API changelog
Every change to the /v1 surface and its webhooks, newest first. Additive by default — see versioning for how breaking changes would be handled.
Cards go live on the API Added
Issue virtual and physical cards funded by a ledger account, with spending controls (per-auth, daily and monthly limits, MCC rules). Authorizations decide against the available balance in real time; clear and reverse flows post to the ledger. A short-lived cardholder session token mints an embeddable card UI via the SDK.
Remote check deposit Added
Submit a check image for deposit and receive check_deposit.posted or check_deposit.rejected when it clears or is returned. Funds post to the ledger on the same double-entry path as every other credit.
Lossless webhook secret rotation Changed
During a rotation window the signature header now carries every active secret's signature, comma-separated, so a receiver holding either the old or new secret keeps verifying. Install the new secret during the window, then retire the old one — no dropped deliveries.
Idempotency keys on every write Added
All POST endpoints accept an Idempotency-Key header. A retried request with the same key returns the original result instead of creating a duplicate — safe to retry through timeouts.
Returns modelled explicitly Changed
A settled payment that is later returned now emits payment_order.returned with a return code, distinct from payment_order.failed (which is a pre-settlement decline). Update handlers that previously treated both as one case.
Consistent error envelope Fixed
Every 4xx now returns the same JSON shape — { error, message, details } — with a stable machine-readable error code, so you can branch on the code rather than parsing prose.
Virtual accounts & balances Added
Open virtual accounts under a ledger account and read pending, posted and available balances plus full entry history — reconciliation as a read.
/v1 general availability Added
The first stable surface: payment orders across ACH, RTP, wire and book transfers, a double-entry ledger, counterparties, and signed webhooks — all behind the X-API-Key header.