> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stabyl.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Product updates and improvements to the Stabyl API.

Follow along for new features, improvements, and fixes shipped to the Stabyl API.

<Update label="July 11, 2026" tags={["features", "wallets", "security"]}>
  ## New features

  **Signed direct partner withdrawals.** Dedicated API keys can explicitly enable `wallets:withdraw` and use Ed25519-signed quote and direct-submit requests. NGN amounts above the per-transfer limit are represented as grouped transfers in quote, submission, and transaction responses. The same list envelope supports one-item USD stablecoin settlement. See [Withdrawals](/docs/withdrawals).

  ## Compatibility

  Public withdrawal requests now use one list-shaped body for both quote and submit. Transport retries keep the same business idempotency key and body while generating a new timestamp, nonce, and signature.
</Update>

<Update label="June 5, 2026" tags={["features", "updates", "fixes"]}>
  ## New features

  **Trade fill email notifications.** Account holders now receive email notifications when their exchange orders fill, bucketed to avoid noisy delivery on partial fills. No API changes are required — emails are sent automatically to the account's verified address.

  **Email OTP gate for passkey enrollment.** Adding a new passkey to an account now requires a one-time code delivered by email before enrollment can complete. This protects accounts from passkey takeover even if a session is compromised. See [Authentication](/docs/authentication) for the supported credential flows.

  ## Updates

  **KYB verification migrated to Persona.** Business onboarding now runs on Persona instead of Sumsub. The KYB statuses returned by the API and the [sandbox `POST /simulate/kyb/status` endpoint](/docs/sandbox-simulation) are unchanged, so integrations that read KYB state continue to work without modification. Production webhook recipients should switch over to the new Persona-backed events.

  **Partner API key setup links hardened.** The one-time setup links partners use to provision API keys are now more resilient to reuse and edge cases during onboarding, making the flow described in the [Quickstart](/docs/quickstart) more reliable.

  **Exchange ownership always enabled.** Exchange partition ownership is now always on and no longer configurable, removing a class of misconfiguration that could affect order routing. No action is required from API consumers.

  ## Bug fixes

  * **Order admission near full balance.** Orders that would consume nearly the entire available balance are now admitted correctly instead of being rejected by a rounding edge case. See [Order management](/docs/order-management).
  * **Passkey revoke listing.** Revoked passkeys are now filtered out of the active passkey listing so the credentials shown match what can actually be used to sign in.
  * **TRON deposits and withdrawals on DFNS custody.** Several fixes to TRON chain parameter parsing, fee advance payload encoding, fee buffer sizing, and sweep amortization make TRON [deposits](/docs/crypto-deposit-addresses) and [withdrawals](/docs/withdrawals) more reliable under load.
  * **Wallet notifications.** Wallet event notifications are more consistent after an internal configuration cleanup, reducing the chance of missed or delayed wallet events.
  * **Exchange budget recovery.** Recovery of exchange budgets after restart is more robust, preventing rare cases where a restart could leave budgets in an inconsistent state.
  * **Durability recovery.** Ambiguous write-ahead-log states during durability recovery are now resolved deterministically, eliminating a rare source of stuck recovery.
</Update>

<Update label="May 29, 2026" tags={["features", "updates", "fixes"]}>
  ## New features

  **WebSocket ticket authentication.** You can now authenticate private WebSocket subscriptions and order commands with short-lived tickets instead of passing your API key in the connection URL. This keeps API keys off the wire and makes it safer to fan out streaming connections from constrained environments. See [WebSocket Overview](/docs/websocket-overview) for the supported authentication flows.

  **Partner API and API key onboarding.** Partner accounts can now provision API keys through a guided setup flow, with reference documentation for the partner endpoints. Start with the [Quickstart](/docs/quickstart) and [Authentication](/docs/authentication) guides.

  **DFNS-backed crypto custody.** Crypto deposits, withdrawals, and hot-wallet routing are now backed by DFNS custody infrastructure across supported chains. Existing [crypto deposit addresses](/docs/crypto-deposit-addresses) and [withdrawal](/docs/withdrawals) flows are unchanged for API consumers — addresses, networks, and confirmations continue to behave as documented.

  ## Updates

  **Exchange fill notifications.** Fill notifications are now bucketed for delivery and no longer include system-internal recipients, producing cleaner and more predictable webhook traffic for trading clients.

  ## Bug fixes

  * **DFNS webhook payload parsing** is more resilient to edge-case payloads, reducing the chance of dropped custody events.
  * **Asset identifiers in DFNS webhooks** are now canonicalized so deposit and withdrawal events consistently match the asset IDs returned by the API.
  * **Duplicate exchange fill notifications** are now suppressed end-to-end through stronger idempotency, so each fill is delivered exactly once.
</Update>