diff --git a/CHANGELOG.md b/CHANGELOG.md index 96c5deb..739dd3d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +## [v3.1054.0] - 2026-10-22 + +### Changed +- Updated `openapi` +- Updated `v3-biometric-authentication-entry` +- Updated `v3-biometric-enrollment-entry` +- Updated `v3-biometric-kyc-entry` +- Updated `v3-document-verification-entry` +- Updated `v3-enhanced-document-verification-entry` +- Updated `v3-residency-document-verification-entry` +- Updated `v3-smart-selfie-compare-entry` + + ## [v3.1039.0] - 2026-10-20 ### Changed diff --git a/specs/v3/openapi.yaml b/specs/v3/openapi.yaml index 7b97262..8fbef8c 100644 --- a/specs/v3/openapi.yaml +++ b/specs/v3/openapi.yaml @@ -631,7 +631,7 @@ paths: $ref: '#/components/schemas/ApiErrorResponse' '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: @@ -779,7 +779,7 @@ paths: message: Unsupported Media Type. Required Content-Type is multipart/form-data '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: @@ -948,7 +948,7 @@ paths: message: Unsupported Media Type. Required Content-Type is multipart/form-data '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: @@ -1121,7 +1121,7 @@ paths: message: Unsupported Media Type. Required Content-Type is multipart/form-data '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: @@ -1304,7 +1304,7 @@ paths: message: Unsupported Media Type. Required Content-Type is multipart/form-data '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: @@ -2960,7 +2960,7 @@ paths: message: Unsupported Media Type. Required Content-Type is multipart/form-data '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: @@ -3378,7 +3378,7 @@ paths: $ref: '#/components/schemas/ApiErrorResponse' '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: diff --git a/specs/v3/v3-biometric-authentication-entry.yaml b/specs/v3/v3-biometric-authentication-entry.yaml index 0ebf708..3010223 100644 --- a/specs/v3/v3-biometric-authentication-entry.yaml +++ b/specs/v3/v3-biometric-authentication-entry.yaml @@ -19,6 +19,8 @@ info: At least one of `email` or `phone_number` is required. The `user_id` field is required and must match an existing enrolled user. Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422. + + The partner may add form fields and files of its own alongside the package, such as `callback_url`. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document` and `document_back`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field. tags: - name: Biometric Authentication paths: @@ -105,7 +107,7 @@ paths: $ref: '#/components/schemas/ApiErrorResponse' '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: diff --git a/specs/v3/v3-biometric-enrollment-entry.yaml b/specs/v3/v3-biometric-enrollment-entry.yaml index 4560345..8c6305a 100644 --- a/specs/v3/v3-biometric-enrollment-entry.yaml +++ b/specs/v3/v3-biometric-enrollment-entry.yaml @@ -21,6 +21,8 @@ info: Token Payload: Identity fields (given_names, last_name, email, phone_number, callback_url) and the ISO 27560 consent fields can be bound to the authentication token via the token payload feature at /v3/token (PII fields are held as opaque references, never raw values). When present in the token, these fields are injected automatically and override any values in the request body. Fields provided via the token do not need to be repeated in the request body; GET /v3/services/config lists them as token_provided_fields. Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422. + + The partner may add form fields and files of its own alongside the package, such as `callback_url`. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document` and `document_back`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field. tags: - name: Biometric Enrollment paths: @@ -151,7 +153,7 @@ paths: message: selfie_image is too large. '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: diff --git a/specs/v3/v3-biometric-kyc-entry.yaml b/specs/v3/v3-biometric-kyc-entry.yaml index c5db5bf..17cbd88 100644 --- a/specs/v3/v3-biometric-kyc-entry.yaml +++ b/specs/v3/v3-biometric-kyc-entry.yaml @@ -21,6 +21,8 @@ info: Token Payload: Identity fields (country, id_type, id_number, given_names, last_name, email, phone_number, callback_url) and the ISO 27560 consent fields can be bound to the authentication token via the token payload feature at /v3/token (PII fields are held as opaque references, never raw values). When present in the token, these fields are injected automatically and override any values in the request body. Fields provided via the token do not need to be repeated in the request body; GET /v3/services/config lists them as token_provided_fields. Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422. + + The partner may add form fields and files of its own alongside the package, such as `callback_url`. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document` and `document_back`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field. tags: - name: Biometric KYC paths: @@ -166,7 +168,7 @@ paths: message: Unsupported Media Type. Required Content-Type is multipart/form-data '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: diff --git a/specs/v3/v3-document-verification-entry.yaml b/specs/v3/v3-document-verification-entry.yaml index c218418..6d6722d 100644 --- a/specs/v3/v3-document-verification-entry.yaml +++ b/specs/v3/v3-document-verification-entry.yaml @@ -21,6 +21,8 @@ info: Token Payload: Identity fields (country, id_type, given_names, last_name, email, phone_number, callback_url) and the ISO 27560 consent fields can be bound to the authentication token via the token payload feature at /v3/token (PII fields are held as opaque references, never raw values). When present in the token, these fields are injected automatically and override any values in the request body. Fields provided via the token do not need to be repeated in the request body; GET /v3/services/config lists them as token_provided_fields. Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422. + + The partner may add form fields and files of its own alongside the package, such as `callback_url`. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document` and `document_back`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field. tags: - name: Document Verification paths: @@ -170,7 +172,7 @@ paths: message: Unsupported Media Type. Required Content-Type is multipart/form-data '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: diff --git a/specs/v3/v3-enhanced-document-verification-entry.yaml b/specs/v3/v3-enhanced-document-verification-entry.yaml index 8f7e03e..de8f768 100644 --- a/specs/v3/v3-enhanced-document-verification-entry.yaml +++ b/specs/v3/v3-enhanced-document-verification-entry.yaml @@ -21,6 +21,8 @@ info: Token Payload: Identity fields (country, id_type, given_names, last_name, email, phone_number, callback_url) and the ISO 27560 consent fields can be bound to the authentication token via the token payload feature at /v3/token (PII fields are held as opaque references, never raw values). When present in the token, these fields are injected automatically and override any values in the request body. Fields provided via the token do not need to be repeated in the request body; GET /v3/services/config lists them as token_provided_fields. Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422. + + The partner may add form fields and files of its own alongside the package, such as `callback_url`. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document` and `document_back`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field. tags: - name: Enhanced Document Verification paths: @@ -180,7 +182,7 @@ paths: message: Unsupported Media Type. Required Content-Type is multipart/form-data '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: diff --git a/specs/v3/v3-residency-document-verification-entry.yaml b/specs/v3/v3-residency-document-verification-entry.yaml index 6b2e5e2..aaa5fe3 100644 --- a/specs/v3/v3-residency-document-verification-entry.yaml +++ b/specs/v3/v3-residency-document-verification-entry.yaml @@ -25,6 +25,8 @@ info: Token Payload: Identity fields (country, id_type, given_names, last_name, email, phone_number, callback_url) and the ISO 27560 consent fields can be bound to the authentication token via the token payload feature at /v3/token (PII fields are held as opaque references, never raw values). When present in the token, these fields are injected automatically and override any values in the request body. Fields provided via the token do not need to be repeated in the request body; GET /v3/services/config lists them as token_provided_fields. Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422. + + The partner may add form fields and files of its own alongside the package, such as `callback_url`. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document`, `document_back` and `visa`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field. tags: - name: Residency Document Verification paths: @@ -287,7 +289,7 @@ paths: message: Unsupported Media Type. Required Content-Type is multipart/form-data '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: diff --git a/specs/v3/v3-smart-selfie-compare-entry.yaml b/specs/v3/v3-smart-selfie-compare-entry.yaml index 24ffb65..94557cc 100644 --- a/specs/v3/v3-smart-selfie-compare-entry.yaml +++ b/specs/v3/v3-smart-selfie-compare-entry.yaml @@ -19,6 +19,8 @@ info: At least one of `email` or `phone_number` is required. Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422. + + The partner may add form fields and files of its own alongside the package, such as a comparison image. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document` and `document_back`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field. tags: - name: Smart Selfie Compare paths: @@ -119,7 +121,7 @@ paths: $ref: '#/components/schemas/ApiErrorResponse' '422': description: >- - Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails. + Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it. content: application/json: schema: