Operate

Changelog

2026-08-16

Catalogued standalone Marketplace Contract Vault read BFF routes (GET /api/v1/marketplace/contract-vault/records, versions, and commitments). These use a Marketplace SPA OIDC session, not a sandbox Plane B API key, and are not published on the wallet sandbox host. Missing Identity wallet link or store fails closed to unavailable + empty. Writes remain on wallet-backend.
Added live sandbox Merchant routes to the committed OpenAPI catalog (/merchant/v1/...). Human routes use Merchant OIDC bearer; the public pay-instrument resolver is unauthenticated. Internal /internal/merchant Plane B routes were probed as present but left out of the public Merchant tag.
Aligned Quickstart and the committed Auth OpenAPI with the live sandbox OTP contract: businessEntityId + channel: "sms" on issue; otpChallengeId + code on verify; businessEntityId on register and login.
Noted that live /api/v1/docs and /api/v1/docs-json both return 404; the portal keeps using the committed catalog.

2026-08-09

Renamed the public documentation surface to PayPM Developer Portal.
Removed optional portal login and browser-session request signing.
Disabled the interactive API playground and browser credential entry.
Defined authenticated developer membership and partner mutations as a separate future PayPM Platform workspace boundary.

2026-07-03

Published the developer portal through PayPM source, CI, Harbor, GitOps, and ArgoCD deployment path.
Added the PayPM Zudoku developer portal.
Added file-backed API reference covering Plane A and Plane B route families.
Added login-ready configuration for Clerk, Auth0, OpenID Connect, and Supabase.
Added protected route configuration for API reference and operator docs when auth is enabled.
Added developer runbooks for health, readiness, logs, GitOps, and portal redirects.

Known gaps

The live backend currently returns 404 for /api/v1/docs and /api/v1/docs-json; the portal uses a committed OpenAPI catalog until the backend intentionally exposes or exports generated OpenAPI.
API response schemas should be tightened continuously from DTOs as endpoints stabilize.

Last modified on August 17, 2026

Go-live Checklist

2026-08-16

Catalogued standalone Marketplace Contract Vault read BFF routes (GET /api/v1/marketplace/contract-vault/records, versions, and commitments). These use a Marketplace SPA OIDC session, not a sandbox Plane B API key, and are not published on the wallet sandbox host. Missing Identity wallet link or store fails closed to unavailable + empty. Writes remain on wallet-backend.

Added live sandbox Merchant routes to the committed OpenAPI catalog (/merchant/v1/...). Human routes use Merchant OIDC bearer; the public pay-instrument resolver is unauthenticated. Internal /internal/merchant Plane B routes were probed as present but left out of the public Merchant tag.

Aligned Quickstart and the committed Auth OpenAPI with the live sandbox OTP contract: businessEntityId + channel: "sms" on issue; otpChallengeId + code on verify; businessEntityId on register and login.

Noted that live /api/v1/docs and /api/v1/docs-json both return 404; the portal keeps using the committed catalog.

2026-08-09

Renamed the public documentation surface to PayPM Developer Portal.

Removed optional portal login and browser-session request signing.

Disabled the interactive API playground and browser credential entry.

Defined authenticated developer membership and partner mutations as a separate future PayPM Platform workspace boundary.

2026-07-03

Published the developer portal through PayPM source, CI, Harbor, GitOps, and ArgoCD deployment path.

Added the PayPM Zudoku developer portal.

Added file-backed API reference covering Plane A and Plane B route families.

Added login-ready configuration for Clerk, Auth0, OpenID Connect, and Supabase.

Added protected route configuration for API reference and operator docs when auth is enabled.

Added developer runbooks for health, readiness, logs, GitOps, and portal redirects.

Known gaps

The live backend currently returns 404 for /api/v1/docs and /api/v1/docs-json; the portal uses a committed OpenAPI catalog until the backend intentionally exposes or exports generated OpenAPI.

API response schemas should be tightened continuously from DTOs as endpoints stabilize.

Last modified on August 17, 2026