Release Notes — v2.4.4 (September 14, 2026)

Added

• One package now serves Bagisto 2.4.10 and the releases before it. The theme surface follows the store it is installed on: a 2.4.10 store gets the Appearance API, an older store keeps the theme customization endpoints it already had. Nothing else in the API changes shape between them.
• GET /api/shop/features and the storefrontFeature query — which optional features this channel has switched on, so a storefront can decide what to render before calling something that might refuse. Covers GDPR data requests and the EU right of withdrawal.
• GET /api/shop/returnable-orders and the returnableOrders query — the customer's orders a return can still be raised against, which is the list the New Request flow opens with. Filter by order number or status; sort by date, order number or total.

Fixed

• Section update dropped options and locale, so content could not be published through it.
• Section update erased a locale's content when options were omitted.
• Section create ignored the channel it named.
• Copying a footer links section produced a second one; it is refused, as in the admin.
• Section media upload of an unsupported type failed with a server error; it is refused with the admin's types and 50 MB limit.
• Reordering a subset of sections reshuffled the published order; a reorder must carry every section of one theme and channel.
• Storefront sections returned only ten per page; the default is now 50.
• Exported GraphQL schemas dropped every array-valued field.

Changed

• On a Bagisto 2.4.10 store, storefront theme customizations are sections: /api/shop/theme-customizations[/{id}] and themeCustomization(s) become /api/shop/sections[/{id}] and section/sections, and translations carry sectionId. On an older store the previous endpoints stay exactly as they were — upgrading the store is what moves them.
• On a Bagisto 2.4.10 store, storefront sections return only the published sections of the channel's active theme.
• On a Bagisto 2.4.10 store, admin theme customizations move out of Settings: /api/admin/settings/themes and adminSettingsTheme* become /api/admin/appearance/themes and /api/admin/appearance/sections, under appearance.* permissions, and bulk status becomes the staged status plus publish rather than mass-update-status. On an older store the Settings endpoints and their settings.themes.* permissions are unchanged.
• On a Bagisto 2.4.10 store, deleting an attribute family is refused for the default family; on an older store it is refused for the last remaining one, as before.

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v2.4.3...v2.4.4

Release Notes — v2.4.3 (August 26, 2026)

Added

• Add social login — sign in or sign up with a Google, Facebook or LinkedIn token the app or web already holds (no redirect), returning a Bearer token. POST /api/shop/customers/social-login and the createSocialLogin mutation.

• Add a GraphQL operation map to the export (graphql-operations-shop.json / -admin.json) mapping each root field to its resource tag, so tooling can group GraphQL the way REST is grouped.

• Add a re-seed tool that rebuilds the collections from the exported schemas.

• Add View permissions for Integration and API Change History, so read access to those screens can be granted or withheld separately from creating, editing and deleting.

Fixed

• Fix a fatal error at boot after installing on a newer Symfony release.
• Fix an inactive customer being able to log in; inactive accounts are now rejected.
• Fix a suspended customer being blocked at login; they can now log in and browse, and are stopped only at checkout.
• Fix a customer logging in without verifying their email when email verification is required.
• Honour permissions on the Integration and API Change History screens.
• Scope each exported schema to its own surface.
• Restore tag descriptions in the exported schemas and the interactive docs (the tag list and folders were unlabelled).
• Write a placeholder storefront key into the exported storefront schema instead of the configured key (it resolves from the Postman environment).
• Include two missing storefront endpoints in the export: the invoice PDF and the downloadable-product download.
• Make the exported schemas import cleanly into Postman — they now carry a title and a configurable server URL.

Changed

• bagisto-api-platform:export-schema now writes to schema/generated/ instead of schema/, leaving the hand-maintained collections and environments untouched; --path is unchanged.
• The export now refuses to write a schema that leaks another surface, references a missing definition, carries an unused definition, or contains a storefront key.

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v2.4.2...v2.4.3

Release Notes — v2.4.2 (August 17, 2026)

Added

• Add POST /api/admin/marketing/search-terms (and createAdminMarketingSearchTerm) to create a search term.
• Add bagisto-api-platform:export-schema, which writes the REST (OpenAPI JSON) and GraphQL (SDL) schemas to files for Postman and code generators. Defaults to the package's schema/ folder; override with --path.

Changed

• Update the bundled translations across all supported locales.
• Group the admin draft-cart and place-order endpoints under Admin: Customer Order creation in the Swagger docs.
• Speed up every request by splitting the service provider and deferring state bindings, so a request only loads what it uses.

Fixed

• Fix newsletter subscription rejecting guests with Unauthenticated; a visitor can subscribe with the storefront key alone, as on the storefront.
• Fix deleting a customer account (POST /api/shop/customer-profile-deletes/{id}) doing nothing over REST, and drop the password field the docs wrongly marked required.
• Fix product 404s returning the raw text bagistoapi::app.graphql.product.not-found instead of "Product not found", on both transports.
• Fix adminProfile returning roleId and roleName as null over GraphQL.
• Fix the admin product copy mutation returning sourceId as null over GraphQL.
• Fix adminCatalogProduct's superAttributes { options } returning null, and its relatedProducts / upSells / crossSells returning storefront-shaped nodes.
• Fix createAdminCatalogProduct / updateAdminCatalogProduct returning an unusable id and connections listing unrelated products.

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v2.4.1...v2.4.2

Release Notes — v2.4.1 (July 22, 2026)

Added

• Add request and response examples to the Swagger/OpenAPI docs for every Returns (RMA) and EU Withdrawal endpoint (shop and admin).
• Add the request body schema for creating and updating RMA reasons, rules, statuses and custom fields in the Swagger docs.
• Add redirect and redirectUrl to the place-order response so clients can tell when the shopper must be sent to a payment page before the order exists.
• Add minPrice and maxPrice to the storefront category response so REST clients can bound a price-range filter, matching what GraphQL already exposed.
• Add xls and xlsx to every admin export endpoint (?format=), matching the formats the admin panel offers; exported values are now guarded against spreadsheet formula injection.

Changed

• Drop the hard Redis requirement: the API metadata/schema cache and rate-limit counters now follow the application's CACHE_STORE (falling back to file), so no separate cache service or extra configuration is needed.
• Take the cart file-upload size limit from php.ini and the staged-upload lifetime from the session lifetime, instead of package settings.

Fixed

• Fix GraphQL connection fields (e.g. cart items { edges }) failing with Field "items" of type "Iterable" must not have a sub selection on some production PHP-FPM servers.
• Fix RMA settings create and update responses showing a success message; the confirmation message is now returned only on delete.
• Restore backward compatibility with Bagisto cores below 2.4.5 by conditionally registering the EU Withdrawal endpoints only when the core module is present.
• Fix paymentGatewayUrl coming back empty for redirect payment methods (Stripe, Razorpay, PayPal Standard, PhonePe), leaving clients with nowhere to send the shopper.

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v2.4.0...v2.4.1

Release Notes — v2.4.0 (July 15, 2026)

Changed

• Upgrade to Bagisto 2.4.7 / Laravel 12; the package now requires PHP 8.3+.
• Upgrade API Platform to 4.3.x (api-platform/laravel and api-platform/graphql at ~4.3.8), which also resolves the api-platform/json-api security advisory.
• Install only api-platform/laravel and api-platform/graphql — the other api-platform/* components are pulled in automatically, so the redundant per-component composer require list has been removed.
• Keep every endpoint URL unchanged after the API Platform upgrade: auto-generated paths stay underscored (e.g. /api/shop/compare_items), so no client needs to update a URL.

Fixed

• Fix GraphQL delete mutations (deleteWishlist, deleteCompareItem, deleteGdprRequest) returning only id instead of the deleted record's fields.
• Fix storefront place-order (createCheckoutOrder) returning an empty payload.
• Fix a request for another customer's return (customerReturn) returning a blank record instead of an error.
• Fix filterableAttributes missing from the storefront category GraphQL type.
• Fix admin user create/edit/delete and downloadable-file download rejecting roles that hold the correct permission, caused by permission keys renamed in Bagisto 2.4.
• Fix storefront contact-us, newsletter, login, logout, forgot-password and token-verification responses returning empty payloads.
• Fix creating a product review over REST (POST /api/shop/reviews) failing with a server error.

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v2.3.1...v2.4.0

Release Notes — v2.3.1 (July 07, 2026)

Fixed

• Fix file-type customizable options not being usable on add to cart for simple and virtual products (POST /api/shop/customizable-option-files).
• Fix required customizable options not being enforced on add to cart.

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v2.3.0...v2.3.1

Release Notes — v2.3.0 (July 02, 2026)

Added

• Add product video endpoints: upload a video (POST /api/admin/catalog/products/{id}/videos, REST multipart) and delete one (DELETE /api/admin/catalog/products/{id}/videos/{id} / deleteAdminCatalogProductVideo).

Fixed

• Fix the storefront filterableAttributes price range: maxPrice now reflects the authenticated customer's customer-group pricing, and minPrice now returns the actual lowest product price.
• Fix admin tax-rate update leaving orphaned zip fields when switching between specific-zip and zip-range modes.
• Fix the storefront (shop) REST API documentation: correct the authentication endpoint paths, remove the non-existent reset-password page, and replace placeholder request/response examples with real ones.
• Update the translations for all non-English locales.

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v2.2.0...v2.3.0

Release Notes — v2.2.0 (July 02, 2026)

Added

• Add downloadable-product file upload (REST)
• Add downloadable-product file download (REST)

Changed

• Change admin marketing campaign update to be partial — send only the fields you want to change (previously every field was required).

Fixed

• Fix the campaign-send, coupon-generate, coupon-mass-delete, and sitemap-generate mutations returning null over GraphQL.
• Fix admin customer-address update / delete / set-default over GraphQL not verifying the owner — customerId is now required.

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v2.1.0...v2.2.0

Release Notes — v2.1.0 (July 01, 2026)

Added

• Invoice Payments: Added the Record Payment action for invoices (POST /api/admin/transactions + createAdminTransaction), allowing full or partial payments. Invoices are marked as paid and orders advance once the total amount is covered.

Fixed

• Dashboard: Fixed an issue where the dashboard date range returned null in GraphQL (REST was unaffected).
• Rate Limiting: Fixed admin API token rate limiting so per-minute and per-day limits are enforced independently. Previously, both limits shared a counter, causing the per-minute limit to trigger early and the per-day limit to be ignored.

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v2.0.0...v2.1.0

Release Notes — v2.0.0 (June 26, 2026)

Version 2.0.0 is a major release that introduces several breaking changes to the Admin API while keeping the Shop (storefront) API fully backward compatible.

⚠️ Breaking Changes

• Admin API responses now return several related resources as nested objects instead of flat fields.
• Channel settings now return object collections instead of ID arrays.
• Tax categories, themes, and settings GraphQL data are now field-selectable objects rather than JSON blobs.
• adminReviews and adminReview endpoints have been removed. Use adminCustomerReviews and adminCustomerReview instead.

✨ Added

• GDPR data request support for storefront customers via REST and GraphQL.
• Automated API field-completeness tests.
• New Compare Items endpoint.
• Expanded Shop API documentation with 31 new overview pages.
• New bagisto-api-platform:optimize command for deployment optimization, delivering up to 5× faster API response times.

🔄 Improved

• Settings GraphQL nested data is now field-selectable.
• Enhanced API documentation for filters, sorting, pagination, and product fields.

🐛 Fixed

• Fixed Admin GraphQL delete mutations returning internal server errors.
• Resolved multiple Admin listing and nested relationship issues.
• Fixed cart rule updates, catalog operations, permissions, cache clearing, and customer-related API errors.
• Added sorting support for Wishlist and Customer Address listings.
• Removed the unused History tab from Integration token pages.

Upgrade Note: Review Admin API integrations for response structure changes. Storefront integrations require no changes.

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v1.0.5...v2.0.0

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v1.0.4...v1.0.5

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v1.0.3...v1.0.4

1.0.3

Added

Customer account APIs

• Customer orders list / detail endpoints (CustomerOrderProvider).
• Customer order shipments (CustomerOrderShipmentProvider).
• Customer invoices (CustomerInvoiceProvider) and invoice PDF download (InvoicePdfController).
• Customer reviews list (CustomerReviewProvider).
• Customer downloadable products listing (CustomerDownloadableProductProvider) and purchased-downloads download endpoint (DownloadablePurchasedController).
• Cancel order (CancelOrderProcessor + CancelOrderInput DTO).
• Reorder (ReorderProcessor + ReorderInput DTO).
• Customer profile output resource (CustomerProfileOutput) and profile helper.
• Customer address DTO + processor updates for address CRUD.

Catalog & storefront APIs

• REST endpoints for Locale, Category tree, and Theme Customization.
• CMS page lookup by URL key (PageProvider, GraphQL PageByUrlKeyResolver tagged as collection query resolver).
• Channel endpoint (ChannelProvider).
• Product API now exposes query fields for dynamic currency.
• Booking product slot provider (BookingSlotProvider) and mutations for Booking / Event Booking product types.
• Downloadable product sample download (DownloadSampleController).
• More precise product search by title.
• Contact Us submission (ContactUsProcessor + ContactUsInput/ContactUsOutput DTOs).

Cart, wishlist & compare

• Merge cart API with configurable product support (CartTokenProcessor extended).
• Compare item CRUD (CompareItemProvider/CompareItemProcessor) + delete-all (DeleteAllCompareItemsProcessor).
• Wishlist CRUD (WishlistProvider/WishlistProcessor) + delete-all (DeleteAllWishlistsProcessor).
• Move wishlist item to cart (MoveWishlistToCartProcessor + input/output DTOs).

Infrastructure

• php artisan bagisto-api-platform:cache:clear (ClearApiPlatformCacheCommand).
• CursorAwareCollectionProvider for cursor-based pagination.
• FixedSerializerContextBuilder to patch API Platform serializer context handling.
• SnakeCaseLinksHandler for consistent snake_case link rendering.
• Push Notification integration.
• Extensive Pest feature test coverage: GraphQL product/cart/checkout/customer/wishlist/compare/booking/reorder, REST customer orders/invoices/reviews/downloadable/CMS pages, customer auth and address flows, locale + channel + currency headers.

Changed

• Cart price conversion now respects the active currency.
• Translation fallback for products and product variants based on active status.
• Translations extended across 21 locales (en/app.php + 20 locale files: ar, bn, ca, de, es, fa, fr, he, hi_IN, id, it, ja, nl, pl, pt_BR, ru, sin, tr, uk, zh_CN) including Event Booking product type strings.
• Shipping rates now expose formattedPrice (ShippingRateOutput updated).
• GraphQL Playground controller refreshed (~460 lines) with updated endpoints and UX.
• InstallApiPlatformCommand now publishes vendor config.
• api-platform/laravel and api-platform/graphql pinned to specific versions in composer.json.
• OpenAPI info.version bumped to 1.0.3 in config/api-platform.php, config/api-platform-vendor.php, and the SwaggerUIController error fallback.
• Add-to-cart error response updated with clearer payload.
• Rate-limit enforcement tightened for storefront endpoints.

Fixed

• Disabled products can no longer be added to the wishlist.
• Moving a wishlist item to the cart now increments the cart quantity when the same product is moved again.
• attributeValues key resolved correctly in product query data.
• formattedPrice field for downloadable and Event Booking product types.
• Cart merge behaviour for configurable products.
• Translation fallback for products and cart price conversion.
• Order, customer, and wishlist edge cases reported during QA.
• README + api-platform-vendor.php newline hygiene.

Documentation

• README: fixed step numbering (Step 9 → Step 6), stray backtick on the GraphQL endpoint URL, and the graphqli → graphiql typo in the GraphQL Playground link.
• Added CHANGELOG.md (this file).

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v1.0.1...v1.0.2

Full Changelog: https://github.com/bagisto/bagisto-api/compare/v1.0.0...v1.0.1

Storefront API Added