# Layout CLI 0.4.2

October 21, 2026 · Console · Breaking

Version 0.4.2 of the Layout CLI is out. Update with `npm i -g @layoutplatforms/cli`. `layout --version` prints yours.

## What changed

- **`layout webhooks add <https url> [--events <a,b>] [--name <name>]`** adds an endpoint, for every event unless you name some. Layout sends it `endpoint.verification` and turns it on when it answers 2xx. If it does not, the endpoint is added but off, and the command exits 1 with `endpoint_not_verified` and the `subscriptionId` on stderr, or 6 when Layout could not send the verification yet. **`layout webhooks remove <id> --yes`** removes one. Both work while the application is not approved, and are refused with exit code 4 once it is: an endpoint has no environment, so one added to an application under review also receives its live events once it is approved. The console still adds and removes endpoints at any time. A CLI session's capabilities now include `webhooks:sandbox`.
- **`layout webhooks list`** shows the sandbox signing secret as its prefix and last four, such as `whsec_...wxyz`. Add `--show-secret` to print it whole. With `--json`, `signingSecretMasked` says which you got.
- **`--app`** takes an application's id or a name only one application has. A name several applications share exits 2 and lists them; an unknown name exits 5. With `--json`, every error that asks you to pick an application carries `apps`, each with `id`, `name` and `status`. `layout init --app` works the same way.
- **`layout usage`** lists every sandbox allowance and rate `GET /v1/usage` lists, with today's use, and says whether each counts for the application or for your developer account. With `--json`, when `daily` is there it no longer carries the older `sandbox` and `live` blocks.
- **`layout test-order`** also runs `test_place_needs_choices`, `test_place_needs_location`, `test_place_pickup_later` and `test_place_delivery_far`. A `price_changed` refusal is its own step with the old and new totals, and the JSON `order` carries `confirmedTotalMinor`.
- **`layout listen`** says on stderr when Layout cannot start recording for the run, and asks again every 10 seconds; `recordsWithoutEndpoint` is false until it does. Ctrl-C stops it at once.
- A `405` from `layout api` exits with code 2. The update notice is shown on stderr also when no terminal is attached, never with `--json`.

## What to do

If a script reads the signing secret from `layout webhooks list --json`, add `--show-secret`. If a script reads `usage.sandbox` or `usage.live` from `layout usage --json`, read `usage.daily` instead. See [Commands](https://developer.layout.link/reference/cli#commands).

## Breaking changes

- `layout webhooks list` masks the signing secret unless you add `--show-secret`, in `--json` too.
- `layout usage --json` no longer carries the `sandbox` and `live` blocks when `daily` is there.
- A `405` from `layout api` now exits 2, where it was 1.