Dated changes to the Shotwisp API and its documentation. The API is versioned under /api/v1/ and v1 contracts are stable — see the versioning policy. Deprecations and breaking changes are announced here before they take effect.
Acceptance-test fixes
Unmatched /api/* paths now return the JSON error envelope with the new not_found code instead of an HTML 404 page.
405 responses now include the Allow: POST header.
The OpenAPI spec (v1.2.0) documents the x-shotwisp-id and x-shotwisp-duration-ms headers on byte responses, the batch endpoint's all-failed behavior (per-item body on 402/413/415/422/500), and the rare non-envelope 5xx case.
Upload curl examples use @./file.png paths so HTML-level email obfuscation can never corrupt them; documented the Free-plan default for expires_in (30 days when omitted).
Machine-readable API surface
Published the OpenAPI 3.1 specification at /openapi.json (also reachable at /.well-known/openapi.json), generated from the same validation schemas the API runs on.
Added /llms.txt (concise index) and /llms-full.txt (complete plain-text docs) for LLMs and AI agents.
Added per-endpoint documentation pages under /docs/api/ and the AI agent guide at /docs/ai-agents.
Documented the consolidated limits, capture capability matrix, security behavior, and versioning policy on /docs.
Fixed code examples that still pointed at a legacy domain — the canonical API origin everywhere is https://shotwisp.com.
Added this changelog.
Shotwisp v1 API
Launched POST /api/v1/upload, /api/v1/upload/batch, /api/v1/screenshot, and /api/v1/pdf.
Bearer-token authentication with account-scoped sw_ API keys.
One error envelope across every endpoint: {"error": {"code", "message"}} with stable machine-readable codes.
Per-minute rate limiting with Retry-After and x-shotwisp-ratelimit-* headers; monthly quotas with x-shotwisp-quota-* headers and optional overages on paid plans.