Changelog

[3.0.9] - 2026-10-12

Accept public MD5 document hashes (alongside numeric IDs) on offer, order, and invoice paths (GET/PUT/PATCH/DELETE /{id}, /{id}/articles, convert, send-email); detail and create responses expose read-only public_offer_id, public_order_id, and public_invoice_id.
Document the official PHP Composer package yourbureau/api-client in the API description.
Percentage discount/surcharge positions on offer, order, and invoice article payloads via is_reduction_percentage (1 = discount, 2 = surcharge) plus reduction (percent); amounts are calculated from preceding regular lines (same rules as the yourBureau UI, including round_chf / enter_netto_prices). When description is omitted, tenant settings default_reduction_percentage_description / default_surcharge_percentage_description are used. article_number is optional for these rows.

Read-only audit fields created_at, creator_user_id, modified_at, modified_user_id on customers, contacts, projects, articles, offers, orders, invoices, support tickets, comments, open tasks, and outgoings. Server-assigned on insert/update; never client-writable.
creator_user_id / modified_user_id on time reports (GET/POST/PUT/PATCH /api/v3/time-reports), alongside the existing created_at / modified_at.
List and get events on GET /api/v3/events and GET /api/v3/events/{id} (view_events; requires using_events). Date filters use overlap on [date, date_until].

**Breaking:** Renamed user_id to creator_user_id (document author) on offers, orders, and invoices.
**Breaking:** Renamed user_id to creator_user_id on projects.
**Breaking:** Renamed owner_user_id to creator_user_id on articles; removed owner_user_id from writable payloads (was previously client-settable).
**Breaking:** Renamed user_id_owner to creator_user_id on open tasks (including the user_id_owner list filter and the user_owner embedded relation, now creator_user).
**Breaking:** Renamed user_id_owner to creator_user_id and create_date to created_at on outgoings (domain user_id unchanged).
**Breaking:** Renamed create_date to created_at on offers, orders, invoices, articles, and open tasks.
**Breaking:** Renamed create_date_time to created_at on comments; removed from writable payloads (server-assigned).
**Breaking:** Renamed create_date / modify_date to created_at / modified_at on contacts.

Fixed created_at being stripped from time-report responses even when listed in showFields.
Scope assistant view_my_* document access and open offer/order KPIs by creator_user_id after the audit-field rename.
Filter offers, orders, invoices, and projects by creator_user_id (documented list filter; was still named user_id).

List time-report order positions on GET /api/v3/orders/{id}/time-report-positions (lookup fields only; is_for_time_rapport filter).
List article work packages on GET /api/v3/work-packages (article_id required; add_time_report* or both view_work_packages rights).

Allow two-character usernames on POST /api/jwt (minimum length 2).
Allow email-style usernames (@, +, up to 255 characters) on POST /api/jwt.
Allow view_projects_in_time_report on project list/show (UI parity with the time-report form).
Allow view_orders_in_time_report on order list/show; treat it like limited_view_orders for amount filtering.
Allow limited_view_orders and view_orders_in_time_report to read assistant order documents.
Allow article list/show with add_time_report / add_time_report_from_all_users; without view_articles, limit to rapport articles.

Return HTTP 422 with field-level messages on POST /api/jwt when tenant, username, or password fail input checks. Invalid credentials still return 401.
Set customer_display on customer create and update using the same formula as the main application.

Allow appending article lines on assistant documents with mode=append (POST /api/v3/assistant/documents/{type}/{id}/positions).
Filter open tasks to JWT owner or responsible with owner_or_responsible=me on GET /api/v3/open-tasks.

Allow partial updates (PATCH) for customers, contacts, projects, customer-contacts, users, and reference-data resources that previously only defined PUT.
Enforce document-type permissions on assistant documents (add/edit/view per offer|order|invoice; view_my_* limited to the JWT owner's records).
Ignore client-supplied user_id_owner / user_id_responsible on open-task create/update; set owner and responsible from JWT on create.
Enforce row-level open-task access for view_my_open_tasks / edit_my_open_task / edit_assigned_open_task on list, show, update, and delete.
Require state_id when finalizing an assistant document (confirm alone no longer returns success without a state change).

Default open_task_state_id on new open tasks to the Offen state when omitted.
Ignore user_id on GET /api/v3/my-time-reports; the list is always the JWT user, including with view_time_report_from_all_users.
Ignore user_id on assistant queries my_hours_by_period and my_flextime_balance (always the JWT user).
Omit my_* info-query types from GET /api/v3/assistant/info-query/catalog unless the caller is a JWT user; executing them without JWT stays 401.
Reject API keys on GET /api/v3/my-time-reports with 403 (JWT only).
Require JWT user permissions for assistant document type checks (API keys no longer inherit all document types from the route OR).

Email the customer from API when a support ticket is answered. Optionally also on assign or complete, if the tenant settings allow it (same mail path as the UI).
Convert an offer to an order and an order to an invoice via API V3. Orders now show which offer they came from.
Filter offers, orders, invoices, outgoings, and open tasks by a day or date range.
Add assistant KPIs for hours (including flextime), open tickets and tasks, project budget, and customer revenue. Hour KPIs can be limited to a day or date range.
Expose custom fields (custom_input_1–10, custom_select_1–10, custom_text_1–5) on API V3 offers, orders, and invoices.

Answering a support ticket via the API now always sends a customer email (previously the answer was stored only).

Keep the existing time-report duration when an update does not send new times.
Keep invoice cancel status in sync with the invoice state (including after a payment), show it in responses, and reject invalid state changes.
Let users with time, support, task, or project rights use assistant KPIs. “My” hour and count queries stay limited to the current user; pauses are not counted as work.
Allow partial updates of support tickets (PATCH). Clients can no longer change creator or done/email workflow fields via create/update.
Let read-only API keys run assistant KPIs.

Use 30 days as invoice payment terms when the customer value is missing or zero.

Add assistant endpoints for KPIs and for creating or updating offers, orders, and invoices.
Show deadline text on offers, orders, and invoices, and default order texts on projects.
Add API V3 outgoings and distributors, including PDF archive upload/download (one PDF per outgoing, max 2 MB).

Add VAT ID on customers and e-invoice fields on invoices.
Add e-invoicing codes on taxes, units, bank accounts (BIC), and payment methods.