Deprecation policy
Nothing you depend on disappears without warning. A field, a parameter, an operation, an MCP tool or an A2A skill that is going away is announced at least 90 days before it stops working. During those 90 days the old and the new behaviour run side by side.
The notice reaches you three ways: a dated entry on the news page, a note in the field or operation description in the OpenAPI contract, and the Deprecation and Sunset response headers (RFC 9745 and RFC 8594) on every answer that touches the deprecated part. Changes that only add something (a new field, a new example, a new optional parameter) are not deprecations and need no notice; every change to date has been of that kind.
A security or legal emergency can shorten the window. If that ever happens, the news entry says why.
Support lifetime
The API carries one product version (today 1.4.0, shared by the OpenAPI document, the MCP server card, the agent card and GET /status). The current major version, 1.x, is supported for at least 12 months after a 2.0 is published, and security fixes are applied to it for the whole of that period. No 2.0 is planned.
The official client libraries (JavaScript smklog, Python smklog-sdk, Go) follow the same rule: the latest minor release of each major version gets security fixes for 12 months after the next major release.
Incident notification
An outage or a wrong answer that affects API users and lasts longer than 15 minutes is posted on the status page within one hour of SMKlog becoming aware of it, and updated until it is resolved.
Within 5 business days of the fix, the same entry gains a short account: what broke, when, what users saw, and what was changed so it does not happen again. A security incident that exposes personal data is also reported by email to every affected customer within 72 hours of confirmation, and to authorities as the law requires.
Exit assistance
You can leave at any time and take your records with you. On a written request to info@smklog.com from the email address on your orders, SMKlog sends, within 10 business days and at no charge, a machine-readable export (JSON and CSV) of everything it holds for you: orders, label and tracking numbers, carrier-adjustment invoices and your account settings. Label PDFs that are still retrievable from the carrier are included.
After the export, and on request, your personal data is deleted except where the law requires a record to be kept (payment and tax records), as the privacy policy states. API access needs no migration: there is no lock-in, no contract term and no fee to stop using the API.
Transparency report
Once a year SMKlog publishes how many requests for user data it received from government agencies and courts, and how it answered them.
| Period | Requests received | Data disclosed | Content removal requests |
|---|---|---|---|
| 1 January to 13 October 2026 | 0 | 0 | 0 |
Requests are answered only when legally valid, and the affected customer is told unless the law forbids it. The next report covers the full year 2026 and is published in January 2027.
Roadmap
What is being worked on next for API users, in no fixed order and without dates:
- Self-service API credentials. Register an OAuth client on the site and get your own rate-limit bucket without writing an email.
- Label status webhooks. A callback when a checkout is paid, a label is bought and a parcel is delivered, so you do not have to poll
getCheckoutStatus. - More destinations. Countries beyond the US, Canada, the UK, Germany and Australia, one at a time as carriers and customs paperwork allow.
Shipped items move to the news page. Suggestions go to info@smklog.com.