Changes

What was added to the Partner API, and when. The API has one major version, v1, and it only grows: see Versions and compatibility. A revision is listed on the day it went live. Revisions 1.0 to 1.3 were numbered afterwards, from the history of this documentation.

Revision 1.13

9 November 2026

• The session of a partner's Telegram Mini App is bounded to the subscription. A user who signs in through your Mini App (POST /api/v1/partners/{partner_id}/auth/telegram) gets a session that carries the mark of a partner's Mini App in every token it has, the tokens a refresh returns included. It reads the account (the profile, the balance, the usage, the sessions, the subscription and its lines, the payments) and connects by country (POST /api/v1/connect with exit_country, and entry_country if you like: ProofKit's own selector picks the node). It can no longer link a wallet, ask for a withdrawal or a claim, connect to a node, an entry or a service by name, switch a session to one, change the profile, the two-factor sign-in or the Telegram link, or make an API key, an extra link, a partner or a node. Those calls answer 403 with the code DOOR_SCOPE and the sentence "Sign in on proofkit.org to do this.": send the user to proofkit.org, where, signed in, they do all of it. The list is in the section "What the session may do" of the Mini App integration guide you were sent. A session your Mini App opened before this revision is bounded the same way from its next refresh.
• Not changed: no route, field, parameter or status of the Partner API with your key (X-Partner-Key), and nothing of the MCP server. A partner with no Telegram Mini App is not affected.

Revision 1.12

3 November 2026

• transport on every event of GET /guard-events: the transport the session's connections came in through in the minute that ended it, the one that carried most of those to ports other than 80 and 443, or of all of them in a minute with none. It is one of vless_reality, vless_xhttp, hysteria2, vless_webtunnel and olcrtc, the words of supported_transports in GET /catalogue, or null: for upload and session_limit, which are judged by the session's bytes whatever they came in through, and when the exit could not say. Until now an event said which exit and why, not which way the subscriber came in. The set can grow: treat a value you do not know as other.
• Not changed: no other field, parameter or status. The five reasons, the counts, the paging and the 30 days are as they were.

Revision 1.11

2 November 2026

• WebTunnel on a direct route. A route straight to an exit can now carry the vless_webtunnel line, not only a route through an entry. It comes as before: you list vless_webtunnel in sub_transports, and the line is the fourth of its route, after XHTTP, with a name ending · WebTunnel, in the happ and json formats of GET /subscribers/{external_id}/subscription and at the hosted /sub/<sub_token> URL. On a direct route it runs to a name on a domain that ProofKit controls, at the exit's own address, so to a network it looks like a visit to an ordinary website; it is for networks that cut the other lines. An exit serves it only while it is working, and the route has its other lines meanwhile. No list for the Ghostlane app carries it, as before. See WebTunnel.
• vless_webtunnel among the supported_transports of an exit in GET /catalogue, while a route straight to it can carry the line. Until now only an entry named it. If your code read the value there as "through an entry", read node_type as well: on an exit it means a direct route. In the same way a vless_webtunnel entry of a subscription may now have edge_id and entry_country set to null, as every direct route does.
• The WebTunnel box of the Partner page's Subscription tab is shown once an entry or an exit you can sell serves the line, and the preview names the line on a direct route that serves it.
• Not changed: no field, parameter or status is added, and null in sub_transports is still Reality, Hysteria2 and XHTTP. GET …/configs still lists three transports and the bundle of those three, and the transport of POST …/connect ignores "vless_webtunnel" as it ignores every value but "hysteria2".

Revision 1.10

2 November 2026

• GET /guard-events: every time Torrent Guard ended one of your subscribers' sessions, kept for 30 days. An event names the subscriber (external_id and subscriber_id), the reason (upload, session_limit, scan, torrent or bittorrent), the time, the exit node (node_id, node_country, node_type), the session and the numbers behind the decision: the session's bytes for the first two reasons, the minute's destination counts for the other three. since and limit page through it, and polled_to and has_more say where to continue. We send no notice: you poll.
• Not changed: no existing call or answer. Ended sessions are still not listed, and a session that ends for any reason but Torrent Guard has no event.

Revision 1.9

28 October 2026

• stake_nano on GET /account: the stake locked on your partner, in nanoTON, 0 for a partner without one.
• balance_nano is as it was: the balance of your billing account before any stake is taken off. The connect gate works from balance_nano − stake_nano, less any stake locked in nodes your billing account owns.

Revision 1.8

27 October 2026

• WebTunnel: a fourth transport, vless_webtunnel, for a partner that lists it. Its line runs VLESS over HTTPUpgrade and TLS to a name on a domain that the entry's operator controls, so to a network it looks like a visit to that operator's website. It is off until you list it in sub_transports, where null is still Reality, Hysteria2 and XHTTP. See WebTunnel.
• vless_webtunnel as the transport of an entry in GET /subscribers/{external_id}/subscription with format=json. In the happ and json formats of that call and at the hosted /sub/<sub_token> URL the line closes a route through an entry, after XHTTP, and its name ends · WebTunnel. No list for the Ghostlane app carries it: neither format=ghostlane nor the hosted /sub/<sub_token>/unified URL.
• vless_webtunnel among the supported_transports of an entry in GET /catalogue, while one of its links to an exit in the list serves a line. An exit never names it.
• The WebTunnel box of the Partner page's Subscription tab, shown once an entry you can sell serves the line (and, once ticked, until you untick it), and vless_webtunnel as a value of sub_transports in the dashboard's settings call.
• Not changed: GET …/configs still lists three transports and the bundle of those three, and the transport of POST …/connect ignores "vless_webtunnel" as it ignores every value but "hysteria2".

Revision 1.7

20 October 2026

• Subscriber device limit: how many devices may receive a subscriber's subscription, the devices that did, and removing one or letting it back. See Subscriber device limit.
• device_limit on POST /subscribers and PATCH /subscribers/{external_id}; device_limit and devices on the subscriber wherever it is answered (GET /subscribers/{external_id}, POST /subscribers/{external_id}/reset) and in the list, GET /subscribers.
• GET /subscribers/{external_id}/devices, DELETE /subscribers/{external_id}/devices/{device_id} and POST /subscribers/{external_id}/devices/{device_id}/allow.
• GET /subscribers/{external_id}/subscription and the hosted subscription URLs read the device an app names in its request headers, x-hwid, x-device-os, x-ver-os, x-device-model and user-agent. A fetch the limit refuses is answered 200 with no route and x-hwid-active, x-hwid-max-devices-reached or x-hwid-not-supported, x-hwid-limit, announce and announce-url; every answer that judged the device of a subscriber with a limit carries subscription-always-hwid-enable: 1.
• The error codes INVALID_DEVICE_LIMIT, DEVICE_NOT_FOUND and DEVICE_LIMIT.

Revision 1.6

19 October 2026

• POST /subscribers/{external_id}/olcrtc chooses an exit that serves any olcRTC carrier, and olcrtc_url in its answer is the first line of olcrtc_urls: the Telemost line while the exit serves Telemost, the next carrier's otherwise. Until now only an exit that served Telemost was chosen. From 18 October 2026, when Telemost stopped being offered, the call answered 503 NO_OLCRTC_NODE.
• MTS Link is an olcRTC carrier: mtslink in olcrtc_carriers and as the carrier of a line, whose name ends · MTS. See The olcRTC link.

Revision 1.5

11 October 2026

• Subscriber exit countries: a subscriber's own list of exit countries, in place of your partner's list for that subscriber. See Subscriber exit countries.
• Subscriber expiry: the instant a subscriber's subscription ends, which the platform enforces itself. See Subscriber expiry.
• exit_countries and expires_at on POST /subscribers and PATCH /subscribers/{external_id}; exit_countries, expires_at and expired on the subscriber wherever it is answered (GET /subscribers/{external_id}, POST /subscribers/{external_id}/reset) and in the list.
• expire= in the subscription-userinfo header carries the subscriber's end date when it has one.
• The error codes INVALID_EXIT_COUNTRIES, INVALID_EXPIRES_AT and SUBSCRIPTION_EXPIRED.
• PATCH /subscribers/{external_id} with "quota_bytes": null clears the quota, as this reference has said since revision 1.3. Until now such a call changed nothing.
• POST /subscribers with quota_bytes answers created: true for a subscriber the call made, as it does without one. Until now such a call answered created: false.

Revision 1.4

11 October 2026

• Every answer names the revision that produced it, in the X-Partner-Api-Version header. See Versions and compatibility.
• The OpenAPI document of every revision stays available, at https://proofkit.org/partner-api/versions/1.4.json for this one.

Revision 1.3

10 October 2026

• Subscriber quotas: an optional traffic allowance per subscriber, which the platform enforces itself. See Subscriber quotas.
• quota_bytes on POST /subscribers; quota_bytes, quota_used_bytes, quota_remaining_bytes and over_quota on the subscriber wherever it is answered (GET /subscribers/{external_id}, POST /subscribers/{external_id}/reset), in the list, on each row of GET /usage and on GET /subscribers/{external_id}/usage.
• PATCH /subscribers/{external_id}.
• The error codes INVALID_QUOTA and QUOTA_EXHAUSTED.

Revision 1.2

10 October 2026

• hosted_base on GET /account: the base of your hosted subscription URLs while a domain of your own is active.

Revision 1.1

4 October 2026

• The olcRTC part of usage: olcrtc_bytes, olcrtc_cost_nano and olcrtc_list_cost_nano on each row of GET /usage and on GET /subscribers/{external_id}/usage, with their totals.
• olcrtc_pricing on GET /account.

Revision 1.0

27 September 2026

• The first published contract: the account, the catalogue, subscribers and their list, connect, sessions and their configs, the subscription, olcRTC, and usage.

Back to contents