Changelog

All notable changes to the 505pay platform APIs are documented here. Versions follow Semantic Versioning. The frontend and backend are versioned together.

Subscribe to the RSS feed for automated notifications.

v0.35.1 — 2026-07-13

Added

On-prem license enforcement (pkg/license, offline Ed25519-JWS) — recon-service now supports a fail-closed license boot guard and a RequireLicensedModule request gate that degrades licensed modules to read-only past a grace window. Off by default; only affects on-prem deployments that opt in.

Fixed

recon disbursement force-settle no longer writes a schema-invalid paid status that caused a 500.

Feature Flags

🆕 LICENSE_ENFORCE — on-prem license enforcement gate, off by default.

v0.35.0 — 2026-07-10

Added

Step-up re-authentication. New POST /v1/auth/step-up mints a short-lived elevated access token after fresh TOTP verification. Sensitive mutations (platform tenant/module writes, OIDC-client writes, payment/disbursement/refund approvals) now return 401 insufficient_user_authentication (RFC 9470 challenge) when the caller's token lacks a fresh step-up.
Accounts IdP carve-out — login/signup now redirect to a dedicated accounts.* host; a new dashboard OIDC RP client is seeded.
New payer checkout app origin added to payments-service CORS_ALLOWED_ORIGINS.

Security

Audit-log tamper-proofing hardening closed a WORM audit-log delete path and a default-partition data-laundering pocket; removed an over-broad ledger permission grant.

v0.34.0 — 2026-07-05

Added

Tenant hierarchy: PUT /v1/admin/tenants/{tenantId}/parent, parent_tenant_id on tenant create/get/list, and a new root-tenant-only platform.tenant.kyb permission.

Changed

Access tokens are now audience-scoped instead of carrying a universal audience.

v0.33.0 — 2026-07-02

Added

CashUp reconciliation maker/checker governance: a dedicated recon.disbursement.cfo_approve permission for disbursement second-approval, dual-control lifecycles on risk holds and MDR-rate changes, and a settlement net-adjustments ledger.

v0.32.0 — 2026-06-18

Changed

Breaking (offset callers only): 14 recon list endpoints migrated from an offset-based envelope ({<resource>, total, limit, offset}, ignoring ?page=) to the platform-canonical page-based envelope ({<resource>, total, page, limit, total_pages}). Callers already using ?page= are unaffected; callers relying on ?limit=/?offset= need to switch to ?page=.

Added

Per-tenant settings: BYO-SMTP and BYO-S3 storage (write-only secrets, async test-connection), per-tenant rate-limit / access-token TTL / signup toggle.

Feature Flags

⚙️ SIGNUP_ENABLED (default false) plus a per-tenant signup_enabled toggle.

v0.31.0 — 2026-06-12

Added

AML/fraud compliance surface: PPATK DTTOT/PPSPM sanctions-list screening, cross-rail structuring detection, and AML case management with maker-checker approval — advisory only, screening remains flag-off in production.

Fixed

MDR fee is now debited before crediting the merchant balance (net-of-fee); PSP callback amounts are validated before crediting; refund status transitions are now compare-and-swap safe.
Replayed TOTP codes are now rejected.

v0.30.0 — 2026-06-10

Changed

JWT slimming. Access tokens now carry role bindings instead of the fully expanded permission set, cutting a heavy admin token from ~20 KB to under 1 KB. Permission resolution moved server-side: GET /v1/me now returns a deduped permissions[] array for frontend gating; POST /v1/check is unchanged as the service-to-service authorization path.

Fixed

A suspended user's tokens are now denied within a single ≤30s window instead of remaining valid until natural expiry.

v0.29.1 — 2026-06-05

Changed

Internal reliability and tooling improvements; no public API changes.

v0.29.0 — 2026-06-05

Added

New POST /v1/auth/enter-sandbox mints a sandbox-environment token scoped to the caller's own tenant; the sandbox module catalog widened to 8 keys (adding KYC/fraud/AML/marketplace).

v0.28.0 — 2026-06-04

Added

Double-entry billing ledger, owner/subscriber commercial-tier billing, and OIDC id_token support on the authorization_code grant (audience-bound, nonce-checked).
API-key rotation and JWKS signing-key rotation.

Feature Flags

🆕 PAYMENTS_COMPLIANCE_SCREENING_ENABLED, PAYMENTS_KYC_VERIFICATION_ENABLED, PAYMENTS_SETTLEMENT_ENABLED — all ship off pending the in-house AML/KYC engine.
🆕 CONTENT_SECURITY_POLICY / CSP_REPORT_ONLY — off by default.

v0.27.1 — 2026-06-03

Changed

Internal reliability and tooling improvements; no public API changes.

v0.27.0 — 2026-06-03

Added

CashUp multi-rail disbursement: Flip REST plus Mandiri/BCA/UOB over BI-SNAP, with manual-worksheet and PSP-API execution modes. Feature-flag-gated off by default.

Changed

All per-service and the merged root OpenAPI specs now use the REST aggregator hosts (api.{apex} / sandbox.{apex}) instead of stale per-service subdomains; the SNAP gateway is reachable only via the /v1.0/ path prefix on those hosts, not a snap.* hostname. sdks/authsdk-ts and postman.json regenerated to match.

v0.26.0 — 2026-05-31

Added

Fraud Detection console surface (decisions log, review queue, rule builder, lists manager). Screening itself remains flag-only in production (FRAUD_SCREENING_ENABLED=false) — nothing is blocked yet.

v0.25.0 — 2026-05-28

Changed

Signup target tenant is now resolved per-request from the request Host header against tenant_hostnames, failing closed (signup_unavailable 404) on an unrecognized host.
docs.505pay.link and sandbox.505pay.link now redirect (308) to docs.straventa.com.

v0.24.0 — 2026-05-27

Added

Host-based tenant resolution and a module control plane; GET /v1/me now returns per-tenant branding and enabled modules.

v0.23.0 — 2026-05-26

Added

DOKU is now a live payment provider over its real BI-SNAP wire contract — B2B access-token issuance (RSA-SHA256), signed VA/e-wallet/QRIS transactions (HMAC-SHA512), and signed asynchronous notifications. A dev/test-only mock-doku-service emulates the DOKU SNAP sandbox for local development.

v0.22.1 — 2026-05-25

Added

Card-velocity fraud rule; XLSX export for the transactions report.

Security

Removed a committed FDW reader password literal from the repository.

v0.22.0 — 2026-05-23

Changed

Internal console design-system migration (Mercury); no public API changes.

v0.21.0 — 2026-05-22

Changed

Internal console visual retokenization; no public API changes.

v0.20.0 — 2026-05-22

Changed

Internal design-system foundation work (@payops/ui); no public API changes.

v0.19.3 — 2026-05-22

Fixed

Bearer-token API-key callers were incorrectly rejected by the merchant_required gate on roughly 10 route families — fixed.
List endpoints now return 200 with an empty array instead of 404 for merchants with no data yet.
card_3ds and OTC (Alfamart/Indomaret) channels are now correctly surfaced by ListChannels for the caller's jurisdiction.

v0.19.2 — 2026-05-22

Added

GET /catalog/modifiers and GET /catalog/tax-categories endpoints.

Security

Introduced a platform.payments.kyc.{review,decide} permission namespace and revoked platform.payments.payouts.* from tenant_admin — this permission had been unintentionally reachable by tenant admins.
Service-account admin handlers are now scoped to the caller's own tenant.

v0.19.1 — 2026-05-21

Added

POST /v1/payments/invoices/{id}/resend (capped at 5/invoice) and POST /v1/payments/invoices/{id}/void endpoints.

Fixed

Dispute-opened and dispute-resolved webhook/notification fan-out is now correctly wired (was silently dropped).

v0.19.0 — 2026-05-21

Added

POS tax-category admin routes under /api/pos/v1/catalog/tax-categories; POST /api/pos/v1/sales now honors a tax_category request field.
Merchant-level notification-preference endpoints (GET/PUT /v1/payments/settings/notifications/{merchant_id}).
POST /v1/payments/recon-questions and a settlement_id filter plus CSV export on the settlements report.

Security

GET /v1/admin/audit/export now enforces the tenant.audit.export permission and scopes results to the caller's own tenant — previously any valid bearer token could export any tenant's audit data.

Fixed

Dispute evidence uploads are now forwarded to the PSP adapter (previously persisted to storage but never transmitted, causing disputes to auto-lose at the deadline).

v0.18.4 — 2026-05-19

Added

POS email receipts now render the actual receipt content (was a placeholder string); SMS receipts are now sent via Twilio when configured.
Three previously chi-only POS routes (GET /api/pos/v1/config, POST .../receipt-email, POST .../receipt-sms) are now documented in both OpenAPI specs.

v0.18.3 — 2026-05-18

Changed

Internal reliability and tooling improvements; no public API changes.

v0.18.2 — 2026-05-18

Fixed

Login endpoint latency and 503s under concurrent load fixed (connection-pool and transaction restructuring).
A cross-tab token-refresh race that could trigger spurious refresh_reuse_detected rejections is fixed.

v0.18.1 — 2026-05-18

Added

Akulaku and Kredivo BNPL payment channels; a generic card_3ds channel with POST /v1/payments/intents/{id}/3ds-callback.
POST /api/pos/v1/catalog/products/bulk multipart bulk-import endpoint.

Fixed

Cursor pagination on the POS SKU/category/cashier report endpoints.

v0.18.0 — 2026-05-18

Added

GET/POST /catalog/categories and GET/POST /catalog/variants/{id}/modifiers endpoints; customer_id field on POST /sales.

v0.17.0 — 2026-05-18

Added

Cases inbox: GET /v1/payments/cases, GET /v1/payments/cases/{id}, PATCH /v1/payments/cases/{id}.
POS shift reporting: GET /api/pos/v1/shifts/{id}/z-report, /x-report, and /zreport.pdf.

Feature Flags

⚙️ PAYMENTS_FEE_ENGINE_ENABLED (default false) gates the fee-application engine on webhook processing.

v0.16.0 — 2026-05-18

Added

"Stop the money" tenant kill-switch: a per-tenant env field on the login response and user/tenant revocation enforcement so a suspended account or tenant is blocked platform-wide within seconds.
Signup bot defense (password-strength floor, Turnstile, HaveIBeenPwned) now runs before password hashing.

Fixed

The SDK now returns 403 insufficient_scope (not a generic 500) when /check denies a request.
Login now returns a structured 503 with Retry-After under connection-pool exhaustion instead of hanging.

v0.15.2 — 2026-05-17

Security

8 high-severity Next.js CVEs eliminated (bumped to 16.2.6), including an SSRF via WebSocket upgrade and an App Router middleware bypass.
Audit-log IP recording hardened against a silent-drop bug affecting payments.api_key.* audit rows.

Fixed

Checkout idempotency key now persists across remounts, preventing a double-charge race when a customer navigates back during a slow PSP response.

v0.15.1 — 2026-05-17

Security

Closed a login user-enumeration timing oracle (known vs. unknown email now return in near-identical time).
Signup rate limits now correctly enforce 3/IP/hour and 5/email/day.

Fixed

Environment-switch now returns a proper 4xx (mfa_enrollment_required) instead of a 500 for accounts without TOTP enrolled.
Outbound email From: header no longer leaks internal branding to payers.

v0.15.0 — 2026-05-17

Added

In-app notifications (table, REST endpoints, bell-icon feed), a POS discount engine, and SNAP test-bench credentials with a provisioning UI and access-token cache.

Security

API-key middleware now correctly rejects expired keys (previously accepted them silently).
The environment-mismatch database constraint is now properly enforced, and cross-environment key revocation is gated.

v0.14.3 — 2026-05-17

Fixed

Payout state machine widened with a per-channel default settlement term and a full disbursement-item breakdown in the response DTO.
E-Faktur (tax invoice) NPWP field wiring and PPN rate versioning corrected.

v0.14.2 — 2026-05-17

Added

API keys gained granular scopes and an expires_at field.

Fixed

Refund lifecycle closed 5 gaps: audit events, negative-amount response DTO, settlement deduction, status-token wiring. OTC (Alfamart/Indomaret) channel now works end-to-end; e-wallet channels gained metadata and split return URLs.

v0.14.1 — 2026-05-17

Added

Subscriptions, an invoice product, open-amount/partial-payment intents, a card channel with 3DS iframe, a fraud velocity engine with hCaptcha, monthly merchant statements, and notification preferences.

Fixed

Signup no longer rejects requests carrying the hp (honeypot) and turnstile_token fields.
Webhook endpoint URLs must now use https:// — http:// endpoints are rejected to prevent HMAC secret leakage over plaintext.

v0.14.0 — 2026-05-15

Added

Platform-admin KYC review queue; a TOTP-gated ownership-transfer flow; webhook management additions (rotate secret, delivery log, event catalog).
TeamInvitationRequest.scope_pos_store_id and TransferOwnershipRequest.totp_code documented in the OpenAPI spec, with new error codes pos_scope_without_pos_role, mfa_enrollment_required, and invalid_mfa_code.

v0.13.0 — 2026-05-15

This release ships the complete first-generation PayOps API: sandbox/live isolation, hosted checkout, payment reporting, API-key auth for server-side integrators, disbursements, ledger/balance, tax invoices, disputes, KYC, and POS reporting.

Added

Hosted checkout pages with API-key auth (Bearer sk_…), checkout_url, and idempotency replay.
Environment-scoped API keys: sk_test_* / sk_live_* prefix scheme; GET /v1/me reports the caller's environment.
Disbursements (recipients, batches, two-eyes approval), merchant payout settlements, and a merchant fee-billing engine.
Refund lifecycle: an 8-value reason taxonomy, partial refunds with race-safe remaining-amount validation, two-eyes approval over a per-tenant threshold (GET/PUT /v1/payments/refund-policies, POST /v1/payments/refunds/{id}/approve), and a public, HMAC-signed refund-status page (GET /v1/payments/refund-status/{shortcode}).
Outbound merchant webhook subscriptions with HMAC signing; e-Faktur tax-invoice issuance; SNAP signature test bench in the docs.

Changed — Breaking

Payments-service API-key error codes renamed: 401 invalid_api_key → 403 env_mismatch; 403 scope_forbidden → 403 insufficient_scope; 422 invalid_metadata → 400 metadata_too_large. No integrators were affected — the hosted-checkout SDK docs referencing the old codes were never published.

v0.12.7 — 2026-05-11

Added

Docs-console environment switcher — flipping sandbox/production rewrites every sandbox URL in every code sample live, without a page reload.
Interactive API playground enabled for sending real requests from the docs.
Error-code catalog and webhook-event catalog reference pages.

v0.12.6 — 2026-05-11

Added

SNAP-BI Gateway — new snap-gateway-service with 10 Bank Indonesia SNAP-compliant endpoints:
- POST /v1.0/access-token/b2b (RSA asymmetric partner auth)
- POST /v1.0/transfer-va/{inquiry,payment,status} (HMAC → Payments service)
- POST /v1.0/transfer-credit/{partner_route} (HMAC → Payments service)
- POST /v1.0/balance-inquiry, /v1.0/transaction-status-inquiry, /v1.0/transaction-history-list
- POST /v1.0/qr/qr-mpm-generate, /v1.0/qr/qr-mpm-notify-payment
Cryptographic signature verification: RSA asymmetric for access-token, HMAC-SHA512 for all other endpoints.
Replay protection via X-EXTERNAL-ID uniqueness enforcement per partner per UTC day.
7-year audit retention (snap_audit_log) per PBI No.23/6/PBI/2021 §12.
Per-request structured logging: partner_id, service_code, downstream_service, latency_ms.

Fixed

E2E TRUNCATE+seed atomicity race (permissions_pkey) fixed via single-transaction seeding.
make test-e2e-isolated serialized with -p 1 to prevent fixture race conditions.

v0.12.5 — 2026-05-11

Added

Public developer docs relaunched at docs.505pay.link — Fumadocs + Next.js 16, replacing the Redocly static bundle.
Full OpenAPI reference for all four services (Auth, Payments, POS, Recon) with 259 auto-generated endpoint pages.
10 cross-cutting guide pages: Quickstart, Authentication, Webhooks, Errors, Idempotency, Pagination, Rate Limits, Versioning, Sandbox, Going Live.
15 per-method payment guides with Mermaid sequence diagrams and webhook event tables: QRIS Dynamic/Static, VA (BCA/BNI/BRI/Mandiri/Permata), GoPay, OVO, DANA, ShopeePay, Kredivo, Akulaku, Card 3DS.
x-codeSamples (curl / TypeScript / Python / PHP / Go) across all four service specs.
IBM Plex Sans + JetBrains Mono self-hosted variable fonts; full CSS design token system.

Changed

docs-console Drone pipeline now runs pnpm lint && pnpm build instead of legacy scripts/build.sh.

Removed

scripts/add-code-samples.py one-shot Wave 1 utility.

v0.12.4 — 2026-05-11

Added

make doctor / scripts/doctor.sh — preflight check for tool versions with copy-paste install commands.
make first-run — end-to-end first-time setup (doctor → .env → JWT keys → dev stack → bootstrap admin).
make hooks-install / lefthook.yml — opt-in git hooks (pre-commit: gofmt; pre-push: make ci).
make version-lockstep — CI guard asserting VERSION, web/auth-console/package.json, and CHANGELOG.md stay on the same version.
make env-drift — CI guard asserting every docker-compose.yml env var is declared in .env.example.
scripts/README.md — reference table for every script with make target and purpose.
Four new golangci-lint linters: errorlint, bodyclose, noctx, contextcheck.

Fixed

Replaced all direct err == pgx.ErrNoRows and err == io.EOF sentinel comparisons with errors.Is(...) across all services.

Older entries

Releases prior to v0.12.4 are in the repository CHANGELOG.

Was this page helpful?