Changelog¶

Release history of the SecPaid Payment API.

Unreleased¶

Absolute split fix: Corrected calculation where absolute shares consumed the entire payment leaving the link owner with €0
Multiple refunds for split links: Recipients in a split link can now be refunded individually
Dispute auto-submit: Dispute evidence documents are automatically generated and uploaded
Dispute document webhook: External webhook for dispute document URLs when DISPUTE_DOC_URL is configured
Checkout UI redesign: Cleaner mobile/desktop payment page with reduced spacing
Logo fix: Added missing SecPaid logo SVG to repository

Performance & stability hotfixes.

Performance: Optimized getPayInTransactions query (19s → 50ms) with proper indexing
Fix: Split payment recipient mapping to wrong user resolved
Fix: Null check on disputed transaction in disputes frontend
Fix: Evidence upload increased to nginx 25M / PHP 10M
Fix: Use abs() on refund amount to prevent negative cents sent to payment provider
Fix: Restored json_encode on dispute webhook evidence details
Database: Added performance indexes on payment_master table

Refund API: Direct refund processing (auto-approve path)
Dispute UI: Admin dispute management panel
Fix: File upload switched to multipart/form-data
Fix: Evidence upload size capped at 4.5 MB
Webhook resend: sendWebhookViaPayId API for manually re-triggering webhooks
Security: Removed hardcoded tokens, legacy references cleaned up

Dynamic endpoints: payment_endpoint and callback_url can now be set per-link via API (URL, index, or comma-separated)
Multiple endpoints: Support for sending webhooks to multiple URLs simultaneously
Encryption key parameter: encryption_key now passable as request parameter
Disputed transaction refunds: Refund flow for dispute-won transactions
Performance: getPayInTransactions server-side date filtering (46s → 1.3s)
Infrastructure: PHP-FPM pm.max_children increased from 5 to 50

Cancellation feature: Customers can cancel payment links (configurable per link)
Default cancellable: cancellable = true by default
Cancel webhook: payment_endpoint receives status: "cancel" on cancellation

PayIn transaction performance: Query optimization for large transaction histories

Dispute refunds: Separate dispute/refund pages in admin and user dashboards
Invoice creation: Admin can create invoices manually
Cancel link: Cancellation feature for payment links
Refund blocked for invoices: Invoice-type transactions cannot be refunded via API

Split links: Distribute payments across multiple recipients with proportional shares
Absolute split type: Fixed EUR amounts per recipient (split_type: "absolute")
Personal QR code: Custom-amount QR code links per user
Multiple callback URLs: Account can configure multiple callback_urls with index-based selection
Tax invoice reports: Monthly service fee invoice generation (getTaxInvoiceList)
Bank transfer: Bank transfer payment method with admin confirmation workflow
PDF export: Transaction receipts and reports as PDF
Additional payment methods: Extended payment method support

Payment Links: Create, list, delete payment links via API (createLink, getMyUnusedLinks, getMyUsedLinks, deleteLink)
API Key auth: Simplified API Key authentication
Card payments: Card payment support via hosted checkout
Webhooks: Server-to-server payment notifications (payment_endpoint)
Callbacks: Browser redirects after payment (callback_url)
Encryption: Optional AES-256-CBC encryption for webhook payloads
QR codes: Auto-generated QR code images for payment links
Refunds: refundPayment endpoint for full and partial refunds
Transactions: getPayInTransactions / getPayOutTransactions for financial history