Changelog

How versions work

Only Swum-Version: 2026-10-25 is accepted; omitting it selects that current contract. Other versions return 400. Ignore additive response fields that your client does not use. The documentation update date is not a new API-version header.

2026-10-25

The original contract introduced scoped REST reads and supported proposal-backed writes, signed webhooks, OAuth with S256 PKCE/rotating refresh tokens, stateless MCP, and mandatory owner approval for lesson cancel/reschedule. Payments remain read-only.

Roster, Team and connectors

The current implementation adds family create/update, swimmer create/update, private family/swimmer notes, family-confirmed enrollment requests and verified free-occurrence enrollment. Team groups, meets, entries and recorded swimmer times have scoped read routes; enter_meet sets individual entries with separate family confirmation/payment.

Founder-provisioned DEV sandboxes support sk_test_ keys. Dedicated private Zapier/Make/n8n app keys manage signed app-owned subscriptions and retained canonical event reads. The current inventory is 116 resource routes, 89 MCP tools and 17 event types. JSON and idempotency samples cover POST, PATCH and DELETE.

SportsEngine and other school imports, card migration handoff, waiver ZIP/re-sign, reporting, evaluations, certificates and MFA remain app/operational workflows rather than additional public endpoints. Restricted meet-host formats and real partner installation require their actual acceptance inputs.

AI connectors

November 2026: the docs are live and indexed. Claude, ChatGPT and Codex connect with dynamic client registration or a client ID metadata document (an https client_id). Gemini Enterprise and Microsoft Copilot Studio use a connector the owner makes in Swum: a client ID and secret sent with client_secret_basic or client_secret_post. Only the owner who made a connector can allow it.