Changelog

Unreleased

Changed

• POST /payment-refund answers success: true, message: "PENDING" when the processor accepted the refund but has not settled it yet. It used to answer success: false, message: "ERROR". ERROR now means the processor gave no outcome or rejected the refund. See Refunds.
• A sale whose 3-D Secure authentication failed or was unavailable is declined before any charge is attempted, and your postback carries DECLINED. See Testing.
• Lookups and postbacks give a readable message for an in-flight payment instead of PENDING null.
• Postbacks are now queued for World Acquiring payments too.

Added

• CyberSource and World Acquiring sandbox test cards, with their results, in Testing.
• Sandbox API keys you create and rotate yourself on Get set up. See Authentication.
• The checkout demo can send its postback to a URL you choose.

10 October 2026

Added

• Hosted checkout and widget: POST /api/payment-session opens a 30 minute session, and the widget.js script shows the gateway’s card form in an iframe. The Idempotency-Key header is required on the new call.
• 3-D Secure runs inside the widget iframe.
• The widget demo and sandbox sign-in on Get set up.

Earlier

First version of this developer site. The merchant API is POST /api/payment-process, POST /payment-Lookup, POST /payment-refund and GET /health.