Changelog
This changelog records material changes to the FlexFactor public API surface. Use it to detect drift between an integration built against an earlier snapshot of these docs and the current contract.
What counts as a material change:
- An endpoint added, removed, or marked deprecated
- A request or response field added, removed, renamed, or having its required-ness or type changed
- A response status enum or webhook event added or removed
- A retry / idempotency / rate-limit rule change
- An Optimization Rank change for any documented field
What does not count (no entry required):
- Wording or formatting changes that preserve meaning
- Example-payload edits that do not change the contract
- Brand or domain renames (covered by a single rollup entry)
Entries are most-recent-first. Each entry names the affected pages and the OpenAPI version when relevant.
2026-06-04
| Type | Area | Change | Pages |
|---|---|---|---|
| Added | /v1/evaluate | attemptCount — new optional root-level request field, type integer (OpenAPI FlexFactor-V1). Tells FlexFactor which authorization attempt this request represents (1 = original attempt, 2 = first retry, and so on). Optimization Rank: High. | evaluate.md, evaluate-api.md |
2026-06-01
| Type | Area | Change | Pages |
|---|---|---|---|
| Changed | Branding | All public-facing URLs and embedded references consolidated to flexfactor.io. OpenAPI info.title is now FlexFactor-V1 (source file published as flexfactor-v1.json). The recipes/authentication.md recipe URL is now canonical. The SFTP host sftp.flex-charge.com remains in place pending a separate migration. | — |
| Deprecated | /v1/outcome | Marked deprecated: true in both the markdown frontmatter and the OpenAPI path; reference page hidden from public navigation. Use GET /v1/orders/{id} for current order status. | outcome.md |
| Added | Webhooks | Events payment.chargeback.reversed and payment.early_warning.received (Recommended tier). | webhooks-1.md |
| Changed | Error handling | Retry rules now stated explicitly: 401 refresh access token once; 500 / 502 / 504 exponential backoff (max 3 attempts); 503 fall back to original decline and do not retry. 504 Gateway Timeout added to the response-code table. | errors.md |
| Added | Webhooks | Source-IP allowlist documented: Production 18.233.184.33, 52.4.241.101; Sandbox 35.172.5.145, 3.211.16.180. | webhooks-1.md |
| Added | SFTP | Connection details added (host, port, ed25519 recommended). | ssh-key-generation.md |
| Renamed | OpenAPI schema | threeDsecure key casing corrected to threeDSecure to match prose and reference documentation. | — |
| Clarified | /v1/refund, /v1/cancel | idempotencyKey is not required; idempotency is enforced server-side via the order ID. | — |
| Clarified | /v1/evaluate | expiryDateUtc now documents the 21-day default rescue window. | evaluate.md |
| Clarified | /v1/evaluate | Capture-required status now references the 5-minute default capture window for Authorize flows. | evaluate.md |
| Changed | /v1/evaluate | threeDSecure documented as an optional passthrough object on all flows, including MIT and recurring transactions. | evaluate.md |
| Added | Introduction | Integration prerequisites section covering the four standing assumptions: amount-in-cents, expiry ISO-UTC parsing, GDPR / data minimization, PCI AOC. | introduction.md |
Earlier historyChange history begins on 6/1/2026.
Updated 2 days ago