Docs
Sign in

Release 2026.10-R10

Updated October 27, 20264 min read

Released October 27, 2026.

Rescheduling keeps the schedule in step

When you reschedule a shipment's collection or delivery, its scheduled_date and scheduled_time_slot_id now describe the window you just set. Before, a reschedule could leave the previous date or time slot in place, so the shipment showed a window that no longer matched its schedule.

  • scheduled_date is the local date of the new window, in the country of the pickup or drop-off address.
  • A window chosen from a time slot keeps that slot's ID. A window given as explicit times clears it.
  • A reschedule that changes only the date, with no address in the request, uses the shipment's stored pickup or drop-off country to place the window. If that country can't be placed in a time zone, the stored date is kept.

In the Dashboard: a reschedule request that Carriyo refused now appears on the shipment's Activity timeline as Reschedule Rejected, with the response code. Before, it showed as a reschedule. Open the request in the System Log for the reason. Older entries carry no response code and keep showing as a reschedule.

Via the API: this applies to POST /shipments/{shipment_id}/schedule-collection, POST /shipments/{shipment_id}/schedule-delivery, POST /shipments/{shipment_id}/update-delivery-promise and the deprecated POST /shipments/{shipment_id}/update-collection-schedule.

In the Dashboard: the navigation menu now ends with links to the Fulfillment and Intelligence apps. Each opens in a new tab. If your user has no access to one of them, its link shows a lock, and the tooltip tells you to ask your administrator for access.

Transcorp and Jeebly use their V2 APIs only

The Transcorp and Jeebly connectors now book and track through the carriers' V2 APIs only. Their V1 integrations, including Jeebly's legacy Shipsy platform, are retired.

In the Dashboard: in Settings > Carriers, the Transcorp, Transcorp SA, Transcorp QA and Jeebly account forms no longer have an API Version field. Jeebly's V1-only fields, Customer Code, Service Type and Label Type, are gone.

Existing carrier accounts: an account already set up for V2 loses its leftover V1 settings and keeps working. An account that was never set up for V2 can't book anymore. Carriyo sets it to Inactive and removes its V1 settings. To use it again, enter the V2 settings and activate it. Jeebly needs a V2 URL, API key and client key. Transcorp needs its V2 URL.

Empost status mapping follows the lifecycle code

When an Empost callback carries a LifeCycleCode, Carriyo now maps the shipment's status from that code. A callback without one is mapped from its status text, as before. The status text Delivered - Received by : now maps to delivered.

Document settings responses in snake_case

The responses of GET /document-settings now use snake_case field names, like the rest of the Carriyo API. The fields are tenant_id, document_id, quick_print_enabled, assigned_documents, shipment_type, document_type, entity_type, template_name, uploaded_document and updated_by_user. Before, they were camelCase. Update any integration that reads these fields.

Large order and fulfillment requests no longer blocked

Carriyo's web application firewall returned 403 for requests with a body over 16 KB on several order paths: updating an order; fulfilling, unfulfilling, shipping, splitting or canceling a fulfillment order; updating its partner references; and merging fulfillment orders. These paths are now exempt from the body-size limit, as order creation already was.

API client tokens carry a scope

The POST /oauth/token response, and the access token's scope claim, now carry tenant: followed by your tenant ID. The scope doesn't limit the token: what the API client may do comes from its grants, which Carriyo reads on every request. This reached production on October 23, ahead of the release.

Legacy authorization removed

Users and API clients are authorized by their grants only. The users and API clients APIs no longer return the legacy fields roleByApp, merchants, countries, locations, mcpEnabled and the decoded scopes. Writes no longer accept them either. The merchant-based authorization header and the Fulfillment App seat endpoints are gone. This reached production on October 22, ahead of the release.

Fixes

  • Intelligence for account owners: a user who holds the account's owner role, with no merchant grants of their own, now gets Intelligence reports for every merchant of the account.