Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Changelog

Changes to the API that an integration might notice, newest first. Dates are when a change reached production.

Unreleased

  • More image types. POST /v2/attachments stores WebP, AVIF, BMP, HEIC, TIFF and SVG files as images, converted to JPEG, or to PNG when the picture has transparency. They used to be kept as documents.

4 October 2026

  • Lists. New endpoints read the account's lists of companies, contacts and projects, their members and a record's lists, and add, remove, comment, follow, make, change and delete. A personal list is only there for the person who made it. /me lists lists in api_features, and says in integrations.lists whether the account shows Lists. See Lists.

  • A record's lists carry their comments. Each list in GET /v2/lists?record_id={id} has comment: what that list says about the record, or null.

  • /me says whether the person is an account admin: permissions.account_admin, for the account in use and for each of extra_accounts. Only an account admin can set created_user, modified_user, created_date or modified_date to anything but their own. See Current user.

3 October 2026

  • A time zone field lists its zones. In GET /v2/fields/staff and GET /v2/form_structure/staff, timezone has options: the zones tiny+ offers, each with a value and a label, such as {"value": "Australia/Sydney", "label": "(UTC+10:00) Sydney, Canberra"}. See Time zone.

  • A time zone has to be one. Setting timezone to anything but a zone name, such as Australia/Sydney, gets a 400, and nothing is saved. It used to be saved as sent.

  • Time zones are stored under their current names. A team member or an account on an old name now reads the current one in /me and GET /v2/staff: Asia/Kolkata rather than Asia/Calcutta, Australia/Sydney rather than Australia/Canberra. Those on Etc/Greenwich, which tiny+ offered as Dublin, read Europe/Dublin, with Irish summer time.

2 October 2026

  • Relationship plans. New endpoints list, start, log and change relationship plans, on accounts with the Pro plan. /me says whether an account has them, in integrations.relationship_plans. See Relationship plans.

  • Tasks say which plan they belong to, and when they were completed: plan_id, plan_step_id, plan_occurrence, touch_type, completed_date and completed_user. See Tasks.

  • Companies say where their plans stand: plan_status, plan_next_due, plan_next_staff, last_contact_date and plan_count. A company on a plan has its health worked out from its last contact on the plan. See Companies.

  • A post that holds a plan follow-up's notes carries plan_touch. See Posts.

  • Fields that tiny+ keeps itself are left out of a write, not written. A create or an update that sends one, such as record_url, saves the rest and names it in ignored_fields. See Records.

  • A project's status pipeline: GET /v2/status_history/projects/{id} returns the states a project has been in, where it is now and for how long, and what comes next, as its Status panel shows them.

  • A record's images and documents: GET /v2/attachments?related_id={id} lists them, and GET /v2/attachments/{id} gives a short-lived link that opens a document. An image attached through POST /v2/attachments is listed straight away.

  • linked_to={id} on a list returns the records linked to another record, as a record's panels in tiny+ find them. /me lists it in api_features. See Listing, filtering and paging.

  • Meeting times come back in UTC. meeting_date and meeting_date_end used to come back in Australia/Sydney time, though they are sent and filtered in UTC. See Meetings.

  • A meeting sent without record_status is planned. It used to have no status, so no panel in tiny+ listed it.

  • A meeting's primary_related can be a project. A project's id used to be dropped, leaving the meeting unlinked.

1 October 2026

  • GET /v2/search/{type} searches only that type. For a type the tiny+ search box leaves out, such as stages, it used to search every other type instead and return their records. The MCP server's search_records tool did the same. See Search.

  • GET /v2/search/updates leaves out the posts a search on GET /v2/updates does: posts tiny+ writes automatically, confidential notes, and posts on a confidential record the token's user can't open. It used to return posts on such a record, with their opening words. It is the search Ask falls back to for posts, and the MCP server's search_records tool uses it too. See Search.

30 September 2026

  • Setting who made a record, or when, needs an account admin. Only an account admin can send created_user, modified_user, created_date or modified_date. Anyone else who sends one gets a 403, unless the value is their own id or the one the record already has. See Permissions.

  • DELETE answers {"results": true}, or false if the record couldn't be deleted.

  • A simple access token works only for the account it was made in. Sending another account's id as account gets 403 {"error": "This token is for account N only."}, and a token whose creator has left the account gets a 401. Account admins can now revoke a simple access token on the API Access screen. See Simple access token.

  • Only a post's author, or a News Feed admin, can edit or delete it. Every post's perm_edit and perm_delete now say whether the token can. See Posts.

  • GET /v2/updates?single_id= finds any post the token's user could see on a feed, not only posts on the News Feed.

  • Posts and comments check what they're attached to. A comment on a post the token's user can't open, or a post whose related_id or extra_ids they can't see, gets a 404, and nothing is saved. A comment that can't be saved gets a 500, rather than 200 {"id": false}.

  • Attaching a file needs edit rights on the record. POST /v2/attachments answers 403 for a record the token's user can't edit, and for a read-only token, and 400 for a confidential record they can't see, as for a missing one. Its errors are {"error": …} objects now, and image/bmp, image/tiff and image/svg+xml are kept as documents rather than failing.

  • sort on GET /v2/updates takes created_date, modified_date, name or id. Anything else is ignored.

  • A confidential company's name is hidden on the projects and contacts linked to it, from people who can't see the company.

29 September 2026

  • Ask can search posts. POST /v2/ai/filter with "flavour": "updates" returns text, about and broadcast filters for GET /v2/updates.

  • Confidential records stay confidential in the API. Lists and searches leave out the confidential records the token's user can't open, a direct read masks them, and their history is refused. See Permissions.

28 September 2026

14 September 2026

  • AI assistants can use tiny+ through its MCP server at https://api.tiny.plus/mcp. See AI assistants.

  • Apps can register themselves with POST /oauth/register. See Register a Client App.

  • Ask filters. POST /v2/ai/filter turns a plain-English question into filters for a list.

30 August 2026

  • The v1 API is closed. Requests to /api/v1, which used ?token=, now answer 404. Use /v2 with an access token.

  • /me has a permissions object, with show_fees and all_records. See Current user.

  • Pipeline statistics were rebuilt. GET /v2/stats/projects groups each status's figures by phase, covers every status, and takes the same me, staff, tag and custom-field filters as a project list. /all needs permission to see the company-wide pipeline, and fee figures are null when the account hides fees.

  • Lists can be filtered on more kinds of custom field: date, number, currency, percentage and URL, as well as text and yes/no. A custom-field filter that can't be applied answers 400, rather than returning the list unfiltered.

PreviousWebhooks

Last updated

Was this helpful?