Changelog

Notable changes to the Spellweave API.

v1.2September 2026
  • Collection imports accept up to 10,000 cards per request (was 500) and are much faster: a 10,000-card request typically completes in a few seconds. See Importing Large Collections.
  • Fixed: oracle_id was ignored on POST /api/v1/collections and POST /api/v1/collections/{id}/cards, so rows identified only by oracle_id came back missing_identifier. It now works, and it takes precedence over name when a row has both. An unknown oracle_id is reported as not_found, a value that is not a UUID as the new per-row reason invalid_oracle_id, and an empty value is ignored.
  • A null entry in cards is now reported as a per-row missing_identifier instead of failing the request.
  • Imports for one user run one at a time. A request that cannot start within a few seconds returns 409 import_in_progress with a Retry-After header.
  • New optional Idempotency-Key header on both collection write endpoints, so a retried import is not counted twice.
  • Imports are atomic: if a request fails, none of its cards are written, and POST /api/v1/collections no longer leaves an empty collection behind.
  • A card that the user already owns in another collection no longer counts against the plan's card limit when added to a second collection, matching how the limit is measured.
v1.1September 2026
  • GET /api/v1/collections/{id} is now paginated. It previously returned at most 100 cards with no way to reach the rest. It accepts limit (1-500, default 100) and cursor, and returns has_more and next_cursor in meta. Cards are ordered by oracle_id rather than by name, which keeps every page fast no matter how deep you are in a large collection.
  • A malformed cursor now returns 400 invalid_cursor instead of silently returning the first page.
  • Documentation moved to dev.spellweave.app
v1.0March 2026
  • Initial release of the Spellweave API v1
  • OAuth 2.0 Authorization Code + PKCE authentication
  • Read-only endpoints: user profile, collections, decks, deck stats
  • Three scopes: profile:read, collections:read, decks:read
  • Cursor-based pagination on list endpoints
  • Per-app rate limiting (60/min, 10K/day)
  • Developer registration with admin approval