Change log.

Public npm packages under the MIT licence

All three packages are published under the @sutempo organisation.

Self-service developer access, multi-resource search

The largest API change to date. Available in preproduction; production to follow. 900e616

• AddedTime-slot search GET /v1/business-tenants/{tenantId}/availability/search : multiple people, rooms or machines in one call, over at most 31 days, 10 resources and 155 resource-days, sorted by start time. Permission bookings:read or widget:book.
• AddedSelf-service sandbox: registration open to everyone, a fictional business and test keys, no real emails or payments.
• AddedReal businesses with permission: a Pro business authorises a developer by email address; the key is retrieved once and permission can be withdrawn.
• ChangedFull OpenAPI contract at /openapi.json, documented code snippets verified by tests.
• ChangedWidget embeddable as a script or frame; a Pro business declares the websites allowed to display it.
• SecurityPer-key, per-business and global quotas; per-surface rate limiting; API keys and usage records filtered by business. Response 429 with Retry-After.

/developpeurs page

00ffd2a · #78

• AddedFirst developer landing page: API, SDK, widget and MCP.

Three ways to display the widget, protected public booking

686aade · #67 · ee075c9 · #66

• Addeddata-mode : inline, modal behind any element with data-platform-widget-open, floating with a corner button. Preloaded by default; data-preload="false" defers preloading.
• AddedEvents on document: platform:booking-opened, platform:booking-closed, in addition to platform:booking-confirmed.
• Changed“When” step: date and time on one screen. The autoAssignResourceoption, disabled by default, skips asking “with whom”.
• SecurityCloudflare Turnstile on public booking, only if configured by the platform. Blocked contacts per business: neutral rejection, without revealing that the list exists.

Subdomain pages, robots and llms.txt

#39 · #42 · #50

• AddedPublic pages at <slug>.sutempo.com ; the address /<slug> continues to respond.
• Addedrobots.txt, sitemap.xml and llms.txt served by the API, depending on the environment.
• FixedStripe webhooks: a rejected signature returns 400 instead of 404.

Readable public address

56d2764 · #17

• Added/<slug> serves the same page as /b?tenant=<uuid>, which remains valid.