---
title: Changelog
description: Changes to delegated access, newest first.
---

## 2026-10-20

First release of delegated access to Zev products.

- `GET /v1/partner/delegated/authorize`, `POST /v1/partner/delegated/token`
  and `POST /v1/partner/delegated/revoke`, with live or test keys.
- Test environments: no approval or verification, team-only, at most 25
  connections that end on their own. `tenant_mode` and `grant_expires_at` in
  token responses, `tenantMode` and `expiresAt` in webhooks.
- `reason` (and `error_reason`) on every error body and `error_reason` on every error redirect,
  from one vocabulary (see [Errors](/delegated-access/errors/)).
- `login_hint` on authorize, and `POST /v1/partner/delegated/authorize-url`
  (secret key) taking your own `user_id`, so only the account you expect can
  approve. The code exchange revokes a connection made by any other account
  (`reason: "account_mismatch"`).
- [Common scenarios](/delegated-access/scenarios/).
- ZevCloud's published scopes and target header, linked to
  [ZevCloud's connected apps guide](https://docs.zevcloud.net/guide/connected-apps).
- PKCE with S256 and `state`, required and passed through to ZevID untouched.
- `prompt=configure` to add or remove targets, and `prompt=reconfirm` to
  confirm high-risk permissions again.
- High-risk permissions: `auth_strength`, `hr_exp` and `high_risk` in token
  responses.
- Webhooks: `delegated_access.connection.created`, `.updated`, `.revoked`,
  `delegated_access.app.updated` and `delegated_access.security.refresh_reuse`.
- Paused permissions, shown in the console and in webhooks.
- A **Delegated access** page in the console: approvals per product,
  approved and paused permissions, callbacks, connections and failed calls.
- Callbacks registered per product, checked against your verified domain and
  synced to ZevID.
- App icons are reviewed before they appear on consent screens. The console shows the review status.