Changed
Decision-component result labels standardized
Decision-component result labels are now sentence case, with ownership and threshold-style labels reformatted to a consistent form, such asOwnership > 25%. This changes the label values in webhook payloads and the application checklist display for applications evaluated after this change.AddedChanged
businessToBusinessMix on processing activity
Processing activity types now include a businessToBusinessMix field, reporting the approximate percentage of business-to-business transactions.customerInitiatedCardNotPresentMix and merchantInitiatedCardNotPresentMix on processing activity
Processing activity types now include customerInitiatedCardNotPresentMix and merchantInitiatedCardNotPresentMix fields, letting the card-not-present mix be reported as separate customer-initiated and merchant-initiated components.cardNotPresentMix derived from initiated components
When a processing activity’s cardNotPresentMix isn’t supplied directly, it’s now derived as the sum of customerInitiatedCardNotPresentMix and merchantInitiatedCardNotPresentMix.Changed
Minimum year on stakeholder birth dates
Person stakeholder birth dates now enforce a minimum year of 1900, rejecting dates before that year that were previously accepted as long as they were in the past.Plausible calendar year on date-type dynamic fields
Date-type dynamic fields now enforce a plausible calendar year, 1900 through 2099, returning newDATE_MUST_NOT_BE_BEFORE_MINIMUM_YEAR and DATE_MUST_NOT_BE_AFTER_MAXIMUM_YEAR error codes for issuing and expiration dates outside that range.ChangedFixed
Passport number format validation on guarantors
Submission now enforces a valid passport number format, six to nine letters and/or digits, for a guarantor’s personal identification number. Values that don’t match are rejected, where previously any non-blank value was accepted.Removing an already-removed stakeholder
Removing a stakeholder that was already removed, or was never present on the application, no longer fails the mutation. That id is now skipped, and any other ids requested in the same call are still removed.Guarantor passport number altered before identity verification
A guarantor’s passport number is no longer altered before being submitted for identity verification, which could cause a valid passport to be reported as unverified.Owner Identity Verification field status on passport-only verification
The partner-specific Owner Identity Verification decision component now returns aMATCH field status, instead of NEEDS_REVIEW, for an owner verified by passport number when no Social Security number is on file.AddedFixed
UpdateConflictError on decision component updates
updateDecisionComponent can now return an UpdateConflictError when a concurrent update to the same application couldn’t be applied. Retry the request.Passport match on Owner Identity Verification
The partner-specific Owner Identity Verification decision component now matches on a passport number in addition to a Social Security number, returningKYC Passport or Passport Not Verified result labels when applicable.Transient document download failures no longer re-trigger completed evaluations
A transient failure downloading a decision component’s supporting document no longer re-triggers an evaluation that had already completed successfully.Changed
Field-change audit entries read as plain language
Field-change audit entries now read as plain-language sentences, such as “Person Stakeholder #2 (Jane Smith)‘s first name changed from populated to populated”, instead of showing internal field paths. Decision-component field-status entries show the field’s display name instead of its internal identifier.Approval-required validations block moving to APPROVED
Underwriting journeys configured with approval-required validations now block moving an application to APPROVED status until those validations pass. Failures return as validation errors on the update mutation.Breaking changeAdded
Breaking: CIP “Country” fields use two-character codes
Partner-specific CIP “Country” dynamic fields now use two-character country codes instead of three-character codes.COUNTRY_CODES_ALPHA_2 field type for dynamic fields
Underwriting dynamic fields support a new COUNTRY_CODES_ALPHA_2 select field type, offering two-character country codes as an alternative to the existing three-character COUNTRY_CODES list.Automatic business verification report attachment
Underwriting automatically downloads and attaches a business verification report as a document on the relevant decision component.AddedChanged
”ID Issue Date” and “Name of Issuer” on Articles of Association/By-Laws
The Articles of Association/By-Laws CIP business identification type now includes required “ID Issue Date” and “Name of Issuer” fields, alongside its existing “Issuing State” field.Field-change audit entries name the changed entity
Field-change audit entries for stakeholders and bank accounts now identify the changed entity by kind, number, and name, such as “Person Stakeholder #2 (Jane Smith)”, falling back to the number or identifier when a name isn’t available. Decision-component item entries in the same audit trail now show the item’s resolved label instead of its identifier.AddedFixed
validation field on UnderwritingDynamicFieldSchema
UnderwritingDynamicFieldSchema now includes a validation field, backed by a new UnderwritingDynamicFieldValidation enum (NO_FUTURE_DATE, ONLY_FUTURE_DATE), with matching DATE_MUST_BE_IN_FUTURE and DATE_MUST_NOT_BE_IN_FUTURE values on UnderwritingDynamicFieldValidationErrorCode. Applied to the CIP ID Issue Date and Expiration Date fields, and enforced both when a field value is saved and when its decision component is accepted.last4 blank on short encrypted field values
last4 on encrypted field values, such as bank account numbers and tax and personal identification numbers, is no longer blank when the underlying value is 4 characters or fewer.createdByUserId and updatedByUserId default identifier fix
Comments and dynamic field values now show null for createdByUserId and updatedByUserId when the change was made by the platform rather than a user, instead of a default identifier.Business tax ID field reads from the correct application data
The business tax identification number decision-component field now reads from the correct application data depending on application type, instead of always sourcing it from acceptor application data.CIP dynamic field label spacing fix
Fixed a spacing issue in a partner-specific CIP dynamic field label: “Articles of Association/By-Laws” is now “Articles of Association/ By-Laws”.AddedChanged
referenceNumber on stakeholders and bank accounts
Stakeholder and bank account types now include a referenceNumber field, assigned when the entity is added. It’s unique within the application per kind, never changes, and is never reused. Entities added before reference numbers existed have a null value.entryReferenceNumber on sensitive-change records
Structured sensitive-change records now include an entryReferenceNumber field, giving the reference number of the stakeholder or bank account an audit entry applies to, alongside its identifier.UpdateConflictError on application updates
Update-application error responses can now return an UpdateConflictError when a concurrent update to the same application couldn’t be applied. Retry the request.Automatic risk level calculation
An application’s assessed risk level is now calculated automatically from its merchant category code, sales channel, card-present/card-not-present mix, advance payment rate, and sales volume, and recalculates whenever those inputs change.Fixed
Bank account labels no longer shift after removal
Removing a bank account no longer shifts the submission validation labels on the accounts that remain, such as showing the sole remaining account as “Bank account 2” instead of “Bank account 1”.ChangedFixed
Clearer text on “sensitive data viewed” events
“Sensitive data viewed” application events now name the user who viewed the data and describe what was viewed, instead of showing internal identifiers.Authorized contacts item field list corrected on Mastercard MATCH
The authorized contacts item on the Mastercard MATCH decision component now shows first name, last name, email, and phone number, instead of including business legal address fields.updateUnderwritingApplication not-found error on early exposure updates
updateUnderwritingApplication no longer fails with a not-found error, or discards the entire submitted update, when submitted exposure inputs change an application’s calculated payment exposure before the application has any decision components.AddedChangedFixed
Per-person items driven by a configured set of stakeholders
Decision component items can now derive their per-person sub-items from a configured set of person stakeholders, instead of matching by stakeholder role.Authorized contacts on the Mastercard MATCH decision component
The Mastercard MATCH decision component now includes an “authorized contacts” item, available where configured, showing each reported contact’s name, phone, and business legal address. Items are added and removed automatically as contacts are reported or no longer reported.PCI certification check result label renamed
The PCI certification check result label is now “Certification Search”.Audit trail no longer records no-op field changes
Application event audit entries no longer record a field as changed when the submitted value matches the value already on record. No-op field changes, including client-echoed values and unchanged workflow queue recalculations, are excluded from the audit trail.Owner and Business Identity Verification require complete data before accepting
Owner Identity Verification and Business Identity Verification decision components, and thedecisionComponentsUpdated webhook, now report ACTION_REQUIRED until every required identity field is captured, moving to ACCEPTED only once the component’s data is complete.PCI certification check excludes removed Visa PCI registry listings
PCI certification check company-name matching now excludes Visa PCI registry listings that have since been removed.AddedChangedFixed
Additional review fields on the PCI certification check
The PCI certification check decision component’s review data now includes service provider type, validation type, valid-through date, assessor, regions of operation, website, and registered-since date.Configurable decision component item labels
A decision component item’s label can stay as configured instead of being replaced with the applicant’s business or stakeholder name. The PCI certification check uses this so its item labels show the software name.PCI certification check guidance text typo
The PCI certification check result guidance text now reads “Manual searches” instead of “Manually searches”.ChangedFixed
Maximum length validation on submission
Submission now enforces maximum lengths on stakeholder names and addresses: first name (36 characters), last name (48 characters), address lines 1 through 3 (100 characters each), city (100 characters), and postal code (15 characters), for business, legal, and residential addresses.Duplicate guarantor validation failures on submission
A person with the guarantor role no longer gets reported twice for the same field validation failure on application submission.UNDERWRITING_APPLICATION_CHANGED webhook timing for decision component evaluations
The UNDERWRITING_APPLICATION_CHANGED webhook for a decision component evaluation now fires only after all of a run’s changes, including the application’s status, queue, and related updates, are persisted. It carries the final recalculated status instead of a possibly stale one.Changed
Validation errors on application field updates no longer echo the submitted value
Validation errors for application field updates no longer include the submitted value, only the field name and reason.Validation errors on dynamic field updates no longer echo the submitted value
Validation errors for dynamic field updates no longer include the submitted value, only the field label and reason.Added
naicsCode and naicsDescription on application identity
Underwriting application identity now includes naicsCode and naicsDescription fields, settable via createUnderwritingApplication and updateUnderwritingApplication. Both are optional, free-form, and capped at 500 characters.Changed
GraphQL error on decision-component field configuration issues
Revealing a decision-component field that fails due to a configuration issue now returns a GraphQL error instead of an empty value.Added
salesChannel on application identity
Application identity now includes a salesChannel field (RETAIL, MOTO, or E_COMMERCE), settable via the ApplicationIdentity input and returned on both acceptor and underwriting applications.riskLevel on application processing activity
Application processing activity now includes a riskLevel field, returned on underwriting, acceptor, and relationship processing activities.Fixed
Authorized-contact-only applications missing MATCH screening
Applications whose only person stakeholder is an authorized contact now have that contact screened and shown as a sub-item on the MATCH decision component, consistent with owner, control person, and guarantor stakeholders.AddedChanged
UnderwritingDynamicFieldValidationError on updateDecisionComponent
updateDecisionComponent returns a UnderwritingDynamicFieldValidationError when a decision component with required CIP dynamic fields is accepted before those fields are complete.CIP dynamic-field validation extended to component edits
Editing an already-ACCEPTED decision component now enforces the same CIP dynamic-field completeness check as acceptance. An edit that leaves a required field incomplete is rejected and rolled back instead of persisted.Changed
Auto-populated identity number after Owner Identity Verification
When the Owner Identity Verification workflow approves an owner, their identity number dynamic field is populated automatically.CIP dynamic field catalog updates for Article of Association
The Article of Association item now captures only Issuing State, dropping the ID Issue Date and Name of Issuer subfields. Issuing State and Country are nowSELECT fields, with valid options returned over the API instead of free text.Auto-populated identity number after Business Identity Verification
When the Business Identity Verification workflow approves a business, its Secretary of State identity number and issuing state dynamic fields are populated automatically.AddedFixed
Submit validation failures persisted as a system comment
When a submit is rejected withSUBMISSION_INVALID, the validation failures are now persisted as a system comment on the application, so the reasons stay retrievable over GraphQL after the original response is gone.Downstream submit processing waits for a fully saved submission
Downstream submit processing, such as webhook delivery or underwriting submission, now runs only after an application submit is fully saved, so a submit that fails to save no longer triggers processing for an application that was never recorded as submitted.Terminal status reverting to PROCESSING after submission
Underwriting applications no longer revert from a webhook-set terminal status, such as PENDING, back to PROCESSING when the synchronous submission request completes after the asynchronous result webhook already finalized the application.Stale exposure reason on dual-gated decision components
A decision component’s Total Risk Exposure or Potential Exposure gate result reason now clears correctly when that gate’s value drops below its threshold, even while the other gate remains tripped.Fixed
Missing exposure reasons on components already in ACTION_REQUIRED
Decision components already inACTION_REQUIRED status now surface a newly-tripped exposure reason, such as Total Risk Exposure, alongside the reason that originally triggered the status.Fixed
Person-stakeholder name masking in decision-component event history
Person-stakeholder names in decision-componentdisplayInformation and internalInformation event history are now masked, including in previously recorded events.Fixed
Deeply nested children queries on dynamic field schemas
Queries nesting children selections 4 levels deep on UnderwritingDynamicField values or the UnderwritingDynamicFieldSchema catalog no longer fail with a “Maximum allowed coordinate cycle depth was exceeded” error.AddedFixed
relationshipProcessingActivity on underwriting applications
UnderwritingApplication exposes relationshipProcessingActivity input and output, capturing relationship-wide processing-activity totals across all locations in a relationship: advanced payment rate, average annual and monthly sales amount, average and highest ticket amount, card-present and card-not-present mix, chargeback rate, currency, days in cycle, delivery timeframe, and refund rate. Applicable organizations also get an automatically computed Total Risk Exposure value.Expanded sanctions-review PII masking in displayInformation
Sanctions-review PII masking in displayInformation now covers additional review fields, including in previously recorded event history.AddedChangedFixed
dynamicFieldSchemas on decision component item schemas
UnderwritingDecisionComponentItemSchema carries a dynamicFieldSchemas resolver, returning the dynamic field schema definitions scoped to that item schema as a tree of root nodes with their children.sensitiveField reveals masked dynamic field values
sensitiveField on UnderwritingDynamicField resolves decrypted values for TEXT_FIELD_MASKED fields, requiring read access. revealSensitiveFields also supports revealing dynamic field masked values.Sanctions and MATCH review data masked in displayInformation
Matched person and entity names, dates of birth, and Mastercard MATCH owner PII on sanctions and MATCH decision components are now masked in displayInformation. Authorized callers can still retrieve the underlying values through the existing revealChange resolver.Dynamic field ADD validation on updateDecisionComponent
updateDecisionComponent dynamic field ADD operations validate that the target decisionComponentItemId belongs to the mutated decision component and matches the field’s required item schema type.Dynamic field REMOVE operations soft-delete values
Dynamic field REMOVE operations soft-delete values instead of erasing them. Re-adding a previously removed field resurrects the existing row instead of creating a new one.Relationship-level Total Risk Exposure gate on approval components
Approval decision components can gate on a relationship-level Total Risk Exposure alongside single-application Potential Exposure, where configured. A component moves toACTION_REQUIRED when either exposure crosses its threshold, and returns to ACCEPTED only when both are below threshold and auto-accept validations pass, with each gate contributing its own result reason.updateDecisionComponent server error on zero acceptance-time exposure
updateDecisionComponent no longer returns a server error when recalculating potential exposure with a zero acceptance-time value.Errors on concurrent webhook processing
Concurrent webhook processing for the same application no longer produces intermittent errors.Breaking changeAdded
Breaking: SELECT_MULTIPLE removed from UnderwritingDynamicFieldType
SELECT_MULTIPLE is removed from the UnderwritingDynamicFieldType enum.agentReview query on underwriting applications
agentReview returns the latest AI agent review for an underwriting application. New types: UnderwritingApplicationAgentReview and UnderwritingApplicationAgentReviewComponent. New enums: UnderwritingApplicationAgentReviewDisposition (LIKELY_PROBLEM, LOOKS_ACCEPTABLE, NEEDS_A_CLOSER_LOOK, NOT_YET_ASSESSABLE) and UnderwritingApplicationAgentReviewStatus (COMPLETED, FAILED, IN_PROGRESS, NOT_STARTED).Changed
displayInformation masks sensitive PII on application events
displayInformation on ApplicationEvent masks sensitive PII field values such as names and addresses. Original values remain accessible via the revealChange resolver.Added
dynamicFields on applications and decision components
UnderwritingApplication exposes dynamicFields and dynamicField resolvers for retrieving dynamic field values from the org-applicable catalog, optionally scoped to a decision-component item. DecisionComponentItem also carries a dynamicFields resolver.dynamicFields input on updateDecisionComponent
updateDecisionComponent accepts a dynamicFields input for adding, removing, or updating dynamic field values via the @oneOf UnderwritingDynamicFieldInput.Dynamic field types
New types:UnderwritingDynamicField, UnderwritingDynamicFieldSchema, and UnderwritingDynamicFieldSensitiveFields. New enums: UnderwritingDynamicFieldKind (CHOICE, GROUP, SCALAR) and UnderwritingDynamicFieldType (CHECKBOX, CURRENCY, DATE_PICKER, SELECT, SELECT_MULTIPLE, TEXTAREA, TEXT_FIELD, TEXT_FIELD_MASKED).Fixed
PCI Certification Check items for multi-provider applications
The PCI Certification Check decision component correctly creates and labels distinct items per software provider when an application has multiple providers.Changed
PCI Certification Check evaluates software providers
The PCI Certification Check decision component evaluates application software provider names against the Visa PCI listing registry, returningACCEPTED or ACTION_REQUIRED status with detailed review data per provider.Software provider removal updates PCI Certification Check
Removing a software provider name from an application automatically excludes its PCI Certification Check items. Re-adding the provider re-includes them.Fixed
revealChange and sensitiveChanges fix for one-sided PII changes
revealChange and sensitiveChanges on ApplicationEvent no longer fail on one-sided PII changes — such as a field first populated or cleared — where the serializer omits the absent value. Change history for those events is now viewable.Changed
legalEntityName validation relaxed on sole proprietors
legalEntityName no longer needs to match the owner’s name on sole proprietor applications. The value is accepted as-is.birthDate requirement narrowed on person stakeholders
birthDate is only required for owner, guarantor, primary contact, and control person roles. Authorized persons can omit it, but any provided value must still be a date in the past.Stakeholder requirement on application submission
Application submission requires at least one person stakeholder with a role. Submissions without a qualifying stakeholder return aMISSING_STAKEHOLDER validation error.AddedFixed
revealChange covers updateDecisionComponent edits
revealChange on ApplicationEvent returns decrypted before/after values for encrypted PII fields edited via updateDecisionComponent, not just direct application input edits.sensitiveChanges null value fix
sensitiveChanges no longer throws a deserialization error when previousValue or updatedValue is null, which could prevent viewing application change history.Added
sensitiveChanges on application events
ApplicationEvent carries a sensitiveChanges field with masked before/after values for encrypted PII changes in the audit change log.revealChange resolver on application events
revealChange on ApplicationEvent provides audited, per-entry decryption of sensitive change-log values.Added
Fixed
Underwriting data export columns
The underwriting data export correctly populates status, decision timestamp, and decline reason columns.Breaking change
Breaking: declineCodes input restructured on updateUnderwritingApplication
declineCodes changed from [DeclineCode!] to [DeclineCodeInput!], a @oneOf input. Use { addDeclineCodeInput: CODE } to add or { removeDeclineCodeInput: CODE } to remove individual codes instead of replacing the full set.Changed
Unrestricted declineCodes on updateUnderwritingApplication
updateUnderwritingApplication accepts any number of decline codes. The previous limit is removed.Added
Decline reasons on underwriting applications
UnderwritingApplication carries a declineReasons field, and updateUnderwritingApplication accepts declineCodes. A DeclineCode enum and DeclineReason type capture adverse action reasons on declined applications.ChangedFixed
Potential exposure rounding and threshold enforcement
Potential exposure values round to 2 decimal places. Decision components reset toACTION_REQUIRED when recalculated exposure exceeds the threshold.Owner Sanctions Watchlist Check potential match results
Owner Sanctions Watchlist Check potential match results now appear correctly in decision component responses.AddedChangedFixed
CURRENCY field type on decision components
CURRENCY is a value on the DecisionComponentFieldType enum.Expanded sanctions decision component results
Sanctions decision component results include per-source detail and source identification.stateOfIncorporation validation
stateOfIncorporation is validated as a 2-character US state or territory code on underwriting applications and normalized to uppercase on all applications.Auto-accept on potential exposure threshold drop
Decision components with potential exposure thresholds are automatically accepted when recalculated exposure drops below the action-required threshold.Processing activity fields on decision components
Processing activity field values now appear correctly in decision component fields for underwriting applications.AddedChanged
State of Incorporation on Business Identity Verification
The Business Identity Verification decision component includes a state of incorporation verification result and an editable field, auto-populated from upstream evaluation data.Approval validation on updateDecisionComponent
updateDecisionComponent validates required application data when approving a decision component. The mutation returns validation errors (UnderwritingApplicationFieldValidationError, UnderwritingApplicationValidationError, etc.) if required fields are incomplete.Real-time potential exposure on approval components
Potential exposure on approval decision components reflects recalculated values in real time instead of a static result.Breaking changeAddedChanged
Breaking: nameOnAccount removed from bank account types
nameOnAccount is removed from UnderwritingBankAccount, UnderwritingApplicationAddBankAccountInput, and UnderwritingApplicationUpdateBankAccountInput. Use underwritingIdentity.legalEntityName instead.stateOfIncorporation on application identity
stateOfIncorporation is available on application identity input and output types.Automatic potential exposure recalculation
Updating application fields that affect potential exposure triggers an automatic recalculation. Affected decision components may reset toACTION_REQUIRED.Added
type field and DecisionComponentReviewType on DecisionComponentReview
DecisionComponentReview carries a type field with a DecisionComponentReviewType enum (INQUIRY_DATA, REVIEW), distinguishing supplied inquiry data from match results. Sanctions components include an inquiry data review alongside matches.Fixed
Application submission stall in CREATED status
Applications no longer stall in CREATED status when transient upstream communication errors occur during submission.Fixed
SUBMISSION_FAILED status on decision components
Decision components correctly reflect SUBMISSION_FAILED status when the upstream evaluation returns no items.Changed
Auto-accept on decision component acceptance
Accepting a decision component automatically sets all non-INFORMATIONAL item statuses to ACCEPTED.AddedChanged
STATUS_CHANGED webhook for SUBMISSION_FAILED
The UNDERWRITING_APPLICATION_UPDATED webhook fires with a STATUS_CHANGED change type when an application reaches SUBMISSION_FAILED status.averageAnnualSalesAmount on acceptor processing activity
averageAnnualSalesAmount is available on AcceptorApplicationProcessingActivityInput and AcceptorApplicationProcessingActivityOutput, previously limited to underwriting-specific processing activity types.Guidance text replaces status messages for missing website URL
Decision component results no longer include status messages when a business website URL is missing. Guidance text is the sole indicator.Annual sales in Alloy journey payloads
Alloy journey application request payloads includeannual_sales alongside monthly_sales, supporting potential exposure calculations based on annual volume.AddedChanged
GraphQL schema descriptions
Enums, types, and error types carry GraphQL descriptions. Schema introspection doubles as documentation.guidance field on decision component items
DecisionComponentItem carries a guidance field with actionable text for items in ACTION_REQUIRED status.Attach uploads to multiple decision components
The attachment upload endpoint accepts an optionaldecisionComponentIds array. Link one upload to multiple decision components in a single request.Expanded Guarantor Credit Check and Mastercard MATCH results
Both decision components return expanded result data.Unrestricted businessName length
The 22-character cap on businessName is removed. Business names of any length are accepted.Website URL optional on MCC Confirmation and Site Inspection
The website URL field on both decision components is no longer required.Added
AddedChangedDeprecatedFixed
averageAnnualSalesAmount on processing activity
averageAnnualSalesAmount is available on underwriting processing activity input and output, giving integrators a direct field for annual volume.QUESTION info request type reactivated
QUESTION is back as an active option on UnderwritingInformationRequestType.UNDERWRITING_APPLICATION_UPDATED webhook expanded
This webhook fires for attachment changes, decision component updates, and terminal status transitions. New change types: DECISION_COMPONENT_UPDATED and FILE_DELETED.Org-level DefaultDaysInCycle config
When set, daysInCycle auto-populates on new underwriting applications if the input omits it.Relaxed chargebackRate and refundRate validation
Both fields are truly optional on submitUnderwritingApplication.Deprecated: nameOnAccount
nameOnAccount on UnderwritingBankAccount and related input types is deprecated. Use underwritingIdentity.legalEntityName instead.Minor bug fixes and improvements
Breaking changeAddedChangedDeprecatedFixed
Breaking: info request input restructured
CreateUnderwritingInformationRequestInput uses a flat type-based input instead of the OneOf pattern with customInput/fromOptionInput. Specify a type enum value directly — CreateUnderwritingInformationRequestCustomInput and CreateUnderwritingInformationRequestFromOptionInput are removed.Breaking: info request option fields removed
id, isActive, createdDateTime, and updatedDateTime are removed from UnderwritingInformationRequestOptionOutput.New info request document types
Eight new values onUnderwritingInformationRequestType: ARTICLES_OF_INCORPORATION, BANK_LETTER_VOIDED_CHECK, BANK_STATEMENTS, BUSINESS_LICENSE, CERTIFICATE_OF_GOOD_STANDING, FINANCIAL_STATEMENTS, PASSPORT, and PROOF_OF_ADDRESS.defaultMerchantCategoryCode replaces merchantCategories
merchantCategories on UnderwritingApplicationIdentityInput is deprecated — only a single MCC is supported. Use defaultMerchantCategoryCode instead.Deprecated: BANK_LETTER, VOIDED_CHECK, and QUESTION request types
Use BANK_LETTER_VOIDED_CHECK instead of the first two. QUESTION is no longer available as a request option.Info request output enriched
type and fulfillmentTypes are available on underwriting info request output and option output types.Decision component schema authorization
requiredScopes and requiredRoles on UnderwritingDecisionComponentSchema expose per-component authorization requirements.RISK decision component result status
A new RISK value on DecisionComponentResultStatus supports fraud risk scoring.Org-scoped info request options
underwritingInformationRequestOptions returns options scoped to the requesting organization, with platform defaults as fallback.Webhook payload expanded for info requests
description and fulfillmentTypes are included in the UNDERWRITING_APPLICATION_UPDATED webhook payload for information request events.Expanded decision component result data
New result fields across Business Sanctions, MATCH, MCC Confirmation, Owner Identity, Owner ID Fraud, Owner Sanctions, and Site Inspection decision components.Website Review MCC field
MCC field status on the Website Review decision component always showsNOT_VERIFIED.Business Sanctions display fix
Watchlist match results display correctly; “workflow not run” results are hidden.Partial errors on decision component resolver
Decision component resolver errors no longer nullify the entire response. Failures surface in theerrors array with safe defaults for affected fields.