// System notice · Transmission 0x01
API v1 is deprecated
The /api/v1 interface of the cyber-punk.online cyberware shop is frozen and will be
permanently shut down on 31 January 2027 at 23:59 UTC.
All integrations — storefronts, clinic booking systems, inventory bots and companion apps — must migrate to
/api/v2 before that date.
until v1 flatlines · 2027-01-31T23:59:59Z
HTTP/1.1 200 OK
Content-Type: application/json
Deprecation: @1792195200 # RFC 9745 — deprecated since 2026-10-17
Sunset: Sun, 31 Jan 2027 23:59:59 GMT # RFC 8594
Link: <https://cyber-punk.online/docs/api/v2/migration>; rel="deprecation"; type="text/html"
Link: <https://cyber-punk.online/api/v2/>; rel="successor-version"
01Deprecation timeline
v1 keeps serving traffic until sunset, but it receives no new features — only critical security patches.
-
17 Oct 2026
Deprecation announced
v1 is frozen.
Deprecation,SunsetandLinkheaders are added to every v1 response. New catalog fields (firmware channels, ICE ratings) are exposed in v2 only. -
01 Dec 2026
No new v1 API keys
The developer dashboard stops issuing v1 keys. Existing keys keep working. New integrations must use v2 OAuth clients.
-
02 Dec 2026 · 14:00–15:00 UTC
Brownout #1 — 1 hour
All v1 endpoints return
410 Gonefor one hour so you can detect hidden dependencies in your stack. -
13 Jan 2027 · 14:00–18:00 UTC
Brownout #2 — 4 hours
Same behaviour, longer window. If anything breaks here, it will break for good on sunset day.
-
31 Jan 2027 · 23:59 UTC
Sunset — v1 flatlines
v1 is permanently shut down. Every request returns
410 Gonewith anapplication/problem+jsonbody pointing to v2. All v1 API keys are revoked.
02Why v2 is better chrome
v2 was rebuilt around how cyberware is actually sold, installed and maintained — not just listed.
OAuth 2.1 + scoped tokens
Short-lived Bearer tokens via client credentials, with granular scopes like catalog:read, orders:write and clinics:book. No more keys in query strings.
Compatibility engine
POST /compatibility/check validates a full implant stack against a client's neural load budget, interface bus and power cell before checkout.
Signed OTA channels
Firmware releases per implant with stable, beta and legacy channels. Every image ships with an Ed25519 signature and SHA-256 checksum.
Webhooks
Stop polling. Subscribe to order.shipped, implant.firmware.released, appointment.confirmed and more, signed with HMAC-SHA256.
Idempotent orders
An Idempotency-Key header on order creation guarantees a retried request never double-charges a client for a second arm.
10× rate limit
600 req/min per token (v1: 60 req/min per IP), burst of 50, with standard RateLimit-* headers and Retry-After on 429.
03Breaking changes
v2 is not a drop-in replacement. These are the changes most likely to break an existing integration.
| Area | v1 (deprecated) | v2 |
|---|---|---|
| Base path | /api/v1/ | /api/v2/ |
| Authentication | ?api_key= / X-API-Key | Authorization: Bearer <token>OAuth 2.1 client credentials, tokens valid 1 h |
| Identifiers | "id": 1042 | "sku": "KSL-OCU-KX7"Integer IDs are gone; SKUs are stable across regions |
| Prices | "price": "2499.00" | {"amount": 249900, "currency": "EUR"}Integer minor units + ISO 4217 code |
| Field naming | product_name | name (camelCase everywhere) |
| Pagination | ?page=3&limit=20 | ?cursor=…&limit=50Read meta.nextCursor; null means last page |
| Errors | 200 {"error": "..."} | Real HTTP status + application/problem+json (RFC 9457) |
| Timestamps | 1760700000 (Unix s) | "2026-10-17T09:30:00Z" (ISO 8601, UTC) |
| Neural load | "neural_load": "18" | "neuralLoad": 18Integer NLI points, 0–100 |
| Order creation | Plain POST | Idempotency-Key header required (UUID v4, kept 24 h) |
04Endpoint mapping
Every v1 endpoint and its v2 replacement. Paths are relative to https://cyber-punk.online.
| v1 | v2 | Notes |
|---|---|---|
GET/api/v1/products | GET/api/v2/implants | Cursor pagination, filter[category]=ocular, filter[bus]=NL-4 |
GET/api/v1/products/{id} | GET/api/v2/implants/{sku} | Adds specs, firmware, compatibleWith |
GET/api/v1/categories | GET/api/v2/implants/categories | Includes typical NLI range per category |
GET/api/v1/compat?ids=1,2 | POST/api/v2/compatibility/check | Neural profile sent in body, returns warnings |
GET/api/v1/firmware/{id} | GET/api/v2/implants/{sku}/firmware | Per-channel releases with signatures |
POST/api/v1/cart/add | POST/api/v2/carts/{cartId}/items | Carts are now server-side resources |
POST/api/v1/checkout | POST/api/v2/orders | Idempotency-Key required |
GET/api/v1/orders/{id} | GET/api/v2/orders/{orderId} | Prefer order.* webhooks over polling |
POST/api/v1/install | POST/api/v2/clinics/{clinicId}/appointments | Scope clinics:book, checks surgery class |
GET/api/v1/user | GET/api/v2/me | Scope profile:read |
| — new — | POST/api/v2/webhooks | Register an HTTPS endpoint + event list |
05Cyberware data model
v2 exposes the full technical profile of every implant in the catalog. Here is what each spec field means.
- neuralLoad · int 0–100
- Neural Load Index (NLI): how much of the nervous system's processing headroom the implant consumes. A standard client has a budget of 100; stacks above 85 trigger a warning, above 100 are rejected.
- interfaceBus · enum
- Neural link bus generation:
NL-3(legacy, flaggedlegacy: true),NL-4(current standard) andNL-5(high-bandwidth, required for full-sensory implants). - powerDrawMw · int
- Continuous draw in milliwatts from the client's subdermal bio-cell. The default power budget is 1,200 mW; the compatibility engine warns under 20% headroom.
- bioRejectionRisk · enum
low·moderate·high. Derived from material biocompatibility and the client's immunosuppressant profile when one is supplied.- surgeryClass · A–D
- A: non-invasive / outpatient. B: minor invasive. C: spinal or cranial. D: full-limb or full-body replacement. Clinics can only book classes they are certified for.
- firmware · object
- Current
version, releasechannelandotaSupportedflag. Images are signed with Ed25519; always verify before flashing. - iceRating · int 1–5
- Security-class implants only. Tier of intrusion countermeasures (ICE) protecting the neural port against unauthorized access.
- compatibleWith · string[]
- Interface buses the implant can run on, with adapters where applicable. Use it to pre-filter catalog results.
Implant categories
| Category | Example SKU | Typical NLI | Power draw | Surgery |
|---|---|---|---|---|
| Ocular | KX-7 Ocular Overlay | 12–22 | 250–400 mW | B |
| Neural | Synaptic Accelerator Mk.III | 25–40 | 500–800 mW | C |
| Dermal | Graphene Subdermal Weave | 5–10 | 0–50 mW | B |
| Limb | Ozu Hydraulic Forearm | 15–30 | 600–1,100 mW | D |
| Interface | NeuroPort NL-5 Jack | 8–12 | ~120 mW | C |
| Security | Aegis ICE-4 Neural Firewall | 6–10 | ~90 mW | B |
{
"id": 1042,
"product_name": "KX-7 Ocular Overlay",
"price": "2499.00",
"neural_load": "18",
"in_stock": 1,
"updated": 1792228200
}
{
"data": {
"sku": "KSL-OCU-KX7",
"name": "KX-7 Ocular Overlay",
"category": "ocular",
"manufacturer": "Kessler Neuroworks",
"price": { "amount": 249900, "currency": "EUR" },
"stock": { "status": "in_stock", "quantity": 14 },
"specs": {
"interfaceBus": "NL-4",
"neuralLoad": 18,
"powerDrawMw": 340,
"bioRejectionRisk": "low",
"surgeryClass": "B",
"firmware": {
"version": "4.2.1",
"channel": "stable",
"otaSupported": true
}
},
"compatibleWith": ["NL-4", "NL-5"],
"updatedAt": "2026-10-17T09:30:00Z"
},
"meta": { "apiVersion": "2.0", "requestId": "req_01JAX9F3K2" }
}
06Migration guide
Four steps cover most integrations. Test with cp_test_ credentials first — test-mode orders never charge and never ship.
1 · Get an access token
curl -X POST https://cyber-punk.online/oauth/token \
-d grant_type=client_credentials \
-d client_id=$CP_CLIENT_ID \
-d client_secret=$CP_CLIENT_SECRET \
-d scope="catalog:read orders:write"
# → { "access_token": "eyJhbGciOi...", "token_type": "Bearer", "expires_in": 3600 }
2 · Replace page-based listing with cursors
const res = await fetch(
`https://cyber-punk.online/api/v1/products?page=2&api_key=${KEY}`
);
const products = await res.json();
// errors came back as 200 { error: "..." }
async function* listImplants(token, category) {
let cursor = null;
do {
const url = new URL("https://cyber-punk.online/api/v2/implants");
url.searchParams.set("limit", "50");
if (category) url.searchParams.set("filter[category]", category);
if (cursor) url.searchParams.set("cursor", cursor);
const res = await fetch(url, {
headers: { Authorization: `Bearer ${token}` }
});
if (!res.ok) throw await res.json(); // RFC 9457 problem+json
const { data, meta } = await res.json();
yield* data;
cursor = meta.nextCursor;
} while (cursor);
}
3 · Check implant compatibility before checkout
curl -X POST https://cyber-punk.online/api/v2/compatibility/check \
-H "Authorization: Bearer $CP_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"neuralProfile": { "interfaceBus": "NL-4", "neuralBudget": 100, "powerBudgetMw": 1200 },
"installed": ["KSL-OCU-KX7"],
"candidates": ["OZU-NEU-SYN3"]
}'
{
"compatible": true,
"totalNeuralLoad": 52,
"totalPowerDrawMw": 1020,
"warnings": [
{
"code": "POWER_HEADROOM_LOW",
"detail": "Power headroom below 20% of budget (180 mW remaining)."
}
]
}
4 · Create orders idempotently & listen to webhooks
curl -X POST https://cyber-punk.online/api/v2/orders \
-H "Authorization: Bearer $CP_TOKEN" \
-H "Idempotency-Key: 6f1c2a9e-3b7d-4c55-9a0e-8d2f41b7c3aa" \
-H "Content-Type: application/json" \
-d '{ "cartId": "cart_8QZ2", "clinicId": "clinic_PAR_03", "compatibilityCheck": true }'
# Webhook deliveries are signed:
# CP-Signature: t=1792195200,sha256=<hex HMAC of "t.body" with your webhook secret>
# Reject deliveries older than 5 minutes to prevent replay.
HTTP/1.1 410 Gone
Content-Type: application/problem+json
{
"type": "https://cyber-punk.online/docs/errors/api-version-sunset",
"title": "API version sunset",
"status": 410,
"detail": "API v1 was shut down on 2027-01-31. Use /api/v2.",
"successor": "https://cyber-punk.online/api/v2/"
}
07Migration checklist
Tick items as you go — progress stays in this browser only.
08FAQ
Will my v1 API key work on v2?
Can the sunset date be extended?
Does v2 change the catalog or prices?
What happens to NL-3 implants?
"legacy": true and an adapterRequired field. The compatibility engine flags them when the client's bus is NL-4 or newer.How do I know if something still calls v1?
Deprecation header in your HTTP client logs, check the "v1 traffic" panel in the developer dashboard, and use the brownout windows as a live test.