Every packshot returned by GET /packshots and GET /products/{id_or_ref} now includes two new fields: voting (pending, accepted, or rejected) and voting_at (the time of the decision). Until now, the only way to find out whether a product had an approved packshot was to submit a photo session and handle the packshot_not_approved error — your integration can now read the approval state directly from the catalog listings.
Packshots registered directly via POST /packshots are approved automatically, and the listings reflect that immediately. The API contract was also clarified in two places: the HMAC secret rotation response now documents the grace_window_hours field (the dual-signing window, currently 48 hours), and the external_metadata field on session submissions documents its 4096-byte size limit.