Skip to main content

​
July 2026

​
Data Entitlements & CRM Exports — July 18, 2026

New:
  • Access endpoint (GET /api/access) — the authoritative statement of what your API key may do. Per dataset it reports whether access is granted and by what (subscription, offer, or enterprise), the exact territory (states/districts/pincodes), the exact date window, and the granting plans with their expiry — plus rate limits and credit balances. Call it at integration time to self-configure instead of guessing.
Changed:
  • Recently registered feeds now enforce your entitlement. POST /api/recently-registered/gst, /companies and /directors apply the same three controls as the web app: dataset entitlement, territory scope, and the subscription-anchored date window. With no entitlement the request is refused with 403 and error_code: "NO_DATASET_ACCESS" rather than returning a silent empty page.
  • Every feed response now carries an access block echoing the granted_by, territory and date_window actually applied, so any result set can be explained and audited.
  • Recently registered companies and directors are documented again — both feeds are available, gated by the entitlement system above.
  • Order leads are now flat, CSV-shaped rows. GET /api/crm/orders/{order_id}/leads returns each lead as a single row of scalars with no nested objects or arrays, mapping straight onto CRM columns. Lists are joined into one cell with ; (descriptions with |). The column set differs per item type — gst (31 columns), company (36), director (23).
  • New format query parameter on order leads: flat (default) or nested for the previous {lead, full_data} shape.
  • Contact details are populated on order leads for paid orders — Email, Mobile and the address columns were previously always null. GST rows now use the district for City and the state name for State.
  • GST lead rows now include HSNCodes, HSNDescriptions, SACCodes and SACDescriptions.
Clarified:
  • Your fsk_ API key is not a bearer token. It must be exchanged at POST /api/auth/login, and the token to send is the nested token.access_token — there is no top-level access_token. Sending the raw key as Authorization: Bearer fsk_... now returns a 401 explaining the missing exchange step.
  • The cashfree value for paymentOption is a legacy label meaning “pay online” — online payments are processed by Razorpay.

​
June 2026

​
Product Updates — June 29, 2026

Removed:
  • Newly registered company & director access — the POST /api/recently-registered/companies and POST /api/recently-registered/directors endpoints are discontinued, along with the Recent_COMP and Recent_DIR subscription features. Recently registered GST access (Recent_GST) remains available.
  • Full Company order type — the fullcompany order/lead type is no longer supported. Order companies, directors, and GST registrations individually.
  • MCP Server integration — the hosted Model Context Protocol server has been retired and its documentation removed.
Changed:
  • POST /api/crm/newlead now supports the gst entity type only.
  • Orders now refund the credit for any item with no contact data found.

​
March 2026

​
Security & Compliance Hardening — March 25, 2026

Major security update to align backend implementation with our Privacy Policy and Terms & Conditions commitments. New Features:
  • Account deletion endpoint (DELETE /api/users/me/account) — DPDPA Right to Erasure compliance
  • Account suspension system — admin can suspend/unsuspend users, all sessions invalidated on suspend
  • Persistent IP blocking — malicious IP bans now stored in MongoDB (survive restarts)
  • Automated threat detection — brute-force and credential stuffing patterns detected every 15 minutes
  • Scheduled security cleanup — expired sessions, tokens, rate limits auto-cleaned every 6 hours
Security Headers:
  • Browser routes now include Strict-Transport-Security, X-Frame-Options, Content-Security-Policy, Referrer-Policy, Permissions-Policy
  • Developer API routes include Cache-Control: no-store, X-RateLimit-* headers instead of browser-specific headers
Fixes:
  • MongoDB TLS certificate validation now configurable (was hardcoded to skip validation)
  • Developer API suspension check added — suspended users blocked from API key access
  • Rate limit info now returned in X-RateLimit-* response headers for developer API
Admin Endpoints:
  • POST /admin/users/{id}/suspend — suspend a user account
  • POST /admin/users/{id}/unsuspend — reactivate a suspended account
  • GET /admin/security/blocked-ips — view all blocked IPs
  • POST /admin/security/block-ip — manually block an IP
  • POST /admin/security/unblock-ip — unblock an IP

​
Privacy Policy Update — March 2026

Updated Privacy Policy with comprehensive DPDPA 2023 compliance:
  • Key definitions (Data Fiduciary, Data Principal, Processing, Publicly Available Data)
  • Detailed data source breakdown (MCA V2/V3, GST, MSME portals)
  • Legal basis for processing (5 legal bases with balancing test)
  • Full DPDPA user rights (access, correction, erasure, portability, withdraw consent)
  • Grievance redressal mechanism (7-day acknowledgment, 30-day resolution)
  • Data accuracy disclaimers and liability protections
  • Children’s privacy protections (under-18)
  • International data transfer safeguards

​
Upcoming — March 26, 2026

  • Run Screener endpoint (POST /api/screener/screeners/{id}/run) — execute a saved screener and get matching results in real-time