release: 3.5.0

.github/actions/setup-go/action.yml

@@ -7,7 +7,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: stainless-api/retrieve-github-access-token@v1
+    - uses: stainless-api/retrieve-github-access-token@1f03f929b746c5b03dcdafa2bebbb18ca5672e1a # v1.0.0
       if: github.repository == 'stainless-sdks/courier-cli'
       id: get_token
       with:
@@ -20,7 +20,7 @@ runs:
       run: git config --global url."https://x-access-token:${{ steps.get_token.outputs.github_access_token }}@github.com/stainless-sdks/courier-go".insteadOf "https://github.com/stainless-sdks/courier-go"
 
     - name: Setup go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version-file: ./go.mod
 

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: ./.github/actions/setup-go
         with:
@@ -51,7 +51,7 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/courier-cli' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: ./.github/actions/setup-go
         with:
@@ -66,7 +66,7 @@ jobs:
         run: ./scripts/bootstrap
 
       - name: Run goreleaser
-        uses: goreleaser/goreleaser-action@v6.1.0
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
         with:
           version: latest
           args: release --snapshot --clean --skip=publish
@@ -78,7 +78,7 @@ jobs:
           github.repository == 'stainless-sdks/courier-cli' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
@@ -98,7 +98,7 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/courier-cli' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: ./.github/actions/setup-go
         with:

.github/workflows/publish-release.yml

@@ -10,20 +10,21 @@ on:
   push:
     tags:
       - "v*"
+  workflow_dispatch: {}
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version-file: "go.mod"
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@v6.1.0
+      uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
       with:
         version: latest
         args: release --clean

.github/workflows/release-doctor.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'trycourier/courier-cli' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check release environment
         run: |

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.4.2"
+  ".": "3.5.0"
 }

.stats.yml

@@ -1,4 +1,4 @@
-configured_endpoints: 103
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/courier%2Fcourier-0f56d7860a1be3ffaea5dea291b20ac92e31c94d54e41cc8a30462dacf2f2d37.yml
-openapi_spec_hash: 7e7c6f963e83c5f626c09efa322f476a
-config_hash: afcc4f6f8c33ca3f338589e32e086f56
+configured_endpoints: 117
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/courier/courier-8e7ad3d889c555ff9c381518b627b24b85e3eb7376bdc3689adc7a96ec78e537.yml
+openapi_spec_hash: 53b3680aae719487c56efaa782bbe5b2
+config_hash: 10bd597dd6cc89023541bc551b6532b8

CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 3.5.0 (2026-05-19)
+
+Full Changelog: [v3.4.2...v3.5.0](https://github.com/trycourier/courier-cli/compare/v3.4.2...v3.5.0)
+
+### Features
+
+* [C-18380] Journeys API reference: copy + naming cleanup ([3e5f0cd](https://github.com/trycourier/courier-cli/commit/3e5f0cd321b17598cf89d2e9fcc0a364bbc379d2))
+* [SUP-607] Add DELETE endpoint for Courier Create tenant templates ([5ad24c4](https://github.com/trycourier/courier-cli/commit/5ad24c484316bfbfe4e89a50ea3f98d55c897ea2))
+* **api:** add journeys methods and journeys:templates resource ([f4afb09](https://github.com/trycourier/courier-cli/commit/f4afb0962c0d224f65d5c3d2061629787ada86b1))
+* **cli:** add `--raw-output`/`-r` option to print raw (non-JSON) strings ([780a9c0](https://github.com/trycourier/courier-cli/commit/780a9c0e5dc5f889e1756e00b7712b58fd1c2cf6))
+* **cli:** alias parameters in data with `x-stainless-cli-data-alias` ([4c52102](https://github.com/trycourier/courier-cli/commit/4c5210271156ddab475383aa6d512d915c43e7b6))
+* **cli:** send filename and content type when reading input from files ([8de2857](https://github.com/trycourier/courier-cli/commit/8de28579f6a831bfdc78ec33b16bcf31c55d06bb))
+* support passing path and query params over stdin ([29f9b3f](https://github.com/trycourier/courier-cli/commit/29f9b3f993fbd72360b1ce65e77b26e03bbfce8f))
+
+
+### Bug Fixes
+
+* **cli:** correctly load zsh autocompletion ([c58ffcd](https://github.com/trycourier/courier-cli/commit/c58ffcd91a7c0fb5255b638a34a61c2c8146759c))
+* flags for nullable body scalar fields are strictly typed ([41b8096](https://github.com/trycourier/courier-cli/commit/41b809656f1b5a1d4ba73b91e9c60533f032e5f0))
+
+
+### Chores
+
+* **ci:** support manually triggering release workflow ([99e6955](https://github.com/trycourier/courier-cli/commit/99e6955357951c874d777c4a26a920d602b7ec72))
+* **cli:** fall back to JSON when using default "explore" with non-TTY ([09aeebd](https://github.com/trycourier/courier-cli/commit/09aeebd03bb1402bd278940cdeb8ea69b01517b6))
+* **cli:** switch long lists of positional args over to param structs ([389c820](https://github.com/trycourier/courier-cli/commit/389c8207c4c54f657dfd310ce5ab1d8d751cc357))
+* **cli:** use `ShowJSONOpts` as argument to `formatJSON` instead of many positionals ([747c709](https://github.com/trycourier/courier-cli/commit/747c7090e140eb34ff022c5d9e42454618efe5c4))
+* **internal:** codegen related update ([b152ea0](https://github.com/trycourier/courier-cli/commit/b152ea0392fc2ee9857dde8affe7746cc07fa0cd))
+* **internal:** codegen related update ([cd851ac](https://github.com/trycourier/courier-cli/commit/cd851acc33bb7aa94374078ce84ca0e69064eec3))
+* **internal:** codegen related update ([0f66682](https://github.com/trycourier/courier-cli/commit/0f66682369f79620f487884c535e41ad96304d95))
+* **internal:** codegen related update ([8f3872f](https://github.com/trycourier/courier-cli/commit/8f3872f856ca43e04183c8f965f8e0e7ec1e0177))
+* **internal:** more robust bootstrap script ([3934247](https://github.com/trycourier/courier-cli/commit/39342478242318700e674e0ed42b1950e7bce5a1))
+* redact api-key headers in debug logs ([26b9617](https://github.com/trycourier/courier-cli/commit/26b96175c773dae96c8eb7a877126c309f71040f))
+
+
+### Documentation
+
+* **api:** update notification parameter descriptions ([40e76a4](https://github.com/trycourier/courier-cli/commit/40e76a403eab7c2c445e532fcbce8494b9cef78a))
+
 ## 3.4.2 (2026-04-14)
 
 Full Changelog: [v3.4.1...v3.4.2](https://github.com/trycourier/courier-cli/compare/v3.4.1...v3.4.2)

cmd/courier/main.go

@@ -43,7 +43,12 @@ func main() {
 			fmt.Fprintf(os.Stderr, "%s %q: %d %s\n", apierr.Request.Method, apierr.Request.URL, apierr.Response.StatusCode, http.StatusText(apierr.Response.StatusCode))
 			format := app.String("format-error")
 			json := gjson.Parse(apierr.RawJSON())
-			show_err := cmd.ShowJSON(os.Stdout, "Error", json, format, app.String("transform-error"))
+			show_err := cmd.ShowJSON(json, cmd.ShowJSONOpts{
+				ExplicitFormat: app.IsSet("format-error"),
+				Format:         format,
+				Title:          "Error",
+				Transform:      app.String("transform-error"),
+			})
 			if show_err != nil {
 				// Just print the original error:
 				fmt.Fprintf(os.Stderr, "%s\n", err.Error())

internal/autocomplete/shellscripts/zsh_autocomplete.zsh

@@ -1,5 +1,4 @@
-#!/bin/zsh
-compdef ____APPNAME___zsh_autocomplete __APPNAME__
+#compdef __APPNAME__
 
 ____APPNAME___zsh_autocomplete() {
 
@@ -44,3 +43,14 @@ ____APPNAME___zsh_autocomplete() {
       ;;
   esac
 }
+
+# When installed in fpath (e.g., via Homebrew's zsh_completion stanza), this file
+# is autoloaded as the function ___APPNAME__ and its body becomes that function's
+# body. Detect that case via funcstack and dispatch to the completion function.
+# When sourced (e.g., `source <(__APPNAME__ @completion zsh)`), register the
+# function with compdef instead.
+if [[ "${funcstack[1]}" = "___APPNAME__" ]]; then
+  ____APPNAME___zsh_autocomplete "$@"
+else
+  compdef ____APPNAME___zsh_autocomplete __APPNAME__
+fi

internal/debugmiddleware/debug_middleware.go

@@ -21,7 +21,12 @@ const redactedPlaceholder = "<REDACTED>"
 
 // Headers known to contain sensitive information like an API key. Note that this exclude `Authorization`,
 // which is handled specially in `redactRequest` below.
-var sensitiveHeaders = []string{}
+var sensitiveHeaders = []string{
+	"api-key",
+	"x-api-key",
+	"cookie",
+	"set-cookie",
+}
 
 // RequestLogger is a middleware that logs HTTP requests and responses.
 type RequestLogger struct {

internal/requestflag/innerflag.go

@@ -14,22 +14,44 @@ import (
 type InnerFlag[
 	T []any | []map[string]any | []DateTimeValue | []DateValue | []TimeValue | []string |
 		[]float64 | []int64 | []bool | any | map[string]any | DateTimeValue | DateValue | TimeValue |
-		string | float64 | int64 | bool,
+		string | float64 | int64 | bool |
+		*string | *float64 | *int64 | *bool | *DateTimeValue | *DateValue | *TimeValue,
 ] struct {
 	Name        string        // name of the flag
 	DefaultText string        // default text of the flag for usage purposes
 	Usage       string        // usage string for help output
 	Aliases     []string      // aliases that are allowed for this flag
 	Validator   func(T) error // custom function to validate this flag value
 
-	OuterFlag  cli.Flag // The flag on which this inner flag will set values
-	InnerField string   // The inner field which this flag will set
+	OuterFlag   cli.Flag // The flag on which this inner flag will set values
+	InnerField  string   // The inner field which this flag will set
+	DataAliases []string // alternate names recognized in YAML values passed as the outer flag
+
+	// OuterIsArrayOfObjects tells an untyped outer flag (Flag[any], used for nullable
+	// complex schemas) to seed its underlying value as []map[string]any rather than
+	// map[string]any before SetInnerField runs. The hint is ignored for typed outer
+	// flags whose zero value already carries a dispatchable reflect.Kind.
+	OuterIsArrayOfObjects bool
+}
+
+// GetDataAliases returns the aliases recognized when parsing inner field keys from piped or flag YAML.
+func (f *InnerFlag[T]) GetDataAliases() []string {
+	return f.DataAliases
+}
+
+// GetInnerField returns the API field name that this inner flag sets on its outer flag's value.
+// For example, the flag --parent.foo targeting a parameter whose OpenAPI property name is "foo"
+// would return "foo". This is distinct from the flag's CLI name and from any DataAliases entries.
+func (f *InnerFlag[T]) GetInnerField() string {
+	return f.InnerField
 }
 
 type HasOuterFlag interface {
 	cli.Flag
 	SetOuterFlag(cli.Flag)
 	GetOuterFlag() cli.Flag
+	GetInnerField() string
+	GetDataAliases() []string
 }
 
 func (f *InnerFlag[T]) SetOuterFlag(flag cli.Flag) {
@@ -61,6 +83,10 @@ func (f *InnerFlag[T]) Set(name string, rawVal string) error {
 			}
 		}
 
+		if seeder, ok := f.OuterFlag.(InnerFieldSeeder); ok {
+			seeder.SeedInnerCollection(f.OuterIsArrayOfObjects)
+		}
+
 		if settableInnerField, ok := f.OuterFlag.(SettableInnerField); ok {
 			settableInnerField.SetInnerField(f.InnerField, parsedValue)
 		} else {
@@ -121,6 +147,9 @@ func (f *InnerFlag[T]) TypeName() string {
 	if ty == nil {
 		return ""
 	}
+	if ty.Kind() == reflect.Pointer {
+		ty = ty.Elem()
+	}
 
 	// Get base type name with special handling for built-in types
 	getTypeName := func(t reflect.Type) string {