Skip to content

Modernize the SDK and remove legacy endpoints (3.0.0) - #162

Closed
bartes wants to merge 7 commits into
developfrom
modernize-sdk
Closed

Modernize the SDK and remove legacy endpoints (3.0.0)#162
bartes wants to merge 7 commits into
developfrom
modernize-sdk

Conversation

@bartes

@bartes bartes commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

Modernizes the SDK around the current Castle API surface and removes the legacy endpoints. Releases 3.0.0.

Public API

Capability Methods
Scoring risk, filter, log
Generic requests get, post, put, delete
Lists createList, getAllLists, getList, queryLists, updateList, deleteList
List items createListItem, createListItemsBatch, getListItem, queryListItems, countListItems, updateListItem, archiveListItem, unarchiveListItem
Privacy requestUserData, deleteUserData
Events eventsSchema, queryEvents, groupEvents
Webhooks verifyWebhookSignature
Secure mode secureUserID

Removed (breaking)

  • Authenticate — authenticate, authenticateAsync
  • Track — track
  • Devices — approve, report, userDevices, device
  • Impersonation — impersonateStart, impersonateEnd
  • Privacy by id — removeUser
  • The authenticate failover strategy configuration and the doNotTrack option

Bumps the version to 3.0.0.

bartes added 7 commits June 10, 2026 23:25
…on APIs

Introduce the Lists API (createList, getAllLists, getList, queryLists,
updateList, deleteList) and the List items API (createListItem,
createListItemsBatch, getListItem, queryListItems, countListItems,
updateListItem, archiveListItem, unarchiveListItem) on CastleApi.

Add requestUserData for privacy data requests and the Events API
(eventsSchema, queryEvents, groupEvents).

Add Castle#verifyWebhookSignature for verifying the X-Castle-Signature
header against the raw request body using HMAC-SHA256.

Bump version to 2.2.0.
Add a Supported APIs section to the README listing the modern API surface
(scoring, generic requests, lists, list items, privacy, events, webhooks)
alongside the previous, deprecated-but-supported endpoints, and bump the
quickstart dependency snippet to 2.2.0.
Adds CastleApi#deleteUserData(payload) issuing DELETE /v1/privacy/users,
alongside the existing requestUserData. Documents it in the README and
CHANGELOG and covers it with an HTTP test.
Change archiveListItem to issue DELETE /v1/lists/{listId}/items/{itemId}/archive
instead of PUT, and update the HTTP test accordingly.
Replace the reflective Field.modifiers hack in SdkMockUtil by making the
internal restApiFactory field non-final, build the separate-classloader test
runner classpath from java.class.path instead of casting the system class
loader to URLClassLoader, and open java.base packages to the test runtime on
JDK 9+ so the environment-variable rule keeps working.
Run the test suite on Temurin 8, 11 and 17 on every push and pull request,
and pin Java 17 for local development via .tool-versions.
Drop the Authenticate (authenticate/authenticateAsync), Track (track),
device (approve/report/userDevices/device), impersonation
(impersonateStart/impersonateEnd) and removeUser endpoints, along with the
authenticate failover strategy configuration and the doNotTrack option, leaving
the modern surface: risk/filter/log, generic requests, Lists, List items,
Privacy (requestUserData/deleteUserData), Events, webhook verification and
secureUserID. Bump the version to 3.0.0.
@bartes bartes closed this Jun 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant