API changes

What is in API VISH now, what has changed, and how we warn about incompatible changes. The page is updated along with the API; the last reconciliation is October 23, 2026, d1 and production.

Version v1 today

All methods are under /api/v1; the description of each is in the OpenAPI of the stand (/documentation, machine view — /documentation/json).

History

In development (d1), October 2026

• “Login via VISH” — OAuth 2.1 and OpenID Connect: setup document, /oauth/token, /oauth/userinfo, /oauth/revoke, /oauth/introspect, ES256 signing keys. Registration of your applications is on the “Developer page for” holders of a valid key.
• The university data model (/university/…) is for employees with rights.
• Uploading schedules (/exports/…) to CSV for everyone and to JSON is rightfully analytics:export.
• New rights and roles. analytics:export — uploading analytics as a file (it was received by all the roles that already had analytics:read); places:read, places:write, leads:read, leads:write, ads:read, ads:draft, ads:manage — for the locations, partners, and advertising sections that are still being prepared; roles analyst, sales, and adsManager. Analytics discoveries (analytics:read) are now written to the audit log — no more than one entry per person and an endpoint per 10 minutes.
• The “Developers” section in the reference guide contains these pages with examples that are tested on d1.

0.12 — October 20, 2026

• Issuing a key to yourself without an application (POST /api-keys/mine) — for roles with the right to api:keys:self-issue; up to 730 days.
• The monthly report of the institute as data: GET /reports/institute?month=ГГГГ-ММ — only summary numbers.

0.11 — October 7, 2026

• The key moved “to the developer” page along with a link to the API documentation.

0.10.4 — October 4, 2026

• The frequency limit can no longer be circumvented with a fictitious token or key: such requests are considered to be at the address. Logged-in people and valid keys still have their own limit.

September 22, 2026

• A new production platform. Requests for a role and an API key.

How we change the API

• Inside v1— it is only compatible. New methods, optional parameters, new fields in responses, and new values in lists like change or lessonType may appear. Write to the client so that an unfamiliar field or value does not break it.
• Error messages (error.message) can change at any time; machine codes (error.code) cannot.
• An incompatible change — deleting a method or field, changing the meaning or format — will be a new version at a new address. We'll write about it in advance here and in the “What's New” app section, and the old version will work alongside for a while.
• First, d1. Everything new first appears on d1 and only then, with a biweekly release, on production. Check the integration on d1 before the release.

What is on your stand

The example reads the booth's OpenAPI and tells you how many methods there are in it, which groups (tags) are the largest, and whether the booth has “a VISH” Input enabled.:

// What this stand's API offers: operations per tag and whether «Sign in with VISH» is on.
const API = process.env.VISH_API ?? 'https://d1.vish-app.ru/api/v1'

const response = await fetch(new URL('/documentation/json', API))
if (!response.ok) throw new Error(`OpenAPI: HTTP ${response.status}`)
const openapi = await response.json()

const perTag = new Map()
let total = 0
for (const [path, methods] of Object.entries(openapi.paths)) {
	if (path !== '/health' && !path.startsWith('/api/v1/')) throw new Error(`unversioned path ${path}`)
	for (const operation of Object.values(methods)) {
		total++
		for (const tag of operation.tags ?? []) perTag.set(tag, (perTag.get(tag) ?? 0) + 1)
	}
}
if (total === 0 || !perTag.has('schedule')) throw new Error('no schedule operations')

const discovery = await fetch(`${API}/oauth/.well-known/openid-configuration`)
console.log(`${openapi.info.title} ${openapi.info.version}: ${total} operations`)
console.log([...perTag].sort((a, b) => b[1] - a[1]).slice(0, 8).map(([tag, count]) => `${tag} ${count}`).join(', '))
console.log('Sign in with VISH:', discovery.ok ? 'on' : `off (HTTP ${discovery.status})`)

Verified: 2026-10, PWA aa337c45, platform bff65fce._