Changelog

Changes to delegated access, newest first.

2026-10-20

First release of delegated access to Zev products.

• GET /v1/partner/delegated/authorize, POST /v1/partner/delegated/token and POST /v1/partner/delegated/revoke, with live or test keys.
• Test environments: no approval or verification, team-only, at most 25 connections that end on their own. tenant_mode and grant_expires_at in token responses, tenantMode and expiresAt in webhooks.
• reason (and error_reason) on every error body and error_reason on every error redirect, from one vocabulary (see Errors).
• login_hint on authorize, and POST /v1/partner/delegated/authorize-url (secret key) taking your own user_id, so only the account you expect can approve. The code exchange revokes a connection made by any other account (reason: "account_mismatch").
• Common scenarios.
• ZevCloud’s published scopes and target header, linked to ZevCloud’s connected apps guide.
• PKCE with S256 and state, required and passed through to ZevID untouched.
• prompt=configure to add or remove targets, and prompt=reconfirm to confirm high-risk permissions again.
• High-risk permissions: auth_strength, hr_exp and high_risk in token responses.
• Webhooks: delegated_access.connection.created, .updated, .revoked, delegated_access.app.updated and delegated_access.security.refresh_reuse.
• Paused permissions, shown in the console and in webhooks.
• A Delegated access page in the console: approvals per product, approved and paused permissions, callbacks, connections and failed calls.
• Callbacks registered per product, checked against your verified domain and synced to ZevID.
• App icons are reviewed before they appear on consent screens. The console shows the review status.

Updated at, Wednesday, October 21, 2026