Skip to main content
The API is versioned by date; see Versioning for how pinning works. Each entry below describes what changed relative to the previous version. Your integration keeps its pinned behaviour until you change the API-Version header, so you can upgrade on your own schedule.

​
2026-09-01 (Latest)

Risk intelligence, the credential event chain, and bounded mandates.
  • Intelligence (new, Beta): GET /intelligence/snapshot, GET /intelligence/window, and GET /intelligence/action. See Risk Metrics.
  • Credentials: new GET /credential/{credentialId}/events re-verifies a credential’s signed event chain. CredentialEntity gains executionsRemaining and inactiveAt.
  • Credential status (breaking): status is now DRAFT, ACTIVE, or INACTIVE; REJECTED, CANCELED, REVOKED, and EXPIRED collapse into INACTIVE.
  • Bounded mandates: credentials[].maxExecutions on POST /request caps how many approved verifications a mandate allows.
  • W3C credential shape (breaking): w3cCredential carries evidence/proof instead of evidences/proofs on GET /credential/{credentialId}, GET /request/{requestId}, and the credential webhook.

​
2026-07-06

Richer catalog and audit surfaces; leaner verification shapes.
  • Credentials: decisions is now always present on CredentialEntity.
  • Verifiable presentations (breaking): PresentationResponseEntity was renamed PresentationEntity (same fields); VerifyPresentationDto.presentation is no longer required, so you can send presentation or presentationEncoded; CreatePresentationDto.targetVerifier now takes the verifier’s domain instead of its DID.
  • Requests: iframe gains an optional cookie object for trusted browser sessions that skip the OTP. See the iframe integration guide.
  • Status codes (breaking): issue VP, verify, cancel request, and resend OTP now return 201 instead of 200.

​
2026-06-18

Multi-user requests and a structured identity webhook.
  • Multi-user requests (breaking): POST /request now takes a users[] array (each entry with its own contact, secondaryContact, docId, language and signerQuality), replacing the former top-level contacts, expectedDocIds and language fields.
  • Embedding (breaking): iframe configuration moved into the request body (iframe with pubKey), and the top-level pubKey and redirectUrl fields were removed.
  • Identity webhook (breaking): the flat IdentityPayload became the structured IdentityWebhook: document data is now organised into fields such as addresses, birth, nationality, documentType, fullDocId, issueDate, placeOfIssue, placeOfBirth, expiresAt, gender, height and weight. Pin your webhook version before upgrading.
  • Filtering: dateFrom/dateTo on GET /request are converted to the start and end of the day in UTC (dateTo requires dateFrom).

​
2026-05-17

The platform surface: credentials, actions, DIDs, webhooks.
  • New endpoint groups:
    • Credentials: GET /credential/evidence/{evidenceId}, POST /credential/vp/{vcId} (issue VP), POST /credential/verify, DELETE /credential/revoke/{credentialId}
    • Actions: GET /actions, GET /actions/version/{id}
    • DIDs: GET /did/resolve/{did}
    • Webhook event schemas: credential, identity, otp-failed and test events documented as first-class payloads
  • Idempotency: Idempotency-Key header support on POST /request, POST /user and PATCH /request/resend/{requestId}, for safe retries without duplicate side effects.
  • Lookups (breaking): users are addressed by id (previously did); request listing filters by subject; GET /credential/{credentialId} dropped the includePdf parameter.

​
2026-03-20

Initial public version.
  • Requests: create, list, fetch, delete, and OTP resend (/request, /request/{requestId}, /request/resend/{requestId})
  • Users: create and look up (/user)
  • Credentials: fetch by id (/credential/{credentialId})
  • Approvals: GET /approvals, GET /approvals/workflow