api-v1.2.0

[1.2.0] - 2026-06-25

Added

• Public site configuration — Apps can now fetch feature flags and the announcement banner anonymously and cache the result.
• Policy and form rules — Sections with forms can now read the current validation requirements and also verify the form before it's submitted.

Changed

• Email confirmation returns the confirmed address — Verified email address action now returns the same address in the success response, making it easier for the user to check.
• Consistent lockout signal during password reset — The two-factor step during password reset now reports a locked account using the same machine-readable code as sign-in.
• Clearer form errors — Registration now returns structured, de-duplicated field-level error codes, so validation can pinpoint the exact field.

Fixed

• Better name handling — Names now accept curly/iOS apostrophes, nicknames are canonicalized consistently, and the configured name character set is enforced on registration.
• Accurate validation error codes in API docs — The API documentation now describes validation error codes as HTTP 400 instead of 422.