Changelog

Deprecation policy

Pomelo API follows a minimum 90-day deprecation window for breaking changes:

Breaking changes are announced in this changelog and in the docs
Deprecated request parameters return Deprecation: true and Sunset headers
Deprecated response fields are marked in OpenAPI and docs even when per-field headers are not practical
After the sunset date, deprecated request parameters are rejected with 422 INVALID_PARAMS

Published a new Consumer Migration Guide for existing snippet and API consumers
Clarified that public API deprecations apply to /v1/*, while the internal dashboard /metrics/* contract follows its own shared contract
Clarified that public /v1/* now requires from / to, while /v1/me.plan_id and /v1/me.retention_days remain the only active compatibility mirrors

/v1/reports/acquisition now serves a strict-safe acquisition-lite slice with channels, host-only referrers, and landing pages
/v1/reports/actions now serves strict-safe simple actions (ui.click, outbound.click, file.download, form.submit) while keeping advanced families profile-gated
/v1/reports/overview restores an acquisition-lite preview in Strict

Mixed routes keep returning 200 in Strict; use availability.readModel for the strict-safe baseline and availability.sections for locked attribution or advanced slices
UTM, campaigns, goals, tenant drill-down, raw/session logs, and region/city remain outside the default Strict envelope

/v1/me still returns top-level plan_id and retention_days, but they are now explicitly deprecated compatibility mirrors
Canonical runtime product data remains under product

Client UA removed: User agent string is no longer sent from the browser; device/browser/OS classification is now server-side only
Session ID hardened: Uses browser_family (server-derived) instead of raw UA
Automatic PII sanitization on all captured fields:
- el_id, el_scope, form_id: strict charset, 100 char max, PII rejected
- el_label: 80 char max, PII rejected
- page_title: 200 char max, PII rejected
- Error messages: PII redacted, query strings stripped, 200 char max
Fixed global regex lastIndex bug in sanitizeText()

data-analytics-label for explicit click labels
data-autocapture-forms toggle controlled by server-side site configuration; not a Strict baseline default
data-autocapture-errors toggle controlled by server-side site configuration; not a Strict baseline default
data-autocapture-labels-only mode for explicit-only UI click tracking
el_label, el_label_src, and el_role on ui.click events
Label auto-detection cascade: data-analytics-label > aria-label > aria-labelledby > title

text > value > alt

GET /v1/usage/history — monthly usage history (up to 24 months)
X-RateLimit-* response headers on all endpoints
Strict error envelope with stable error codes
Metering metadata in metrics responses (meta.units_charged, meta.billable_overage, meta.usage)