Changelog

2026-10-21

• Removed the X-Deployment-Scope: end-user header from the Plane A guidance and the API overview: the backend never reads it.
• Corrected the private Identity resolve path to /api/internal/v1/authentication-subjects/resolve (the service mounts its routes under /api).
• Re-tagged /aliases and /aliases/resolve as Plane A (end-user bearer token) and catalogued the Plane B alias routes POST /internal/aliases/resolve, POST /internal/aliases/bulk-upsert and DELETE /internal/aliases.
• Catalogued GET /internal/webhooks/deliveries/{id} and POST /internal/webhooks/events/{eventId}/replay.
• Named the partner-facing surfaces consistently (Partner Console, PayPM Business web) and noted that browser sign-in on marketplace.paypm.net is currently held.
• Code samples now use a monospace face; the portal ships the light theme only.

2026-08-17

• Closed virtual cards and savings pots as live catalog surfaces. Routes remain in the committed OpenAPI (GET /virtual-cards/my and GET /savings-pots/my exist and return 401 without a token) but are marked unavailable / not contracted. Do not integrate create, freeze, deposit, or withdraw as live product.
• Money-flow idempotency examples are now only POST /wallets/transfer and sandbox POST /wallets/topup-dev. Cash-in, airtime, and bills stay unavailable until rails connect.

2026-08-16

• Catalogued standalone Marketplace Contract Vault read BFF routes (GET /api/v1/marketplace/contract-vault/records, versions, and commitments). These use a Marketplace SPA OIDC session, not a sandbox Plane B API key, and are not published on the wallet sandbox host. Missing Identity wallet link or store fails closed to unavailable + empty. Writes remain on wallet-backend.
• Added live sandbox Merchant routes to the committed OpenAPI catalog (/merchant/v1/...). Human routes use Merchant OIDC bearer; the public pay-instrument resolver is unauthenticated. Internal /internal/merchant Plane B routes were probed as present but left out of the public Merchant tag.
• Aligned Quickstart and the committed Auth OpenAPI with the live sandbox OTP contract: businessEntityId + channel: "sms" on issue; otpChallengeId + code on verify; businessEntityId on register and login.
• Noted that live /api/v1/docs and /api/v1/docs-json both return 404; the portal keeps using the committed catalog.

2026-08-09

• Renamed the public documentation surface to PayPM Developer Portal.
• Removed optional portal login and browser-session request signing.
• Disabled the interactive API playground and browser credential entry.
• Defined authenticated developer membership and partner mutations as a separate future PayPM Platform workspace boundary.

2026-07-03

• Published the developer portal through PayPM source, CI, Harbor, GitOps, and ArgoCD deployment path.
• Added the PayPM Zudoku developer portal.
• Added file-backed API reference covering Plane A and Plane B route families.
• Added login-ready configuration for Clerk, Auth0, OpenID Connect, and Supabase.
• Added protected route configuration for API reference and operator docs when auth is enabled.
• Added developer runbooks for health, readiness, logs, GitOps, and portal redirects.

Known gaps

• The live backend currently returns 404 for /api/v1/docs and /api/v1/docs-json; the portal uses a committed OpenAPI catalog until the backend intentionally exposes or exports generated OpenAPI.
• API response schemas should be tightened continuously from DTOs as endpoints stabilize.