Connect, grants and account closing
Three changes to what your integration can rely on, and one fix.
Connect return URLs are registered ones
returnUrl on POST /v1/users/:id/connect must now be exactly one of the return URLs registered for your application, the rule card links already follow. A URL you did not register is not put in the consent link, and the answer carries returnUrlIgnored: true; the person finishes on Layout's page instead of being sent back.
What to do. Register the https URL you pass as returnUrl under Return URLs in the console, and check your connect answers for returnUrlIgnored. A later change will answer 400 invalid_request for an unregistered URL, as card links do.
Build grants read their own orders
With a build grant, order_status and POST /v1/order/placement-status answer only for orders your application built, whether you pass an ord_ id or an order's own id. Any other id answers order_not_found.
What to do. Nothing, if you poll the ids your own builds returned.
Closing an account ends its connections
Closing your developer account now disconnects every OAuth client your applications owned, so their tokens stop refreshing, and retires your console sign-in test accounts. A suspended account cannot be closed from the console; contact Layout.
Return URLs into the Layout app
A return URL may not use the Layout app's own layout scheme. Fixed.
Breaking changes
Yes. An unregistered connect returnUrl no longer sends the person back to it. A build grant that polled an order it did not build now gets order_not_found.