Add account_information_request field on billing requests, in both create and
response, and the links.account_information_request ID.
- Update documentation links for new docs site
Redirect Flows and Payer Authorisations are legacy APIs and cannot be used by new integrators. If you use RedirectFlowService and PayerAuthorisationService, migrate to Billing Requests, which cover the same flows (and more) through a single API. The integration planner is a good place to start.
The legacy methods are now marked as deprecated with @Deprecated annotations and Javadoc @deprecated tags. Behaviour is unchanged. The compiler and IDEs will warn on calls to these methods.
Includes linked resources in the response. Use customer to embed customer details, or mandate to embed mandate details.
For subscriptions and plans, values 1-31 or -1 are accepted, not just 1-28.
1-28 applies to payout intervals, creditors and mandate caps.
GoCardlessClient.Builder now has withConnectTimeout, withReadTimeout, withWriteTimeout and withCallTimeout, each taking a java.time.Duration. Previously the client used OkHttp's defaults (10 seconds for connect, read and write, and no overall call timeout) with no way to change them. Unset options keep those defaults, which are now documented in the README and covered by tests.
GoCardlessClient client = GoCardlessClient.newBuilder(accessToken)
.withConnectTimeout(Duration.ofSeconds(5))
.withCallTimeout(Duration.ofSeconds(30))
.build();A request that times out raises GoCardlessNetworkException once the client's automatic retries are exhausted, so the total time before an error can exceed the configured timeout.
Includes linked resources in the response. Use customer to embed customer details, or bank_account to embed bank account details.
- Remove unused definitions from schema
This field is only used in request parameters on GET requests. Parameters on GET requests are querystrings and can only ever be strings.
Therefore any attempt was rejected with "One of your parameters was incorrectly typed" - ""true" is not a boolean.".
This string enum "true" or "false" is our general pattern for parameters like this.
Add payment_request.retry_if_possible - On failure, automatically retry payments using intelligent retries.
Add actions.available_country_codes - list of currencies the current mandate supports
- Updates the public institutions API to allow merchants to provide the include_disabled query param and see institution status per feature
Several resource response schemas were missing required field lists,
even though the fields are always present in the actual response.
Added accurate required arrays (and fixed a few hardcoded docs
examples that predated them) for: payment, bank_details_lookup,
billing_request_template, currency_exchange_rate, mandate_import,
mandate_import_entry, negative_balance_limit, payer_authorisation,
payout, payout_item, refund, scenario_simulator,
scheme_identifier, tax_rate, verification_detail and logo.
This is a documentation-only change; API behaviour is unchanged.
The low-level request path was joined onto the configured base URL with a resolving
join, which follows a path the way a browser follows a link. An absolute URL
(https://host/x) or a scheme-relative one (//host/x) replaced the configured
origin outright while the Authorization header was still attached, so an application
that passed untrusted input as a path could send its API token to a host of someone
else's choosing.
A path that is not a relative reference is now rejected before the join. Paths containing dot segments remain valid: they resolve against the base URL and cannot leave its origin.
A URL parameter is a single path segment — a resource identity — but the escaping
applied to one varied by language, and in Go, Node, PHP and .NET there was none at
all. A value carrying path syntax could move a request to an endpoint the caller
never asked for: find("../mandates") reached the mandates collection, and
find("?limit=500") injected a query parameter.
Escaping alone cannot fix this, because . and .. are dot segments that a path
resolver strips whether or not they are encoded, and an empty value addresses the
collection rather than one resource. Values that could change which endpoint is
addressed are therefore rejected rather than escaped: /, ?, #, control
characters, ., .. and the empty string now raise an error instead of producing a
request that quietly 404s. Everything else is escaped as before.
No valid GoCardless resource identity contains any of these characters, so correct
code is unaffected. Ruby and Java previously encoded / as %2F and sent the
request; they now raise.
- Fixed postal_code and country_code fields on Scheme Identifiers to correctly allow null values.
- Fixed response_body_truncated, response_headers_content_truncated, and response_headers_count_truncated fields on Webhooks to correctly allow null values.
- Fixed the email field in merchant_contact_details on Billing Request Flows to correctly allow null values.
- Fixed the url field on Bank Authorisations to correctly allow null values.
- Made account_number_ending nullable across all resources that reference this shared definition
- Added
languageandphone_numberproperties to prefilled_customer in Billing Request Flows.
- Add missing
consent_parametersproperties:id,scheme,currency,fixed_amount_per_payment - Make
max_amount_per_period,max_payments_per_periodandend_datenullable - Add missing
period_alignmenttoperiod_alignmentenum
Fix GET /institutions documentation incorrectly listing status and autocompletes_collect_bank_account fields
These fields are only returned by GET /billing_requests/{identity}/institutions, not by the top-level GET /institutions endpoint. This is a documentation-only fix; API behaviour is unchanged.
Only payment_created, mandate_created and subscription_created are supported for now, but the enum implied it was more event types.
The enum is unchanged to avoid breaking consumers dependent on the ordering.
- Add missing bank_name property to payer_authorisation bank_account schema
- Fix nullable metadata reference in billing_request list response schema
The API and client libraries accept string or integer for amount-type fields. We only emit those same fields as integer. However, the schema incorrectly specified string or integer for the response as well as the request.
- Prune unused definitions from the schema
- Add missing institution properties to billing_request schema
Bank details lookups now return a payer_name_verification_result field when an account_holder_name is supplied and a payer name verification check is performed. It can be full, close, cannot_perform_verification or null
You can now pass interval (daily, weekly, or monthly) when fetching metrics to have values aggregated over that period, instead of only receiving a single value for the full start_date/end_date range.
- Fix example values for a small number of fields to comply with the schema
- Fix schema definition/component names to avoid losing types in openapi schema
- Add "reference" to Create Bank Account Holder Verification
- Clean up docs and use a shared definition of event
includeandresource_typeenums
Adds null to type declarations for fields that legitimately return nil across redirect_flows, webhooks, scheme_identifiers, customer_bank_accounts, outbound_payments, and billing_request_with_actions. Also adds the missing period_alignment property to mandate consent_parameters.
Adds sepa_credit_transfer and sepa_instant_credit_transfer to the complete scheme enum, adds hosted payment flow sources to the event source/type enum, and makes creditor_type nullable for legacy creditors.
- Bump crank dependency to v7.2.0 for oneOf schema support
mandate_request_verify, mandate_currency, and payment_currency on
billing_request_template are now generated as typed nullable fields instead
of untyped objects. For example, mandate_request_verify is now typed as
MandateRequestVerify (or the language equivalent) rather than a generic
object type.
This is a breaking change — code that accesses these fields using untyped
patterns (e.g. casting from Object in Java) will need to be updated to
use the new typed accessors.
The two variants for creating an instalment_schedule were surfaced as separate functions. However, they both went to the same URL and endpoint on the backend.
This created some bugs in generating our openapi schema and therefore our API reference documentation.
Therefore, we've added specific URLs for each endpoint aliased to the original one: POST /instalment_schedules/with_dates or POST /instalment_schedules/with_schedule.
The existing POST /instalment_schedules endpoint is unchanged and will remain available for the foreseeable future.
Client libraries will now use the specific endpoint matching the method - if you are stubbing the HTTP call you may need to update those stubs.
- Add remember_me to ui_components bootstrap endpoint
The "Create a mandate", "Reinstate a mandate", and "Create a customer bank account" endpoints incorrectly stated they were restricted to GoCardless Pro and Enterprise accounts. Custom payment pages are available to any merchant — they are not package-restricted.
- Update code samples to match change to integer types for amounts etc
The intention is to make it possible to define common types in generated code. Instead of ~37 different currency enum types which are all equivalent, we could have one.
- Fix typo in Mandate next_possible_standard_ach_charge_date description
Exports can now be created with resource_type: app_connected_organisations, allowing connected merchant details to be exported.
- Fix typo in subscription status description
- Fix typo in mandate_import_entry status description
- Fix typo in mandate_import_entry status description
- Fix typo in mandate_import_entry status description
Start of changelog tracking with Knope. See GitHub releases for the history of earlier versions.