What's new in Own It 2.0
Every Ownware tool now ships a REST API with OpenAPI, signed webhooks, two-factor sign-in, BYO-SMTP notifications, CSV import with a dry run, one-click backups and dark mode. One release, the whole catalogue.
Own It 2.0 went out across the whole catalogue at once, not product by product. If you own one
Ownware tool, everything below is now in it. If you own five, all five got the same upgrade on the
same day.
Nothing was taken away, nothing was moved behind a paywall, and there is no new subscription. It is
the same one-time purchase you already made.
What you get
A REST API, with the spec included. Every tool exposes /api/… endpoints for the things its
screens do, plus /api/openapi.json — the machine-readable spec that Power Automate, Zapier, n8n
and most integration tools import directly to build a connector. Authentication is a bearer key you
create in Settings and can revoke at any time.
Signed webhooks. Instead of polling, another system can be told the moment something happens.
Each delivery carries an HMAC-SHA256 signature of the exact request body, so your receiver can prove
the message came from your install and was not altered on the way.
Two-factor sign-in. Standard TOTP — Google Authenticator, 1Password, Aegis, anything that reads
a QR code — with ten one-time recovery codes for the day the phone is gone. The QR renders locally;
nothing about your account is sent anywhere to enrol.
Email notifications through your own SMTP server. Your host, your credentials, your sending
reputation. There is no Ownware relay in the middle, and no third-party sending service to sign up
for. Where a tool has no event worth an email — a petty-cash tin, for instance — we
deliberately did not invent one.
CSV import with a mandatory dry run. Every import shows you exactly what it would create,
change and skip — and why each skipped row was skipped — before anything is written. You choose
to commit after reading it. Bad rows never take the good ones down with them.
One-click full backup. A complete JSON export of every table, plus the raw SQLite file itself
if you run SQLite. Secrets such as SMTP passwords and API-key hashes are redacted, so a backup you
hand to a bookkeeper or a contractor does not hand them your credentials.
Login rate limiting and /healthz. Repeated failed sign-ins are slowed automatically, and an
unauthenticated /healthz returns the app name and version as JSON — the one endpoint an uptime
monitor actually needs.
Dark mode. A real palette, not an inverted filter, with the primary buttons and status pills
measured against the WCAG AA contrast floor rather than eyeballed.
How to upgrade
Replace the files with the new ones and load any page. The database migrates itself — additively,
so nothing existing is dropped or rewritten — and you carry on. Your config.php, your uploads and
your data are untouched by the file swap.
Two things worth doing straight after:
- Open Settings → API & webhooks and create a key only if you actually intend to use the API.
An unused key is a credential you have to look after for no reason.
- Open Settings → Security and turn on two-factor sign-in. Save the recovery codes somewhere
that is not the same laptop.
Why one big release instead of a trickle
Because you host these yourself. Every release is a file swap that you perform, so a steady drip
of small versions spends your time, not ours. Shipping the whole bundle at once means one upgrade
for a long time — which is exactly the arrangement you paid for when you chose to own the software
instead of renting it.