---
agentTools:
  projectIndex: https://docs.delivr.ai/llms.txt
---

# API Updates - May 2026

## Distinct profile count on audience responses

Audience responses now include a `distinct_profile_count` field, reporting the number of unique resolved profiles. This is separate from the raw record count, which can be larger because a single profile may carry multiple records. Use it to report true reach without downloading and de-duplicating the audience yourself.

The field is returned by both the list and detail endpoints.

```
GET /api/v1/audiences
GET /api/v1/audiences/{id}
```

**Response:**

* `distinct_profile_count` (integer) - number of unique resolved profiles in the audience

**Example:**

```bash
curl https://apiv3.delivr.ai/api/v1/audiences/{id} \
  -H "Authorization: Bearer YOUR_TOKEN"
```

## Intent frequency and impression count on audience samples

The audience sample endpoint now returns two additional per-contact fields for intent and persona audiences, giving a graded signal rather than a binary match.

```
GET /api/v1/audiences/{id}/sample
```

**Response (per contact):**

* `intent_frequency` (integer) - number of times the profile appeared in the audience over the lookback window
* `impression_count` (integer) - ad impressions served to the profile over the same window

**Example:**

```bash
curl https://apiv3.delivr.ai/api/v1/audiences/{id}/sample \
  -H "Authorization: Bearer YOUR_TOKEN"
```

## API key and secret pair validation

API key authentication now validates the key and its secret together. Send the secret in the `X-Api-Secret` header alongside `X-Api-Key`. For clients with secret enforcement enabled, a request that presents a valid key without the matching secret is now rejected. If your integration has only been sending the key, add the secret you saved at key creation time.

**Headers:**

* `X-Api-Key` (string) - your API key
* `X-Api-Secret` (string) - the secret issued when the key was created

**Example:**

```bash
curl https://apiv3.delivr.ai/api/v1/audiences \
  -H "X-Api-Key: YOUR_KEY" \
  -H "X-Api-Secret: YOUR_SECRET"
```

## Application client secrets are no longer returned in plaintext

Application credential reads no longer return the raw client secret. Credential validation now compares a hash of the secret you supply, so the secret cannot be read back from the API. Store the secret issued at creation time; it is the only opportunity to capture it.

```
GET /api/app/get
GET /api/app/retrieve/{app_id}
```

**Example:**

```bash
curl https://api.delivr.ai/public/core/api/app/retrieve/{app_id} \
  -H "Authorization: Bearer YOUR_TOKEN"
```

## Refreshing a paused audience returns 409

Requesting a refresh on a paused audience now returns a `409` with a structured reason, instead of reporting success without queuing a rebuild. Resume the audience before requesting a refresh.

```
POST /api/v1/audiences/{id}/refresh
```

**Response:**

* `409` - returned when the audience is paused; includes a structured reason. Resume the audience first, then retry.

**Example:**

```bash
curl -X POST https://apiv3.delivr.ai/api/v1/audiences/{id}/refresh \
  -H "Authorization: Bearer YOUR_TOKEN"
```

## Bug Fixes

* `GET /api/v1/audiences/{id}/download` no longer returns a spurious `400` when upstream data lands late for an otherwise-ready intent audience.
* `GET /api/v1/audiences` no longer returns `500` for projects in certain organization hierarchies.
* Audience filters using range operators (such as greater-than or less-than on bucketed fields like company employee-count ranges) now return only records that fall within the requested range.

For full endpoint details, parameters, and examples, see our [developer documentation](https://docs.delivr.ai/changelog/api-updates-may-2026).