Five Minutes Developers

Changelog

The Five Minutes Platform API follows SemVer-minor for additive changes and SemVer-major for breaking changes. New endpoints, new event types, and new optional fields on existing responses are minor bumps. Removing a field, renaming a code, or changing the shape of an existing endpoint is major — and we'll ship it on a versioned URL prefix (/v2/...) so /v1/* callers don't break.

Compatibility promise

  • /v1/* will not break shape mid-version. If a response gains a field, it gains it as optional and existing parsers keep working.
  • Error code values are append-only. We will not rename or repurpose an existing code.
  • Webhook event types are append-only. New types are introduced under new names; existing event payloads gain optional fields.
  • Deprecations are announced at least 90 days before removal, with a Deprecation: <date> header on affected responses.

1.0.0 — 2026-06-12

Initial Public API Phase 1 launch.

Endpoints (/v1/*)

  • GET /v1/me — whoami for the calling credential.
  • GET|POST|PATCH|DELETE /v1/clients + /v1/clients/:id — Tier-2 client CRUD.
  • GET|POST|PATCH|DELETE /v1/groups + nested members.
  • GET|POST|PATCH|DELETE /v1/users + /v1/users/:id/invite + .../deactivate.
  • GET|PATCH /v1/tenant — tenant record read + update.
  • GET|PATCH /v1/settings — tenant settings.
  • GET /v1/audit/events + /v1/audit/events/:id — audit log read.
  • GET /v1/modules/catalog — enabled modules.
  • GET /v1/plans — plan catalog.
  • GET|POST|PATCH /v1/roles — tenant roles.
  • GET /v1/billing/invoices + /:id, GET /v1/billing/payments — billing reads.
  • GET|POST|PATCH|DELETE /v1/clients/:cid/locations (and group-nested) — locations.
  • GET|POST|PATCH|DELETE /v1/webhooks/endpoints + /v1/webhooks/events + /v1/webhooks/deliveries + POST /v1/webhooks/events/:event_id/replay — webhook management.

Authentication

  • fmp_live_* and fmp_test_* API keys (one key per tenant, scope-gated at mint).
  • OAuth 2.0 Authorization Code + PKCE (S256 required). Refresh-token rotation with reuse detection (PAPI9).

Webhooks

  • 21 event types delivered at-least-once with HMAC-SHA256 signatures (X-Five-Minutes-Signature).
  • Retry schedule: 7 attempts over 24 hours with exponential backoff.

Errors

  • 17 canonical error codes (see Errors).
  • Every response carries X-Request-Id for support correlation.

Developer console

  • Magic-link auth at developers.infiveminutes.com/login.
  • App registration + verification queue at /apps.
  • API key minting + revocation at /keys.
  • Webhook endpoint management at /webhooks.
  • Interactive OAuth flow tester at /apps/{appId}/oauth-flow.
  • Public docs at /docs with Scalar-rendered OpenAPI reference.