Release notes

BSimple API Changelog

Current BSimple API changes, compatibility notes, documented limitations and release guidance for developers building integrations.

Read the API documentation
requestv1
$ GET /api/v1/status
● scoped access · JSON response

BSimple API Changelog

This page records public changes to the BSimple API reference. Check it before upgrading an integration or relying on a capability that is not listed in the developer documentation.

Current release — API v1

The current public API is served under /api/v1 and provides scoped REST/JSON access to selected BSimple data.

Current resource families include:

  • Leads and customers, including tagging.
  • Inventory and suppliers, including stock adjustments, item management, images and categories.
  • Locations, PAR, reorder recommendations and supplier reorder levels.
  • Stocktakes.
  • Purchase orders, including creation, auto-build and sending.
  • Saleable (warehouse bundle) lists.
  • Stock transfers.
  • Invoices, including draft invoice creation.

The current public release does not provide webhooks, bulk operations, file attachments, payment processing, invoice approval or sending, invoice editing or deletion, stocktake-count writes, transfer writes, purchase-order receiving, or location PAR writes.

24 October 2026 — MCP write safeguards and slice backups with restore

  • MCP writes are now rate-limited per key: after 5 successful writes in 10 minutes, further writes are refused until a human confirms. Two registry tools support the flow — writes_status (read-only safeguard state) and writes_confirm (operator confirmation lifts the limit until the service restarts).
  • New slice-backup tools and REST endpoints: GET /api/v1/backups/list, POST /api/v1/backups/create and POST /api/v1/backups/restore. Backups capture database rows only, are gzipped and stored server-side, and any key lists/creates for its own slice (admin keys may target another slice). Restore replaces the slice's rows with the point-in-time snapshot and takes an automatic pre-restore safety backup first; it requires the backups:restore scope.
  • Nightly automated backups at 03:00 capture every paying slice.
  • The MCP tool registry grew from 75 to 82 tools (backups list/create/restore and the two safeguard tools alongside the WooCommerce tools below).

23 October 2026 — WooCommerce store matching: wc admin/setup API and MCP tools

  • New admin/setup REST family under /api/v1/wc: GET integrations/list, POST integrations/test (probes the store, pins wc/v3 with wc/v2 fallback, reports latency and catalogue size), POST match/auto, GET match/review/list, GET match/review/candidates (batch work queue: each unmatched store product with its price, category, permalink and top-5 candidate inventory items), POST match/review/accept|reject, GET mapping/list and POST mapping/set.
  • All wc endpoints take a target_slice_id, validated against the target and impersonated for the call (the cron pattern); they require an API key with the demo_setup scope (slice-1000 admin/setup keys). POSTs require an Idempotency-Key header.
  • The MCP tool registry grew by the ten matching wc_* tools (integrations, connection test, auto-match, review and mapping tools) plus wc_match_playbook, which serves the steering prompt an AI harness should follow when matching a store's catalogue (served directly by the tool).
  • Matching behaviour (also live in the app): order lines resolve through a cascade — existing mapping, normalised SKU, name equality, containment, then similarity scoring. A suggestion whose name clears 80% and whose price is within ~5% of the store price auto-applies; anything else lands in a review queue with candidate picks. Unmatched lines import as flagged free-form invoice lines, so order totals are always exact.
  • Requires migration 037_core_wc_match_context.sql (adds the review table and store-context columns). No existing endpoints, scopes or response shapes change — the family is purely additive.

19 October 2026 — OAuth connectors for MCP and purchase-order / inventory writes

  • The MCP facade (mcp.bsimple.com.au/mcp, Dev: dev.mcp.bsimple.com.au/mcp) now accepts OAuth 2.0 sign-in for ChatGPT custom connectors and other OAuth-capable MCP clients: dynamic client registration, PKCE, a BSimple consent screen and refresh-token rotation. Revocation lives in BSimple under Settings → API & MCP Access → Connected apps. API/MCP keys continue to work unchanged for CLI clients.
  • The MCP tool registry grew from 51 to 67 tools: purchase-order create, auto-build and send; stock adjustment with mandatory reason; whitelisted inventory edits, hide/show, discontinue-to-replacement, product image and category management; supplier reorder-level updates; the saleable list; and lead/customer tag tools.
  • New REST write endpoints under /api/v1: POST /purchase_orders/add|auto_build|send (purchase_orders:write), POST /inventory/adjust|update|hidden|discontinue|image/upload|image/url|category (inventory:write), POST /reorder/supplier_levels (reorder:write) and GET /saleable/list (saleable:read).
  • All new write endpoints require an Idempotency-Key header; replays return the original response. See the developer documentation.

12 October 2026 — MCP registry documentation update

  • Updated the MCP pages to the current tool registry. Read tools are now documented for contracts, repeat invoices and debtor views alongside the existing customers, inventory, suppliers, locations, PAR/reorder, stocktakes, purchase orders, transfers, invoices and leads tools.
  • Documented the scope-gated MCP write tools: lead updates, lead notes and stored-template email/SMS sends (leads:write), plus contract renewals and debtor notes and payment reminders (customers:write).
  • Inventory, stocktake, purchase-order and transfer tools remain read-only in MCP. The REST v1 contract is unchanged.

9 September 2026 — public documentation release

  • Published the BSimple API overview for business owners and integration teams.
  • Published the endpoint, authentication, scope, pagination and error reference.
  • Added getting-started guidance and server-side key-handling examples.
  • Added guides for draft invoice creation, inventory and stock reads, customer portals, and polling/reconciliation.
  • Clarified that invoice creation creates a draft/pre-draft invoice and does not approve, send or pay it.
  • Corrected public curl examples to use separate, valid headers.

Compatibility guidance

Treat endpoint paths, scope names and response envelopes in the API reference as the public contract. Do not depend on undocumented fields, internal admin endpoints or HTML responses.

If an integration depends on a capability that is not documented, ask BSimple to confirm it before building production behavior. When a future release changes an endpoint, scope or response shape, this page will record the migration guidance.

Before you contact support

Include the endpoint, HTTP method, status code, safe error code, request timestamp and the integration environment. Never include the API key, full customer records or sensitive invoice data.

For setup help, start with Getting started. For custom integration requirements, contact BSimple.

Ready when you are

Build it against
a real account.

Build with the API