chore: update v3 OpenAPI specs to v3.1054.0

CHANGELOG.md

@@ -6,6 +6,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [v3.1054.0] - 2026-10-22
+
+### Changed
+- Updated `openapi`
+- Updated `v3-biometric-authentication-entry`
+- Updated `v3-biometric-enrollment-entry`
+- Updated `v3-biometric-kyc-entry`
+- Updated `v3-document-verification-entry`
+- Updated `v3-enhanced-document-verification-entry`
+- Updated `v3-residency-document-verification-entry`
+- Updated `v3-smart-selfie-compare-entry`
+
+
 ## [v3.1039.0] - 2026-10-20
 
 ### Changed

specs/v3/openapi.yaml

@@ -342,7 +342,7 @@
                 status: Internal Server Error
                 message: An unexpected error occurred. Please try again or contact support.
   /v3/aml/monitoring/{job_id}/news/{reference}:
     get:
       operationId: getAmlMonitoringNews
       tags:
         - AML Monitoring News
@@ -631,7 +631,7 @@
                 $ref: '#/components/schemas/ApiErrorResponse'
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema:
@@ -779,7 +779,7 @@
                 message: Unsupported Media Type. Required Content-Type is multipart/form-data
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema:
@@ -948,7 +948,7 @@
                 message: Unsupported Media Type. Required Content-Type is multipart/form-data
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema:
@@ -1121,7 +1121,7 @@
                 message: Unsupported Media Type. Required Content-Type is multipart/form-data
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema:
@@ -1304,7 +1304,7 @@
                 message: Unsupported Media Type. Required Content-Type is multipart/form-data
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema:
@@ -2960,7 +2960,7 @@
                 message: Unsupported Media Type. Required Content-Type is multipart/form-data
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema:
@@ -3378,7 +3378,7 @@
                 $ref: '#/components/schemas/ApiErrorResponse'
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema:

specs/v3/v3-biometric-authentication-entry.yaml

@@ -19,6 +19,8 @@ info:
     At least one of `email` or `phone_number` is required. The `user_id` field is required and must match an existing enrolled user.
 
     Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422.
+
+    The partner may add form fields and files of its own alongside the package, such as `callback_url`. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document` and `document_back`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field.
 tags:
   - name: Biometric Authentication
 paths:
@@ -105,7 +107,7 @@ paths:
                 $ref: '#/components/schemas/ApiErrorResponse'
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema:

specs/v3/v3-biometric-enrollment-entry.yaml

@@ -21,6 +21,8 @@ info:
     Token Payload: Identity fields (given_names, last_name, email, phone_number, callback_url) and the ISO 27560 consent fields can be bound to the authentication token via the token payload feature at /v3/token (PII fields are held as opaque references, never raw values). When present in the token, these fields are injected automatically and override any values in the request body. Fields provided via the token do not need to be repeated in the request body; GET /v3/services/config lists them as token_provided_fields.
 
     Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422.
+
+    The partner may add form fields and files of its own alongside the package, such as `callback_url`. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document` and `document_back`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field.
 tags:
   - name: Biometric Enrollment
 paths:
@@ -151,7 +153,7 @@ paths:
                 message: selfie_image is too large.
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema:

specs/v3/v3-biometric-kyc-entry.yaml

@@ -21,6 +21,8 @@ info:
     Token Payload: Identity fields (country, id_type, id_number, given_names, last_name, email, phone_number, callback_url) and the ISO 27560 consent fields can be bound to the authentication token via the token payload feature at /v3/token (PII fields are held as opaque references, never raw values). When present in the token, these fields are injected automatically and override any values in the request body. Fields provided via the token do not need to be repeated in the request body; GET /v3/services/config lists them as token_provided_fields.
 
     Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422.
+
+    The partner may add form fields and files of its own alongside the package, such as `callback_url`. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document` and `document_back`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field.
 tags:
   - name: Biometric KYC
 paths:
@@ -166,7 +168,7 @@ paths:
                 message: Unsupported Media Type. Required Content-Type is multipart/form-data
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema:

specs/v3/v3-document-verification-entry.yaml

@@ -21,6 +21,8 @@ info:
     Token Payload: Identity fields (country, id_type, given_names, last_name, email, phone_number, callback_url) and the ISO 27560 consent fields can be bound to the authentication token via the token payload feature at /v3/token (PII fields are held as opaque references, never raw values). When present in the token, these fields are injected automatically and override any values in the request body. Fields provided via the token do not need to be repeated in the request body; GET /v3/services/config lists them as token_provided_fields.
 
     Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422.
+
+    The partner may add form fields and files of its own alongside the package, such as `callback_url`. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document` and `document_back`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field.
 tags:
   - name: Document Verification
 paths:
@@ -170,7 +172,7 @@ paths:
                 message: Unsupported Media Type. Required Content-Type is multipart/form-data
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema:

specs/v3/v3-enhanced-document-verification-entry.yaml

@@ -21,6 +21,8 @@ info:
     Token Payload: Identity fields (country, id_type, given_names, last_name, email, phone_number, callback_url) and the ISO 27560 consent fields can be bound to the authentication token via the token payload feature at /v3/token (PII fields are held as opaque references, never raw values). When present in the token, these fields are injected automatically and override any values in the request body. Fields provided via the token do not need to be repeated in the request body; GET /v3/services/config lists them as token_provided_fields.
 
     Encrypted SDK package: when a request is captured by a Smile ID SDK and forwarded by the partner's backend, the SDK can encrypt the request fields and headers into `encrypted_package` (with `package_nonce` and `package_tag`). The partner forwards these three form fields unchanged, alongside the image files and the SmileID-Source-SDK and SmileID-Source-SDK-Version headers. Smile ID decrypts the package before validation, so required fields may be supplied inside the package instead of as plain form fields. A package that cannot be decrypted or parsed is rejected with HTTP 422.
+
+    The partner may add form fields and files of its own alongside the package, such as `callback_url`. The payload signature does not cover them: it covers only the package and the SDK-captured images (`selfie_image`, `liveness_images`, `document` and `document_back`), which must come from the SDK. A field that also appears in the package must agree with it. Objects such as `partner_params` may gain extra keys, but any other difference is rejected with HTTP 422, naming the field.
 tags:
   - name: Enhanced Document Verification
 paths:
@@ -180,7 +182,7 @@ paths:
                 message: Unsupported Media Type. Required Content-Type is multipart/form-data
         '422':
           description: >-
-            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails.
+            Unprocessable Content — the encrypted SDK package could not be decrypted or parsed. Returned when `encrypted_package` is supplied and `package_nonce` or `package_tag` is missing or the wrong length, the SmileID-Source-SDK or SmileID-Source-SDK-Version header is missing or unrecognised, or decryption or JSON parsing fails, or a form field sent alongside the package conflicts with a field inside it.
           content:
             application/json:
               schema: