API v4 Release Notes — August 5, 2026

New

• Alarm.com provisioning — provision Alarm.com service directly from the API with new actions on customers: discover your dealer's packages (adc_packages, with camera-only filtering), create the Alarm.com customer or commitment, activate a commitment, and change service plans. Customer app credentials are returned once in the create response. Duplicate provisioning is blocked so a customer can't end up with two Alarm.com accounts.
• Guardian Protection Services provisioning — new guardian_options, guardian_save_account, and guardian_resync actions on customers for creating and syncing Guardian monitoring accounts.
• ADT order lifecycle — eight new actions on customers cover the full ADT ordering flow: precheck a customer, fetch options and order data, save and submit an order, check order status, and cancel an order.
• Integration reference pages — the API docs now include a dedicated reference page per integration (Alarm.com, Guardian, ADT) documenting each action's request and response.
• Credit checks — run a live credit pull via the new run action on customer_credit_checks (all bureau types, with the same per-bureau options as the app), or record a manually obtained score via record. Reads support customer, bureau, and date filters, and credit checks are available as an include on customers. A same-customer, same-bureau pull within 24 hours is rejected as a duplicate unless you explicitly override with force: true.
• Credit bureau catalog — new read-only credit_bureaus resource so you can discover the tenant's configured bureaus before running a check.
• File uploads — attach files to customers and leads via the new object_files resource: POST the file bytes base64-encoded to upload (up to 20 MB), GET to read file metadata. Renaming, deleting, and downloading remain on v1 for now.
• Inline invoice line items — POST /customer_invoices now accepts line items embedded in the create request, so an invoice and its lines can be created in one call. The write is all-or-nothing: if any line fails, nothing is saved.

Improved

• Single-call customer imports — POST /customers now accepts monitoring account numbers (account_num, secondary_account_num, ADT identifiers), install fields (is_installed, install appointment, service flags), confirmation number, receiver number, abort code, and beacon score. Previously these were update-only, forcing a create-then-update round trip when importing already-installed customers.
• Company-wide user reads — GET /users and user_rep_numbers reads now return all users in the company (matching the app and earlier API versions) instead of only users sharing a location with the caller.
• Company-wide user management — user edits, rep-number changes, and user deletion now follow the same company-wide permissions as the app. Deletion requires the User delete permission.

Fixed

• Monitoring account numbers rejected on write — account_num, secondary_account_num, and the ADT identifier fields on customers could not be created or updated by regular API users even with full customer permissions. They now accept writes with the standard customer create/modify permission.