> ## Documentation Index > Fetch the complete documentation index at: https://developers.vantageclaw.ai/llms.txt > Use this file to discover all available pages before exploring further. # Changelog > What changed and when. ## v1.0.0 — Initial release The Partner API v1 ships substrate-only: authenticated identity verification and webhook subscriptions. No resource CRUD yet — those land with the first resource family. ### Endpoints * `GET /api/v1/partner/me` — identity, scopes, rate-limit headroom (requires `identity:read`, auto-granted to every key). * `POST /api/v1/partner/webhooks` — create webhook subscription; HMAC secret returned **once** (requires `webhooks:manage`). * `GET /api/v1/partner/webhooks` — list subscriptions for the calling org (secret omitted). * `DELETE /api/v1/partner/webhooks/{id}` — delete a subscription. * `POST /api/v1/partner/webhooks/{id}/test` — fire `vc.test.ping` through the real dispatch pipeline; requires echoing the stored secret in the body. * `GET /api/v1/partner/webhooks/{id}/failures` — cursor-paginated delivery-failure audit. ### Scopes * **Real:** `identity:read`, `webhooks:manage`. * **Reserved (rejected at key creation):** `leads:read`, `leads:write`, `intakes:read`, `intakes:write`, `records:read`, `records:write`, `skills:read`, `skills:author`, `skills:execute`, `agents:invoke`, `tenants:provision`. ### Webhooks * Stripe-shaped envelope: `event`, `id`, `subscription_id`, `occurred_at`, `data`. * HMAC-SHA256 signing over `.`, headers `X-VC-Signature` and `X-VC-Timestamp`. * 5-minute replay window. * Retry schedule: 1m / 5m / 30m / 2h / 6h / 24h, then dead-letter (7 attempts total). * 10-second per-attempt HTTP timeout. * Auto-disable after 20 consecutive failures. * SSRF protection at create time + DNS re-resolution at delivery time. ### Known limitations * No in-place key rotation. Rotation = delete + recreate. * No in-place webhook secret rotation. Same pattern: delete + recreate the subscription. * No public org-admin UI for key management — keys are admin-provisioned. * Only one production event type (`vc.test.ping`). Real platform events land as resource families ship.