# API changelog

Dated changes to the Vezmo API, webhooks and browser SDKs, newest first, with deprecated routes and how changes reach you, from API key expiry reminders and plan limits to the V2 webhook signature, the Agreements API and the payment link permission change.

Source: https://vezmo.com/docs/developers/changelog

## How changes reach you

- **One version.** Every call goes to `https://api.vezmo.com/api/v1`, with no version header. Changes are made to
  that version.
- **New fields and events can appear at any time.** Ignore fields you don't know, in answers and in webhook events.
  A new event shows in the event list of **Developers › Webhooks**: tick it on your endpoint to receive it.
- **Renamed routes.** So far, a route that got a new name has kept working under its old one, marked deprecated in the
  [API reference](https://user.vezmo.com/docs/v1). See [Deprecated](#deprecated).
- **This page** lists the changes, newest first, by the day they reached the API. The WooCommerce plugin keeps its own
  changelog on GitHub: [vezmoPay-wooCommerce](https://github.com/vezmoPay/vezmoPay-wooCommerce/releases).

## Deprecated

| Route | Use instead | Since |
| --- | --- | --- |
| `POST /merchant/agreements/:id/recipients/:rid/id-check/reject` | `POST /merchant/agreements/:id/recipients/:rid/id-check/ask-again` (same behaviour, new name) | 29 Oct 2026 |

## November 2026

- **9 Nov.** API keys: we email reminders 30 and 7 days before a key's expiry date, and **Change expiry** can remove
  the date. A new key has no expiry unless you pick one. See [The expiry date](/docs/developers/api-keys#the-expiry-date).
- **6 Nov.** `payment.refunded`: a refund that goes through after a failed one has its own event `id`, so it is no
  longer skipped as a repeat.
- **2 Nov.** Plan limits: your plan's API requests a minute, all your keys together, in watch mode. When a limit is
  enforced, a request past it answers `PLAN_LIMIT` (`429` with `Retry-After` for API requests, `403` for the others).
  See [Rate limits](/docs/developers/rate-limits).

## October 2026

- **29 Oct.** Agreements: `…/id-check/ask-again` asks a signer for a new ID, and `…/id-check/reject` becomes its old
  name. New: reject a signer, `POST /merchant/agreements/:id/complete` (approve and complete), and the
  `agreement.awaiting_approval` event.
- **29 Oct.** Payment links and invoices: taking a payment with an API key needs the write permission.
  `/merchant/paylinks/:code/client`, `…/checkout` and `…/confirm` need `paylink.update` (was `paylink.read`);
  `/merchant/invoice/:id/checkout`, `…/pay` and `…/confirm` need `invoice.update` (was `invoice.read`).
- **29 Oct.** Rate limit per API key: requests a second, `429` `rate_limited` with `Retry-After`.
  `POST /merchant/invoice/:id/pay` also has its own limit per key.
- **29 Oct.** Declined cards: one set of limits on every card checkout. At a limit, `429` `too_many_declines` with a
  `reason`.
- **29 Oct.** Card fields: Vezmo's server prices and confirms every card payment made with `vezmo-elements.js`.
- **29 Oct.** Webhooks: each delivery has 5 seconds in all (connecting and your reply), and we read only the first
  2 KB of your reply. Payment events for a sale paid in your customer's own currency carry your price in `amount` and
  `currency`, and what they paid in `charged`.
- **29 Oct.** Payouts: a payout the bank returns after it was paid sends `payout.failed` after `payout.paid`, with the
  same `id`.
- **20 Oct.** Live API keys can be generated once VezmoPay is approved for your business; before that, `403`
  `LIVE_KEYS_NEED_VEZMOPAY`. Test keys work any time.
- **18 Oct.** Test mode: emails about test objects go only to your team; asking for an object of the other mode answers
  `404` with a hint; payment links, invoices and proposals made with a test key are test ones.
- **17 Oct.** Test and live stay apart: a test key sees only test payments and a live key only live ones, and every
  payment carries `livemode`. A test key can't change the account's payment methods or 3D Secure (`403`).
- **17 Oct.** Refunds (`POST /merchant/payment/:id/refund`) take an `Idempotency-Key`.
- **17 Oct.** Webhooks: every delivery is also signed with `X-Webhook-Signature-V2`, over `X-Webhook-Timestamp` and the
  body, so you can refuse an old event sent again. `X-Webhook-Signature` stays. See
  [Check the signature](/docs/developers/webhooks#check-the-signature).
- **17 Oct.** Agreements API (`/merchant/agreements`) and the `agreement.*` events.
- **17 Oct.** Subscriptions API: new keys get the `subscription.create` and `subscription.read` permissions (calls
  answered `403` before). `POST /merchant/subscription` takes an `Idempotency-Key`. New event:
  `subscription.cancel_scheduled`.
- **17 Oct.** Webhooks: each refund sends its own `payment.refunded`, and `invoice.paid` and `invoice.cancelled` are
  sent.
- **16 Oct.** Webhooks: `subscription.*` events are delivered; new `subscription.trial_started` and
  `payment_method.saved`.
- **15 Oct.** Mobile apps: add your apps under **Developers › Mobile apps**; checkout sessions take `app.returnUrl`.
- **14 Oct.** Payments API and payment events: `method` names UPI, Klarna, Affirm, Afterpay and Amazon Pay.
- **14 Oct.** Your customer's own currency in `vezmo-elements.js` (and in API checkout sessions since 13 Oct).
- **8 Oct.** Disputes: `GET /merchant/dispute` and `GET /merchant/dispute/:id`. The `dispute.*` events carry
  `reasonCode`, `evidenceDueBy` and `livemode`.

## September 2026

- **30 Sep.** `GET /merchant/payment` pages by cursor: `cursor`, `nextCursor` and `hasMore`. See
  [Pagination](/docs/developers/errors-and-retries#pagination).
- **27 Sep.** Webhooks: an endpoint that keeps failing for 3 days (and at least 50 attempts) is switched off, and your
  team is emailed. Failed events are retried, 4 attempts in all.

## Related

- [Errors, retries and idempotency](/docs/developers/errors-and-retries)
- [Webhooks](/docs/developers/webhooks)
- [API reference](https://user.vezmo.com/docs/v1)