Changelog

We follow calendar versioning. Every notable change that affects partners is logged here. Subscribe to [email protected] for release emails.

2026-07-04

Changed — attachment URLs are now short-lived signed links

attachment_url values returned for chat messages, dispute evidence, and escrow attachments now carry a signed capability token (?exp=…&sig=…). Render or download the URL as returned — do not strip the query string, cache it long-term, or reconstruct the bare URL. The token is valid for roughly 12–24h; re-fetch the parent resource to obtain a fresh link. Files remain private to the escrow's parties and admins.
Uploads still return a bare, storable URL from POST /api/upload/:type; the signing happens only on read responses. Submit the bare URL back as attachment_url / evidence_urls exactly as before.

Changed — partner deep links must be signed

POST /api/escrows/from-link now requires a valid HMAC signature whenever partner parameters (seller, item, etc.) are present. An unsigned partner link is rejected with 400 SIGNATURE_REQUIRED. Malformed URL-encoding now returns 400 instead of a 500.

Fixed — payment webhook retries are never silently dropped

A webhook delivery that fails mid-processing on a transient error is now reprocessed on the gateway's retry instead of being treated as a duplicate. Previously such a retry could be acknowledged (200) without the payment being applied. Genuinely duplicate (already-processed) deliveries are still acknowledged idempotently. A late expired/failed callback arriving after a successful paid no longer overwrites the paid state.

Fixed — idempotent retries after a failed request

A request that fails (any non-2xx response, including a transient 5xx) is no longer cached against its Idempotency-Key. Previously the failure was frozen as the key's answer and replayed for the key's 24h lifetime; now retrying with the same key re-executes the operation. Successful (2xx) responses are still cached and replayed as before.

Added — shipping tracking for physical goods

Sellers can attach a courier + AWB (resi) when marking an escrow shipped: POST /api/escrows/:id/send now accepts an optional { courier, tracking_number } body.
New party-only endpoints: GET /api/escrows/:id/tracking (courier metadata, live journey snapshot, and the courier dropdown list) and POST /api/escrows/:id/tracking/refresh (forces a fresh upstream check, rate-limited to one call per escrow every 5 minutes).
GET /api/escrows/:id now includes a tracking object (courier, AWB, last-known status, and an official-courier deep link) once a resi is attached.
The live status timeline is best-effort enrichment: the courier + AWB are always persisted and an official-courier deep link is always available, so a flaky upstream never blocks the page.

Added

Universal inbound Webhook/IPN endpoints (POST /api/webhooks/inbound, /ipn, /payment, /universal) with dynamic provider auto-detection.
Integrated Paymento payment gateway adapter supporting cryptocurrency payments.
Support for admin-configured payment gateway surcharges (fee_percent and fee_fixed), calculated securely on the server and surfaced in GET /api/gateways/available-methods and POST /api/escrows/:id/pay.
New payment response fields: escrow_amount (base value) and surcharge (gateway fee) in payment responses.

Added

Changed

Documentation

We commit to no breaking changes within signature version v=1. Any breaking change will:

Additive changes (new fields, new events, new endpoints) are not breaking and will be released without a version bump.