reference

Changelog

2026-07Shift4 connector, safer fallback & hardened webhooks

Shift4 connector is live — full conformance suite (capture, manual auth, void, partial refunds, declines, tokens) green against the Shift4 sandbox.
Fallback safety: cross-PSP retries now happen only when the first PSP definitively did not receive the charge. Ambiguous failures (timeout after send, PSP 5xx) hold the payment in `processing` for reconciliation instead of risking a double charge.
Refund integrity: concurrent refund requests are serialized against the refundable balance, and every PSP refund call carries a deterministic idempotency key.
Webhook endpoint URLs are validated at registration and delivery: public addresses only (loopback/private/link-local/metadata ranges rejected); redirects are no longer followed.
Developer docs now also served at docs.vermil.dev, with the OpenAPI spec and llms.txt downloadable.

Merchant dashboard: analytics, payment timelines, routing rule builder, PSP connection management with encrypted credential intake, API keys, audit viewer, TOTP 2FA.
Platform tokens: POST /v1/payment_methods tokenizes at every eligible PSP; charge with payment_method.type = "token".
Webhook delivery log (GET /v1/webhook_deliveries) and manual retry endpoint.

Adyen connector (cards, capture/void/refunds, tokens, HMAC webhooks) — conformance suite green against the Adyen test environment.
Routing rules (/v1/routing_rules): priority matching on method, currency and amount with ordered PSP chains.
Automatic fallback on retryable technical failures; PSP health checks feed availability.

Stripe connector with full lifecycle: manual capture, voids, partial refunds, 3DS challenges.
Inbound PSP webhooks: signature verification, deduplication, tolerant state application.
Normalized decline taxonomy shared across all providers.