# Layout

> Layout places real pickup orders at the restaurants Layout orders from, by API or MCP, by driving the
> restaurant's own ordering site. No merchant integration, and the person ordering never installs
> anything. REST and MCP are two doors to the same ordering: connect or provision a person, build a
> cart, and the person approves every charge.

Base URL: https://api.layout.link/v1 — bearer auth, JSON. MCP: https://mcp.layout.link (OAuth, PKCE).
Pickup only today: delivery isn't available on Layout's developer platform yet. Read fulfillment.type on the cart and the order rather than assuming it.
Every page below is also available as Markdown at the same path with .md appended.
A coding agent integrating Layout starts at https://docs.layout.link/reference/coding-agents.md.

## Docs

- [Layout for Developers](https://docs.layout.link/index.md): Layout API and MCP documentation.
- [How Layout works](https://docs.layout.link/how-it-works.md): One order end to end, the credentials, how REST and MCP map, and when a confirm needs a code.
- [Quickstart](https://docs.layout.link/quickstart.md): Your first sandbox order over REST, end to end, in about five minutes. No order you confirm here reaches a restaurant or charges anyone. New to Layout? How Layout works shows the whole lifecycle on one page.
- [Provisioning users](https://docs.layout.link/provisioning.md): Someone you can order for. You vouch for a name and a phone number; they prove the phone by reading back the code Layout texts them, and that makes their Layout account.
- [Card links](https://docs.layout.link/card-links.md): A short Layout link where a person you provisioned adds a card, with no Layout sign-in, and then goes straight back to your app.
- [Carts](https://docs.layout.link/carts.md): Build a real cart at a restaurant, show the person its total, and confirm it, over REST. A cart is built and unpaid. An order is confirmed. Layout never charges without the person's confirm.
- [Webhooks](https://docs.layout.link/webhooks.md): Layout POSTs a signed event when an order you initiated changes state. Delivery is fire-and-forget with retry, and never delays or alters an order.
- [Texts Layout sends](https://docs.layout.link/texts.md): Every text Layout sends a person on behalf of your application, word for word, when it goes out and whether you can turn it off.
- [Ordering over MCP](https://docs.layout.link/mcp.md): MCP is one of two doors to the same ordering; REST carts is the other, with the same checks behind both. Mint a build session for a provisioned user, point an MCP client at our server, and drive the order tool. The session builds and reads a cart, and confirms it once the person says yes, with the 6-digit code Layout texts them when a code is due. In sandbox a cart is built from the restaurant's menu as Layout holds it, with no browser, and the confirm is always simulated; it takes no code unless the cart was built to ask for one. A person with their own Layout account can instead connect through an OAuth client you created, and confirm from your app.
- [Sign in with Layout](https://docs.layout.link/sign-in-with-layout.md): One button that signs a person in with their Layout account and lets your app place orders for them, paid with the card they keep in Layout.
- [Environments and approval](https://docs.layout.link/environments.md): Sandbox works the minute you create an application. Production needs a human yes from us, and while you wait nothing about your sandbox changes.
- [Sandbox](https://docs.layout.link/sandbox.md): In sandbox, a cart at a real restaurant is built from that restaurant's menu as Layout holds it. No browser opens, nothing is charged, no restaurant receives anything, and the order reaches whichever ending you ask for, so you can test every path your integration handles.
- [Authentication](https://docs.layout.link/authentication.md): Every request carries one bearer token, and there are four kinds: your application secret, a build grant, a person's OAuth access token and a CLI token. Which one you send decides who the call acts for. What each one opens is in The credentials.
- [Layout CLI](https://docs.layout.link/cli.md): The Layout CLI signs in to your developer account. In sandbox it does the whole build: create an application and a key, call any endpoint, forward webhook events to your machine, fire test events, and run a whole test order. In production it reads: live events, deliveries and key details. It never changes an approved application's production settings, and never moves money. Every command takes --json, so a coding agent can drive it.
- [Coding agents](https://docs.layout.link/coding-agents.md): A coding agent can integrate Layout into your product and prove it against sandbox on its own. A person does the first step, because only a person can create the developer account.
- [API reference](https://docs.layout.link/api.md): Users, places, menus, menu item photos, orders, events and the readiness check. Carts have their own page. Base URL https://api.layout.link/v1, bearer auth on every call, JSON in and out. The machine-readable contract is openapi.json, generated from the shapes the API validates with.
- [MCP tools](https://docs.layout.link/mcp-tools.md): Every tool the Layout MCP server publishes, with the JSON Schema of its input and its output, read off the server's own registry. The same contract is machine-readable at mcp-tools.json.
- [Event types](https://docs.layout.link/events.md): The full catalog of webhook events. The vocabulary carries the truth: order.unconfirmed is first-class, and must never be collapsed into order.failed.
- [Errors & status](https://docs.layout.link/errors.md): Layout never claims an order is placed without evidence, and a confident false failure is just as dangerous. Handle the uncertain state deliberately.
- [Rate limits and idempotency](https://docs.layout.link/limits.md): Every ceiling that can refuse you, when to come back after a 429, and the key that stops a retry from running twice.
- [Versioning](https://docs.layout.link/versioning.md): How the API names its versions, what can change without one, and how much notice you get before anything you rely on stops working.
- [Fees and Layout One](https://docs.layout.link/fees.md): This is Layout's fee schedule, the one the Terms and Conditions incorporate by reference. It is effective October 21, 2026.

## Changelog

Entries are history: a later entry can change what an earlier one says. Where an entry disagrees with a page above, the page is current.

- [Order notifications](https://docs.layout.link/changelog/order-notifications.md): 2026-10-26, Console. The Order texts setting is now Order notifications. Turned off, it also stops Layout's placed push notification and the Live Activity in the Layout app for orders your application starts.
- [Connect, grants and account closing](https://docs.layout.link/changelog/connect-grants-and-account-closing.md): 2026-10-25, API, breaking. A connect return URL must be one you registered, a build grant reads only its own orders, and closing an account ends its connections.
- [Layout CLI 0.5.0](https://docs.layout.link/changelog/layout-cli-0-5-0.md): 2026-10-25, Console. CLI 0.5.0 adds layout check, which grades your integration from its last day of sandbox and tests your webhook handler, and runs test-order at real restaurants with any ending.
- [Logo changes go to review](https://docs.layout.link/changelog/logo-changes-go-to-review.md): 2026-10-25, Console, breaking. Uploading or removing the logo of an approved application now returns it to review, as renaming one already does.
- [Sandbox carts at real restaurants](https://docs.layout.link/changelog/sandbox-carts-at-real-restaurants.md): 2026-10-25, Sandbox, breaking. A sandbox cart at a real restaurant is built from the menu Layout holds, with no browser, and reaches the ending you send as simulate. Sandbox places and menus cover only restaurants whose menu Layout holds.
- [Card links replace any card](https://docs.layout.link/changelog/card-links-replace-any-card.md): 2026-10-24, API. On a full Layout account, a card link now lets the person replace any card on it, named on the page before they type, instead of ending on "No room for another card".
- [Preselected choices on menus](https://docs.layout.link/changelog/preselected-choices.md): 2026-10-24, API. An item the restaurant serves already built now comes back that way, and orders no longer ask the person to pick what it already comes with.
- [Choices on usual menus](https://docs.layout.link/changelog/choices-on-usual-menus.md): 2026-10-23, API. A usual menu, scope "chain", now carries each item's optionGroups on POST /v1/menus and the MCP menu tool, with no price on any option.
- [Usual menus answer first](https://docs.layout.link/changelog/usual-menus-answer-first.md): 2026-10-23, API. For a location Layout has not read yet, POST /v1/menus and the MCP menu tool now answer at once with the restaurant's usual menu, scope "chain", instead of starting a read.
- [Card status and picked places](https://docs.layout.link/changelog/card-status-and-picked-places.md): 2026-10-22, API, breaking. GET /v1/users/{userId} and verify now say whether a person has a card Layout can order with. GET /v1/places takes several names, the ids of places you picked, include=closed and ordering=confirmed.
- [Choose what a webhook receives](https://docs.layout.link/changelog/choose-what-a-webhook-receives.md): 2026-10-22, Webhooks. A webhook subscription can receive sandbox events, production events or both. Events wait as held while an endpoint is unverified, and Layout checks it again on its own.
- [Layout CLI 0.4.3](https://docs.layout.link/changelog/layout-cli-0-4-3.md): 2026-10-22, Console. CLI 0.4.3 adds layout webhooks verify and layout refusals, an --environment flag on webhooks add, and reads of production keys and endpoints without login --live.
- [Card links for every app](https://docs.layout.link/changelog/card-links-for-every-app.md): 2026-10-21, API, breaking. POST /v1/users/:id/links mints a single-use, 15-minute Layout page where a person you provisioned adds a card without signing in. card_required for that person no longer carries a url.
- [Disconnect a person with DELETE](https://docs.layout.link/changelog/disconnect-a-person.md): 2026-10-21, API. DELETE /v1/users/:id ends your application's link to a person, for every application. Their grants stop at once and their standing agreement ends; their Layout account is never deleted.
- [Layout CLI 0.4.2](https://docs.layout.link/changelog/layout-cli-0-4-2.md): 2026-10-21, Console, breaking. CLI 0.4.2 adds layout webhooks add and remove, masks the sandbox signing secret, takes --app by name, shows every sandbox allowance in layout usage, and runs every test restaurant in layout test-order.
- [MCP builds match REST](https://docs.layout.link/changelog/mcp-builds-match-rest.md): 2026-10-21, MCP, breaking. Build sessions check store names as REST does, answer store_not_found, cancel a cart while it builds, take ord_ ids on every action, read carted and expired carts plainly, and answer grant_expired.
- [No per-person code setting](https://docs.layout.link/changelog/no-per-person-code-setting.md): 2026-10-21, API, breaking. People can no longer ask Layout for a code on every order, so codeReason no longer has person_setting. The sandbox's test_place_code now reads risk_check.
- [Request production in the console](https://docs.layout.link/changelog/request-production-in-the-console.md): 2026-10-21, Console, breaking. Production is now requested from a full-screen form in the console that also writes your listing in the Layout connector marketplace. layout request-live-access answers with the console link instead of filing a request.
- [Verifying makes the Layout account](https://docs.layout.link/changelog/verifying-makes-the-account.md): 2026-10-21, API, breaking. A good verify code now makes the person's own Layout account, for every application. Nobody is sent to a sign-up page, and confirms answer verify_required, not sign_up_required or link_expired.
- [One total on MCP carts](https://docs.layout.link/changelog/one-total-on-mcp-carts.md): 2026-10-20, MCP, breaking. A build session's carted build now carries the total the person pays, Layout's service fee included, and its confirm must send that total. Build sessions also order pickup only, and order_status says more.
- [Week of October 19](https://docs.layout.link/changelog/week-of-october-19.md): 2026-10-20, API, breaking. wrong_credential, grant_expired, CART_EXPIRED on expired carts, stricter store names, provisioned_to_another_app, a real wait on every short 429, the standard 404, pickup details on order.updated, and stricter checks.
- [A location's usual menu](https://docs.layout.link/changelog/a-locations-usual-menu.md): 2026-10-14, API. When a location's own menu cannot be read, POST /v1/menus and the MCP menu tool can answer with the restaurant's usual menu, marked with the new scope field and never priced.
- [Kept menus on /v1/menus](https://docs.layout.link/changelog/kept-menus-on-menus.md): 2026-10-14, API. POST /v1/menus now answers at once from a whole menu Layout read recently, with a new readAt field, and pricesUnavailable is true whenever the site gave no prices.
- [Pickup details in several waves](https://docs.layout.link/changelog/pickup-details-in-waves.md): 2026-10-14, Webhooks. order.updated can now arrive more than once per order, one for each wave of pickup details, each with its own event_id. The pickup time often comes last; the sandbox restaurant test_place_pickup_later tests it.
- [Turn off order texts](https://docs.layout.link/changelog/turn-off-order-texts.md): 2026-10-14, Console. A new Order texts setting on App details stops Layout's text that an order is placed, and the later text with the pickup time, for orders your application starts.
- [Your brand on card pages](https://docs.layout.link/changelog/your-brand-on-card-pages.md): 2026-10-14, API. The page where a person you provisioned adds a card now shows your application's name and console logo, and tells them to go back to your application once the card is saved.
- [A guide for coding agents](https://docs.layout.link/changelog/a-guide-for-coding-agents.md): 2026-10-12, Docs. A new page tells a coding agent how to integrate Layout in sandbox and what a person does first. The quickstart, going to production and the CLI page were corrected where an agent would go wrong.
- [Stopped builds read as canceled](https://docs.layout.link/changelog/stopped-builds-and-flavour-names.md): 2026-10-11, MCP. A stopped build's status now answers canceled right away instead of "still building".
- [Confirm with the cart's total](https://docs.layout.link/changelog/confirm-with-the-carts-total.md): 2026-10-10, API, breaking. POST /v1/carts/:id/confirm now refuses the restaurant's total alone with 400 invalid_request when Layout's fee applies. Send the cart's totalMinor, as the docs have always said.
- [Docs corrections](https://docs.layout.link/changelog/docs-corrections.md): 2026-10-10, Docs. The reference pages were corrected where they were wrong, stale or missing. A few corrections change what an integration should do; they are listed first.
- [Pickup details on orders](https://docs.layout.link/changelog/pickup-details-on-the-order.md): 2026-10-10, API. The order read now carries the pickup name, store order number, instructions, lines and charged total. Carts say why a code is needed, and order.updated follows late pickup details.
- [Places lists open places only](https://docs.layout.link/changelog/places-lists-open-places-only.md): 2026-10-10, API, breaking. GET /v1/places now lists only places open right now. The openNow parameter and the notOpenNow field are gone; a request that still sends openNow is answered, never refused.
- [Confirmed carts stay confirmed](https://docs.layout.link/changelog/confirmed-carts-stay-confirmed.md): 2026-10-09, MCP. A cart whose order is being placed now answers with that order's placement status instead of cart_expired, and a new build at the same store waits until the paying order lands.
- [Finding the nearest store](https://docs.layout.link/changelog/finding-the-nearest-store.md): 2026-10-09, Docs. The docs now say which location to send so Layout offers the store closest to the person: device coordinates first, an address turned into coordinates next, a city name last.
- [CI tokens for the CLI](https://docs.layout.link/changelog/ci-tokens-for-the-cli.md): 2026-10-05, Console. Create a CLI token in the console and set LAYOUT_CLI_TOKEN to run the CLI in CI or from a coding agent with no login. layout init sets an app up in one step, and layout listen needs no webhook endpoint.
- [Sign in with Layout](https://docs.layout.link/changelog/sign-in-with-layout.md): 2026-10-05, API, breaking. A Layout button and guide for signing people in, hosted or on your own screens. Returning people skip a second approval, login_hint prefills the phone, and headless verify texts someone already connected.
- [Pickup time on orders](https://docs.layout.link/changelog/pickup-time-on-orders.md): 2026-10-04, API. GET /v1/orders/:id now carries ready_eta, the pickup time in the store's own words, once an order is placed.
- [CLI production reads](https://docs.layout.link/changelog/cli-production-reads-and-api.md): 2026-10-03, Console. layout login --live adds 12 hours of production reads, layout api calls any REST endpoint with your key, and LAYOUT_SECRET_KEY runs api and test-order in CI without signing in.
- [Connecting is agreeing](https://docs.layout.link/changelog/connecting-is-agreeing.md): 2026-10-03, API. When a person connects your application, Layout now tells them it can place orders for them, and that connection is their agreement. A build grant's first order no longer needs a code of its own.
- [Carts confirmed elsewhere](https://docs.layout.link/changelog/already-confirmed.md): 2026-10-02, API. A confirm on a cart the person already confirmed, by replying YES to Layout's text or in the Layout app, now answers 409 already_confirmed with the order and its real state, over REST and MCP.
- [Cancel while building](https://docs.layout.link/changelog/cancel-while-building.md): 2026-10-02, API. A cancel on a building cart is now accepted as canceling and sends no cart-ready text. A placeId and restaurantName that disagree answer store_mismatch. Store addresses ride everywhere.
- [Codes on first orders](https://docs.layout.link/changelog/codes-on-first-orders.md): 2026-10-02, API. A build grant needs the person's code until they approve an order through your application with it, then only when Layout would ask for one anywhere else. A build_only refusal now names the missing step in error.next.
- [Grants read their own orders](https://docs.layout.link/changelog/grants-read-their-orders.md): 2026-10-02, API. A build grant can read the orders its application built for that person, whoami lists each scope once, and a fired test webhook names the sandbox order it described.
- [The Layout CLI](https://docs.layout.link/changelog/layout-cli.md): 2026-10-02, Console. A command line tool that signs in to your developer account and works in sandbox. Create an app and a sandbox key, forward webhooks to your machine and run a test order, by hand or from a coding agent.
- [Self-serve sign-in test accounts](https://docs.layout.link/changelog/sign-in-test-accounts.md): 2026-10-02, Console. Create a sandbox account that signs in on Layout's consent screen, so you can test your OAuth client end to end with simulated orders. No email to Layout, no real order, no card.
- [Texts grow with your users](https://docs.layout.link/changelog/texts-grow-with-your-users.md): 2026-10-02, API, breaking. Your hourly and daily room for verification and approval texts now grows with the people you have verified, Layout's shared hourly ceiling is 2,000, and GET /v1/usage shows your number and where it grows next.
- [API versions and request ids](https://docs.layout.link/changelog/api-versions-and-request-ids.md): 2026-10-01, API. Every REST endpoint's answer names the dated API version that answered and carries an X-Request-Id. Pin a version with the Layout-Version header. The versioning policy gives at least 180 days' notice.
- [Clearer previews and menu retries](https://docs.layout.link/changelog/clearer-previews-and-menu-retries.md): 2026-10-01, MCP. Order previews now carry a single outcome field, a lone branch on the street someone named resolves without a question, and a menu read refused as too soon says when to try again.
- [Clearer sandbox build limits](https://docs.layout.link/changelog/clearer-sandbox-build-limits.md): 2026-10-01, Sandbox. Your developer account can run 250 sandbox builds a day across all its apps, on a counter of its own. Every sandbox refusal now names the limit that stopped it and how to get past it.
- [Confirm with the person's code](https://docs.layout.link/changelog/confirm-with-the-persons-code.md): 2026-10-01, API. A build grant can now confirm a live order. Layout texts the person a code that names the total, the store and the card, they give it to you, and you send it on the same confirm. Over REST and MCP.
- [Daily limits you can read](https://docs.layout.link/changelog/daily-limits-you-can-read.md): 2026-10-01, API. A refusal by a daily ceiling now names the ceiling in error.limit, with its scope, number and reset time. The MCP order tool returns the same as refusal.
- [Docs that match the API](https://docs.layout.link/changelog/docs-that-match-the-api.md): 2026-10-01, Docs. The docs now tell one story for REST and MCP, list every error code and failure code, describe the webhook payload exactly, and publish every MCP tool's input and output schema.
- [Endpoint verification and secret rotation](https://docs.layout.link/changelog/endpoint-verification-and-rotation.md): 2026-10-01, Webhooks. A new webhook endpoint now turns on once it answers a signed verification event with a 2xx, and you can rotate a signing secret with 24 hours in which both the old and new secrets sign every delivery.
- [Event ids on every webhook](https://docs.layout.link/changelog/event-ids-on-every-webhook.md): 2026-10-01, Webhooks. Webhook payloads carry a stable event_id, an occurred_at time and, on order.failed, a failure_code. GET /v1/events resumes from an event id and filters by order, person, type and time.
- [Finish an order in sandbox](https://docs.layout.link/changelog/finish-an-order-in-sandbox.md): 2026-10-01, Sandbox. A sandbox build can now be confirmed. The confirm is simulated, so no restaurant receives it and nothing is charged, and your webhooks and order reads say so with simulated set to true.
- [Introducing the changelog](https://docs.layout.link/changelog/introducing-the-changelog.md): 2026-10-01, Docs. Changes that affect your integration get an entry here, published once they are live, with an Atom feed and Markdown for agents.
- [Introducing the Images API](https://docs.layout.link/changelog/introducing-the-images-api.md): 2026-10-01, API. Show what a menu item looks like, from the photo the restaurant itself published. POST /v1/images/items finds one item's photo, and every /v1/menus item Layout already holds a photo for now carries it.
- [Introducing the REST API](https://docs.layout.link/changelog/introducing-the-rest-api.md): 2026-10-01, API. The MCP's ordering tools are now REST endpoints. Find a place, read its menu, build a cart, confirm it, and read the order, with the same two ways in as MCP.
- [Limits built for a launch](https://docs.layout.link/changelog/limits-built-for-launch.md): 2026-10-01, API. Production limits on provisioning, build sessions, texts and requests are much higher, one calling address no longer caps a busy backend, build grants refresh, and GET /v1/usage shows every limit and your usage.
- [OAuth clients for your app](https://docs.layout.link/changelog/oauth-clients-for-your-app.md): 2026-10-01, Console. Create OAuth clients for an app where people sign in with their own Layout account. The orders they place through your client reach your webhooks, the events feed and GET /v1/orders/:id.
- [Places and menus over REST](https://docs.layout.link/changelog/places-and-menus-over-rest.md): 2026-10-01, API. Search places, read one place, and read a live menu over REST for a person you are connected to, with the same answers the MCP tools give. The OpenAPI spec is now generated from the shapes the API validates with.
- [Retired route names carts](https://docs.layout.link/changelog/retired-route-names-carts.md): 2026-10-01, API, breaking. POST /v1/orders still answers 410, now with the code use_carts and a message that points to POST /v1/carts. It used to send moved_to_mcp.
- [Retry any POST safely](https://docs.layout.link/changelog/retry-any-post-safely.md): 2026-10-01, API. Every REST POST now takes an Idempotency-Key header. A retry with the same key and body gets the stored response for 24 hours and never runs twice.
- [Revocation and one consent](https://docs.layout.link/changelog/revocation-and-one-consent.md): 2026-10-01, API, breaking. Revoke a person's connection with RFC 7009, ask for the REST API and MCP in one authorization, and read a real WWW-Authenticate on a refused person credential. A disconnect now stops MCP tokens on the next request too.
- [Safer codes, fairer limits](https://docs.layout.link/changelog/safer-codes-fairer-limits.md): 2026-10-01, API, breaking. The codes Layout texts a person now only verify a number or approve one order. A production headless verify connects your application and nothing else, and sandbox and unapproved traffic draws on limits of its own.
- [Sandbox test restaurants](https://docs.layout.link/changelog/sandbox-test-restaurants.md): 2026-10-01, Sandbox. Sandbox test restaurants script one outcome each, from a ready cart to a declined or unconfirmed order, and never reach a real restaurant. A new endpoint fires a signed test webhook at your sandbox endpoints.
- [Turn off cart-ready texts](https://docs.layout.link/changelog/turn-off-cart-ready-texts.md): 2026-10-01, Console. When nobody confirms a ready cart, Layout texts it to the person so they can reply YES. If your own chat carries the confirm, you can now turn those texts off for your application.
- [Week of September 28](https://docs.layout.link/changelog/week-of-september-28.md): 2026-10-01, MCP. The order.challenge webhook is now sent, MCP results carry the ord_ id your REST calls use, and the MCP reference now says how long build waits.
- [Card-free sandbox builds](https://docs.layout.link/changelog/card-free-sandbox-builds.md): 2026-09-22, Sandbox. Sandbox builds never ask for a card. Each application has its own daily sandbox allowance, and a new Usage page shows what you have used and lets you ask for more.
- [Orders in the console](https://docs.layout.link/changelog/orders-in-the-console.md): 2026-09-21, Console. A new Orders page lists every order your keys caused in the selected environment, with the outcome in words and the reason when one did not complete.
- [Week of September 14](https://docs.layout.link/changelog/week-of-september-14.md): 2026-09-15, Console. A disconnected person can be invited again, sandbox answers next: "connect" where production would text an approval link, and order.needs_approval and order.challenge are marked as not sent yet.
- [A signing secret per environment](https://docs.layout.link/changelog/a-signing-secret-per-environment.md): 2026-09-13, Webhooks, breaking. Sandbox and production deliveries are now signed with different secrets, and every delivery says which environment it came from. Production verification needs the new production secret.
- [Check readiness with whoami](https://docs.layout.link/changelog/check-readiness-with-whoami.md): 2026-09-13, API. GET /v1/whoami says which application and environment a key opens and whether production is approved, so going live is a check instead of a 403.
- [Connections that last](https://docs.layout.link/changelog/connections-that-last.md): 2026-09-13, API. A person's connection to your app now survives them signing in to Layout. People who already have Layout can connect by approving you, and Layout texts them the approval link itself.
- [Headless phone verification](https://docs.layout.link/changelog/headless-phone-verification.md): 2026-09-13, API. Two new calls let a provisioned person prove their phone without opening a Layout page. Layout texts them a code, they read it to you, and you pass it back.
- [Ordering moves to MCP](https://docs.layout.link/changelog/ordering-moves-to-mcp.md): 2026-09-13, MCP, breaking. POST /v1/orders is retired and answers 410. Carts are built over MCP with a build grant, and a build grant session now lists only the three tools it can use.
- [Builds before a card](https://docs.layout.link/changelog/builds-before-a-card.md): 2026-09-12, API. Someone you just provisioned can see a real, priced cart before they have a card on file, up to a daily allowance set for your application. When a card is needed, Layout's card page names your app.
- [Docs for people and agents](https://docs.layout.link/changelog/docs-for-people-and-agents.md): 2026-09-12, Docs. Search that reads every page, an endpoint reference, three new guides, and the whole reference as llms.txt, Markdown twins and an OpenAPI 3.1 file.
- [Keys you can read again](https://docs.layout.link/changelog/keys-you-can-read-again.md): 2026-09-12, Console. Client secrets can be revealed on demand instead of once at creation, the console says what your approval status allows, logos upload as files, and application ids take a new form.
- [Send a test webhook](https://docs.layout.link/changelog/send-a-test-webhook.md): 2026-09-12, Webhooks. Send test event fires a real, signed delivery at your endpoint, so you can prove the whole path before a single order exists.
- [Why a key was refused](https://docs.layout.link/changelog/why-a-key-was-refused.md): 2026-09-12, Console. The API still answers every refused key with the same sentence. Your console now shows the real reason, which key it was, how many times, and when it last happened.
- [Layout for Developers opens](https://docs.layout.link/changelog/developer-platform-opens.md): 2026-09-11, API. Sign up, create an application and build against sandbox the same day. Provision a person, build a real cart for them, and follow every order on signed webhooks.
- [Your logo on consent](https://docs.layout.link/changelog/your-logo-on-consent.md): 2026-09-04, MCP. When a person connects an MCP client to Layout through OAuth, the consent screen shows that client's logo beside the Layout mark, drawn from the host its redirect URI points at.

## Optional

- [OpenAPI 3.1 specification](https://docs.layout.link/openapi.json): the REST endpoints in this reference, generated from the shapes the API validates with.
- [MCP tool contract](https://docs.layout.link/mcp-tools.json): every MCP tool's input and output JSON Schema, and what each session may call, read off the server's registry.
- [Full documentation as one file](https://docs.layout.link/llms-full.txt): every page above, concatenated.
- [Changelog feed](https://docs.layout.link/changelog/feed.xml): every change above as Atom, newest first.