What's changed

Every endpoint that takes a PDF — merge, watermark, pages, split, info, form — now accepts `fileUrl` (or `fileUrls` for merge) as well as `file`. The document is usually already somewhere with a URL, and sending it inline meant base64's 33% overhead on the wire, so the old ~11 MB ceiling was really ~8 MB of actual PDF. Fetches are held to the same rules as url→PDF rendering: http(s) only, private and link-local addresses refused, and redirects re-checked at every hop rather than followed blindly.

A webhook URL is often a credential rather than just an address — Slack and Discord both put a token in the path. Delivery failures logged the whole URL, so anyone with access to the logs could post as that integration. Only the host is recorded now. Recipient email addresses are reduced to their domain for the same reason.

Scopes could only be set when a key was created, so narrowing one was a one-way door: widening it again meant minting a new secret, redeploying everything that held the old one, and revoking it. Edit them from the Scopes button on any key in the dashboard. Clearing the selection restores full access.

GET /api/v1/jobs returns your renders newest first, filterable by status and paginated with a cursor. Previously a job id was the only way to reach a render, so losing one — a client that crashed before saving it, a worker that restarted — left the work unreachable. Reading the list doesn't count against your quota.

POST /api/v1/pdf/form fills an AcroForm and returns the PDF. Text, checkbox, radio, dropdown and list fields are supported, and `flatten: true` bakes the values in so they can't be edited back. /api/v1/pdf/info now lists a PDF's fields and their permitted values, so you don't have to guess names.

Plans, overage rates and the answers to the usual billing questions now live at /pricing.

The Content-Security-Policy did not allow framing blob: URLs, so the preview was blank in every browser — Chrome showed a broken-document icon, Safari showed nothing. Both now render, and every result offers an 'open' link regardless.

Rendering a URL to PDF uses Chrome's print stylesheet by default, which is why some sites came back nearly blank. The playground now exposes the toggle, and `emulateMediaType: "screen"` has always been available on the API.

The public playground key is now limited per client — 5 requests a minute and 40 a day — and only works from rendral.com in a browser. It was previously a single shared bucket, so one heavy user could exhaust it for everyone. Account keys are unaffected at 120 requests a minute.

The spec declared OpenAPI 3.1 while using `nullable`, a keyword removed in 3.1. Strict validators rejected the whole document, which broke code generation for anyone using it.

Every endpoint on /reference carries a real request example. Previously the spec supplied none, so the reference generated one from the schema — filling in every field at once, which for /api/v1/pdf meant sending `html`, `url` and `template` together and getting a 400 back. The samples are now copy-and-run.

"Fill a PDF form" imported with an empty body and failed on Send. The collection's examples were maintained separately from the spec and had fallen behind it; they are now generated from the spec, so a new endpoint arrives documented.

The 429 named the free-account rate (120 a minute) but not the demo's own (5 a minute), so it never explained what had actually stopped you.