your same version, while changes that are breaking in a new dated version that does not affect you until you choose to upgrade yourself. This page documents every change with its date and its tag.
Wthaiq-Version: 2026-07-01
Every change in the log is tagged with its colour and its type, so you can read its impact on your integration at a glance.
All the beta versions and then the stable v1 release are listed with their exact dates and tags.
sk_live_/sk_test_. Every secret key now follows one unified format sk_ + 40 hexadecimal characters, and it is live from the moment it is created — there is no separate test mode, and the field livemode equals true always.pk_ Safe to expose in the browser: locked to specific domains through allowed_origins, and limited to a fixed set of paths (templates, signature requests, signers, flows) with writes to templates/signers/flows blocked.POST /v1/signature_requests with the full lifecycle (draft then sent then completed) and the endpoints send andcancel andreminders anddownload andcertificate.Wthaiq-Signature (HMAC-SHA256 in t=..,v1=..) with a 300-second tolerance window and escalating retries for up to 24 hours.sk_live_ andsk_test_, and the Webhook signing secret whsec_; test mode does not send real email and does not issue legal certificates. Note (2026-07-26): This two-environment system was removed later — see the top of the changelog.@wthaiq/node andwthaiq (Python) andwthaiq/wthaiq-php — they pin the version header by default and follow SemVer.Wthaiq-Version: 2026-07-01 is the default dated version for all new accounts, with the header Wthaiq-Request-Id in every response.whsec_ from the dashboard, with no service interruption.GET /v1/templates andGET /v1/templates/{id} with the field definitions (key andlabel andtype andrequired).source.type = "template" passing the field values in signers[].fields.fields from the request body.GET /v1/verifications/{reference} (codes WTQ- andWTH-) without authentication, to check the integrity of the document and its parties.integrity with the values intact andmodified andunknown in the object verification, with the names of the parties masked.verification.created to the Webhooks event list.POST /v1/signers/{id}/signing_session Issues a short-lived signing link/token for embedding inside your app under your own brand.signing_url to the object signer to support the hosted and the embedded page through the same field.expires_at and invalidate it as soon as signing is completed or declined.identity_verification and the endpoint GET /v1/identity_verifications/{id} (official document + live face match).require_identity at the request and signer levels, and the two events signer.otp_verified andsigner.identity_verified.legal_level = "aes" which ties the signature to a verified real person before the signing page opens.pades-lt with DSS/LTV (embedded certificates + OCSP + CRL) for long-term preservation and for verification without contacting the issuing authority.format = "pades-lt" The default value for requests at the level aes instead of pades-t.document.sealed Fired when the CMS/PAdES signature is embedded in the final PDF file.pades-t) to prove the moment of signing independently.{ error: { type, code, message, param, request_id } } with standard HTTP codes (400/401/402/409/422/429).Idempotency-Key on requests POST (stored for 24 hours) to make retries safe.X-RateLimit-Limit andRemaining andReset, and a 429 code accompanied byRetry-After./v1/preview in favour of the new dated version; the endpoint will be removed in a later dated version.We follow date-based versioning. The behaviour of your pinned version never changes through a breaking change — you alone decide when to upgrade it.
Require a new dated version
enum, or renaming it.string to integer).required) to an existing request.ship continuously on your same version
enum new (handle unknown values gracefully).Wthaiq-Deprecation on the responses concerned, and we keep the old behaviour working for at least 6 months before removing it in a new dated version — leaving enough time to upgrade safely. Pin the version by sending the header Wthaiq-Version with every request. If you do not send it, the last dated version pinned to your account is used (or the latest default version). The behaviour of your pinned version never changes through a breaking change:
curl https://wthaiq.com/api/v1/signature_requests \
-H "Authorization: Bearer sk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
-H "Wthaiq-Version: 2026-07-01"
# The response returns the version actually used in the header:
# Wthaiq-Version: 2026-07-01
# Wthaiq-Request-Id: req_9f2a1cWthaiq-Version in production. There is no need to upgrade all at once — each integration upgrades at its own pace. Start from the full API documentation, pin your dated version, and subscribe to receive every update as it ships.