Versioning & deprecation policy.

Every endpoint under /api/v1/ keeps its URL, request parameters, response field names, and response field types. Once a field ships, its meaning does not change.

Breaking changes only ever ship under a new version prefix (/api/v2/), and v1 keeps working alongside it for the full deprecation window.

These are additive and may ship at any time (always announced in the changelog):

• New endpoints, new optional query parameters, new suites.
• New fields added to existing response objects.
• New enum-like values where the schema documents the set as open (e.g. new exchange codes, new sectors).
• More rows or deeper history in existing datasets.

Client rule of thumb: ignore JSON fields you don’t recognize. Parsers that reject unknown fields will break on additive changes — that is the one integration pattern we cannot protect.

If we ever need to remove or change something incompatibly — an endpoint, a field, an authentication mechanism — we commit to:

• 12 months’ notice before the old behavior stops working, announced in the changelog and by email to every active API key.
• Sunset headers on deprecated endpoints: Deprecation: true and Sunset: <date>, so monitoring can catch it even if emails are missed.
• A documented migration path to the replacement before the deprecation clock starts.

The pre-v1 NGX routes under /api/ngxdata/ were superseded by the markets namespace in May 2026 — and they still respond today. That is the policy in practice: supersede, document, keep serving.