Changelog

Notable changes to the Ummat API. Dates are in UTC.

2026-05 — Developer Portal P4

API key management. Create, revoke, and rotate API keys from the developer panel. Keys are scoped to specific operations.
OAuth 2.0. Authorization Code + PKCE and Client Credentials flows. OIDC discovery document published at /.well-known/openid-configuration.
Webhooks. Subscribe to 10 event types. HMAC-SHA256 signature verification. 6-attempt retry with exponential backoff.
Sandbox environment. Read-only fixture data at sandbox.api.ummat.dev. No rate limits. Resets nightly.
Rate limit headers. All responses now include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset.
Usage dashboard. Per-key analytics in the developer panel: requests today, this month, avg response time, error rate, and top endpoints. Export usage as CSV.
Documentation portal. This site — publicly accessible at ummat.dev/docs.
New JWT claims. x-hasura-org-id, x-hasura-api-key-id, and x-hasura-api-key-scopes added for developer role tokens.

Event triggers. Hasura event triggers wired to up_events, up_iqamah_schedules, ua_donations, up_entity_members, up_masjid_claims.
Prayer times API. calc_prayer_times and calc_prayer_times_range functions with 7 calculation methods.
Nearby masjid search. PostGIS-powered nearby_masjids function with distance output.

Masjid directory API. Query verified masjids by city, state, or coordinates.
Events API. List and filter published events by entity.
GraphQL API launched. Single endpoint at api.ummat.dev/v1/graphql. Authorization header auth.

For breaking changes and migration guides, see the GitHub releases.