Changelog

Every change to the v3 OpenAPI is recorded here before release: CI refuses a portal whose reference is older than the OpenAPI in the repository.

API v3: payment timeline and webhook history (lot 2.1b)

• GET /payments/{reference}/timeline (session or API key): every fact of the payment in order (creation, checkout opens, provider choice, attempts and their status changes, callbacks, payer returns, final status, anomalies, e-mails, webhooks and each HTTP try), keyset paginated, filter category (repeatable). It also returns the attempts with their normalised result and the webhook deliveries with every try.
• GET /admin/payments/{reference}/timeline (Konnect admin only): the same view with the redacted raw provider payloads.
• GET /payments/{reference} gains result: final status, provider, failureCode (closed list), authorisation code, masked instrument, attempts, duration and merchantConfirmation with its reason. Webhook bodies do not carry result.
• GET /checkout/{reference} takes view (payment by default, result, attempt): only payment counts as an open of the checkout.
• GET /checkout/{reference}/return?outcome=success|fail (public) records the payer's return and redirects to the merchant's success or fail URL.
• POST /payments/{reference}/cancel accepts an optional reason. POST /organisations/{id}/webhooks/deliveries/{deliveryId}/retry now replays any delivery that is not pending, once, as a manual try (it answered 409 webhook_delivery_not_failed before; now 409 webhook_delivery_pending). Deliveries gain lastOutcome, nextRetryAt and manualTries.

API v3: hosted checkout on the engine (lot 2.2)

• Checkout (public): GET /checkout/{reference}/attempts/{attemptId} shows an attempt again (kind, status, redirect URL, QR code or form parameters); GET /checkout/{reference}/logo serves the payment account logo, and merchant.logoUrl points to it.
• The browser return of a provider (GET /callbacks/{provider}/{attemptId}) now redirects to the result page with ?attempt=<attemptId>.
• The public checkout and callback routes are rate limited per client IP and per payment reference (callbacks per attempt) and answer 429 rate_limited with Retry-After.

API v3: admin console, organisations (lot 1.7)

• GET /admin/organisations and GET /admin/organisations/{id}: organisations with their status facts (KYB, contract, canCollect), reserved to Konnect staff (admin, support, compliance).

API v3: payments, attempts and webhooks (lot 2.1)

• Payments: POST /payments (API key, or session with organisationId; Idempotency-Key honoured) returns the reference (24 hexadecimal characters) and payUrl; GET /payments, GET /payments/{reference}, POST /payments/{reference}/cancel, GET /payments/{reference}/attempts with the timeline of each attempt.
• Checkout (public): GET /checkout/{reference}, POST /checkout/{reference}/attempts, GET /checkout/{reference}/status. Provider callbacks on GET|POST /callbacks/{provider}/{attemptId}.
• Webhooks: endpoints under /organisations/{id}/webhooks with a signing secret shown once, delivery log and retry. The signature Konnect-Signature: t=<unix>,v1=<hex> is final (ADR 0008); the guide is no longer provisional. Events payment.succeeded, payment.failed, payment.expired, payment.canceled, attempt.duplicate_success.

API v3: affiliations (lot 1.6)

• Affiliations under /organisations/{organisationId}/affiliations: list and read with masked secrets (last four characters), creation verified through the connector, verify again, credential rotation (PUT /{affiliationId}/credentials), suspend, resume, revoke, audit timeline of the affiliation.
• Creation and rotation need a recent re-authentication for a session (403 reauth_required); an API key of the organisation passes. Permissions affiliations.view and affiliations.manage.
• Every affiliation lists the payment accounts routed to it (paymentAccounts), to show before a revoke.
• Konnect support: GET /admin/affiliations with organisation, provider and status filters.

API v3: payment accounts (lot 1.14)

• Payment accounts under /organisations/{id}/payment-accounts: list, read, create, update (name, slug, branding, URLs, pause and resume, default account), archive.
• Routing: GET and PUT /organisations/{id}/payment-accounts/{accountId}/routing choose, per provider and label, the affiliation each account uses (shared or its own).
• Members can be scoped to some payment accounts; accounts.view and accounts.manage permissions.

2026-10-03: developer portal (lot 1.15)

• v3 API reference generated from packages/sdk/openapi.json, with samples in cURL, PHP, Node (@konnect/sdk) and Python.
• v2 compatibility reference: init-payment, GET /payments/{paymentId}, x-api-key authentication.
• Guides: quick start, webhooks, errors and idempotency, migrating from v2 to v3, sandbox, going live.
• Plugins page: WooCommerce 2.8.3, PrestaShop 2.0.3, with SHA-256 sums; WHMCS coming soon.

API v3: identity, organisations, providers (lots 1.2, 1.3, 1.13, 1.4)

• Authentication: /auth/* (login, two-factor, password) for the dashboard, and GET /auth/api-key to check an API key.
• API keys: GET, POST and DELETE /organisations/{id}/api-keys; x-api-key header, new keys kpk_<prefix>:<secret> shown once.
• Organisations, members, invitations, roles, documents and ownership transfer under /organisations/{id}.
• Provider catalogue: GET /providers, GET /providers/{code}.

API v3 0.1.0 (lot 1.1)

• GET /health: status of the API, the database, the secrets provider and the outbox.
• GET /organisations/{organisationId}/audit: audit log of an organisation, cursor pagination. Closed (401) until lot 1.2.
• GET /admin/outbox: outbox events, for Konnect support. Closed (401) until lot 1.2.
• Idempotency-Key header honoured by the POST routes that opt in.

API v2 (compatibility)

• No change: the v2 routes are served as they are by the new platform for migrated organisations, and relayed for the others.
• addPaymentFeesToAmount is accepted and ignored; legacy payment methods (wallet, konnect, MCOIN, wire_transfer, Paypal) are ignored.