Forward-looking work tracked publicly for partner integration planning. Items here are commitments to direction, not to specific delivery dates — exact timing is communicated through the infrastructure Atom feed as it firms up.

Near-term

• Outbound webhook delivery. The shape is documented at https://developers.dealermax.app/docs → 05 Webhooks; production delivery + HMAC signing + retry policy lands when the v1 contract has shipped to its first three partner integrations.
• Idempotency observability. Durable replay and mismatch detection are active for mutating endpoints; the next hardening step is partner-facing reporting around replay rates and conflict causes.
• Dealer read-only SDK packages. The public dealermax package names are reserved for the Dealer Public API. Until publication, generate a server-side client from the Dealer Public API contract linked from /api.

Reserved API surfaces

• /v1/beta/ — opt-in surface for experimental endpoints, governed by an X-Partnermax-Experimental: true header. Empty in v1.
• /v2/dealers — the next major path will live under /v2/ when a breaking change to the dealers surface is required. Returns the migration guide at https://developers.dealermax.app/docs/migrations/v1-to-v2 when consulted directly.

Trust posture

• SOC 2 Type 1 readiness — target Q3 2026.
• Independent penetration test — annual cadence.
• Security advisories feed: subscribe.