Skip to main content

Week of October 26, 2026

This week was about trust and visibility. You can rotate an API key without leaving the dashboard, and the Hub now shows the events that didn't land on a member so you can fix them. Event publishing can be retried safely, and you hear about public incidents by email and in the bell. Sign-in and the AI assistant connections also got a round of fixes.

Highlights​

Rotate API keys from the dashboard​

The API keys page now has a rotate action, so you can replace a key without creating a new client by hand. A key's owner can rotate it with the role it already has, and organization admins can assign the Viewer and API Client roles. Learn more

Missing Events in the Hub​

Customers > Missing Events lists the events in an environment that matched no member or failed a rule. Open one to see its stored data, then retry it, retry it against a member you pick, or dismiss it with a note. Every action is logged. If far more events than usual go missing, organization admins get a notification with a link to the page.

Safe retries when you publish events​

POST /events now accepts an Idempotency-Key header, so a retry after a timeout doesn't count the same purchase twice. Send the same key with the same payload and you get the original result back.

curl -X POST "https://api.loomloyalty.com/events?entityType=CUSTOMER&email=jane@example.com" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Idempotency-Key: order-10042" \
  -H "Content-Type: application/json" \
  -d '{"eventTypeCode": "purchase", "description": "Order 10042"}'

Incident notices by email and in the bell​

When we publish an incident on the status page, organization admins get an email and a bell notice at each public update and when it's resolved. Anyone can also sign up for email updates on the status page.

Requesting deletion now ends access​

When an owner requests an organization's deletion, access ends for every member right away. Support handles the data copy and can stop the deletion if you change your mind. To get a whole-organization data export, ask support. Learn more

Also this week​

New​

  • AWS Marketplace sign-up. Buyers who subscribe through AWS Marketplace finish creating their account in the dashboard.
  • Support sign-in. Loom support can sign in to your organization to help you, and the Audit Log marks every action taken in a support session with a headset icon. Learn more
  • Wallet pass refresh. Wallet passes update on a member's device when a coupon is issued, used, cancelled or expires.
  • Feed file upload in the Hub. You can upload a points file to an event feed, see what the run did, and download the rows that failed.
  • More API routes for Weave tools. REST routes now cover the data-model reads that were previously available only to the AI assistant.
  • Agent skills. A new @loom-loyalty/skills package and Claude plugin marketplace bring Loom Loyalty skills to your coding agent. Learn more
  • llms.txt for the docs. The docs site publishes llms.txt, llms-full.txt and a public openapi.json for AI assistants and API tools.
  • Loom Loyalty Rewards. The gift-card partner now appears under the Loom Loyalty Rewards name.
  • Own sign-in for MCP clients. Connecting an AI assistant now signs you in on Loom Loyalty's own sign-in screens. Learn more

Improved​

  • Organization picker. Sign-in groups your environments under each organization, and the CLI sign-in lets you pick an organization and environment.
  • treadle sign-in. A .treadlerc file pins the sign-in organization, treadle logout ends the CLI's session, and treadle plan shows each conflict and its reason. Learn more
  • Connected accounts. The Pipes widget moved to Settings > Connected accounts, and the Slack link command points there.
  • Agreements. The Settings > Agreements screen is tidier. Learn more
  • Icon rail labels. Each section in the Hub and dashboard icon rail has a one-word label under its icon.
  • Hub home. The "Set up Loom Loyalty" checklist sits below Quick Actions.
  • Weave progress. The step thread animates while Weave works, and Weave explains targets better when it creates them. Learn more
  • Deleting a member. The portal and Hub now say what deleting a member removes.
  • Unknown Hub addresses. A weave.host address that no organization owns returns a real 404 page.
  • Admin API. Platform admin routes are no longer in the public OpenAPI spec or the SDK.

Fixed​

  • Environment reads across organizations. GET /organizations/{organizationId}/environments and its by-id and by-code reads only return your own organization's environments.
  • Duplicate portal members. Overlapping first-time sign-ins to the rewards portal end up on one member.
  • Two-step verification. Sign-in asks for your authenticator code on Loom Loyalty's own screens instead of sending you to a hosted page.
  • Password reset and invitations. Reset and invitation emails link to the dashboard.
  • Sign-in timeout. Picking an organization no longer fails with "Your sign-in timed out" for people in many organizations.
  • Sign-in logo and Sign out. The sign-in logo is the right size, and the onboarding Sign out button keeps its label on small screens.
  • Workflow permissions. The Hub and dashboard check environment workflow permissions by their real names, so the right people see the workflow actions.
  • Batch enable. A batch enable with only automatic approval steps no longer waits for a person.
  • Event rule lookups. Reading an event rule defaults to the current time, and rule status is read fresh.
  • Notification text. The bell shows the rendered text of a notice instead of its template.
  • Billing webhooks. Stripe webhooks are processed even when their API version differs from the one we pin.
  • Subscription tiers after a price change. A subscription on a replaced price keeps its tier instead of reading as Free.
  • Assistant tools. Weave's list_environments reads the active organization list, and customer and program updates read the tenant schema correctly.
  • Date filters. Environment enablement list filters are judged in UTC.