From e5294d8f17457216ee9b37c7332e1b7a3df973b2 Mon Sep 17 00:00:00 2001
From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com>
Date: Fri, 25 Sep 2026 23:07:33 +0000
Subject: [PATCH] docs: add Sep 25, 2026 changelog entry

---
 changelog.mdx | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/changelog.mdx b/changelog.mdx
index 47c1347f0..64642c770 100644
--- a/changelog.mdx
+++ b/changelog.mdx
@@ -7,6 +7,19 @@ keywords: ["changelog", "API updates", "release notes", "what's new", "API chang
 
 To subscribe to updates, please [**“Turn on notifications”**](https://help.x.com/en/managing-your-account/notifications-on-mobile-devices#:~:text=In%20the%20top%20menu,%20you,you%20would%20like%20to%20receive) for [**@API**](https://x.com/api). You can also follow this changelog in your feed reader via the [**RSS feed**](https://docs.x.com/changelog/rss.xml).
 
+<Update label="Sep 25, 2026" description="X API v2">
+  ### New features
+
+  - **X Activity API subscription expiration**: Pass an optional `expires_at` timestamp (RFC 3339) when creating a subscription, and XAA deletes it automatically at that time. To change the expiration, `POST` the same subscription again with a new `expires_at`. See [Subscription expiration](/x-api/activity/introduction#subscription-expiration).
+  - **OAuth 2.0 client secret for webhook security**: Webhook POSTs now include an `X-Twitter-Webhooks-Signature-OAuth2` header signed with your app's OAuth 2.0 client secret. Generate CRC `response_token` values with the same secret. Apps that only have an OAuth 1.0 consumer secret keep receiving `X-Twitter-Webhooks-Signature` unchanged. See [Signature headers](/x-api/webhooks/introduction#signature-headers).
+
+  ### Updates
+
+  - **`is_moderator` in `broadcast.chat` events**: The [`broadcast.chat`](/x-api/activity/event-payloads#broadcast-chat) payload now includes an `is_moderator` boolean. The broadcast owner is reported as `is_moderator: false` in their own broadcast.
+  - **Broadcast scopes in OAuth 1.0a token exchange**: Exchanged tokens now include `broadcast.read` for Read apps and `broadcast.write` for Read and write apps. See the [permission-to-scope mapping](/fundamentals/authentication/oauth-2-0/oauth-1-0a-token-exchange).
+  - **Livestream API access**: The [Livestream API](/livestream-api/introduction) is available to allowlisted apps. It is not limited to Enterprise. Request access with the [Livestream API Access Form](/forms/livestream-api-access).
+</Update>
+
 <Update label="Sep 21, 2026" description="X API v2">
   ### Migrate OAuth 1.0a user tokens to OAuth 2.0 with token exchange