VTEX in the First Half of 2026: The Updates That Actually Touch Your Integrations

Six Months, Nine Releases, One Pattern

VTEX shipped steadily through the first half of 2026, and almost none of it was new surface area. The pattern running through the release notes is quieter than that: operations that used to require a support ticket moved into the Admin, data that used to require an API call became visible in the interface, and the audit trail got meaningfully denser around personal information.

That is a good kind of boring. Here is what landed, and what is worth acting on.

The One With a Deadline

Brazil moved to an alphanumeric format for company registration numbers this month. VTEX got ahead of it back in April: the document and company registration fields in Master Data v1 previously accepted numeric values only, and the validation logic now handles alphanumeric input. Master Data v2 never carried that restriction, so nothing changed there.

No action was required on the platform side, and the update rolled out to stores in every region automatically. The risk was never VTEX, though. It is everything downstream: your own validation regexes, your ERP mapping, your invoicing pipeline, any place a fourteen-digit assumption is baked into a schema. If you have not run that check yet, run it now rather than during a billing cycle.

Governance Got Noticeably Tighter

Two changes here, and read together they point in the same direction: VTEX is building out the paper trail around sensitive data access.

In June, Audit picked up a substantial batch of new event types across four applications:

VTEX ID: UserLogin and UserLogout, both recording the user ID.
Master Data: read, create, update, delete, and search operations on personal information, scoped to the CL and AD entities through the CRM interface. Most log the document ID; the search event logs the search details.
Orders: GetUnmaskedPersonalInformation and UpdatePersonalInformation, keyed to the order ID.
Gift Cards: viewing transactions, plus viewing, creating, and editing conditions.

That GetUnmaskedPersonalInformation event is the interesting one. Knowing which operator unmasked a customer’s data on which order, and when, is exactly the kind of record you want to already have when someone asks for it.

In January, the Client secret field for Google and Facebook login stopped rendering in full. Revisit the configuration under Account Settings and you now see only the last three characters. It is a display-only change with no effect on authentication, which also means it is a change you will only notice at the worst possible moment: when you needed to copy that value out and no longer can. Store your secrets somewhere you own.

Fewer Tickets, More Self-Service

Sales channels (the artist formerly known as trade policies) can now be created directly in the Admin by users holding the Owner role, with no ticket required. Two caveats worth reading before you click: creating a channel may carry additional cost depending on your contract, and every creation action is written to the audit logs. Autonomy and accountability arriving together is the right trade.

The catalog spreadsheet import and export experience reached general availability in January, with migration completing across all regions by the end of February. Import and export now live together under Catalog, Products and SKUs. The genuinely useful parts:

Filter-driven export. Apply filters or a search on the list page and only those results get exported, rather than dumping the whole catalog and cutting it down afterward.
An export status window, so you can see what finished and what is still processing, and run several export types concurrently.
A downloadable import template in .xlsx, with field names available in English, Spanish, and Portuguese.

Order Data You Used to Need the API For

Custom data attached to orders in the OMS, meaning store custom fields (customFields) and app payloads (customApps), was previously reachable only through API calls. As of May it renders on the order details page and in the print view, grouped into collapsible menus, one per type.

If you have ever tried to debug a checkout integration by explaining to a support agent which API endpoint to call, you already know why this matters. One mild irony: the feature that eliminates API queries has to be switched on by opening a support ticket.

Payments, Logistics, Fulfillment

Contingency Mode is the new name for Mode-off, and the rename is an improvement in itself since the old label described a state rather than a purpose. The behavior is unchanged: when VTEX detects repeated technical failures in a payment connector, the mode can activate automatically to protect eligible transactions while the provider recovers. What did change is the recovery path. Queued transactions are reprocessed faster once the connector comes back, which matters most for express shipping orders, where approval latency eats directly into the promise you made at checkout. It is fully automatic, so there is nothing to configure.

Operational capacity left beta in May and is now live everywhere. It governs how much each seller can take on, letting you watch order distribution across the network and rebalance when one seller is absorbing more than it should. The GA release added segmentation by sales channel, which is the piece that makes it usable in a real multi-policy operation. Enable it under Shipping, Operational capacity. One prerequisite that will stop you cold if you miss it: your main account needs linked franchise accounts.

Pick and Pack got proper localization across the application, the Admin, and printed labels, covering Portuguese, English, French, and Spanish. The target is bilingual operations, Canada being the explicit example. The reasoning is worth noting even if you do not run a bilingual warehouse: when the app says one thing and the label says another, the operator absorbs that gap as interpretation time on every single pick. Catalog translations still depend on what the retailer sends to the platform, so this fixes the interface, not your product data.

What I Would Actually Do This Week

Grep your codebase for company registration number validation. The Brazilian transition is live as of this month. Anything numeric-only is now a latent bug.
Pull the new Audit events and look at who is reading unmasked personal data. Not because you expect to find something, but because knowing the baseline is the whole point of having the log.
If you run seller or marketplace operations, open Operational capacity. Sales channel segmentation is what makes it worth configuring properly rather than leaving at defaults.
File the ticket for order custom data if you spend any real time debugging orders. The lead time on a support request is shorter than the hours you will otherwise spend in Postman.

All of the above is drawn from the VTEX announcements feed, which remains the single best page to keep in a browser tab if you build on the platform.