v0.10 in August was the no-code on-ramps release. v0.11 is the operations release. The API had three PDF primitives, inspect, fill and merge, plus an invoice renderer. It now has fourteen PDF endpoints, and every client we ship, the n8n node, the MCP server, the TypeScript SDK and the Python package, carries the same set at the same version of the contract. ## Ten new endpoints Each one takes the multipart shape `/api/fill-form` already uses: a `pdf` file, a few string fields, and a PDF back. The limits are the same too, 4 MB and 2,000 pages per input PDF, and every call counts against the same quota as a fill or a merge. Splitting a packet into two-page parts, from a shell: curl -X POST https://pdfops.dev/api/split \ -F "pdf=@packet.pdf" \ -F "every=2" \ -o parts.json ## fill-form resolves field names forgivingly An exact field name still wins, every time. When no field has the exact name you sent, the key and each field name are compared in a normalized form: Unicode-normalized, lowercased, with only letters and digits kept and array indices like `[0]` removed, against the full name and against its last dotted segment. The field's label, the tooltip a form author typed in Acrobat, is compared the same way. So `F1 01` fills `f1_01`, and `First Name` fills the field whose tooltip says that, whatever its internal name is. Only a unique match resolves. A key that matches two fields is a 422 that lists up to five candidates, and a key that matches none lists up to three similar names. The endpoint still refuses to skip unknown keys silently, because that is how wiring bugs reach a signed document. The full rules are under Field matching. ## Encrypted templates open on their own Most government blanks are owner-locked with an empty user password: anyone can open them, and only edits are restricted. Until October, every one of them came back as `encrypted_pdf` with a pointer to qpdf. Now `fill-form`, `inspect`, `merge` and all ten new endpoints open those files themselves. A PDF with a real user password takes it in the `password` form field, and `unlock` is there when you want the file re-saved without encryption for good. ## The same operations in every client The point of a small API is that each wrapper can carry all of it. As of this week, all four do: from pdfops import PdfOps client = PdfOps() # reads PDFOPS_API_KEY from the environment result = client.split("packet.pdf", every=2) for i, part in enumerate(result.parts): stamped = client.watermark(part.pdf, "COPY", opacity=0.2) open(f"part-{i + 1}.pdf", "wb").write(stamped) print(client.metadata("packet.pdf")["page_count"]) ## Fixed: a long multiline value could stall a fill A multiline text field given tens of kilobytes of text with no line breaks could run past the edge function's time limit and come back as a 504. The cause was in the layout step underneath: for one unbroken paragraph, pdf-lib's line breaking does work that grows with the cube of the word count, so a value that filled a page in a viewer took minutes to lay out on a server. Since 2026-11-08, `fill-form` wraps any line over 300 characters that is wider than its field before the layout runs. The stored value gains newlines at those points; shorter lines, and lines that fit, are stored exactly as sent. The 60 KB value that timed out now returns in about two seconds. ## Also since v0.10 ## Try it Watermark a draft, with no signup. The keyless trial allows 100 calls per IP a month: curl -X POST https://pdfops.dev/api/watermark \ -F "pdf=@contract.pdf" \ -F "text=DRAFT" \ -F "opacity=0.2" \ -o draft.pdf A free key from /docs/signup raises that to 250 calls a month, no card. Every endpoint has a reference page under /docs and a schema in openapi.json. A workflow these fourteen endpoints still do not cover is the most useful thing you can tell us.

Bring SharePoint into your custom apps and agents with Work IQ API New SharePoint tools are coming to the Work IQ API, bringing SharePoint content and

Shopify is making IP allowlisting mandatory for public apps that call its Admin API, adding a security check to limit the use of stolen access tokens. Developers must enable the control by November 20, 2026, at 11:59 PM ET. Apps using bulk operations face an earlier deadline of November 12 at the same time. The change turns a security feature introduced on October 27 into a requirement. Shopify will check where API requests come from, rather than relying on a valid token alone. This addresses the risk covered in Cybersecuritynews.com’s cloud API security guide , where stolen credentials can give attackers access to cloud services. Once allowlisting is active, Shopify checks the source IP of GraphQL Admin API and REST Admin API requests using the app’s tokens. Requests from outside approved addresses or networks receive an HTTP 403 response. Shopify also rejects requests when it cannot confirm the source address. Apps that miss the November 20 deadline face removal from the Shopify App Store and blocked new installations. Existing installations can continue operating until April 1, 2027, when Admin API requests will fail. However, bulk queries and mutations face the earlier November 12 cutoff. Merchants will receive admin warnings from January 15. The policy targets token misuse, a risk illustrated by Cybersecuritynews.com’s report on the Internet Archive’s repeated breach through unrotated API tokens . Network restrictions add protection, but developers still need to secure their credentials. An attacker operating inside an approved network could remain within the permitted boundary. Shopify Mandates IP Allowlisting Shopify’s setup guide supports specific public IP addresses and address ranges for static infrastructure. Apps with changing addresses can approve hosting networks through autonomous system numbers, or ASNs. Developers can list up to 10 ASNs and narrow access to up to 10 countries. These network rules are broader than individual server addresses. Developers configure the control under Settings in the Dev Dashboard and test it against recent traffic before enabling enforcement. Shopify recommends checking whether legitimate requests would be blocked, then confirming an outside request fails. Apps must choose either IP addresses or networks, because saving one type replaces the other. Shopify’s official announcement lists November 12 in its detailed bulk-operation instructions, despite November 11 appearing in its summary. Separately, public apps must migrate to expiring offline tokens by January 1, 2027, adding time limits alongside network restrictions. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Shopify Mandates IP Allowlisting for Public Apps to Prevent Unauthorized Admin API Access appeared first on Cyber Security News .

Introduction: Modern executive operations increasingly leverage autonomous AI agents to maintain productivity, automate lead generation, and sync schedules without human intervention. By deploying background automation using Grok AI, Google Sheets APIs, and Google Calendar integrations, professionals can enforce strict operational boundaries while running heavy computational and research workloads continuously. This article explores the technical setup, security hardening, and operational protocols required to build resilient, automated workflow agents.

Learn how to build a serverless REST API using Amazon API Gateway, AWS Lambda, and DynamoDB. This beginner-friendly guide explains CRUD operations, API integration, database management, security, monitoring, and deployment.

API security protects the data, identities, and business workflows exposed through your applications. Learn risks, controls, costs, and decisions.

To rotate exchange API keys safely without interrupting automated trading operations, generate a new secondary API key pair on your exchange, input the new credentials into your management system, ver

Yesterday I wrote that the client stack did not collapse, it went dark. An agent reads the docs, explores, writes a small SDK for the three operations it nee...

Netlify reports partially degraded service for GitHub API Requests and GitHub Git Operations. The provider is investigating the issue and gives no workaround. No resolution time is available.

Every team I talk to that is wiring an agent up to its APIs asks some version of the same question once the demo works: what is this thing actually going to ...