Draft changelog: bulk bookmarks and OAuth 2.0 auth updates

changelog.mdx

@@ -7,6 +7,21 @@ keywords: ["changelog", "API updates", "release notes", "what's new", "API chang
 
 To subscribe to updates, please [**“Turn on notifications”**](https://help.x.com/en/managing-your-account/notifications-on-mobile-devices#:~:text=In%20the%20top%20menu,%20you,you%20would%20like%20to%20receive) for [**@API**](https://x.com/api). You can also follow this changelog in your feed reader via the [**RSS feed**](https://docs.x.com/changelog/rss.xml).
 
+<Update label="Sep 8, 2026" description="X API v2">
+  ### Bulk bookmarking with `tweet_ids`
+
+  You can now bookmark up to **25 Posts** in a single request. [`POST /2/users/{id}/bookmarks`](/x-api/users/create-bookmark) accepts a new `tweet_ids` array as an alternative to the existing `tweet_id` field (the two are mutually exclusive).
+
+  - The optional `folder_id` applies to every Post in the request
+  - The response returns per-Post results in request order, with `bookmarked` and `tweet_id` for each
+  - Failures are reported per ID in `errors`; the remaining Posts are still bookmarked
+  - Billing and rate limits still apply per HTTP request
+
+  ### OAuth 2.0 user context for webhook and subscription management
+
+  The [webhook management endpoints](/x-api/webhooks/introduction) (`GET`/`POST /2/webhooks`, `PUT`/`DELETE /2/webhooks/{webhook_id}`) and the X Activity API subscription endpoints ([`PUT`](/x-api/activity/update-x-activity-subscription)/[`DELETE /2/activity/subscriptions/{subscription_id}`](/x-api/activity/deletes-x-activity-subscription)) now accept [OAuth 2.0 user context](/fundamentals/authentication/oauth-2-0/authorization-code) authentication. Previously, most of these endpoints were limited to app-only Bearer Tokens or OAuth 1.0a. No changes are required if you use existing authentication methods.
+</Update>
+
 <Update label="Sep 1, 2026" description="X API v2">
   ### Media upload and Post-create size and duration limits