Changelog

Release notes for the Gurdx API and platform, newest first.

1.1.0 – 2026-10-08#

Feedback and learning#

• New free methods to send what really happened: Payment Outcome Feedback, Fraud Label Feedback and Bulk Feedback. See Feedback and learning.
• Each account's payment model and rule weights are re-fitted nightly from its outcomes, and adopted only when they beat the running version on recent transactions.
• Reputation memory: new payment rules GX2001 and GX2002, and IP, email and phone checks that remember identities you confirmed as fraud.
• Dashboard: a Learning page with feedback received, the model in use and a suggested score threshold.
• Error codes 131 (invalid_feedback) and 132 (too_many_feedback_items).

Data#

• IP Lookup and IP Geolocation now return zipCode where postal data exists, and asn.email / asn.phone. ASN Lookup fills email, phone, created and status from the registry record.
• BIN Lookup: larger, fresher card register (issuer, brand, type, category, bank phone and website); info is always returned.
• IBAN Lookup: new bank object (code, name, nameAr, swift) for Saudi Arabia, UAE, Kuwait, Bahrain, Qatar and Jordan.
• Email Scoring: new suggestion (typo fix), isGibberish and normalized fields.

1.0.0 – 2026-10-06#

Initial release.

API#

• A consistent API: shared paths, success envelope and error codes 101 to 127 delivered over HTTP 200.
• IP intelligence: IP Geolocation, IP Lookup, Bulk IP Lookup, IP Reputation and ASN Lookup.
• Reference data: BIN Lookup, IBAN Lookup, Country Lookup and Domain Lookup.
• Scoring: Email, Phone, Profanity and Payment Fraud Detection.
• User Data Deletion and the free Get IP method.
• Options on every method: format (JSON, XML, CSV, Newline), lang (EN, AR, FR, DE, ES, JA, ZH, RU), mode, callback, params and userID.
• Gurdx extensions: error codes 128, 129 and 130, and the lookup/domain endpoint.

Keys and limits#

• Live (gx_live_) and test (gx_test_) keys, authorized hosts, Bearer or ?key= authentication.
• Test mode: free, fake-but-well-formed data, never raises events.
• Per-cycle plan quotas, a 1,000 requests-per-second flood limit and plan-based access to endpoints and modules.

Platform#

• Dashboard with usage charts, request logs and a real-time events feed.
• Events for suspicious IPs, fraudulent payments, spam emails and phones, profanity and invalid IBAN or BIN values.
• Webhooks signed with X-Gurdx-Signature: sha256= and notification integrations.
• Custom rules and blacklists.
• Bilingual dashboard and documentation in English and Arabic.

Privacy#

• Card numbers are never stored; only the BIN, the last four digits and a keyed hash are kept.