Release 4.1.0 - Forward secrets path fix + Address Document Verification endpoints + challenge indicator docs

[david-ruiz-cko]

Release 4.1.0 bundles three changes: the Forward secrets path fix (#443, INT-1666), the new Address Document Verification endpoints (#444, INT-1665) and the challenge indicator documentation alignment (#445, INT-1667).

Forward secrets path fix (behaviour change)

Swagger 2026-07-20 completed the rename of the Forward secrets endpoints. Requests now go to the Forward host root, without the /forward prefix:

• Collection endpoints (create, list) moved from /forward/secrets to /secrets.
• Item endpoints (PATCH, DELETE) moved from /forward/secrets/{name} to /secrets/{name}.
• src/config.js keeps a single Forward host root (FORWARD_SANDBOX_URL / FORWARD_LIVE_URL) with no trailing slash, and ForwardClient appends the forward and secrets path segments explicitly, matching every other SDK. Forward request URLs themselves are unchanged.
• Unit tests updated accordingly. (src/api/forward/forward.js, src/config.js, test/forward/forward-unit.js)

Anyone calling the secrets methods will now hit the new paths, so this is worth calling out in the release notes.

Address Document Verification (Adv) endpoints

Implements the Adv family from swagger 2026-07-16: POST/GET /address-document-verifications, anonymize, attempts (create, list, get) and pdf-report.

• New src/api/identities/address-document-verifications.js, wired into the identities client. (src/api/identities/identities.js)
• TypeScript definitions added. (types/dist/api/identities/address-document-verifications.d.ts, types/dist/api/identities/identities.d.ts)
• Unit tests under test/identities/address-document-verifications/.

Challenge indicator documentation alignment

Clarifies the allowed values of 3ds.challenge_indicator per endpoint. No runtime behaviour changes here, only JSDoc plus a new test.

• Documented in hosted-payments.js, payments-links.js, payment-sessions.js and payments.js that the field accepts only the four standard values (no_preference, no_challenge_requested, challenge_requested, challenge_requested_mandate), and that exemption values are not accepted on these endpoints.
• Documented in sessions.js that challenge_indicator uniquely accepts all nine values, including exemption requests, and explained the fallback behaviour when an exemption cannot be applied.
• Added test/sessions/challenge-indicator.js covering the accepted value sets.

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• 2.2.7_dependency_upgrade

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 2

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
2.2.7_dependency_upgrade	classifying	§2.2.7	All files are manifest + lockfile, and no security-sensitive package was touched.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[agent-wall-e]

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

• 2.2.7_dependency_upgrade

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}