Changelog

Notable changes to the SoftLemon API and this documentation, newest first.

2026-09-07

• card.exp_month and card.exp_year now take the same formats on POST /api/v1/3ds/verify and POST /api/v1/transactions: an integer or a string, with or without a leading zero on the month. Before this, /3ds/verify refused "01" and /transactions refused 1, so months January to September needed a different format per endpoint. See conventions.

2026-08-19

• New GET /api/v1/payment-methods lists the alternative payment methods enabled for a merchant and, given country and currency, whether each one can be offered to that customer and why not (country_not_supported, currency_not_supported, provider_not_offering). Read-only and side-effect free. See Ask before you show a method.
• POST /api/v1/payment-sessions accepts an optional customer.ip_address (the customer's IP as seen by your server). It is forwarded to the provider as the customer's device IP; without it the provider sees the IP of the server calling the API. Card payments already accepted customer.ip_address and now forward it to the provider as well when browser_data.ip_address is absent. See availability.
• Payment sessions now check the method's country availability on customer.country_code before the provider is called and refuse unserved countries with the new ERR_PAYMENT_METHOD_NOT_AVAILABLE_IN_COUNTRY code. A provider that declines to open a checkout is reported as the new ERR_PROVIDER_REJECTED (HTTP 400, provider reason in message) instead of a generic ERR_GATEWAY_ERROR (502). Both codes are in the error catalogue.
• POST /api/v1/3ds/verify identifies a verification by public_id (tds_...). Store that value and send it as card_verification_data.id; the card_verification_id on the post-challenge redirect is the same tds_... string. The numeric id in the response is deprecated and will be removed on a date announced here; numeric ids stay accepted on input. See Initiate Card Verification.
• Published the versioning and deprecation policy: the API is additive within a version, clients must ignore unknown fields and treat ids as opaque strings, and removals follow a mark, announce, notice period, remove sequence.
• Guides now use the tds_... public id in every 3DS example.

2026-08-09

• Added Idempotency-Key support on capture, refund and void for safe retries. See conventions.
• Added the ERR_IDEMPOTENCY_CONFLICT and ERR_IDEMPOTENT_REQUEST_IN_PROGRESS error codes to the error catalogue.
• Rate limit responses now include a Retry-After header and every response includes X-RateLimit-Remaining. See rate limits.

2026-08-07

• Relaunched the documentation site with searchable references for both the Merchant and Partner APIs.
• Added the API basics section covering conventions, environments, error handling, rate limits, SCA and PSD2 and support.
• Documented previously missing error responses in the API references.