New API version released V1.4.0

See the full API Version 1.4.0 reference for request and response details.

Add engagement brief endpoints

New GET /engagements/{engagement_id}/engagement_briefs lists an engagement’s published briefs.
New GET /engagement_briefs/{id} fetches one published brief. It is also the related link of a submission’s engagement_brief relationship.
Published briefs are the versions researchers saw and submitted against. The brief returned through an engagement is its current, editable brief, which may have changed since.
Published briefs, including a submission’s engagement_brief, now also include:
- published_at and redacted
- industry (id, name)
- resources, each with an s3_signed_url valid for one minute and its expiry in s3_signed_url_expires_at
- vrt_scope_rules, with the name of each VRT category
- scope: target groups, their targets and reward ranges, inline in each brief
Use fields[engagement_brief] to limit the attributes returned.
coordinated_disclosure, crowdstream_visible and share_known_issues are null on published briefs, which don’t record them.

GET /engagements now returns a deterministic order: created_at ascending by default, with id as a tie-breaker.
It now honours the documented sort parameter (created_at-asc or created_at-desc).
Previously, consecutive pages could overlap, so some engagements were never returned when paging through the full list. Each engagement now appears exactly once across pages.