Clearer authentication and permissions in the REST API

We’ve made a few fixes to the REST API to make authentication, permissions and public responses more consistent.

If your integration sends an invalid, expired or revoked token in the Authorization header, you’ll now get a 401 Unauthorized response—even when requesting public information. Previously, some unrecognised tokens could be ignored and the request would return public data anyway, making authentication problems easy to miss.

If you start seeing a 401, check that your integration is using a valid Bearer token. If you only need public status information, you can leave out the Authorization header and continue making requests without authentication.

We’ve also tidied up a few related areas:

• More consistent checks for team roles and access to pages and collections.
• Public responses now follow Component visibility rules across notices, updates and reported status.
• Corrected caching for authenticated requests, private pages and error responses.
• Reading page details no longer creates or updates subscriber records.

If you need a hand checking your integration, get in touch at help@sorryapp.com.