# Changelog

Notable changes to the SoftLemon API and this documentation, newest first.

## 2026-09-07

- `card.exp_month` and `card.exp_year` now take the same formats on `POST /api/v1/3ds/verify` and `POST /api/v1/transactions`: an integer or a string, with or without a leading zero on the month. Before this, `/3ds/verify` refused `"01"` and `/transactions` refused `1`, so months January to September needed a different format per endpoint. See [conventions](/api-basics/conventions#card-expiry).

## 2026-08-19

- New `GET /api/v1/payment-methods` lists the alternative payment methods enabled for a merchant and, given `country` and `currency`, whether each one can be offered to that customer and why not (`country_not_supported`, `currency_not_supported`, `provider_not_offering`). Read-only and side-effect free. See [Ask before you show a method](/guides/accept-an-alternative-payment#ask-before-you-show-a-method).
- `POST /api/v1/payment-sessions` accepts an optional `customer.ip_address` (the customer's IP as seen by your server). It is forwarded to the provider as the customer's device IP; without it the provider sees the IP of the server calling the API. Card payments already accepted `customer.ip_address` and now forward it to the provider as well when `browser_data.ip_address` is absent. See [availability](/guides/accept-an-alternative-payment#availability).
- Payment sessions now check the method's country availability on `customer.country_code` before the provider is called and refuse unserved countries with the new `ERR_PAYMENT_METHOD_NOT_AVAILABLE_IN_COUNTRY` code. A provider that declines to open a checkout is reported as the new `ERR_PROVIDER_REJECTED` (HTTP 400, provider reason in `message`) instead of a generic `ERR_GATEWAY_ERROR` (502). Both codes are in the [error catalogue](/api-basics/errors).
- `POST /api/v1/3ds/verify` identifies a verification by `public_id` (`tds_...`). Store that value and send it as `card_verification_data.id`; the `card_verification_id` on the post-challenge redirect is the same `tds_...` string. The numeric `id` in the response is **deprecated** and will be removed on a date announced here; numeric ids stay accepted on input. See [Initiate Card Verification](/merchant/card-verification#initiate-card-verification).
- Published the [versioning and deprecation policy](/api-basics/conventions#deprecation): the API is additive within a version, clients must ignore unknown fields and treat ids as opaque strings, and removals follow a mark, announce, notice period, remove sequence.
- Guides now use the `tds_...` public id in every 3DS example.

## 2026-08-09

- Added `Idempotency-Key` support on capture, refund and void for safe retries. See [conventions](/api-basics/conventions).
- Added the `ERR_IDEMPOTENCY_CONFLICT` and `ERR_IDEMPOTENT_REQUEST_IN_PROGRESS` error codes to the [error catalogue](/api-basics/errors).
- Rate limit responses now include a `Retry-After` header and every response includes `X-RateLimit-Remaining`. See [rate limits](/api-basics/rate-limits).

## 2026-08-07

- Relaunched the documentation site with searchable references for both the Merchant and Partner APIs.
- Added the API basics section covering [conventions](/api-basics/conventions), [environments](/api-basics/environments), [error handling](/api-basics/errors), [rate limits](/api-basics/rate-limits), [SCA and PSD2](/api-basics/sca-and-psd2) and [support](/api-basics/support).
- Documented previously missing error responses in the API references.