History: Canonical API behaviour

Every change to this page, newest first. Expand an entry to see what changed.
2 Oct 2026 · +4 −8 lines
Show changes
⋯
  | Film or episode published or withdrawn, `stream_ready` changed | Catalog: ≤ 30 s | ≤ 60 s |
  | Licence granted, suspended, switched off or past its window | Catalog: ≤ 30 s | ≤ 30 s |
- | Organisation suspended | ≤ 30 s | ≤ 30 s |
- | Key revoked or rotated | ≤ 30 s (creatives: at once) | ≤ 30 s |
+ | Organisation suspended | about 1 s (always ≤ 30 s) | about 1 s (always ≤ 30 s) |
+ | Key revoked or rotated | about 1 s (always ≤ 30 s) | about 1 s (always ≤ 30 s) |
  | Something just created (a key, an episode, a licence) | ≤ 5 s | ≤ 5 s |
  | Subtitle attached or replaced | — | ≤ 5 minutes |
⋯
  | Subtitle languages in `GET /config` | ≤ 5 minutes | — |
  
- > **Rolling out.** A revoked key, or the old secret of a rotated key, is refused within about **1 second** on every Wandura server (always within 30 seconds).
- 
  - **Several servers.** Each Wandura server keeps its own cache, so two calls a few seconds apart can return slightly different snapshots. That is normal.
  - **During a Wandura database incident** the catalog and licence checks are served from the last good answer for up to **5 minutes** (stale-if-error), instead of failing. A change Wandura has already seen (a withdrawal, a suspension) is never undone by this.
⋯
  - `Retry-After` comes with `429` and with retryable `503`s.
  
- > **Rolling out.** Every response carries a `Wandura-Request-Id` header, and every error body a `request_id` field. Quote it to support.
+ - Every response carries a `Wandura-Request-Id` header, and every JSON error body a `request_id` field. Quote it to support.
  
  Every status and code, per endpoint, with what to do: [Errors](../concepts/errors.md).
⋯
  ## Caching headers {#caching-headers}
  
- Creatives and configuration responses carry `Cache-Control: no-store`. Never store any Delivery API response in a shared cache (a CDN or a proxy): tickets, signed links and your catalog belong to your organisation only.
- 
- > **Rolling out.** Every Delivery API response, tickets included, carries `Cache-Control: no-store`.
+ Every Delivery API response, tickets included, carries `Cache-Control: no-store`, and sets no cookies. Never store any of them in a shared cache (a CDN or a proxy): tickets, signed links and your catalog belong to your organisation only.
  
  ## Related {#related}
⋯
2 Oct 2026 · Page created