feature/INT-1667 - ChallengeIndicator/SessionChallengeIndicator enum alignment - #445
Merged
Conversation
🔴 Risk Classification: MAJORApproval route: AI Review + Human Approval Required Classification reasons
Operational gates
Files analysed: 5 wall-e 2026.06.19-02 · policy |
🔬 Debug — why this classification?Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.
Kinds:
See issue #3 for the proposal to formalise this map as Appendix A of the standards doc. wall-e 2026.06.19-02 · debug |
🔴 Risk Classification: MAJORApproval route: AI Review + Human Approval Required Classification reasons
Operational gates
Files analysed: 6 wall-e 2026.06.19-02 · policy |
🔬 Debug — why this classification?Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.
Kinds:
See issue #3 for the proposal to formalise this map as Appendix A of the standards doc. wall-e 2026.06.19-02 · debug |
|
david-ruiz-cko
changed the title
armando-rodriguez-cko
approved these changes
Aug 5, 2026
david-ruiz-cko
added a commit
that referenced
this pull request
Aug 6, 2026
Release 4.1.0 bundles three changes: the Forward secrets path fix (#443, INT-1666), the new Address Document Verification endpoints (#444, INT-1665) and the challenge indicator documentation alignment (#445, INT-1667). ## Forward secrets path fix (behaviour change) Swagger 2026-07-20 completed the rename of the Forward secrets endpoints. Requests now go to the Forward host root, without the `/forward` prefix: * Collection endpoints (create, list) moved from `/forward/secrets` to `/secrets`. * Item endpoints (`PATCH`, `DELETE`) moved from `/forward/secrets/{name}` to `/secrets/{name}`. * `src/config.js` keeps a single Forward host root (`FORWARD_SANDBOX_URL` / `FORWARD_LIVE_URL`) with no trailing slash, and `ForwardClient` appends the `forward` and `secrets` path segments explicitly, matching every other SDK. Forward request URLs themselves are unchanged. * Unit tests updated accordingly. (`src/api/forward/forward.js`, `src/config.js`, `test/forward/forward-unit.js`) Anyone calling the secrets methods will now hit the new paths, so this is worth calling out in the release notes. ## Address Document Verification (Adv) endpoints Implements the Adv family from swagger 2026-07-16: `POST`/`GET /address-document-verifications`, anonymize, attempts (create, list, get) and pdf-report. * New `src/api/identities/address-document-verifications.js`, wired into the identities client. (`src/api/identities/identities.js`) * TypeScript definitions added. (`types/dist/api/identities/address-document-verifications.d.ts`, `types/dist/api/identities/identities.d.ts`) * Unit tests under `test/identities/address-document-verifications/`. ## Challenge indicator documentation alignment Clarifies the allowed values of `3ds.challenge_indicator` per endpoint. No runtime behaviour changes here, only JSDoc plus a new test. * Documented in `hosted-payments.js`, `payments-links.js`, `payment-sessions.js` and `payments.js` that the field accepts only the four standard values (`no_preference`, `no_challenge_requested`, `challenge_requested`, `challenge_requested_mandate`), and that exemption values are not accepted on these endpoints. * Documented in `sessions.js` that `challenge_indicator` uniquely accepts all nine values, including exemption requests, and explained the fallback behaviour when an exemption cannot be applied. * Added `test/sessions/challenge-indicator.js` covering the accepted value sets.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates the API documentation for payments-related endpoints to clarify the allowed values for the
3ds.challenge_indicatorfield. It distinguishes between endpoints that accept only the four standard challenge indicator values and theSessionsendpoint, which uniquely accepts additional exemption values. These clarifications help ensure correct usage of the challenge indicator and reduce errors when integrating with the API.Documentation improvements:
hosted-payments.js,payments-links.js,payment-sessions.js, andpayments.jsthat the3ds.challenge_indicatorfield accepts only four standard values (no_preference,no_challenge_requested,challenge_requested,challenge_requested_mandate) and that exemption values are not accepted for these endpoints. [1] [2] [3] [4]sessions.jsto specify that thechallenge_indicatorfield uniquely accepts all nine values, including exemption requests, and explains fallback behavior if an exemption cannot be applied.