🚀 Official SDKs Released

• bursapay/bursapay-php: Official PHP SDK (PHP 8.0+) with Guzzle transport, PSR-4 autoloading, typed exception mapping, and HMAC webhook verification.
• github.com/bursapay/bursapay-go: Official Go SDK (Go 1.18+) with standard library transport, contextual execution, typed structs, and HMAC webhook signature verification.
• Comprehensive developer documentation updated across all guides and interactive API references.

🎉 New Events

• subscription.charged: now available for webhook subscriptions
• subscription.charge_failed: fires when a recurring charge attempt fails
• subscription.cancelled: fires when a subscription is cancelled
• virtual_account.credited: fires when a dedicated virtual account receives funds
• dispute.created: fires when a new dispute is opened by the cardholder
• dispute.won: fires when a dispute is resolved in your favour
• dispute.lost: fires when a dispute is resolved against you

✨ New Features

• Customer PATCH: PATCH /customers/<ref>/ partial update of name, phone, metadata
• Customer DELETE (soft): DELETE /customers/<ref>/ with payment-guard check
• Customer virtual account sub-resource: GET /customers/<ref>/virtual-accounts/
• Bulk customer CSV import: POST /customers/import/ with per-row error reporting
• Split payment rule builder: portal UI at /portal/settings/splits/
• Dashboard 30-day revenue forecast widget
• Dashboard per-key API usage widget with utilisation bars and burst count

✏️ Changes

• GET /webhooks/events/: nine additional events now return "available": true
• Portal webhook creation form updated with all nine new events as selectable checkboxes
• Dispute evidence form pre-populates customer email, name, and phone from the linked payment

🚀 Production Launch

First live release. Live mode API keys activated (sk_live_). Real NGN transactions enabled for verified developers after completing full KYC/KYB tier requirements.

🎉 New Endpoints & Features

• Transfers & Payouts: POST /transfers/, GET /transfers/, GET /transfers/<ref>/, recipient management, bank resolution
• Inline direct charge: POST /payments/charge/ for billing saved authorization tokens directly
• Bulk payment processing: POST /payments/bulk/ supporting batch requests (sync processing for ≤10 items, async Celery execution for >10 items)
• Wallet Ledger & Reconciliation: GET /wallet/ledger/ with cursor-based pagination, entry classification, filter by date range, and export options
• Dispute Management Portal: GET /disputes/, GET /disputes/<ref>/, automated dispute status synchronization, and interactive evidence uploading
• Audit Log System: full security activity logging across portal actions, key rotations, and settings modifications
• Multi-Factor Security: TOTP-based Two-Factor Authentication (2FA) with recovery backup codes
• Team Collaboration: multi-user access with invitation workflow, token activation, and granular RBAC roles (Owner, Admin, Developer, Analyst)
• Settlement Engine: automated settlement rules, bank account verification, and flexible schedule configuration (daily, weekly, monthly)
• Webhook Log Diagnostics & Retry: GET /webhooks/logs/<log_id>/ payload inspection and POST /webhooks/logs/<log_id>/retry/ manual trigger
• Real-Time Event Stream: Server-Sent Events (SSE) streaming live transactions and system alerts directly to portal dashboards

✏️ System Improvements

• transfer.success, transfer.failed, and dispute.created events added to system event catalog
• Standardized webhook envelope structure containing high-precision timestamp sent_at and top-level version
• Enforced 403 transfer_not_allowed on test-mode payout simulations without verified settlement accounts

🎉 Subscriptions, Invoicing & Dedicated Accounts

• Payment Links Engine: POST /payment-links/ hosted single/multi-use checkout pages with customizable titles, descriptions, expiry timers, and pay limits
• Subscriptions & Recurring Billing: POST /subscriptions/, plan creation, billing interval scheduling (daily, weekly, monthly, annual), automatic dunning retries
• Invoicing Suite: POST /invoices/ complete with line item calculations, automatic tax/discount handling, public payment landing view, status updates (paid, partially_paid, overdue)
• Dedicated Virtual Accounts: POST /virtual-accounts/ provision permanent NGN NUBANs per customer via provider integration
• Payment Scheduling: charge_at timestamp parameter on payment initialization for deferred background execution
• Portal Analytics Dashboard: revenue growth charts, daily transaction volume breakdowns, success vs failure percentage tracking
• Sandbox Simulation Playground: interactive web UI for testing card charges, 3DS authentication, bank transfers, and webhook triggers

✏️ Architecture Refinements

• Standardized reference prefix format to unified BP- standard across all resources (payments, refunds, links, subaccounts)
• Enhanced GET /payments/ with multi-field search (q), date filtering (from/to), and payment method filters
• Introduced Webhook Schema V2: structured payload format with signature header verification

🎉 Marketplace & Platform Security

• Granular API Key Scopes: permission-based API keys (e.g. payments:read, payments:write, customers:write, transfers:write)
• IP Address Allowlisting: CIDR-based IP restriction on secret key usage configurable via Developer Portal
• Split Payments & Subaccount Management: splits parameter support on payment initialization for multi-vendor marketplaces
• Subaccount API: subaccount creation, bank verification, commission split configurations (percentage vs fixed fee cut)
• Checkout Branding Customization: custom logos, accent color customization, merchant brand names rendered on hosted checkouts
• Verification & Onboarding Wizard (KYC/KYB): multi-tier merchant verification workflow (CAC registration, Director BVN/NIN submission, utility bill validation)
• Risk Engine & Anomaly Detection: rate limiting checks, suspicious transaction scoring, automated risk alerts

✏️ System Enhancements

• Enforced strict Idempotency Key matching (Idempotency-Key header) on payment initialization with 24-hour cache caching
• Isolated Test & Live Mode Environments: distinct database state, separate keys (sk_test_ / sk_live_), and dual-mode portal switcher
• Robust Webhook Delivery Retry Service: Celery worker task with exponential backoff algorithm for failed notifications

🎉 Core Services & Developer Tools

• Customer Management API: POST /customers/, GET /customers/, GET /customers/<ref>/, metadata storage, phone and email search
• Customer Payment History: sub-resource endpoint GET /customers/<ref>/payments/
• Refunds Engine: full and partial refund processing via POST /refunds/ with automatic wallet debit accounting
• Wallet & Balance APIs: GET /wallet/balance/ returning available balance, pending settlements, and currency breakdowns
• Manual Payout Requests: wallet withdrawal processing to verified merchant bank accounts
• Webhook Management API: programmatic CRUD endpoints for webhook URL subscriptions (POST / GET / PATCH / DELETE /webhooks/)
• Developer Portal Enhancements: expanded payments overview table, wallet status widgets, real-time key usage counter
• CSV Export Services: async report generation for customer transactions, ledger items, and payments

✏️ Improvements

• Optional callback_url parameter on /payments/initialize/ defaulting to Portal merchant settings
• Switched API pagination format to cursor-based pagination across list endpoints for performance and consistency

🎉 Core Gateway API & Developer Portal

• Payment Initialization: POST /payments/initialize/ generating hosted payment page URLs and BP- transaction references
• Payment Verification: POST /payments/verify/ for server-side status verification and payload decryption
• Hosted Checkout Page: responsive, secure payment interface rendering card, USSD, and bank transfer options at /pay/<ref>/
• API Key Authentication: SHA-256 hashed Bearer key verification system supporting sk_test_ and sk_live_ keys
• Webhook Delivery Engine: initial webhook notification pipeline for payment.success and payment.failed events with HMAC-SHA512 signature validation
• Developer Portal MVP: authentication (signup/login/password reset), key management dashboard, transaction history viewer
• Webhook Echo & Testing: /webhook/test/ endpoint for payload inspection during development
• Payment Listing: GET /payments/ with basic status, date filtering, and summary statistics

🌱 Foundation & Project Initiation

Development kick-off for the BursaPay Gateway platform (May 2025). Built initial Django project structure, core payment models, provider abstraction layer, and developer portal foundation.

• Django Application Architecture: scaffolded gateway (models, services, admin, portal) and gateway_api (REST endpoints, serializers, authentication)
• Provider Integration Layer: initial Paystack API integration wrapper for payment initialization and verification
• Data Architecture & Models: designed Developer, APIKey, Payment, Customer, WebhookEndpoint, and WebhookLog schema models
• Authentication & Security: AES-256 encryption service for API keys/secrets and secure Bearer token authentication middleware
• Background Task Scaffolding: Celery asynchronous worker setup for webhook processing and background notifications
• Public Developer Documentation: initial integration guide, interactive OpenAPI schema viewer, and code example generators