Changelog

Changelog

2026-10-08

Payment Link and Invoice return_url:

• Create and update accept an optional return_url. Only an https URL with a host is stored (max 2048 characters). Anything else returns 90000.
• Omit or send "" to leave it unset. On update, omit keeps the stored value and "" clears it. A partially locked Payment Link can still change it.
• Hosted Checkout uses it only on the success page. It is not written to the order or to webhooks. See Return URL.

Address book chain_type:

• An empty or whitespace-only chain_type on create returns 90000. It does not default to evm.
• eth and ethereum are stored as evm, sol as solana, and trx as tron. Any other non-blank value returns 90111.

2026-09-24

Payment Link / Invoice edit, Invoice PDF, and the payout address book:

• Get, update, and status for Payment Links, and get / update for Invoices. Locks come from edit_state. See Invoices & Payment Links.
• GET /invoices/pdf returns download_url and file_name for one PDF template. Paid documents include the payin order id.
• Address book groups and entries under /payout/v1/address-book. The book stores addresses only; create payout still takes recipients directly. See Address Book.
• Error codes 90102, 90129–90134, and 90209 documented. A Payment Link or Invoice id from another merchant returns 90201.

Address-collected payin refunds on OpenAPI quote:

• POST /refunds/quote accepts refund_to_address for collect_mode=hd_address orders. It is required there and ignored on every other order.
• The address must match the refund target chain (receiving chain when the payin is same-chain, payer chain when it is cross-chain) and must not be the collect address. Otherwise quote returns 90214.
• Prepare and authorize do not take this field again; the quote soft order already has the destination.

2026-09-23

Merchant stamp binds the hosted-wallet timestamp:

• Authorize (POST /payouts/authorize and POST /refunds/authorize) requires waas_timestamp, a 13-digit Unix millisecond value.
• merchant_sign is Ed25519 over the raw 32-byte SHA256(utf8(param_json + "|" + waas_timestamp)), standard Base64. Do not sign param_hash.
• Morph forwards that timestamp as X-Waas-Timestamp. It must match the stamp and fall within ±60 seconds. See Merchant stamp.

2026-09-22

Partial refunds on OpenAPI quote:

• POST /refunds/quote accepts optional refund_amount. Omit it to refund the original order amount (not the remaining balance). After a successful partial refund, omit is rejected with 90211; refund the remainder with GET /refunds/info refundable_amount. See Refunds.
• Error code 90211 documented.

2026-09-20

Payment Link / Invoice payer allowlist:

• support_networks / support_tokens are optional. Omit both (or send empty arrays) and create expands them to the full paying catalog. See Invoices & Payment Links.

TRX payout authorize:

• Create returns raw_txs (unsigned txs including raw_data) beside param_json. param stays {chain, data} so hosted-wallet signing can accept it.
• Authorize must echo raw_txs on TRX. Missing or mismatched values return 90604. See Payouts.

2026-09-18

Payout and refund write OpenAPI:

• Payout: GET /support-tokens, POST /payouts/preview, POST /payouts (idempotency key), POST /payouts/authorize. Hosted wallet signs on-chain; the merchant stamps param_json (Ed25519). See Merchant stamp and Payouts.
• Refund: POST /refunds/quote, POST /refunds/prepare, POST /refunds/authorize, plus GET /refunds/info (by payin platform_order_id). Wallet-collected orders only. See Refunds.
• GET /wallets documents hosted addresses used as source_address.
• Error codes 90201, 90207, 90210, 90212, 90213, 90309, 90604, 90605, 90606 documented.