Introduced Changes

Webhook URL (required)
OAuth URL (if applicable)
Health Check URL (if applicable)

PENDING_REVIEW
BLOCKED

Status Descriptions

How the New Process Works

A webhook subscription is created or updated.
Submitted URLs are checked against existing approval records.
New or unknown URLs are evaluated through automated validation.
If additional review is required, the subscription status changes to PENDING_REVIEW.
If any URL is rejected or blocked, the subscription status changes to BLOCKED.
If all required URLs are approved, the subscription status changes to INACTIVE.

Review the affected endpoints.
Update the URLs to an acceptable endpoint.
Resubmit the subscription for processing.

For New Subscriptions

Why We Are Making This Change

Reduce security risk
by preventing outbound calls to unapproved endpoints.
Improve compliance
through stronger review and approval controls.
Increase transparency
with clearer merchant-visible statuses.
Support scale
through a standardized and repeatable validation process.

Overview of MLE

Update Methods

Create or update your custom MLE integration using JWTs with P12 certificates. For more information, see the Enable Message-Level Encryption section in the
Getting Started with REST Developer Guide
. For a method using shared secret key pairs, see the HTTP Messaging Migration to JWT Messaging section.
Update your REST API SDK. For more information, see the
REST API related products
section in the Cybersource GitHub.

JSON Web Token Construction Update

Update Methods

See Construct JWT Messages Using a
P12 Certificate
in the
Getting Started with REST Developer Guide
See Construct JWT Messages Using a
Shared Secret Key Pair
in the
Getting Started with REST Developer Guide

HTTP Messaging Migration to JWT Messaging

Update Method

See Construct JWT Messages Using a
Shared Secret Key Pair
in the
Getting Started with REST Developer Guide

Merchant Impact

You might occasionally experience slower response times or timeouts.
For API integrators, an HTTP
429
response often indicates that there are too many request responses on Transaction Search, Case Search, or the Find Similar Transactions feature, particularly for large, broad, or long-date-range searches.

Recommended Actions

Keep multi-value lookups to 15 identifiers or fewer per search.
Use the narrowest date range that answers your question. A period of no more than 7 days is recommended for interactive transaction searches.
Break large bulk lookups into smaller batches instead of using one large combined search.
Avoid broad wildcard searches, especially searches that use a short prefix and an asterisk (*).
If a search is slow or times out, wait a moment before retrying instead of retrying immediately.
For API integrators:
Limit each request to 15 or fewer identifiers.
Use the narrowest date range your job needs.
Implement back off on timeouts or errors instead of tight-loop retries.
If you receive a
429
response, honor any Retry-After value and reduce your request rate and batch size rather than immediately retrying.
If your workflow repeatedly requires a large multi-identifier or long-date-range search, contact your support or account team so that it can be reviewed for the batch and export path or an appropriate exception.

Recommended Next Step

Best Practices for Implementing Searches

General Guidance

Keep multi-value lookups to 15 identifiers or fewer per search. Identifiers include reference numbers, request IDs, or account numbers. For larger lookups, use another method instead of one very large interactive request.
Use the narrowest date range that answers your question. Use a period of no more than 7 days for interactive transaction searches.
Break large bulk lookups into smaller batches. For example, implement several searches of less than or equal to 15 identifiers and less than or equal to 7 days instead of implementing one combined search that spans many identifiers and a long date range.
Retry failed or slow searches manually, using a short pause instead of immediately re-running the identical search in an automated loop.

Practices to Avoid

Do not implement broad wildcard searches. These searches scan a large portion of the search index and use the most resources.
These wildcard validation rules now apply:
Leading wildcard searches are no longer accepted.
Wildcard searches must contain a minimum of three characters preceding the wildcard character (*). These examples demonstrate the unsupported and the accepted wildcard formats.
Unsupported Wildcard Formats:
*ABC
A*
AB*
12*
Accepted Wildcard Formats:
ABC*
ABCD*
123*

Avoid combining a large number of identifiers with a long date range in the same search. Cost increases roughly with identifiers multiplied by a date range, so a search that is fine alone can be expensive when both are large together.
Avoid automated rapid-retry on a timeout. An identical search that timed out will typically time out again if re-run immediately, which adds load on the service without improving results.

API Searches: Request Shape

Cap each request to 15 or fewer identifiers when using multi-value lookups. If your integration currently sends larger batches, split them into multiple smaller requests.
Use an end-of-day reconciliation or bulk report instead of paging through many large interactive search calls.
Use the narrowest date range your job actually needs. Recurring jobs that request a wide window are a common source of avoidable load.
Avoid wildcard or short-prefix values in identifier fields. Search for an exact full value when it is available.

API Searches: Retry and Error Handling

Implement a back-off retry instead of tight-loop retry. If a request times out or errors, wait before retrying, and increase the wait time on repeated failures (exponential back off).
If you receive a
429
(rate limited) response, treat it as a signal to slow down, not a bug to route around. Honor any Retry-After value if present, and reduce your request rate/batch size rather than retrying immediately or in parallel.
Cap your retry attempts for a given request. For example, make 3 to 5 attempts with increasing back-off retries and alert/log instead of retrying indefinitely.
Watch for repeated identical requests from your own systems. A scheduled job that re-issues the exact same search on every run because a previous run did not complete can create a sustained load without your team realizing it. Add job-level locking or de-duplication search so a stopped run does not stack up.

Business Center

Searches

Transaction Search:
search on a specific field (order number, request ID, reference number) instead of a broad free-text and keyword term when possible. Keep the date range to 7 days or fewer.
Quick Search:
use a reasonably narrow date range rather than the widest default. If you manage multiple sub-accounts under a parent account, search from the specific sub-account instead of from the top-level parent view when you know the account where the transaction belongs.
Bulk Export and Reporting:
if you need a large number of transactions or cases, use the
Business Center
report feature to pull the full set at once instead of repeatedly re-running and paging through search results. If a search is slow or times out, wait a moment and retry once instead of repeatedly clicking search or refresh in quick succession.

Bulk Actions Permissions Added for Organization Onboarding

| RM-49277

Description

A new Bulk Actions module enables resellers to onboard multiple organizations to the platform more efficiently. This enhancement reduces manual effort by supporting bulk onboarding workflows and providing visibility into submitted bulk actions. Users with the appropriate permissions can view previously submitted bulk actions or initiate new bulk onboarding actions through the Bulk Actions module.

Mandate

Does not apply.

Audience

Some resellers and portfolio managers responsible for onboarding organizations.

Technical Details

Access to the Bulk Actions module is controlled by the

canViewBulkActions

and

canManageBulkActions

derived permissions. Users receive these permissions when the Bulk Actions feature and the corresponding onboarding permissions are enabled.

Important Dates

Released on October 21, 2026.

Automated Clearing House (ACH) eCheck Follow-On Credit Eligibility Restored

| RM-49229

Description

This release corrects a defect affecting Automated Clearing House (ACH) eCheck transactions. In some cases, follow-on credits were incorrectly unavailable because the system could not accurately calculate transaction age when processing request IDs longer than 26 characters. Following this release, merchants can perform eligible follow-on credits for ACH eCheck transactions for up to 180 days after the original debit transaction, consistent with the intended processor rules.

Mandate

Does not apply.

Audience

Some merchants processing eCheck transactions through an ACH processor.

Technical Details

No API changes are required, and no merchant configuration changes are necessary to use utilize this correction.

Important Dates

Released on October 24, 2026.

Blank Batch Response Files for Batch Upload

| EPS-43394

Description

Some merchants submitting stand-alone credits through Batch Upload might receive a blank response file even when the transaction processes successfully.

Audience

Merchants using Batch Upload through Payments 2.0 processing flows, including affected Fiserv merchants.

Technical Details

For affected Batch Upload transactions, transaction batch identifiers are not populated during processing through the Payments 2.0 REST/Kafka ingestion channel. As a result, the batch reporting process cannot associate transactions with the submitted batch and returns a blank response file. Transaction processing itself is not affected and successful transactions can continue to be processed normally.

Workaround

No known workaround.

Some Click to Pay Authentication Results Misreported

| EPS-43856

Description

Some customers using Unified Checkout Click to Pay (CtP) with Passkey authentication might receive an indication that cardholder authentication was unsuccessful even when authentication has completed successfully.

Audience

Merchants and integrators using Unified Checkout Click to Pay (CtP) through the UI.

Technical Details

For impacted transactions, the response might return

cardholderAuthenticationStatus

=

false

even though valid authentication data such as CAVV and XID values is present.

Workaround

To determine whether additional 3-D Secure authentication is required, merchants validate the presence of authentication data returned in the Click to Pay payload, including returned 3-D Secure values such as CAVV and XID.

Risk Profile Configuration Not Visible

| EPS-46325

Description

Some transactions might be rejected even though the associated risk profile configuration is not visible in the

Business Center

, making it difficult for affected acquirers to determine the source of the rejection or identify the merchants assigned to the profile.

Audience

Resellers and acquirers using Partner Risk Control (Parc).

Technical Details

Impacted transactions might be rejected with the error message

Your aggregator or acquirer is not accepting this transaction - CARD_CATEGORY_ECI_REFUSED

, triggered by a

off_us_domestic_credit

configuration. In affected cases, the risk profile containing the rule is not displayed in

Business Center

, preventing users from viewing the configuration or determining which merchant IDs (MIDs) are assigned to the profile.

Workaround

No known workaround.

Unified Checkout Customer IP Addresses Not Forwarded

| EPS-46439

Description

When a Unified Checkout transaction includes a customer's IP address, Decision Manager does not consider the IP address during evaluation.

Audience

Some merchants using Unified Checkout with Decision Manager.

Technical Details

Some transactions might bypass Decision Manager rules that rely on the customer's IP address because the

deviceInformation.ipAddress

value is not included in risk evaluation. No API error is returned, and non-IP-based Decision Manager rules continue to function normally.

Workaround

No known workaround.