Changelog

What changed for integrators, newest first.

What changed for integrators, newest first. v1 is append-only: fields and endpoints are added,\nnever removed or renamed. Questions: techteam@1809ltd.co.ke.

2026-10-14

A payout now reaches a final state. Payouts raised through POST /payouts told M-Pesa to\nsend the result to the wrong one of our two callback addresses, so the verdict was refused as\nmalformed and never applied: the payout stayed processing and the amount stayed held in your\nwallet, even when the transfer had failed and the money had never left. Results now land where\nthey can be read, so a payout ends as completed or failed, a failed one returns the held\namount to your wallet immediately, and you get payout.success or payout.failed either way.\nPayouts already stuck this way have been settled from the verdicts M-Pesa had already sent.

2026-10-08 (later)

A payment whose callback never arrives is now settled anyway. Every five minutes we ask\nthe provider about payments still waiting and apply the verdict through the same path a\ncallback takes, so the wallet credit, the fee, the sale and your collection.success or\ncollection.failed all happen exactly once. Callbacks stopped reaching us for three days\nafter a DNS lapse; results now resolve within minutes regardless.

2026-10-08

A non-Kenyan payer_phone is now refused with 422 and details.payer_phone, before\nanything is attempted. It used to reach the provider's rail, fail there, and come back as\n502 COLLECTION_FAILED — \"no money has moved\" — which reads like an outage and invites a\nretry that cannot succeed. M-Pesa can only charge Kenyan lines.
Reminder about refresh tokens: POST /auth/refresh returns a new refresh token and\ninvalidates the one you sent. Store the new one every time, and refresh from one place only.\nPresenting a refresh token twice is treated as theft: the whole chain is revoked and the call\nfails with 401 REFRESH_TOKEN_REUSED. An access token lasts 30 minutes, so refreshing every\nfew minutes is unnecessary.

2026-09-17

Callback events match what we send. GET /webhooks/events now lists exactly the 15\nevents we deliver, each saying when. payout.approved, payout.rejected and\npayout.cancelled were sent but could not be subscribed to; now they can.
Retired event names. invoice.paid, invoice.partially_paid, invoice.voided,\nbill.paid, bill.partially_paid, bill.voided, collection.pending and\npayout.pending were listed but never sent. They are still accepted when you register a\nwebhook, so nothing breaks, but they deliver nothing. For payments, use\ncollection.success / payout.success.
\"What you hear back, and when\" in the integration guide: which requests get only a\nreply and which also get a callback.
Interactive reference fixed. The Swagger and Redoc pages were empty because the\nOpenAPI document failed to load. The Collection and Payout schemas also listed type\ntwice; type is the payment type, e.g. mobile_money.
Support is now techteam@1809ltd.co.ke. Our emails come from noreply@mymauzo.com, and\nreplies to them reach support.

2026-09-16

Say what was sold on POST /collections. Optional product_uuid, item_name and\nquantity. Every completed collection is recorded on your account as a paid sale. Without\nthese fields, the sale is recorded against your default \"Collection\" product. Responses\nand webhooks carry item and, once paid, invoice.
Look up a transaction by your own reference. GET /collections/{id},\n/collections/{id}/status and the payout equivalents accept our id, our reference, or\nthe reference you sent.
POST /webhooks/test sends your endpoint a signed test event and returns its answer,\nplus a hint when it was refused.
One secret per URL. A URL you registered as a webhook is always signed with that\nwebhook's secret, including when you also send it as notify_url. Other URLs use your\naccount's Webhook Secret, never your API secret.
Third callback destination. The Default Callback URL set on your account in the\ndashboard now receives results when a request has no notify_url and no registered webhook\ntakes the event.
Registration fix. An endpoint that refuses our unsigned registration probe with 401 or\n403 can now be registered.
invoice.* and bill.* events are now delivered to webhooks that subscribe to them.\nThey were never sent before.
Retry schedule. Failed deliveries are retried after 1m, 5m, 15m, 1h and 3h: six\nattempts in about four and a half hours. We can resend on request after that.
Invoice numbers. API invoice numbers no longer collide with invoices created in the\ndashboard.
POST /invoices/with-collection fixes:
- a tax-inclusive price is charged once;
- goods stock is deducted;
- a retried request never records a second sale;
- a request refused before payment leaves no sale behind.
\n
Settlement. A completed payment settles an invoice only in your own account.

2026-09-10

Docs pages fixed. The Webhooks, Errors and Examples pages no longer return an error.

2026-09-06

Webhook registration fixed. POST /webhooks works; it was refused for every caller.
Clearer availability. GET /collection-methods and /payout-methods give the real\nreason a payment type is unavailable. \"Try again shortly\" and \"ask support to enable this\"\nare now distinguishable.

2026-09-05

Wallets. GET /wallets, GET /wallets/{uuid}/transactions and\nPOST /wallets/transfer, which moves funds between your own wallets. They need the new\nscopes wallets.read and wallets.transfer.
Up to 10 active API keys per account. Revoking one frees a slot.
No double credit. A provider retrying a payment callback no longer credits your wallet\ntwice.

2026-09-04

You choose the payment type, we choose the provider. Send \"type\": \"mobile_money\"\n(and the fields GET /collection-methods lists). Naming a provider is refused.
Self-service API keys. Issue, rotate and revoke keys in the dashboard under\nSettings → API Keys.
Fees shown. Collections and payouts show the platform fee and your net_amount.
Local testing. A local sandbox environment for Postman.

\n\n

\n This page is generated from the integration guide, so it never disagrees with it.\n Download the full guide.\n