# Public API v1: stricter datetime inputs and code-point string lengths

Page: https://getbioflow.com/changelog/api-input-validation-zod-4-6

2026-10-24

The validation library behind the public API was upgraded, which changes three things you can observe on /v1. String length limits now count Unicode code points, so a single-code-point emoji counts as one character, not two. ISO datetime request fields must include seconds. The OpenAPI document writes nullable plain string fields as OpenAPI 3.1 type unions. Request bodies that were valid before can now be rejected: a datetime without seconds is refused, and a value near a length limit can land on either side of it. The OpenAPI change is text only.

## Changed

- String length limits (minLength and maxLength) now count Unicode code points rather than UTF-16 code units, matching JSON Schema and Postgres: a single-code-point emoji such as 😀 counts as 1, not 2; skin-tone, flag and ZWJ emoji count one per code point. A value with emoji near a limit can therefore be accepted where it used to be refused (maxLength) or refused where it used to be accepted (minLength).
- ISO datetime request fields now require seconds. POST /v1/pages/{page_id}/publish (starts_at) and POST /v1/webhook-endpoints/{endpoint_id}/replay (since) answer 400 for `2026-10-23T20:00Z`; send `2026-10-23T20:00:00Z`.
- In the OpenAPI 3.1 document, nullable plain string fields are now `type: ["string", "null"]` unions instead of `anyOf`; nullable date-time and integer fields still use `anyOf` with a null branch. The forms are equivalent; only the spec text changes, so regenerate SDK types if you diff the spec.

Back to the changelog: https://getbioflow.com/changelog