Release 2026.06-R3

Released July 1, 2026.

MCP access per user

Admins can turn on MCP access for individual users. Go to Settings > Administration > Users, open a user, and turn on AI Agent (MCP) Access. Your subscription sets how many users can have MCP access.

An agent acts as the user and can only do what the user's role allows. The authorization page an agent opens now shows who you are signed in as, and has a Decline button.

Email address typo correction

Carriyo now corrects obvious typos in email domains, such as .con or .comm for .com, and gmial.com or hotmial.com for gmail.com and hotmail.com. It corrects only domains that are clearly wrong and leaves real country domains such as .co and .cm alone.

• Shipments: applies to the pickup and drop-off contact_email when you create or update a shipment. When Carriyo changes an address, the shipment keeps the original in input_contact_email on pickup or dropoff.
• Locations: applies to the contact email when you create or update a location.

DHL Express estimated delivery date at booking

Carriyo already records the carrier's estimated delivery date from DHL Express tracking updates. It now also asks DHL Express for an estimate when it books a shipment, and stores it in post_shipping_info.carrier_estimated_delivery_date as soon as the booking succeeds.

DHL Express sends the estimate as a local time without a timezone. Carriyo now reads it in the destination country's timezone, for booking and for tracking updates. Before, tracking estimates were read as UTC.

Webhook authentication

Some webhooks use OAuth 2.0 authentication. For these, Carriyo now fetches a new access token when you change the authentication settings, such as the client secret. Before, it kept using the cached token until that token expired, and webhook calls could fail with 401 errors.

• Carriyo refreshes cached tokens 5 minutes before they expire.
• When your endpoint responds with 401, Carriyo discards the cached token and gets a new one on the next attempt.
• The token request now appears in the shipment's system logs as Webhook Authentication, with the webhook's name as the source.

Aramex status updates

These Aramex codes now map to the suspended status in place of failed_collection_attempt:

• SH162-D11, On Hold - Awaiting Correct Delivery Address
• SH162-D13, On Hold - Pending Missing Documents prior to Shipping
• SH162-D18, Delay - Shipment is Overweight/Oversize - Awaiting Shipper Instructions

SH163-D14, a documentation problem on customs value confirmation, now gives the reason incorrect_merchant_documentation in place of awaiting_merchant_confirmation.

Fixes

• Large orders: Carriyo no longer blocks POST /orders requests of 16 KB or more with a 403 error. Large Shopify orders with many line items failed to reach Carriyo because of this.
• Booked shipments: the Edit Attributes action is back on the shipment page and in the shipment list. Use it to edit custom attributes after booking.
• Shipment import: files with custom attribute values no longer fail with a JSON parse error. Saving custom attributes on a booked shipment is fixed too.
• Create shipment: choosing a saved location for the pickup or drop-off now fills in its full address and contact details.
• Item picker: when several products share a SKU, the item picker on the order and shipment forms keeps the product you chose.
• Shopify: shipments created from Shopify orders now carry the product reference (product_ref) on each item.
• AI estimated delivery date: the shipment page now shows the AI estimate Carriyo records at booking. It no longer fails to load for some users.