Changelog

​

Yativo Fiat

• Login tokens discontinued: POST /auth/login, GET /auth/refresh-token and Authorization: Bearer tokens (legacy Account ID and App Secret) no longer work for API requests. Send X-Api-Key and X-Api-Secret on every request. See Authentication
• Gift cards discontinued: GET /giftcards, GET /giftcards/categories, POST /giftcards, GET /giftcards/redeem/{transactionId} and the giftcard.status_changed webhook are no longer available
• Corporate cards in sandbox (invitation only): issue cards to your business customers’ employees, fund each employee’s card balance from your USDC balance, and review memos, in the sandbox API and dashboard ahead of production. See Corporate Cards in Sandbox
• Corporate card links: card number, CVV and PIN are now only on each card’s reusable, embeddable link, which only the card’s employee can open (email code the first time, then a passkey or authenticator app). Brand it with your logo, font and colours, reset an employee’s sign-in, and change an employee’s email with their confirmation on the card link. Removed: GET /spend/cards/{card_id}/widget-token, POST /spend/cards/pin and POST /corporate-card/employees/cards/pin. See Corporate Card Links
• Sandbox KYC: sandbox does not approve KYC when you create a customer. Your account stays limited until kyc_status is approved and is_kyc_submitted is true. The sandbox dashboard collects business verification in a form. See Sandbox KYC
• Pay out by receive amount: set amount_type: "receive" on POST /exchange-rate (payout quotes) or POST /wallet/payout to fix exactly what the customer receives. Yativo works out the send amount and fees. POST /wallet/payout responses now include amount_type, send_amount, customer_receive_amount and debit_amount. See Pay out by receive amount
• Market rates: new GET /exchange-rates returns live indicative rates for every wallet currency, for display to your customers. See Live market rates
• Fee schedule: new GET /fees returns your account’s fees for every payin and payout method, virtual account currency and card action, including custom pricing. See Fees
• Login history: new GET /auth/login-history lists sign-ins with IP, device, location and suspicious-sign-in flags, including failed API key attempts. See Security
• EUR deposits via SEPA: customers can fund deposits by bank transfer to a Yativo IBAN. See Deposits
• Endpoints that change sign-in settings (passkeys, two-factor authentication, PIN, app secret) or delete the account now return 403 when called with an API key
• GET /ip-whitelist/check now returns api_key.label (was name) and a network.warning when your request came through a proxy
• Currency swap: swap balance between your own wallets with GET /wallet/swap/pairs, POST /wallet/swap/quote, POST /wallet/swap, GET /wallet/swap and GET /wallet/swap/{reference}. Each pair has its own rate, fees and limits. POST /swap/init and POST /swap/process are no longer available. See Currency Swap
• USDC balance: your USDC balance is only for corporate cards. Payouts, transfers and swaps out of it fail with Invalid wallet selected. Fund it with a USDC deposit or a swap from USD. See USDC balance
• Wallet address limits: POST /crypto/create-wallet and POST /corporate-card/wallet allow 3 requests a minute per customer. Going over returns 403 and blocks both for that customer for 24 hours. See Wallet address limits
• Unified errors: every failed response now includes error_details, with a stable code, message, fields, retryable and retry_after. See Error response format
• Payout references and invoices: POST /wallet/payout and POST /payout/simple accept reference (shown to the recipient’s bank), plus invoice or invoice_url. payout.updated webhooks include reference. See Initiate Payout
• Verification results come from endorsements: a customer’s KYC or KYB result is only available through their endorsements, via the endorsement.updated webhook or the endorsement list on GET /customer/{customer_id}. Each service is available when its endorsement is approved. GET /customer/kyc/{customer_id} and is_va_approved are no longer documented as a status check. See Track verification with endorsements
• Corporate cards: customers now need an approved cobo_pobo endorsement, not faster_payments
• Virtual account currencies: USD_KIRA and USDKIRA are no longer available. Get the codes your account can use from GET /business/virtual-account/currencies-and-endorsements
• KYC lookups in the API reference: countries, subdivisions, postal code formats, ID types, occupations, industries, account purposes, sources of funds and transaction currencies and countries, each with a “Try it” playground. See KYC Lookups
• KYC sandbox host: sandbox customers use https://kyc-sandbox.yativo.com; production uses https://kyc.yativo.com. KYC platform endpoints don’t need an API key. KYB business profile fields go in the extra_business_info, collections_data and payouts_data objects. See KYC / KYB
• Try it on every endpoint: every fiat API reference page now has an interactive playground
• KYC rules documented: duplicate-person 409 with duplicate_of, the permanent 403 for placeholder names, what each endorsement needs, sandbox test values, and a go-live checklist. See KYC / KYB
• Endorsement resubmission: POST /customer/kyc/resubmit/{customer_id}/{endorsement} re-runs verification for one endorsement. See KYC / KYB
• KYC and KYB rules: files can be 5 KB–30 MB; tax IDs take letters and digits only; KYB requires primary_website, proof of address for every address, pep_status, third_party_msb_payments, expected_monthly_payments_usd and a shareholding_structure extra document; associated persons below the ownership threshold (default 25%) are dropped; individual submissions return warnings for values verification is likely to reject. See KYC / KYB
• MCP server: connect Claude, Cursor or any MCP client to your fiat account at https://api.yativo.com/mcp to check balances and deposits, and quote and send payouts with your approval. See Fiat MCP server

​

Docs

• Corrected: the fiat webhook signature header is Signature, not X-Yativo-Signature. Webhooks time out after 3 seconds and are attempted up to 3 times. The Webhooks page now lists every event type, including virtual card and corporate card events
• Corrected: POST /payout/simple requires debit_wallet and customer_id. Insufficient balance returns 400, not 402. Idempotency keys are kept for 60 minutes, not 24 hours
• Corrected: KYB account_purpose and source_of_funds use their own lists, separate from individual KYC. KYB associated persons send ID images as image_front and image_back
• AI and MCP servers compares the Docs, Fiat and Agentic Wallet MCP servers, and documents the Docs MCP server at https://docs.yativo.com/mcp

​

Yativo Crypto

• Card IBAN removed from the crypto docs. To receive money by bank transfer, use Yativo Fiat virtual accounts

​

Yativo Fiat

• API Keys: servers now authenticate with X-Api-Key and X-Api-Secret. See Authentication
• Deprecated: legacy API keys (Account ID + App Secret, POST /auth/login). From 15 October 2026, its tokens only work inside the dashboard
• IP whitelisting: every API key lists the server IPs allowed to use it, enforced from midnight on 14 October 2026. See IP whitelisting
• New GET /ip-whitelist/check to confirm each server is allowed
• Passkeys: everyone on a team can sign in to the dashboard with a passkey. See Passkeys

​

Yativo Crypto

• Customers: get, update and delete a customer, plus per-customer auto-forwarding. See Customers
• Agentic wallets: per-connector capabilities, GET /agent/capabilities, GET /agent/openapi.json, and prediction market trading. See Agentic Wallets
• Transactions: POST /transactions/preview-fee, daily and monthly withdrawal limits, and review holds for large sends
• Gas station low-balance email alerts with custom thresholds and recipients
• Swap: GET /swap/destinations and GET /swap/available-chains
• Deposit webhooks use the on-chain transaction hash as transaction_id; deposits below the minimum aren’t credited
• Secure card view: card data always renders light, and the view can be embedded on any website
• Crypto docs now cover the crypto API only. Fiat features are documented under Yativo Fiat

​

Docs

• Comprehensive Yativo Fiat documentation with guides, API references, KYC/KYB docs
• Added HMAC SHA256 webhook signature verification examples in 7 languages
• Docs reordered: Yativo → Yativo Fiat → Fiat API References → Yativo Crypto → Crypto API References
• Changelog page added

​

Monitoring

• Two public status pages for production/live/main:
  • status.yativo.com (primary)
  • status2.yativo.com (backup)
• Both pages show real-time uptime, incident history, and scheduled maintenance
• Fiat backend health check endpoints added (/api/health, /api/health/ping)

​

Yativo Crypto SDK

• 2FA enforcement on all critical operations: send funds, API key management, swaps, card freeze/unfreeze, auto-forwarding rules
• TypeScript SDK updated with twoFactorCode parameter on sensitive endpoints
• Chrome extension updated with 2FA modal prompt for sensitive actions

​

Security

• Webhook HMAC SHA256 signature verification documented with multi-language examples
• Removed API registration/login from public docs — onboarding exclusively via dashboard

​

Yativo Crypto

• Auto-forwarding rules API: create, list, update, delete rules for automatic fund forwarding
• Auto-forwarding supports twoFactorCode for create/update/delete operations

​

Security

• XSS sanitization added to all user-facing string inputs across crypto API
• Browser extension hardened against XSS injection vectors

​

Yativo Fiat

• Virtual card operations: activate, create, topup, freeze, withdraw, terminate
• Send money quote endpoint: /sendmoney/quote for pre-flight rate checks
• Wallet creation API: POST /wallet/create
• PDF transaction receipts: GET /business/transaction/receipt/{id}

​

SDKs

• TypeScript/Node.js SDK released with full crypto API coverage
• Python SDK released
• PHP SDK released
• Java SDK released
• Chrome extension with full wallet management UI

​

KYC/KYB Platform

• Individual KYC submission API at kyc.yativo.com
• Business KYB submission with document upload support
• Hosted KYC links for no-code integration
• Webhook notifications on KYC status changes

​

Yativo Fiat

• Magic link passwordless authentication
• API key generation with PIN protection
• Business virtual accounts (SEPA, SPEI, Brazil, USD LatAm)
• Service endorsements for regional payment rails

​

Launch

• Yativo Fiat platform launched at app.yativo.com
• Yativo Crypto platform launched at crypto.yativo.com
• Multi-currency wallets with support for 30+ currencies
• Real-time exchange rates and FX conversion
• Developer API with sandbox environment at smtp.yativo.com
• Webhook infrastructure for real-time event notifications