broadcast-ruby 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 361d356c1fde238ba1734363607796b005a839f72b70885e52c2ed0eaa2b4209
-  data.tar.gz: 9a1d12cc2b3680689951e325be2100eb64ed9f2ca021c3d69421f336099dec6d
+  metadata.gz: fec10ff364f7b63e728e1da143f2e0ff4445e2466f8a9e1a307370142d4c8666
+  data.tar.gz: efce695852b7774e6e40f1f91a93ee2487e8d635a579ab0fe20505a9fe4a9efe
 SHA512:
-  metadata.gz: 128a65f8767c17b979e98b8516f7c31a99703449487f6fd7cefe93c9940a1c3cb5c4ae21a5144a7236769ec5f41072626694e169ec2eea041f3c1327265c834d
-  data.tar.gz: e54a4fa7d5f1e96f9fbc26a8932c05067a6eda7575ee21f3762cc261b0973d42219536ed1650872746ce2854fa449de9ebc3c0192445ab705ceec0933e36df1d
+  metadata.gz: b72667f6f90ecb99ec60d0d9c905f529fbf0f78e30386e78ca93aeb1ac783e2a923750b76a41b73f2da771be67b3bfca012749066614a2ddb99c6cebb093924c
+  data.tar.gz: ff0b6ba2de7606b7dbc1fab2c552f6947158cd69ad28ae328d3b23f1d52b8878700802a08d108841e7453b5495398258c70e2e287bbc5ac76e1a908baedab1c1

data/CHANGELOG.md

@@ -2,6 +2,93 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.3.0] - 2026-07-26
+
+Catches the gem up to the Broadcast v2.19 API. The API gained a response-warnings
+contract, idempotency keys, and several discovery endpoints since 0.2.0; none of
+them were represented here.
+
+### Breaking
+- **`host` is now required.** It previously defaulted to `https://sendbroadcast.com`,
+  which 301-redirects to `sendbroadcast.net` — and since the client did not follow
+  redirects, the default failed every request with
+  `APIError: Unexpected response: 301`. Broadcast is self-hosted-first, so there is
+  no URL the gem can guess. Pass `host:` explicitly or set `BROADCAST_HOST`.
+  A host without a scheme is now rejected at construction rather than at request time.
+
+### Added
+- **`client.autopilots`** — the Autopilot API (AI-generated newsletters): CRUD,
+  activate / pause / deactivate, trigger_run, and runs. The `autopilot_read` /
+  `autopilot_write` token permissions existed since 2026-01-30 but had no
+  endpoints behind them until Broadcast v2.19.1. `update` strips a bullet-masked
+  `openrouter_api_key` so a fetch-modify-save cannot destroy the stored key.
+- **API warnings.** Successful writes can carry a `warnings` array describing what
+  the server ignored (`unrecognized_parameter`, `parameter_ignored`,
+  `parameter_overridden`, `double_opt_in_skipped`). Exposed as `result.warnings`
+  and controlled by `warnings_mode:` — `:log` (default), `:raise`, or `:ignore`.
+- **`Broadcast::Response`.** All JSON calls now return a Hash subclass carrying
+  `#warnings`, `#rate_limit`, `#status`, `#headers`, and `#idempotent_replay?`.
+  Existing Hash-based code is unaffected.
+- **Idempotent transactional sends.** `transactionals.create(..., idempotency_key:)`
+  sends the `Idempotency-Key` header; `Broadcast::ConflictError` maps 409 (previously
+  a generic `APIError`).
+- **Rate-limit awareness.** `result.rate_limit` exposes the `X-RateLimit-*` headers,
+  `RateLimitError#retry_after` exposes `Retry-After`, and 429s are now retried
+  honouring it, bounded by the new `max_retry_delay` setting (default 30s).
+- **Discovery endpoints:** `client.whoami`, `client.status`, `client.prime`, and
+  `client.skill` (plain text).
+- **Migration/export namespace:** `client.migration.*` covers all 19 read-only
+  endpoints under `/api/migration/v1`, plus `each_record` for automatic paging and
+  `download_file_asset` for binary assets. Requires an admin token.
+- **`Broadcast::Webhook::EVENT_TYPES`** and per-category constants (`EMAIL_EVENTS`,
+  `SUBSCRIBER_EVENTS`, `BROADCAST_EVENTS`, `SEQUENCE_EVENTS`, `SYSTEM_EVENTS`).
+- `BROADCAST_HOST` / `BROADCAST_API_TOKEN` environment fallbacks, matching the
+  Broadcast CLI's config keys.
+- Redirect handling: same-host GETs follow up to 3 hops. Writes, and any redirect
+  that changes host, fail with an error naming the target — every request carries
+  the bearer token, so following a cross-host redirect would leak it.
+- Documented attributes added to the API after 0.2.0 — template
+  `template_purpose` / `confirmation_text` / `default_confirmation` /
+  `confirmation_page_settings`; opt-in form `confirmation_email_template_id` /
+  `welcome_email_template_id` / `confirmation_redirect_url` /
+  `include_unsubscribe_link_in_confirmation`; admin-only `confirmed_at` on
+  subscriber create; and the full subscriber list filter set.
+
+### Fixed
+- Debug logging redacted: SMTP passwords and provider API keys are no longer written
+  to the log when `debug: true`.
+- 2xx responses other than 200/201 (e.g. 204) no longer raise.
+- A 2xx response with a non-JSON body no longer raises `JSON::ParserError`.
+- Error messages now include ActiveModel-style `errors` hashes, not just `error` strings.
+- Binary responses keep binary encoding instead of being tagged UTF-8.
+- The ActionMailer delivery method no longer wraps `WarningError` in `DeliveryError` —
+  the email was sent, so reporting a delivery failure would be wrong.
+- **Packaging:** the gemspec shipped this repo's internal planning documents
+  (`TODO.md`, `SDK-TODO.md`, `.api-coverage.yml`) and the committed `.gem`
+  artifacts at the repo root to every install. The file list now excludes them,
+  along with `.github/` and `pkg/`. `SDK-COVERAGE.md` is kept deliberately —
+  "what does this gem support" is a user's question.
+
+### Internal
+- HTTP transport extracted from `Client` into `Broadcast::Connection`, and debug
+  logging into `Broadcast::DebugLogger`.
+- Test coverage for the gemspec's file list, since a wrong package fails
+  silently: nothing breaks, the download is just wrong.
+
+### Verification
+- 292 tests, rubocop clean.
+- Coverage against the generated OpenAPI document: 104/104 operations
+  (`rake "openapi:coverage[../broadcast-ruby]"` in the `broadcast` repo).
+- The built `.gem` was installed into an isolated `GEM_HOME` and exercised.
+- `rake test_live` run against a real self-hosted instance: 14 tests, 52
+  assertions, 0 failures. Covers the discovery endpoints, the `X-RateLimit-*`
+  headers, and full create/read/update/delete round-trips for subscribers,
+  sequences, segments, templates, and webhook endpoints.
+- Two gaps in that run, both deliberate: the transactional **send** test is
+  skipped unless `BROADCAST_TEST_EMAIL` is set, so no mail was delivered; and
+  the target was a local development instance over plain HTTP, so TLS and
+  real-world latency and rate limiting are still unexercised.
+
 ## [0.2.0] - 2026-04-28
 
 ### Added

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    broadcast-ruby (0.2.0)
+    broadcast-ruby (0.3.0)
       base64
 
 GEM
@@ -155,6 +155,7 @@ GEM
 
 PLATFORMS
   arm64-darwin-24
+  arm64-darwin-25
   x86_64-linux
 
 DEPENDENCIES
@@ -176,7 +177,7 @@ CHECKSUMS
   ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
   bigdecimal (4.0.1) sha256=8b07d3d065a9f921c80ceaea7c9d4ae596697295b584c296fe599dd0ad01c4a7
-  broadcast-ruby (0.2.0)
+  broadcast-ruby (0.3.0)
   builder (3.3.0) sha256=497918d2f9dca528fdca4b88d84e4ef4387256d984b8154e9d5d3fe5a9c8835f
   concurrent-ruby (1.3.6) sha256=6b56837e1e7e5292f9864f34b69c5a2cbc75c0cf5338f1ce9903d10fa762d5ab
   connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a

data/README.md

@@ -1,8 +1,8 @@
 # broadcast-ruby
 
-Ruby client for the [Broadcast](https://sendbroadcast.com) email platform.
+Ruby client for the [Broadcast](https://sendbroadcast.net) email platform.
 
-Works with [sendbroadcast.com](https://sendbroadcast.com) or any self-hosted Broadcast instance.
+Works with any Broadcast instance — self-hosted or SaaS.
 
 ## Installation
 
@@ -37,7 +37,7 @@ require 'broadcast'
 
 client = Broadcast::Client.new(
   api_token: 'your-token',
-  host: 'https://sendbroadcast.com'  # or your self-hosted URL
+  host: 'https://mail.example.com'  # your Broadcast instance
 )
 
 client.send_email(
@@ -47,26 +47,108 @@ client.send_email(
 )
 ```
 
+`host` has no default — every Broadcast instance lives at its own domain, so
+there is no URL the gem could guess correctly. You can supply it through the
+environment instead, using the same variable names as the Broadcast CLI:
+
+```bash
+export BROADCAST_HOST=https://mail.example.com
+export BROADCAST_API_TOKEN=your-token
+```
+
+```ruby
+client = Broadcast::Client.new  # picks both up from ENV
+```
+
 ### Options
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `api_token` | *required* | Your Broadcast API token |
-| `host` | `https://sendbroadcast.com` | Broadcast instance URL |
+| `api_token` | *required* | Your Broadcast API token. Falls back to `BROADCAST_API_TOKEN` |
+| `host` | *required* | Broadcast instance URL, scheme included. Falls back to `BROADCAST_HOST` |
 | `timeout` | `30` | Read timeout (seconds) |
 | `open_timeout` | `10` | Connection timeout (seconds) |
-| `retry_attempts` | `3` | Max total attempts (1 initial + 2 retries). Server errors (5xx) and timeouts are retried; client errors (4xx) are not |
+| `retry_attempts` | `3` | Max total attempts (1 initial + 2 retries). Server errors (5xx), timeouts, and rate limits (429) are retried; other client errors (4xx) are not |
 | `retry_delay` | `1` | Base delay between retries in seconds (multiplied by attempt number) |
-| `debug` | `false` | Log request/response details |
+| `max_retry_delay` | `30` | Ceiling for a server-supplied `Retry-After`, so a long rate-limit window can't stall the caller |
+| `warnings_mode` | `:log` | How to handle API warnings — `:log`, `:raise`, or `:ignore`. See [API Warnings](#api-warnings) |
+| `debug` | `false` | Log request/response details (credentials are redacted) |
 | `logger` | `nil` | Logger instance for debug output (e.g. `Rails.logger`) |
 | `broadcast_channel_id` | `nil` | Auto-included on every request when set. Required when using an admin/system token (regular tokens are channel-scoped already). Can be overridden per-call or via `client.with_channel(id) { ... }` |
 
-All methods return parsed JSON as Ruby Hashes with string keys.
+All methods return parsed JSON as Ruby Hashes with string keys. The returned
+object is a `Broadcast::Response` — a Hash subclass that also carries response
+metadata (`#warnings`, `#rate_limit`, `#status`, `#idempotent_replay?`).
+Anything that worked against a plain Hash still works.
 
 > **Note on module naming:** This gem defines a top-level `Broadcast` module. If your application already has a `Broadcast` class or module (e.g. an ActiveRecord model), you may encounter a namespace collision.
 
 ---
 
+## API Warnings
+
+Broadcast accepts a write and then tells you what it ignored. A misspelled
+attribute, a parameter that only applies in another mode, a value the server
+overrode — none of these fail the request, they come back as a `warnings` array
+on the successful response.
+
+This is the difference between "my custom field isn't saving and I can't work
+out why" and a one-line answer:
+
+```ruby
+result = client.subscribers.create(email: 'jane@example.com', frist_name: 'Jane')
+
+result['id']       # => 42 — the subscriber WAS created
+result.warnings?   # => true
+result.warnings.each { |w| puts w }
+# [unrecognized_parameter] subscriber.frist_name: frist_name is not a recognized
+#   subscriber attribute and was ignored.
+```
+
+Each warning has `#code`, `#param` (a dot-path, may be nil), and `#message`.
+Values you submitted are never echoed back, so warnings are safe to log.
+
+Control what happens via `warnings_mode`:
+
+| Mode | Behaviour |
+|------|-----------|
+| `:log` (default) | Written to `logger` at WARN level, if a logger is configured |
+| `:raise` | Raises `Broadcast::WarningError` |
+| `:ignore` | Left on the response for you to inspect |
+
+```ruby
+# Recommended in CI or a test suite: turn silent parameter drops into failures
+client = Broadcast::Client.new(api_token: '...', host: '...', warnings_mode: :raise)
+```
+
+> `:raise` fires **after** the request succeeded. Rescuing `WarningError` does
+> not mean the write was rolled back — the subscriber was still created, the
+> email was still sent.
+
+Common codes: `unrecognized_parameter`, `parameter_ignored`,
+`parameter_overridden`, `double_opt_in_skipped`.
+
+## Rate Limits
+
+Every response carries the current limit state, and 429s are retried
+automatically honouring the server's `Retry-After` (capped at `max_retry_delay`).
+
+```ruby
+result = client.subscribers.list
+
+result.rate_limit.limit      # => 120
+result.rate_limit.remaining  # => 118
+result.rate_limit.reset      # => 2026-07-26 12:00:00 UTC
+
+# Back off before you get throttled
+sleep 1 if result.rate_limit.remaining < 10
+```
+
+If the retries are exhausted you get a `Broadcast::RateLimitError`, which
+carries `#retry_after` so you can requeue the job sensibly.
+
+---
+
 ## Rails ActionMailer Integration
 
 In a Rails app, the gem auto-registers a `:broadcast` delivery method. Your existing mailers work unchanged.
@@ -91,7 +173,7 @@ Then configure production to use Broadcast:
 config.action_mailer.delivery_method = :broadcast
 config.action_mailer.broadcast_settings = {
   api_token: Rails.application.credentials.dig(:broadcast, :api_token),
-  host: 'https://sendbroadcast.com'
+  host: 'https://mail.example.com'
 }
 ```
 
@@ -133,7 +215,7 @@ Replace in `config/environments/production.rb`:
 + config.action_mailer.delivery_method = :broadcast
 + config.action_mailer.broadcast_settings = {
 +   api_token: Rails.application.credentials.dig(:broadcast, :api_token),
-+   host: 'https://sendbroadcast.com'
++   host: 'https://mail.example.com'
 + }
 ```
 
@@ -213,6 +295,47 @@ client.transactionals.create(
 client.transactionals.get_transactional(42)
 ```
 
+### Idempotent Sends
+
+Pass `idempotency_key:` to make a retry safe. The server stores the response for
+24 hours keyed on (token, key) and replays it instead of sending a second email
+— so a job that times out after the send but before the ack won't double-mail
+your customer.
+
+```ruby
+result = client.transactionals.create(
+  to: 'user@example.com',
+  subject: "Receipt for order ##{order.id}",
+  body: receipt_html,
+  idempotency_key: "receipt-#{order.id}"
+)
+
+result.idempotent_replay?  # => true if this replayed a stored response
+```
+
+Use a key derived from the thing you're emailing about (`"receipt-#{order.id}"`),
+not a random UUID generated per attempt — a fresh UUID on each retry defeats the
+whole mechanism.
+
+Two failure modes worth handling separately:
+
+```ruby
+begin
+  client.transactionals.create(to: ..., idempotency_key: key)
+rescue Broadcast::ConflictError
+  # 409 — the original request is still in flight. Retry shortly; do not
+  # change the key, or you'll send twice.
+  retry_job(wait: 5.seconds)
+rescue Broadcast::ValidationError => e
+  # 422 with an idempotency key can mean the key was already used with a
+  # DIFFERENT payload. Retrying with the same key will never succeed.
+  raise
+end
+```
+
+The fingerprint covers method, full path (including query string), and body.
+Changing any of them while reusing a key is what triggers that 422.
+
 ### Double Opt-In
 
 Pass `double_opt_in: true` to require email confirmation before delivery. The recipient receives a confirmation email; the actual transactional email is held until they confirm. If the recipient is already a confirmed subscriber, `double_opt_in` is ignored and the email sends normally.
@@ -267,13 +390,22 @@ result['subscribers']            # => [{'email' => '...', 'tags' => [...], ...},
 result['pagination']['total']    # => 1500
 result['pagination']['current']  # => 1
 
-# Filter by status, tags, dates, or custom data
+# Filter by status, tags, dates, or custom data -- all combinable
 client.subscribers.list(is_active: true)
-client.subscribers.list(tags: ['newsletter', 'premium'])
-client.subscribers.list(created_after: '2026-01-01T00:00:00Z')
-client.subscribers.list(custom_data: { plan: 'pro' })
+client.subscribers.list(source: 'opt_in_form')
+client.subscribers.list(tags: ['newsletter', 'premium'])   # AND -- must have all
+client.subscribers.list(email: 'example.com')              # partial match, not exact
+client.subscribers.list(confirmation_status: 'unconfirmed')
+client.subscribers.list(created_after: '2026-01-01T00:00:00Z',
+                        created_before: '2026-02-01T00:00:00Z')
+client.subscribers.list(custom_data: { plan: 'pro' })       # JSONB containment
 ```
 
+> An unparseable `created_after` / `created_before` is **ignored** by the server
+> rather than rejected — you get every subscriber back, plus a
+> `parameter_ignored` warning. Check `result.warnings` (or run with
+> `warnings_mode: :raise`) if a filtered count looks too high.
+
 ```ruby
 # Find by email
 subscriber = client.subscribers.find(email: 'jane@example.com')
@@ -871,6 +1003,20 @@ result = client.webhook_endpoints.create(
 # IMPORTANT: Save the secret from the response -- it is only shown once
 secret = result['secret']
 
+# Every valid event type is available as a constant. An unknown event type is
+# dropped server-side rather than rejected, so subscribe from these.
+Broadcast::Webhook::EVENT_TYPES        # all 32
+Broadcast::Webhook::EMAIL_EVENTS       # email.sent, email.delivered, ...
+Broadcast::Webhook::SUBSCRIBER_EVENTS  # subscriber.created, ...
+Broadcast::Webhook::BROADCAST_EVENTS   # broadcast.sending, broadcast.sent, ...
+Broadcast::Webhook::SEQUENCE_EVENTS    # sequence.subscriber_added, ...
+Broadcast::Webhook::SYSTEM_EVENTS      # message.attempt.exhausted, test.webhook
+
+client.webhook_endpoints.create(
+  url: 'https://yourapp.com/webhooks/broadcast',
+  event_types: Broadcast::Webhook::EMAIL_EVENTS
+)
+
 # Update (url and secret cannot be changed -- create a new endpoint instead)
 client.webhook_endpoints.update(1, active: false)
 client.webhook_endpoints.update(1, event_types: ['email.delivered', 'email.opened'])
@@ -933,6 +1079,106 @@ The signature is computed as `HMAC-SHA256(timestamp + "." + payload, secret)`. T
 
 ---
 
+## Discovery
+
+Ask the instance what this token can do and whether the channel is ready to
+send. Useful as a deploy-time smoke check, and as the entry point for agents
+and CLIs.
+
+```ruby
+# Who am I? Token type, permissions, resolved channel.
+me = client.whoami
+me['token']['type']          # => 'channel_scoped' or 'admin_cross_channel'
+me['token']['permissions']   # => { 'subscribers' => ['read', 'write'], ... }
+me['channel']['name']        # => 'Main'
+
+# Is this channel actually able to send?
+status = client.status
+status['subscribers']['active']     # => 1042
+status['readiness']['broadcasts']   # => true
+status['readiness']['sequences']    # => false — no email server configured
+
+# Full capability manifest: platform version, endpoint list, rate limit, tips.
+client.prime
+
+# Plain-text agent skill manifest (Markdown + YAML front matter).
+# Returns a String, not a Hash.
+puts client.skill
+```
+
+A useful preflight before a send job:
+
+```ruby
+raise 'channel not ready to send' unless client.status.dig('readiness', 'broadcasts')
+```
+
+---
+
+## Export & Migration (admin tokens only)
+
+Read-only endpoints under `/api/migration/v1` for backups and moving a channel
+between instances. Two constraints differ from the rest of the API:
+
+- **Admin tokens only.** Channel-scoped tokens are rejected.
+- **`broadcast_channel_id` is required on every call.** Set it once on the
+  client and the gem attaches it for you.
+
+```ruby
+client = Broadcast::Client.new(
+  api_token: ENV['BROADCAST_ADMIN_TOKEN'],
+  host: 'https://mail.example.com',
+  broadcast_channel_id: 1
+)
+
+# Size the export first
+manifest = client.migration.manifest
+manifest['counts']            # => { 'subscribers' => 5000, 'templates' => 12, ... }
+manifest['export_format_version']
+
+# Time-bounded counts (broadcasts, receipts, histories) default to 90 days
+client.migration.manifest(days_history: 365)
+```
+
+Each collection is a paginated list returning `data` and `pagination`:
+
+```ruby
+page = client.migration.subscribers(limit: 250, offset: 0)
+page['data']
+page['pagination']  # => { 'total' => 5000, 'limit' => 250, 'offset' => 0, 'has_more' => true }
+```
+
+`each_record` handles the paging for you, advancing by the page size the server
+actually granted rather than the one you asked for:
+
+```ruby
+CSV.open('subscribers.csv', 'w') do |csv|
+  client.migration.each_record(:subscribers) do |subscriber|
+    csv << [subscriber['email'], subscriber['first_name'], subscriber['created_at']]
+  end
+end
+
+# Without a block you get an Enumerator
+client.migration.each_record(:tags).map { |tag| tag['name'] }
+```
+
+Available collections:
+
+```
+channels  subscribers  templates  segments  sequences  email_servers
+opt_in_forms  broadcasts  outbound_receipts  webhook_endpoints  tokens
+suppressions  tags  users  link_redirects  link_clicks
+subscriber_histories  file_assets
+```
+
+File assets are downloaded separately and return raw bytes:
+
+```ruby
+bytes = client.migration.download_file_asset(7)
+File.binwrite('logo.png', bytes)
+```
+
+---
+
 ## Error Handling
 
 All API errors inherit from `Broadcast::Error`. Put specific errors before general ones:
@@ -943,15 +1189,24 @@ begin
 rescue Broadcast::AuthenticationError  # 401 -- invalid or expired API token
 rescue Broadcast::AuthorizationError   # 403 -- token lacks the required permission, or admin-only endpoint
 rescue Broadcast::NotFoundError        # 404 -- resource does not exist
+rescue Broadcast::ConflictError        # 409 -- Idempotency-Key request still in flight
 rescue Broadcast::ValidationError      # 422 -- missing or invalid parameters
-rescue Broadcast::RateLimitError       # 429 -- exceeded 120 requests/minute
+rescue Broadcast::RateLimitError       # 429 -- rate limited; carries #retry_after
 rescue Broadcast::TimeoutError         # connection or read timeout
 rescue Broadcast::APIError             # 5xx or unexpected status codes
+rescue Broadcast::WarningError         # warnings_mode: :raise -- request SUCCEEDED
+rescue Broadcast::ConfigurationError   # missing api_token or host
 rescue Broadcast::DeliveryError        # ActionMailer wrapper (wraps any of the above)
 end
 ```
 
-Server errors (5xx) and timeouts are automatically retried with linear backoff. Client errors (401, 404, 422, 429) are raised immediately. `DeliveryError` is only raised from the ActionMailer delivery method -- it wraps the underlying API error.
+Server errors (5xx), timeouts, and rate limits (429) are retried automatically —
+429s honour the server's `Retry-After`, bounded by `max_retry_delay`. Other
+client errors (401, 403, 404, 409, 422) are raised immediately.
+
+`DeliveryError` is only raised from the ActionMailer delivery method and wraps
+the underlying API error. `WarningError` is deliberately not wrapped: the email
+was sent, so reporting it as a delivery failure would be wrong.
 
 ---
 
@@ -978,7 +1233,7 @@ Each token can be scoped to specific resources. The ActionMailer delivery method
 ### `Broadcast::AuthenticationError` (401)
 
 - **Wrong token:** Double-check you copied the full token from your Broadcast dashboard.
-- **Wrong host:** If you're self-hosting, make sure `host` points to your Broadcast instance, not `sendbroadcast.com`.
+- **Wrong host:** Make sure `host` points at your own Broadcast instance. There is no default.
 - **Missing permissions:** Your token may not have the required permissions for the resource you're accessing. Check the [permissions table](#api-token-permissions).
 
 ### `Broadcast::AuthorizationError` (403)