Changelog

v2.0.0

10 Mar 2026

This release introduces RESTful URL conventions, a second authentication method (WAPI Keys), and two new API modules (User, Withdrawals). Most existing endpoint paths and scope names have changed.

New: WAPI Key authentication. Requests can now authenticate with either a Bearer token (existing) or an X-WAPI-Key header. Both methods cannot be used simultaneously. WAPI Keys support CIDR allowlists, expiry, and revocation.

Auth endpoint paths are restructured:

v1.0.5	v2.0.0	Method
`/auth/grant`	`/auth/tokens`	POST
`/auth/revoke`	`/auth/tokens`	DELETE
`/auth/refresh`	`/auth/tokens/refresh`	POST

Token revocation (DELETE /auth/tokens) is not supported for WAPI Key authenticated requests and returns 400 Bad Request.

Scopes

All scope identifiers are renamed. Abbreviated prefixes are expanded to full words, and pluralization is made consistent.

v1.0.5 Scope	v2.0.0 Scope
`wapi-accounts-all`	`wapi-accounts-all` (unchanged)
`wapi-accounts-create`	`wapi-accounts-create` (unchanged)
`wapi-accounts-delete`	`wapi-accounts-delete` (unchanged)
`wapi-accounts-retrieve`	`wapi-accounts-retrieve` (unchanged)
`wapi-accounts-update`	`wapi-accounts-update` (unchanged)
`wapi-trans-all`	`wapi-transactions-all`
`wapi-trans-get-history`	Removed — use `wapi-transactions-retrieve`
`wapi-trans-get-status`	Removed — use `wapi-transactions-retrieve`
`wapi-trans-refund-request`	`wapi-transactions-refund-request`
`wapi-trusted-card-all`	`wapi-trusted-cards-all`
`wapi-trusted-card-charge-request`	`wapi-trusted-cards-charge-request`
`wapi-trusted-card-create`	`wapi-trusted-cards-create`
`wapi-trusted-card-delete`	`wapi-trusted-cards-delete`
`wapi-trusted-card-retrieve`	`wapi-trusted-cards-retrieve`
`wapi-trusted-card-verify`	`wapi-trusted-cards-verify`

New scopes:

Scope	Description
`wapi-transactions-get-fees`	Query transaction fee calculations
`wapi-transactions-retrieve`	Retrieve transaction history and individual transactions
`wapi-user-all`	Full access to User endpoints
`wapi-user-create`	Add associated Bank accounts and profile picture
`wapi-user-delete`	Remove associated Bank accounts and profile picture
`wapi-user-retrieve`	Retrieve profile and Bank information
`wapi-user-update`	Update password, phone, Bank accounts, and profile picture
`wapi-withdrawals-all`	Full access to Withdrawal endpoints
`wapi-withdrawals-create`	Create withdrawals
`wapi-withdrawals-delete`	Cancel pending withdrawals
`wapi-withdrawals-retrieve`	Retrieve withdrawal history and details

Endpoint URL Migration

All endpoints now use RESTful conventions. Action verbs are removed from paths and resource identifiers move to URL path parameters.

Accounts

v1.0.5	v2.0.0	Change
`POST /accounts/create`	`POST /accounts`	Path simplified
`DELETE /accounts/delete`	`DELETE /accounts/{account_number}`	`account_number` moved from body to URL
`GET /accounts/retrieve`	`GET /accounts/{account_number}`	`account_number` moved from body to URL
`POST /accounts/update`	`PATCH /accounts/{account_number}`	Method changed to PATCH; `account_number` moved to URL

Transactions

v1.0.5	v2.0.0	Change
`GET /transactions/history`	`GET /transactions/`	Path simplified
`GET /transactions/status`	`GET /transactions/{transaction_id}`	Renamed; `transaction_id` moved from body to URL
`POST /transactions/refund_request`	`POST /transactions/{transaction_id}/refund`	`transaction_id` moved from body to URL
—	`GET /transactions/fees`	New endpoint
—	`GET /transactions/meta`	New endpoint

Trusted Cards

The URL prefix is pluralized from /trusted-card to /trusted-cards.

v1.0.5	v2.0.0	Change
`POST /trusted-card/charge_request`	`POST /trusted-cards/{uuid}/charge`	`uuid` moved from body to URL
`POST /trusted-card/create`	`POST /trusted-cards/`	Path simplified
`DELETE /trusted-card/delete`	`DELETE /trusted-cards/{uuid}`	`uuid` moved from body to URL
`GET /trusted-card/retrieve`	`GET /trusted-cards/{uuid?}`	`uuid` is now an optional URL parameter
`POST /trusted-card/verify`	`POST /trusted-cards/{uuid}/verify`	`uuid` moved from body to URL

New Endpoints on Existing Modules

Transaction Fees — `GET /transactions/fees`

Calculate transaction fees before initiating a payment.

Parameters: fee_structure (required), currency (required), amount (required).

Returns the fee breakdown for the given amount, currency, and fee structure. Validates the amount against platform minimum and maximum limits.

Scopes: wapi-transactions-all or wapi-transactions-get-fees

Transaction Meta — `GET /transactions/meta`

Retrieve transaction configuration metadata.

Returns available currencies, environments, fee structures, and per-currency total limits (minimum and maximum amounts).

Scopes: wapi-transactions-all or wapi-transactions-retrieve

Validation Changes

Transaction history: page_size now enforces min:1 and max:100. page now enforces min:1.
Account passwords: Password complexity checks are now only enforced in production environments.

New Module: User

Manage the authenticated user's own profile, Banking details, and profile picture.

Method	Endpoint	Description
GET	`/user/`	Retrieve profile (account number, type, balances, Bank status, contact info, verification status)
POST	`/user/banks/{type}`	Add an associated local or foreign Bank account
DELETE	`/user/banks/{type}`	Remove an associated local or foreign Bank account
GET	`/user/banks/{type?}`	Retrieve Bank information (one or both types)
PATCH	`/user/banks/{type}`	Update Bank account details
PATCH	`/user/password`	Update password (requires old password, new password, and confirmation)
PATCH	`/user/phone`	Update phone number (validated against platform country)
POST	`/user/picture`	Upload a profile picture (max 5 MB; bmp, gif, jpeg, png, svg)
DELETE	`/user/picture`	Delete profile picture
PATCH	`/user/picture`	Replace existing profile picture

The {type} parameter accepts local or foreign.

New Module: Withdrawals

Create, track, and cancel fund withdrawals from a WiPay account.

Method	Endpoint	Auth	Description
POST	`/withdrawals/`	Required	Create a withdrawal
DELETE	`/withdrawals/{transaction_id}`	Required	Cancel a pending withdrawal
GET	`/withdrawals/`	Required	List withdrawal history (with filtering and pagination)
GET	`/withdrawals/meta`	None	Retrieve withdrawal metadata (Banks, ID types, statuses, withdrawal types)
GET	`/withdrawals/{transaction_id}`	Required	Retrieve a specific withdrawal

Three withdrawal types are supported: normal (withdraw to the authenticated user's own Bank account), sub_banked (withdraw to a specified third-party Bank account), and sub_unbanked (withdraw without a linked Bank transaction).

History supports filters: currency, withdrawal_type, status, amount_min, amount_max, reference, transaction_id, start_date, end_date, with_deleted.

v1.0.5

07 Nov 2024

Revised the document and all API endpoints.

v1.0.4

28 Mar 2023

Improvements to the Trusted Card API endpoints.
General document wording and formatting improvements.

v1.0.3

28 Feb 2023

Improvements to the Transaction Status, Create Trusted Card, and Retrieve Trusted Card API endpoints.
General document wording and formatting improvements.

v1.0.2

07 Jan 2023

Revised the document and all API endpoints.

v1.0.1

24 Dec 2022

Added access token scope and JSON request header.

v1.0.0

19 Dec 2022

Initial release.