All notable changes to the Bitnob API are documented here.

July 23rd, 2026TAGS

NewWebhooks

Webhook source IPs published for firewall allowlisting

Added a **Source IPs** section to the webhook reference pages (Addresses, Virtual Cards, Payouts, Withdrawal, and Beneficiary) listing the addresses Bitnob sends webhooks from — 18.171.51.218 and 13.134.154.133 — so you can allow them through a firewall that restricts inbound traffic. Each page includes an nginx allow/deny example. These addresses can change, so treat the allowlist as a network convenience rather than a security boundary: always verify the x-bitnob-signature header on every event, whether or not you filter by IP.

July 20th, 2026TAGS

BreakingWebhooksPayouts

Payout webhooks reference: initialized, processing, withdrawal.success, withdrawal.expired

Documented the webhook events emitted by the payouts API (quote → initialize → finalize): payouts.initialized, payouts.processing, payouts.withdrawal.success, and payouts.withdrawal.expired. payouts.processing fires when the settlement rail picks up the payout — it is an in-flight update, not a terminal state, so keep waiting for payouts.withdrawal.success before treating funds as delivered. Each event carries the payout record itself, so field names match the payouts API response (quote_id, settlement_amount, from_asset, nested beneficiary) rather than the legacy payout.transfer.* shape, which these events replace. Note that data.status is the event outcome in lower case (initiated, processing, success, expired) and is not the payout record's upper-case lifecycle status returned by Get Payout — check the event field to decide how to handle each webhook.

July 15th, 2026TAGS

NewPlayground

Interactive API Playground with live cURL and raw request bodies

Supported API reference sections now include a **Try it out** playground for sending real, HMAC-signed requests and inspecting the live response. As you fill in the path, query, and body fields, the request panel builds a live, syntax-highlighted **cURL** command you can copy and run as-is. For write endpoints (POST/PUT/PATCH), a new **Raw body** tab lets you paste your own JSON payload instead of using the form fields — the exact bytes you paste are signed and sent verbatim, and your pasted body persists across page refreshes. Enter your API credentials once; timestamps, nonces, and signatures are generated automatically on each run.

July 15th, 2026TAGS

NewAI

Page Assistance: open any reference page in Claude or ChatGPT

API reference pages now include a **Page Assistance** menu that connects the page to your AI assistant. **Open in Claude** and **Open in ChatGPT** launch the assistant pre-loaded with a prompt to read the current page, so you can ask questions answered from the actual documentation rather than guesses. **Copy for LLM** copies the whole page as clean Markdown to paste into any model, and **View as Markdown** opens the page's raw Markdown source in a new tab. Every action operates on the entire page.

June 12th, 2026TAGS

NewWebhooks

Stablecoin webhooks reference

Added dedicated Stablecoin Webhooks pages under the Addresses and Withdrawal API reference sections, documenting the deposit.success, transfer.success, and transfer.failed events. Each page covers event verification (HMAC SHA512 via the x-bitnob-signature header), notification retries, local testing, and full payload field references with sample payloads.

May 19th, 2026TAGS

BreakingWebhooksCard issuing

Card webhooks v2: camelCase payloads, micro-units, new envelope

Refreshed every outbound virtual-card webhook to a new payload shape. Event suffixes renamed from .complete to .completed (e.g. virtualcard.created.completed, virtualcard.topup.completed, virtualcard.withdrawal.completed). All JSON keys are now camelCase (cardId, companyId, createdStatus, etc.) and amounts are integers in micro-units (1 USD = 1,000,000) with a sibling displayAmount float on transaction events. New top-level envelope adds companyId alongside eventId / event / data. Transaction events gain transactionType (stable enum), merchantName / merchantMcc / merchantCountry, and timestamp. Cross-border now emits two variants: cross_border_pending (company-wallet fee debit) and cross_border_settled (card-balance principal debit) — these are transactionType values, which remain snake_case. Contactless and refund events also fire with multiple transactionType values under the same event string — branch on event first, then transactionType.

May 15th, 2026TAGS

ImprovedWebhooks

Webhook payloads: top-level event_id

Refreshed webhook payloads for card top-up, card withdrawal, stablecoin transfer, and stablecoin deposit events to include a top-level event_id, making deduplication and tracing easier. The transfer.success event now also includes transaction_id in its data payload.

February 28th, 2026TAGS

NewCard issuing

Card Issuing API v2 beta

New card creation endpoints are now available, with support for physical cards, custom BIN ranges, and 3D Secure. This update provides greater flexibility in how you issue and manage cards, while also improving security and control over card transactions.

January 30th, 2026TAGS

NewCard issuing

Virtual Cards API v2

Refactored the Virtual Cards API to a resource-oriented design. Replaced /api/virtualcards/* with /api/cards and /api/customers namespaces, standardized route structure using :cardId and :customerId path parameters, and consolidated card operations under /api/cards/:cardId/*. Added endpoints for extended card details, spending-limit controls, and customer-cards lookup.

January 30th, 2026TAGS

BreakingCard issuing

Breaking changes: legacy Virtual Cards endpoints removed

All previous endpoints under /api/virtualcards are no longer supported. Card operations now require an explicit cardId path parameter instead of implicit context, and the user-based model has been replaced with a customer-centric model using customerId. Update integrations to the new /api/cards and /api/customers namespaces before upgrading.

Old Endpoint	New Endpoint
POST /api/virtualcards/create	POST /api/cards
POST /api/virtualcards/topup	POST /api/cards/:cardId/fund
POST /api/virtualcards/withdraw	POST /api/cards/:cardId/withdraw
POST /api/virtualcards/freeze	POST /api/cards/:cardId/freeze
POST /api/virtualcards/unfreeze	POST /api/cards/:cardId/unfreeze
POST /api/virtualcards/terminate	POST /api/cards/:cardId/terminate