Changelog

This page lists changes to the Stablegate public documentation and API. Entries are ordered newest first.

November 11, 2026

This release makes the API explain itself: every failed call answers in one envelope with a request id a partner can quote, the documentation covers that surface end to end, and a customer's verification state is readable without guessing from kyc_level.

• GET /v1/customers/{customer_uuid}/verification/ returns the latest KYC application with its status and the message compliance wrote for the customer, and the verification link can be re-issued while the application waits for the customer or for compliance.
• The orders list reports the commission the platform actually charged, together with commission_asset_code, so the amount matches the order details for both on-ramps and off-ramps.
• check-fees names the asset the commission is charged in: on an off-ramp the amount is deducted in the crypto you send, not in EUR.
• The verification link section says which open applications accept a new link: new, waiting and pending keep it short-lived, so the partner asks for a fresh one.
• The guide examples and the order list fields show the commission in the asset it is charged in, with commission_asset_code beside the amount.
• Every response carries an X-Request-Id header: send your own value and the same id appears in the header and in the trace_id of an error, so a gateway timeout without a body still leaves a trace.
• A new Errors page covers the body of every error, the status codes, the devapi_* codes you can branch on, and when to retry.
• A new Quickstart page walks seven requests from an API key to a paid-out on-ramp order.
• The On-Ramp and Off-Ramp guides describe check-limits the way the API returns it — only the rules the operation breaks — and name the fields a payout needs.
• External Accounts carry the third-party flag you set yourself when registering a bank account; payouts above the invoice threshold ask for the supporting document based on it.
• The Postman Collection page and the API reference come from the same OpenAPI snapshot, so every endpoint is listed once.

November 2, 2026

A customer's account can now be activated through the API: Create a Verification Order returns the bank details the customer pays the test deposit to, and permissions.can_trade turns true once the deposit arrives. A regular order does not activate an account.

• A customer created by mistake can be closed through the API: Close a Customer answers 204 and leaves the record visible in the closed state.

October 31, 2026

A bank account now describes the payment scheme it moves money on. POST and PUT /v1/customers/{customer_uuid}/bank-accounts/ take supported_rails (sepa, swift, ach, wire), account_number for accounts outside SEPA, bank_routing_number for US payments, and the address of the bank and of the account holder. See External Accounts.

• One record covers one scheme: SEPA takes a separate account from ACH and FedWire.
• holder_name is the only field the request body requires. SEPA needs an iban, SWIFT needs a bank_code (BIC), US payments need bank_country: "US" and a 9-digit bank_routing_number.
• The bank decides which details it needs to execute a payout. It can require the holder address and the bank address for SWIFT and US payouts even though the API accepts an account without them, and rejects the payout when the order is executed.

October 30, 2026

• Orders that pay out to a third-party bank account wait for an invoice when the amount is above 15 000 EUR equivalent: such an order is created as usual but Stablegate does not execute it until the invoice is attached. See Orders.
• Stablegate no longer emails deposit instructions for orders you create through the API, so show the payment details to the customer on your own screen. Emails about the received deposit and the sent payout are unchanged. See Integration Checklist.

October 29, 2026

The documentation has a new design: the API Reference has a page for every endpoint, and /openapi.json, llms.txt and the Postman collection are generated from the same specification. Existing links keep working.

Check these before you update.

• Limit amounts are decimal strings like "5000.00" — in GET /limits/, POST /check-limits/ and the order list. Parse them as decimals, not numbers. See Limits.
• Every error, 422 included, returns trace_id, error_code, message and details. The detail key is still there and goes away in a later release, so read message and error_code.
• A customer that does not exist or belongs to another partner answers 404 instead of 403.

New in orders.

• source.deposit_status shows that the customer's transfer has arrived while the order is still new. See Orders.
• exchange_rate and rate_valid_until show the rate the order holds and until when.
• source.deposit_bank_info carries holder_name and bank_address to give to the customer.
• Limit rules carry rail_types, rail_codes and operation_types.

Also fixed.

• POST /v1/customers/{customer_uuid}/orders/{order_uuid}/cancel/ works for orders in new.
• Creating a customer with an email that is already taken answers 400 with devapi_email_occupied_error instead of 500.
• An Idempotency-Key cache entry belongs to the API key that made the request.
• A wallet address must be unique across all customers on its network; a conflict answers oa_client_external_account_address_exists.
• A path without the trailing slash redirects to https:// and keeps X-Api-Key.

October 2, 2026

This release makes bank accounts easier to register. bank_code is no longer required: Stablegate derives the BIC and the bank name from the IBAN, and the new GET /v1/bank-accounts/info-by-iban/ shows what will be filled in — see External Accounts. Order details now also carry the hash of the customer's crypto deposit in source.transaction_hash, so you can show the customer that the transfer has been seen.

Also in this release:

• When the bank registry has no BIC for an IBAN, creating a bank account answers 400 with devapi_bank_code_required_error; pass bank_code yourself in that case.
• exchange_rate returned by check-fees now includes the exchange spread: it is the rate destination.amount is calculated with. Amounts are rounded to the precision of their asset instead of two decimals. See Fees.
• An order whose payout is rejected by the payment provider now moves from processing to rejected; it used to end up in failed. A failed order can now be stopped by Stablegate operations and move to stopped. See Orders.
• A webhook now receives only the events of the account it belongs to.
• An API key whose account has no access to the Partner API answers 403 instead of an internal error. When Stablegate cannot verify a key because an internal service is unavailable, the API answers 503 — retry the request. See Authentication.

September 15, 2026

This release brings Instant (Light) Verification to the Partner API. POST /v1/customers/{customer_uuid}/verification/instant/ takes the customer's first name, last name, and date of birth, runs the automated AML screening, and approves the application when the screening is clear. It is documented on the Customers guide together with the existing Standard verification link endpoint.

Also in this release:

• GET /v1/customers/{customer_uuid}/ now returns kyc_level, so you can poll the outcome of a verification on the detail endpoint (previously only the list endpoint had it).
• Documented what Instant (Light) Verification consists of on Individual Verification: first name, last name, and date of birth, followed by an automated AML screening; approval is automatic when the screening is clear. Verification has to be started by the customer or by the partner through the API — it does not begin on its own after registration.
• Clarified on Account Activation that the test deposit or video interview applies to Standard verification only; Instant verification needs no activation. The permissions.can_trade note on Customers now says which level requires activation.

August 25, 2026

This release corrects the documentation where it disagreed with the API. Two corrections matter most for an integration. A customer cannot transact before verification: the €1,000 monthly limit applies only after Light Verification, and before any verification the limit is €0 — see Individual Verification and Limits. And every transaction is charged whichever is greater, the percentage rate or the €20 minimum commission, which was previously undocumented and could look like a flat fee at small transaction sizes — see Fees.

Also in this release:

• Corrected the Customers guide: customer records cannot be updated after creation (only GET is supported on /v1/customers/{customer_uuid}/; PATCH/PUT return 405). The March 4, 2026 entry below incorrectly listed "update" among the supported operations.
• Documented bank_code (BIC/SWIFT) as a required field on bank account creation — it was previously listed as optional.
• Documented the status and verified_at fields on crypto wallet responses under External Accounts, so you can confirm Satoshi Test / WalletConnect ownership verification via the API before placing an order.
• Clarified in Customers that email/username uniqueness is enforced across your whole legal entity, not per customer type.

April 21, 2026

• Published machine-readable resources for LLM coding agents at the site root: llms.txt (curated index following the llmstxt.org spec), llms-full.txt (full documentation bundle in one file), and openapi.json (raw OpenAPI 3.1 spec).
• Added the For LLM Agents page describing these resources and when to use each.

April 20, 2026

• Updated the list of non-serviced countries to reflect current sanctions and policy.

April 13, 2026

• Added the Bank Providers guide and API endpoint for discovering banks, their supported rails, and the exchange routes accessible through each bank.
• Added the exchange_rate field to fee quotes so you can surface the live rate before placing an order. See Fees.
• Cross-linked the Bank Providers concept from the Introduction, Getting Started, and the integration guides.

April 10, 2026

• Added the Webhooks guide: event types, payload schemas, HMAC signature verification, and endpoint registration.
• Updated Orders and Getting Started to reference webhook-driven order status updates as an alternative to polling.

March 20, 2026

• Documented the external_reference field on orders, which lets you correlate Stablegate orders with identifiers in your own system. See Orders.
• Clarified the end-to-end integration flow in the Introduction and Getting Started pages.
• Corrected inaccuracies across the Customers, Idempotency, Fees, Limits, and integration guides.
• Refreshed the Postman collection to match the current API contract.

March 4, 2026

• Added the Customers guide covering creation, retrieval, listing, and update of customer records, along with customer UUID scoping rules.
• Added the Idempotency guide covering the Idempotency-Key header and safe-retry semantics.
• Expanded the OpenAPI specification to cover the full set of v1 endpoints and schemas rendered on the API Reference.

February 16, 2026

• Revised the Fees and Limits guides with updated calculation examples and field descriptions.

February 13, 2026

• Replaced the initial placeholder guides with the current resource-oriented documentation. Integration content now lives under Getting Started, Integration Guides, and the per-resource guides (Customers, External Accounts, Exchange Routes, Orders, Fees & Limits).
• Updated the OpenAPI specification accordingly.

December 5, 2025

• Added the Terms of Business page to the Verification section.

October 30, 2025

• Initial release of the public Stablegate documentation, including integration guides, API reference, and verification rules.