Skip to main content
​
Improvement

​
Execution Log Entries Expire After 30 Days

Link now keeps execution log entries for a finite window — 30 days by default, set per instance — and deletes them in full once it has passed. Until now an instance without an explicit window kept every entry, including the raw provider response, indefinitely. The change aligns Link with the defined retention period PCI DSS requires for stored account data and with how Specter already ages out provider payloads.What to check on your side:
  • Fetching an expired execution returns 404. If you look up executions by ID after the fact — for reconciliation or dispute handling — do so within the window, or export the entries you need before it closes.
  • The window is fixed per instance. Talk to us if your instance needs a different period; an unlimited window is no longer available.
​
Improvement

​
Provider Calls Reach the Provider You Configured

Link verifies a backend’s address before it connects and holds the call to that verified address for its whole duration, closing a class of network attack in which a call meant for your provider is diverted to another destination. Nothing changes in how you configure a backend, and no action is needed for this protection to apply.Two points are worth checking against backends you already run:
  • A backend needs its final address. Link does not follow redirects. A provider endpoint that answers with a 3xx should be configured with the address it redirects to.
  • Providers that verify our signature from behind a path prefix. If a backend’s base URL includes a path prefix and your provider checks the signature Link sends, verify it against a live request once — the signature now covers the full address the request is actually sent to.
​
Improvement

​
Improvements and Bugfixes

  • Editing a backend’s authentication pipeline in the console saves what you entered. Header changes were discarded on save, and saving could drop settings that had been configured through the API — a provider could be left authenticating differently than intended. Both are fixed.
  • A long request body or response mapping can be edited all the way to the end. The JSON editor was cut off at a fixed height, so a body past a certain length could not be scrolled to or corrected without going through the API; it now fills the dialog and scrolls.
​
New ReleaseImprovement
Link now runs on instances assessed at SAQ A or SAQ A-EP — you no longer need a SAQ-D environment to invoke protocols. Below SAQ-D, Link enforces the boundary that keeps your assessment scope small: invoke request bodies carrying a raw card number (PAN) are rejected with a 422 validation error. At SAQ-D and above, your protocol schema decides which attributes legitimately carry card data. Admin routes are exempt at every level, so backend mappings and protocol specs can keep example card numbers.The platform test-card policy applies on every instance: on the Test tier, only known test cards pass; on the Production tier, test cards are rejected while real card numbers flow as your protocol allows.
​
New Release
Link — the protocol-abstraction runtime of the Composable Payment Architecture — is now generally available on the Test and Production tiers. Define a versioned API contract (a protocol) once and bind it to any provider through declarative backends, so a new provider integration becomes configuration instead of code. It is the connectivity layer Commerce routes through to reach acquirers and PSPs, and that Specter reaches through to call external risk engines.Start with the overview, the quickstart, and the API reference.