> **Description:** A chronological record of all significant changes, updates, and improvements made to the ePayment PSP API, including new features, bug fixes, and deprecation notices.

> **AI agent:** Read [https://developer.vippsmobilepay.com/docs/knowledge-base/ai-tools.md](https://developer.vippsmobilepay.com/docs/knowledge-base/ai-tools.md) first. It covers keeping API keys and secrets out of generated code.

> **Full site overview:** For an overview of the entire site, read [https://developer.vippsmobilepay.com/llms.txt](https://developer.vippsmobilepay.com/llms.txt).

# ePayment PSP API changelog

**NOTE**

This page covers ePayment API changes that are specific to PSP integrations. There may be additional changes that apply to all ePayment API integrations -- see the [ePayment API changelog](https://developer.vippsmobilepay.com/docs/APIs/epayment-api/CHANGELOG.md).

## October 2026

* [Create payment](https://developer.vippsmobilepay.com/redocusaurus/epayment-swagger-id.yaml): the `cardPassthrough` object is
  renamed to `psp`, and its `cardCallbackUrl` field is renamed to `callbackUrl`.

## September 2026

* [Create payment](https://developer.vippsmobilepay.com/redocusaurus/epayment-swagger-id.yaml): `ELEC_DEBIT` added to the allowed
  values for `allowedCardTypes`.

## June 2026

* `softDeclineCompletedRedirectUrl` is now a required field in the [PSP card callback](https://developer.vippsmobilepay.com/redocusaurus/epayment-swagger-id.yaml) request. PSPs implementing the card passthrough callback must include this field.

## May 2026

* Added the [PSP card callback](https://developer.vippsmobilepay.com/redocusaurus/epayment-swagger-id.yaml) endpoint specification for PSP card passthrough payments. Vipps MobilePay POSTs card details to your `cardCallbackUrl`; your server must respond with the authorization result within 20 seconds.
  * The request body (`CardCallbackRequest`) includes `pspReference`, `authorizationAttemptId`, `merchantSerialNumber`, `amount`, `softDeclineCompletedRedirectUrl`, and `cardInfo`.
  * `cardInfo` contains `maskedCardNumber`, `cardType`, `cardIssuedInCountryCode`, `cardDataType`, and either a `networkToken` object or `encryptedPan` string depending on `cardDataType`.
  * The response (`CardCallbackResponse`) must have a `status` of `RESERVE`, `SOFT_DECLINE`, or `FAIL`, with corresponding required fields (`networkTransactionReference`, `softDeclineUrl`, or `errorCode`/`errorMessage`).
  * Callback requests are authenticated using HMAC-SHA256 signed with the PSP's `client_secret`. Verify the `Authorization`, `X-Vipps-Authorization`, `x-ms-date`, and `x-ms-content-sha256` headers.

## March 2026

* Added PSP support via the new `CARD_PASSTHROUGH` payment method type. PSPs can now create payments where the user's card token is sent to a PSP-controlled callback URL for processing. This requires:
  * `paymentMethod.type` set to `CARD_PASSTHROUGH`
  * A new `cardPassthrough` object in the create payment request body, specifying the callback URL, allowed card types, and optionally a public encryption key ID for receiving encrypted PANs
  * The `Psp-Id` header on all requests
  * See [ePayment PSP API guide](https://developer.vippsmobilepay.com/docs/APIs/psp-epayment-api/epayment-psp-api-guide.md) for details.