Skip to main content

Release Notes

API changes and migration notes by release.

v1.4.0 (2026-02-07)​

This release introduces enhanced security measures for message signing, updates timestamp handling, and simplifies transfer operations.

What Changed​

Security Enhancements:

  • All signed messages now require explicit action field (e.g., PLACE_ORDER, CANCEL_ORDER, CANCEL_ALL_ORDERS, TRANSFER, WITHDRAW)
  • Message signing now uses canonicalized JSON with sorted keys for consistency
  • Replay protection enforced with 5-minute window using Redis
  • Timestamp validation: requests rejected if timestamp is in the future or older than 5 minutes

Timestamp Requirements:

  • All timestamp fields must be integers in milliseconds (not ISO strings)
  • Required timestamp field in request body or query params. This Applies to:
    • POST /orders (request body)
    • DELETE /orders/:id (query params)
    • DELETE /users/me/cancel-all-orders (query params)
    • PUT /transfers (request body)
    • POST /withdrawals (request body)

Transfer Changes:

  • PUT /transfers: amount field now expects formatted values (e.g., "100.5" for ETH) instead of base units
  • PUT /transfers: to_wallet_address is now required (username transfers removed)

Order Cancellation:

  • DELETE /orders/:id now expects order_id, timestamp, and signature as query parameters

Migration Notes​

  • Update all message signing to include explicit action field in payload
  • Change timestamp format from ISO strings to integer milliseconds: Date.now()
  • Update transfer amount from base units (wei) to formatted decimals
  • Remove username support from transfers, use wallet addresses only

v1.3.0 (2026-01-19)​

This release standardizes API field names to snake_case across all requests and responses, and updates the withdrawals claim response with clearer naming plus a new formatted amount field.

What Changed​

  • API key fields now use api_key and api_secret (previously camelCase)
  • User fields now use wallet_address (previously walletAddress)
  • Timestamps now use created_at and updated_at (previously createdAt and updatedAt)
  • Pagination query parameters now use page_size (previously pageSize)
  • Withdrawals claim response fields now use snake_case
  • Added new amount_formatted field to withdrawals claim response

Updated Withdrawals Claim Response​

New Format (v1.3.0):

{
  "status": "CLAIM_READY",
  "proof_ready": true,
  "local_exit_proof": "0x...",
  "global_exit_proof": "0x...",
  "global_claim_index": "42",
  "token_address": "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48",
  "chain_id": 1,
  "destination_network_id": 2,
  "destination_address": "0x...",
  "amount": "100000000",
  "amount_formatted": "100.0",
  "bridge_contract_address": "0x..."
}

Migration Notes​

  • Update all camelCase fields to snake_case equivalents (e.g., pageSize → page_size, walletAddress → wallet_address)
  • Update pagination query parameters from pageSize to page_size
  • The amount_formatted field is additive and doesn't replace amount