Changelog

Versions are dated, not numbered — see Versioning. New keys are pinned to the latest version at creation; the version that served a request is in the Paayed-Version response header. Additive changes below apply immediately regardless of pin.

2026-09-01

The first version.

• Payments: create (cardholder present, and merchant-initiated on a stored card), retrieve, list, complete 3-D Secure, refund, retrieve a refund.
• Customers: create, retrieve, update, list.
• Stored cards: attach by paying with store: true, retrieve, list, detach.
• Subscriptions: create, retrieve, update (pause, resume, change the card), cancel, list. Fixed amount and interval, retries for soft declines (up to three, after 1 hour, 6 hours and 24 hours), pause on any other failure or after the last failed retry with a pause_reason, card expiry warning.
• Events: retrieve, list, resend.
• Webhook endpoints: create, retrieve, update, delete, rotate the secret, replay, list deliveries.
• Sandbox: test cards for every outcome, a simulated 3-D Secure challenge page, an amount suffix that declines.

Additive changes within this version are listed below as they ship; none require a change on your side.

Additions

• decline_code on declined and failed payments, from our own vocabulary (see Errors).
• subscription.resumed and payment_method.expiring event types.
• RateLimit-Limit and RateLimit-Remaining headers on every response, and RateLimit-Reset on a 429.
• payment.settled, sent when the acquirer settles a payment: its fee and net are then final (fee.settled: true). Until then the fee shows as 0.00 with fee.settled: false. Sent again if the acquirer later restates the fee.
• Hosted sessions: create, retrieve, list, expire. The cardholder enters their card on Paayed's page, so card data never reaches your systems. A session can also set up a recurring schedule (daily, weekly or monthly, with an optional end date or number of payments) that becomes a subscription when the first payment succeeds. hosted_session.completed and hosted_session.expired events. Uses the payments.read and payments.write scopes.

Not yet available

• Authorization without capture, partial capture and cancel.
• Hosted fields.
• Disputes, balances and payouts.
• OAuth client credentials for platforms acting for many merchants.

Each arrives as an additive change or a new dated version and will be announced here first.