Changelog

2026-09 — v1 published

The Client API v1 is documented publicly, together with its OpenAPI document, the Node.js client and the local API connector. v1 covers wallets and balances, per-network deposit addresses, transactions, destinations, payouts (idempotent and human-approved), webhooks (withdrawal.status_changed, deposit.received, deposit.completed), Ed25519 request signing, rate limiting and replay protection.

Added

• Cancel a payout — POST /api/v1/withdrawals/{id}/cancel cancels a payout that is still pending_approval. See Cancel a payout.
• Cursor paging — GET /api/v1/transactions accepts cursor, created_after and created_before, and returns meta.next_cursor (null on the last page). See Reconcile transactions.
• Single-transaction lookup — GET /api/v1/transactions/{id} returns every leg of one movement, as an array.
• Withdrawal status cancelled.
• Error codes transaction_not_found (404) and withdrawal_not_cancellable (409).
• API connector tools — get_transaction (read), cursor on list_transactions, and cancel_withdrawal (only with MEGTRUST_MCP_ALLOW_WRITES=true). See API connector MCP.

Tightened before public launch

If you integrated early, check these against your client:

• HMAC signatures must be exactly 64 lowercase hex characters.
• Ed25519 signatures must be canonical padded standard base64.
• POST bodies reject unknown fields with 400.
• Idempotency-Key is 1–128 printable ASCII characters without spaces.
• Reusing an idempotency key with a different body returns 409 idempotency_conflict.
• A withdrawal is visible only to keys of the workspace that created it.
• An amount with more decimals than the asset allows returns 400.
• An asset held on several networks needs network; an omitted network resolves to the network the asset is held on.
• Length limits: amount up to 100 characters; ids, network and address up to 128; names up to 120.
• Wallet and transaction reads fail with an error instead of returning partial data.
• Request bodies over 64 KiB return 413 request_too_large.
• The transaction list contains on-chain movements only. Follow payouts with GET /api/v1/withdrawals.