> **Description:** A chronological record of all significant changes, updates, and improvements made to the ePayment PSP API, including new features, bug fixes, and deprecation notices.

# ePayment PSP API changelog

**NOTE**

This page covers ePayment API changes that are specific to PSP integrations. There may be additional changes that apply to all ePayment API integrations -- see the [ePayment API changelog](https://developer.vippsmobilepay.com/docs/APIs/epayment-api/CHANGELOG.md).

## June 2026

* `softDeclineCompletedRedirectUrl` is now a required field in the [PSP card callback](https://developer.vippsmobilepay.com/redocusaurus/epayment-swagger-id.yaml) request. PSPs implementing the card passthrough callback must include this field.

## May 2026

* Added the [PSP card callback](https://developer.vippsmobilepay.com/redocusaurus/epayment-swagger-id.yaml) endpoint specification for PSP card passthrough payments. Vipps MobilePay POSTs card details to your `cardCallbackUrl`; your server must respond with the authorization result within 20 seconds.
  * The request body (`CardCallbackRequest`) includes `pspReference`, `authorizationAttemptId`, `merchantSerialNumber`, `amount`, `softDeclineCompletedRedirectUrl`, and `cardInfo`.
  * `cardInfo` contains `maskedCardNumber`, `cardType`, `cardIssuedInCountryCode`, `cardDataType`, and either a `networkToken` object or `encryptedPan` string depending on `cardDataType`.
  * The response (`CardCallbackResponse`) must have a `status` of `RESERVE`, `SOFT_DECLINE`, or `FAIL`, with corresponding required fields (`networkTransactionReference`, `softDeclineUrl`, or `errorCode`/`errorMessage`).
  * Callback requests are authenticated using HMAC-SHA256 signed with the PSP's `client_secret`. Verify the `Authorization`, `X-Vipps-Authorization`, `x-ms-date`, and `x-ms-content-sha256` headers.

## March 2026

* Added PSP support via the new `CARD_PASSTHROUGH` payment method type. PSPs can now create payments where the user's card token is sent to a PSP-controlled callback URL for processing. This requires:
  * `paymentMethod.type` set to `CARD_PASSTHROUGH`
  * A new `cardPassthrough` object in the create payment request body, specifying the callback URL, allowed card types, and optionally a public encryption key ID for receiving encrypted PANs
  * The `Psp-Id` header on all requests
  * See [ePayment PSP API guide](https://developer.vippsmobilepay.com/docs/APIs/psp-epayment-api/epayment-psp-api-guide.md) for details.

> **Full site overview:** For every page in this documentation, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).