API Changelog

Track updates, new features, and fixes across all relay APIs.

2026-08-14 - Error Codes: Report/Sharing Table Doesn't Reach onError​

Audit of intellirent-services (source of truth) against this docs site. npm run check-sdk-types passes clean (0 errors, 35 types checked) — no SDK type-level drift, and no SDK-observable source changes have landed since the prior audit. This pass focused on prose accuracy below the type-drift check's radar and confirmed one ambiguity in the REST error-code reference.

Error Codes​

• Added: A note to the "Report / Sharing Codes" table (GET /reports/{id}, consent-to-share, revoke-sharing) clarifying that these codes apply to direct API callers only — the embedded SDK's report view forwards only PAYMENT_REQUIRED to onError; every other code in that table (REPORT_SHARING_EXPIRED, SCREENING_REPORT_EXPIRED, REPORT_SHARING_NOT_FOUND, REPORT_ACCESS_DENIED, etc.) renders as an in-iframe error state with no callback to the host page. Confirmed against ReportPage.tsx's error-handling effect (apps/experian-screening), which posts an iframe ERROR message — the only path to onError — exclusively for PAYMENT_REQUIRED, and against that component's own test suite ("does not notify the SDK for other error codes"). This table sits directly below the "Screening Session Codes" section, which carries the opposite callout (most of those codes are forwarded to onError) — without a matching note here, a reader skimming both sections could reasonably assume the same forwarding rule applied to both.

2026-08-13 - Report Sharing: Recipient View-Window Expiry Code​

Audit of intellirent-services (source of truth) against this docs site. npm run check-sdk-types passes clean (0 errors, 35 types checked) — no SDK type-level drift. This pass found one gap in the REST error-code reference introduced by the most recent commits on main (IDT-861/862/863, landed after the prior audit): a new, live error code on a documented endpoint that wasn't yet reflected here.

Error Codes​

• Added: REPORT_SHARING_EXPIRED (403) to the Report / Sharing Codes table for GET /reports/{id}, consent-to-share, and revoke-sharing. Returned when an END_USER recipient's 24-month report view window has lapsed, or when the consumer has not yet consented to that recipient's share. Newly wired into checkReportAccess — previously this recipient-side gate incidentally reused the consumer's 30-day token expiry (SCREENING_REPORT_EXPIRED), which is now a separate, independent clock that no longer applies to END_USER callers.
• Added: A note explaining the two independent expiry clocks on GET /reports/{id} — the consumer's own 30-day report validity (SCREENING_REPORT_EXPIRED, renewable by re-verifying identity) versus a recipient's 24-month share view window (REPORT_SHARING_EXPIRED, not renewable — request a new report from the applicant instead) — and how REPORT_SHARING_EXPIRED differs from REPORT_SHARING_NOT_FOUND.

2026-08-12 - Embedded SDK: Delegation Warning, Lifecycle Timing, and Navigation Guard​

Audit of intellirent-services (source of truth) against this docs site. npm run check-sdk-types passes clean (0 errors, 35 types checked) — the type-level surface is already fully in sync from prior audits. This pass focused on prose accuracy below the type-drift check's radar: behavior descriptions, undocumented side effects, and one backwards event-timing description, found by reading SDK source and its tests directly rather than relying on documented type shapes alone.

SDK Methods​

• Added: DELEGATION_UNSUPPORTED to the "Known warning codes" table. Fires as a non-fatal onWarning when handlePrintRequested/handleDownloadRequested is provided but the embedded form build doesn't acknowledge takeover of that action on READY (a form build that predates delegation support) — invalidFields lists which of 'print'/'download' weren't honored. Also added a note under "Takeover Handlers (Native WebViews)" pointing integrators at this warning as the way to detect a stale form build instead of assuming their handler is broken.
• Added: A note under onResize describing the SDK's one-time-per-overflow console.warn when embedded content reports a width wider than the iframe's rendered width — a console-only diagnostic for a clipped/non-responsive layout, not a callback.
• Added: A note on sdk.mount()'s Mount Options that the SDK may add a beforeunload listener on the host page while the user has unsaved data in the screening form, so navigating away triggers the browser's native "Leave site?" prompt. This was previously undocumented entirely — a cross-origin iframe can't trigger that dialog itself, so the SDK does it on the host's behalf, added/removed automatically as the user enters and clears data.

Lifecycle Events​

• Fixed: component_loaded was documented as firing "When component HTML/CSS finishes loading in iframe." Source (types.ts's own doc comment, and emission order in sdk.ts) says the opposite: it fires when the iframe is about to begin loading, immediately after mounting and before the iframe element even exists. Corrected the Events Reference table, and clarified ComponentReadyPayload.loadTimeMs measures from that early point — including iframe creation, not just an HTML/CSS fetch — so it isn't misread as a pure asset-load duration.

Screening Pre-fill​

• Added: A note that previous-address prefill fields (previousStreet/previousCity/previousState/previousZip) are all-or-nothing — filling in only some of the group leaves the step showing incomplete until the user finishes or clears it manually, and (like a format failure) this does not trigger onWarning.

2026-08-11 - SDK Documentation: WebView Integration & Takeover Handlers (IDT-1113)​

Documents the SDK's new handle* takeover handlers: IDT-1113 asked for a WebView-integration section explaining which SDK features depend on browser-native APIs; intellirent-services#706 (IDT-1112, shipped SDK v0.16.0) is the SDK change that answers it, adding delegation handlers for print and download. Drafted while #706 was still in review — the author had confirmed the handler names and signatures were final — and finished once it merged: scripts/sdk-types/public-surface.json is updated in this same commit (npm run check-sdk-types passes clean, 35 types checked).

SDK Methods​

• Added: handlePrintRequested and handleDownloadRequested to the Mount Options table and a new "Takeover Handlers (Native WebViews)" subsection documenting both: signatures, the handle*/on* naming distinction (providing a handle* option suppresses the form's browser-native default instead of just notifying), and the presigned-URL characteristics of handleDownloadRequested's payload (self-authenticating, short-lived).
• Added: A compliance callout on handleDownloadRequested: the file is an Experian-sourced screening report, and Experian's terms prohibit retaining it outside of delivering it to the requesting consumer/end user — the handler must hand it off (share sheet/save dialog) and discard the local copy, not archive/cache/log it server-side.
• Changed: The existing "Print handling" note (Ctrl/Cmd+P interception) now also covers the case where handlePrintRequested is provided — the SDK invokes the handler directly instead of forwarding to the iframe.

WebView Integration (new guide)​

• Added: New WebView Integration guide — a table of which features depend on browser-native APIs (print via window.print(), PDF download via anchor click) and fail silently in a native WebView, the takeover-handler fix, and a checklist for native app developers. Deliberately platform-agnostic: it describes what each handler hands you and leaves the native-side implementation (iOS, Android, or otherwise) entirely up to the integrator rather than prescribing a particular bridging approach. Linked from the sidebar under SDK → Guides (between Session Tokens and Type Reference), from SDK Methods, and from Type Reference.
• Added: A prominent callout under Download and a matching checklist item: Experian prohibits retaining a downloaded screening report on the integrator's own systems — the native handler must deliver it to the requesting consumer/end user and discard its own copy, never archive, cache, or log it.

Type Reference​

• Added: handlePrintRequested?: () => void and handleDownloadRequested?: (download: DownloadRequest) => void to the MountOptions interface, and the new DownloadRequest interface (url, filename).
• Added: handlePrintRequested/handleDownloadRequested to MountOptions.members and DownloadRequest as a new public entry in scripts/sdk-types/public-surface.json; classified the three types backing them (PrintRequestedMessage, DownloadRequestedMessage, DelegatedActions) as internal — they're iframe-protocol messages, not part of the consumer-facing surface. Re-snapshotted with npm run check-sdk-types -- --write against the merged source.

What's New​

• Added: A v0.16.0 entry summarizing the takeover handlers.

2026-08-11 - Embedded SDK: onResize Now Fires on Width Changes Too​

Audit of intellirent-services (source of truth) against this docs site. npm run check-sdk-types passes clean (0 errors, 34 types checked) — the type-level surface is already fully in sync from prior audits. This pass found one prose gap below the type-drift check's radar: a behavior change to an existing callback's trigger condition.

SDK Methods​

• Fixed: onResize was documented as firing "when the content height changes." A recent fix (fix(IDT-1110): mobile-first share popover + width-change resize reporting) corrected a bug where a width-only change (device rotation, content growing sideways) never notified the host at all — useAutoResize now tracks width alongside height and fires on either changing. Updated the description so integrators relying on onResize for dynamic layouts know it also covers width-only changes.

2026-08-10 - Screening Session Errors: SESSION_EXPIRED Surfaced, Report-Expiry Link Fix​

Audit of intellirent-services (source of truth) against this docs site, focused on the /screening/* error-code family and a stale cross-link introduced by a recent EIS routing fix.

Error Codes​

• Added: SESSION_EXPIRED (410, not recoverable) to the Screening Session Codes table. As of a recent fix (fix(screening): stop reporting a spent KBA session as wrong answers), an expired/spent upstream Experian auth session — previously collapsed into a generic INTERNAL_ERROR — is now surfaced to the client verbatim so the embedded form can route the user to a fresh step-up instead of re-offering a KBA question set that can no longer be graded (mistakenly reading a dead session as "your answers were wrong"). Reachable via the direct API and forwarded through the SDK's onError the same as the rest of this code family.
• Fixed: The prose immediately below that table stated an expired upstream auth session is "deliberately collapsed to a generic INTERNAL_ERROR" — no longer true per the change above. Corrected to describe SESSION_EXPIRED as the one exception that is surfaced, not collapsed.

Workflows​

• Fixed: Consumer View Requested Report linked to GET /api/experian/renters/{renterId}/report/expiry (slashed) in its prose; the actual endpoint — confirmed against the OpenAPI spec and the Getting Started / Troubleshooting pages, which already had it right — is the hyphenated report-expiry.

2026-08-07 - Embedded SDK: Report Bundle Catalog, Screening Requirements, and Payment Error Corrections​

Audit of intellirent-services (source of truth) against this docs site, covering productId values, the screening view's unitAddress requirement, lifecycle event payloads, onResize sizing, and the PAYMENT_REQUIRED/token-exchange error families.

SDK Methods & Types​

• Fixed: ProductId was documented as 71 | 72 | 73 | 74 only. IDT-1069 widened the enum to 11 values, adding 7 consumer-platform report bundles (9, 34, 36, 38, 51, 52, 68) alongside the original 4 TSP passive-Identity bundles. Expanded the productId product table and the ProductId type alias accordingly; a caller passing one of the new values was already accepted server-side, the docs just said it wasn't.
• Fixed: screening.unitAddress was documented as required for CONSUMER only, and the screening view's "Required Options" table said the same. The SDK's actual guard requires it whenever userContext.userType !== 'END_USER' — i.e. also for TSP. Corrected both spots.
• Fixed: The sessionId field on component_loaded/component_ready/component_error/component_destroyed lifecycle payloads was documented as "the iframe instance ID." It's a separately-generated, sess_-prefixed correlation ID that never matches IframeInstance.id or the mounted/unmounted events' instanceId. Corrected the description on both the Lifecycle Events and Types pages so integrators don't try to correlate the two.
• Added: A note on onResize that the SDK enforces a 200px minimum on the mounted iframe's actual height, but dimensions.height in the callback reflects the raw, unclamped value — integrators sizing a wrapper element from this callback should apply the same floor themselves.

Billing & Error Codes​

• Fixed: PAYMENT_REQUIRED is documented as meaning exclusively "the account's prepaid credit balance is exhausted." In fact the report view returns the identical code for a second, unrelated HTTP 402 cause: the specific renter being screened hasn't completed their own per-transaction Stripe Checkout payment for that report. Added a callout and a cause/message/fix table to the Billing and Billing Technical Addendum guides, corrected the PAYMENT_REQUIRED row on Error Codes, and corrected REST error code 285's note (previously claimed to be "unrelated" to PAYMENT_REQUIRED — it's the numeric-envelope equivalent of the same renter-payment condition).
• Added: BILLING_NOT_CONFIGURED — a token-exchange error code returned when a pk_live_* exchange is rejected because the account has neither a Metronome prepaid customer nor a Stripe connected account configured. Previously absent from both the SDK Methods and Error Codes token-exchange tables.
• Fixed: Session Tokens stated publishable-key revocation, "like" secret-key revocation, "takes effect immediately, with no propagation delay." Publishable-key deactivation can take up to ~30 seconds to propagate to new mounts (an in-process cache), and does not revoke a JWT already issued before deactivation — that JWT stays valid until it naturally expires (up to 1 hour later). Secret-key revocation is immediate; scoped the claim to that.

What's New​

• Added: A v0.14.0 entry for the productId bundle expansion above — the SDK's own version was bumped for this change (IDT-1069) but What's New had no corresponding entry.

2026-08-06​

Changed

• Documentation site rebranded to relay and moved to https://docs.relayscreen.com. All docs.ir.app URLs now 301-redirect to the same paths on the new domain. API endpoints, SDK script URLs, and code identifiers (Intellirent.init()) are unchanged — no integration action is required.

2026-08-06 - Embedded SDK onError Reference: Verification-Flow Codes​

Audit of intellirent-services (source of truth) against this docs site, focused on the codes onError actually delivers during the Embedded SDK's identity-verification flow, plus a handful of undocumented mount()/IframeInstance edge cases.

SDK Methods​

• Added: A "Verification-flow error codes" table under onError (and mirrored on Error Codes) documenting FINGERPRINT_SDK_UNAVAILABLE, FINGERPRINT_SCRIPT_LOAD_FAILED, FINGERPRINT_COLLECTION_FAILED, AUTH_TOKEN_INVALID, SCREENING_OTP_RESEND_FAILED, SCREENING_KBA_QUESTIONS_MISSING, SYSTEM_INTERNAL_ERROR, SYSTEM_CONFIGURATION_ERROR, and COMPONENT_RENDER_FAILED — none previously documented anywhere on this site. Traced each to its call site (libs/shared/ir-ui's useErrorReporter → notifyError, used from VerifyStep.tsx, OTPState.tsx, and KBAState.tsx in apps/experian-screening) to confirm it's actually forwarded to the host page rather than only rendered in the iframe's own UI.
• Added: Documented that submitting the initial screening form, an OTP code, or KBA answers can deliver onError the screening-session API's own response code verbatim (INVALID_OTP, INVALID_KBA, USER_BLOCKED, TOO_MANY_ATTEMPTS, etc.) — the same family already listed under Screening Session Codes. That page previously stated these codes are never forwarded to onError, with PAYMENT_REQUIRED as the sole exception; traced through extractErrorCode() in OTPState.tsx/KBAState.tsx, which passes the API's error.code through unchanged and only falls back to a SCREENING_*-prefixed local constant when the caught error carries no code at all. Corrected both notes on that page.
• Added: A third token-exchange fallback code, UNKNOWN_ERROR (apps/sdk/src/token-exchange.ts) — fires when a non-2xx token-exchange or refresh response can't be parsed as JSON at all, distinct from the already-documented TOKEN_EXCHANGE_FAILED/TOKEN_REFRESH_FAILED. Refined those two codes' descriptions: they cover a request failing outright with no response (a raw network failure), while TOKEN_EXCHANGE_FAILED also covers a well-formed JSON response with no error.code to surface.
• Added: Documented two more sdk.mount() Promise-rejection cases under "Validation failures that don't go through onError" — a selector matching no DOM element (Container element not found: <selector>), and mounting while a view is already active on the same sdk instance (Iframe is already mounted. Call unmount() first...). Neither was previously mentioned; both are plain, uncoded Errors like the existing unitAddress/applicationFee/endUserType cases.
• Added: onVerificationFailure's reasonCode is now documented as an open string rather than left unexplained — typically 'BLOCKED' / 'EXPIRED' / 'ERROR', but carrying an arbitrary error code instead if the screening submission itself failed before verification could start.
• Added: A note that report.id is not validated client-side — omitting it on a view: 'report' mount does not reject the Promise, it just mounts with no report loaded.
• Added: A note that IframeInstance.destroy() and sdk.unmount() tear down the same mounted view and are both idempotent.

Error Codes​

• Fixed: Two notes claiming screening-session error codes and most onError codes beyond PAYMENT_REQUIRED are never forwarded to the host page were stale — see above.
• Added: Mirrored the SDK Methods additions above (verification-flow codes table, UNKNOWN_ERROR, the two new mount validation cases) so this page stays the single cross-reference for every error family.

2026-08-05 - REST API Response Samples & Endpoint Review (IDT-966, IDT-963)​

All REST APIs (Consumer, IRO End User, PMC End User, Stripe Integration)​

• Added: Sample response bodies for every documented response across all 35 REST operations. Previously 135 of 158 declared responses carried no response body at all — the generated pages rendered a description and nothing else, because docusaurus-theme-openapi-docs skips rendering entirely when a response has no content block. Every response now has a schema and at least one curated example.

• Added: Reusable response schemas in each spec — ErrorResponse (new to the Consumer API; already present in the others), plus PassthroughResponse, UpstreamErrorResponse, BarePayloadResponse, and ReducedErrorResponse — and a shared components/examples library so repeated bodies (invalid API key, entity-not-found, user-blocked, upstream failures) are defined once per spec.

• Added: Each spec's "Response Envelopes" section now documents every envelope the API actually emits, with a table of which endpoints and statuses produce which. Previously each spec claimed a single uniform envelope, which is the root of the confusion this work addresses. Verified exhaustively against ResultMapper.toResponse in eis-micronaut, which switches over all 11 permitted OperationResult records with no default arm.

• Added: Previously undocumented statuses — 502 (upstream Experian error or transport failure; errorCode 121 for an upstream 4xx, 131 for a 5xx or connection failure) on registration endpoints, 409 errorCode 341 (account not provisioned for live Experian traffic) alongside the existing 292, and 400/409 on the Consumer Submit KBA Answers endpoint.

• Fixed: Documented that 422 authentication-failure responses carry an empty errors array, making them structurally identical to a 200. Integrators must branch on the HTTP status, not on errors.length. This applies to every OTP and KBA submit endpoint and was previously undocumented anywhere.

• Fixed: Documented that report-endpoint query-parameter validation (excludeBackground, excludeHousingCourt) returns a reduced body whose key is message, not errorMessage, with no payload key.

• Fixed: The Consumer API report endpoint's 402 documentation listed prepaid-credit exhaustion and a structured {"error": {"code": "PAYMENT_REQUIRED", ...}} body as a possible cause. That envelope is produced by the platform API behind the Embedded SDK; /api/experian/* routes directly to the integration service and never returns it. The only 402 cause on this endpoint is an incomplete per-transaction renter payment.

• Removed: 402 Payment Required from the IRO and PMC renter-report endpoints. Those endpoints have no payment gate and never return 402.

• Removed: 404 Not Found from the IRO and PMC credit-score endpoints. They return 200 with an empty creditScore when the renter, agent, or organization is unknown or no active link exists — the surrounding prose already said so, but the declared status contradicted it.

• Fixed: The KBA success sample in API Getting Started showed {"payload": {"authenticated": true}}. No such field is returned by that endpoint — it returns the Experian passive-user response unchanged, where the relevant field is userAuthenticated. Replaced with the real nine-field body.

• Fixed: The auth/expire 200 sample described payload as a status string. It is Experian's raw response body passed through unchanged, and may also be null or a plain string when Experian returns an empty or non-JSON body.

• Fixed: The Stripe Integration API's response samples used payload-before-errors key order. That service's envelope emits errors first; samples now match the wire format.

• Fixed: The renter-report endpoints described the /report-suffixed path as a "legacy alias" of the suffix-less path. That is inverted — the service treats the /report form as canonical (the suffix-less spelling is the original V1 path), and the /report form is the only one served by the SDK/Lambda surface. Both behave identically; the note now says so and points new integrations at the /report form.

PMC End User API​

• Deprecated: PUT /api/experian/organizations/{organizationId} ("Add Organization with Token") is now marked deprecated. Use Add Organization followed by Submit KBA Answers instead. The endpoint associates an already-issued Experian token with an organization without contacting Experian, so no identity verification occurs, and it does not capture Experian TSP tenancy for the stored token — leaving the organization in the unbound-user state that later surfaces as Experian /v3/share errors 9007/9008.
• Fixed: That endpoint's documented 400 Missing or invalid token was inaccurate. A missing token query parameter does return 400, but the token value itself is never validated — any non-empty string is stored verbatim and returns 200. Documented accordingly.

2026-08-05 - SDK Documentation Audit (endUserType, productId, TokenResponse flags)​

SDK Methods​

• Added: screening.endUserType (apps/sdk/src/types.ts / libs/shared/types/src/iframe-protocol.ts's ScreeningOptions, shipped SDK v0.13.0, IDT-1012) was entirely undocumented on this site — not in the ScreeningOptions reference, not in the Mount Options table, not in What's New. Documented accepted values (INDEPENDENT_OWNER/REAL_ESTATE_AGENT/PROPERTY_MANAGEMENT), the END_USER-only scope, the mount() Promise rejection on an unrecognized value, and the non-fatal IGNORED_END_USER_TYPE warning when supplied on a non-END_USER mount. Added a What's New entry and a cross-reference from Step 2: Enroll End Users.
• Added: screening.productId (shipped SDK v0.10.6) was likewise undocumented. Documented the four accepted ProductId values against their seeded product names/descriptions (libs/shared/database/src/migrations/0053_api_tsp_onboarding_screening_config.sql), and the important behavioral difference from the other screening.* options: it is not validated client-side — an invalid value passes straight through to the embedded view, which validates it and emits a non-fatal INVALID_PRODUCT_ID warning, falling back to the account's configured default product.
• Added: A "Known warning codes" table under onWarning documenting all five codes the SDK can emit (INVALID_PREFILL_FIELDS, IGNORED_END_USER_TYPE, INVALID_PRODUCT_ID, INVALID_APPLICATION_FEE, INVALID_END_USER_TYPE) — only the first three were reachable from a normal integration; only the SDK's own docs previously mentioned one of the five (INVALID_PREFILL_FIELDS). Noted that INVALID_APPLICATION_FEE and INVALID_END_USER_TYPE are effectively unreachable via the packaged SDK bundle: apps/sdk/src/sdk.ts validates both fields before the embedded view ever mounts, rejecting mount()'s Promise immediately rather than letting an invalid value reach the iframe — the iframe-side check (libs/modules/iframe-messaging/src/form-messaging.ts) only fires for a non-standard client that bypasses the SDK.
• Fixed: Both SDK Methods and Error Codes stated sdk.mount()'s Promise only rejects with a plain Error for an invalid unitAddress or applicationFee. screening.endUserType follows the identical Promise-rejection pattern (added in IDT-1012, after these pages were last audited) and was missing from both lists.

SDK Reference (TypeDoc)​

• Fixed: Regenerated docs/sdk/reference/**, stale against current apps/sdk / libs/shared/types source. Notable drift: TokenResponse.featureFlags and TokenResponse.accountFlags (IDT-1014) were missing entirely and flags wasn't marked @deprecated; the index module's EndUserCategory type alias and ScreeningOptions interface (re-exported via apps/sdk/src/types.ts) were absent from the reference index page; ScreeningOptions itself was missing the endUserType field.
• Fixed (source): InitMessage.screening's own JSDoc comment in libs/shared/types/src/iframe-protocol.ts also listed (prefill, unitAddress, applicationFee, productId), omitting endUserType — a documentation bug at the source, not just in this generated reference. Opened intellirent-services#640 to add it (comment-only, no version bump).

Type Reference​

• Fixed: Type Reference's ScreeningOptions (introduced 2026-07-31 when the generated TypeDoc reference was replaced — see below) predated this audit's addition of screening.endUserType and didn't carry it. Added endUserType?: EndUserCategory to the interface, named productId's type as ProductId (matching SDK Methods) instead of a bare number, and ran npm run check-sdk-types against live source to catch further drift accumulated while the page sat unreviewed: SdkConfig was still missing sessionToken/onTokenExpired (documented in Session Tokens since 2026-08-03 but never folded into this page), and ScreeningPrefillData.phoneType was typed as a bare string instead of "home" | "mobile" | "work" (also fixed on Screening Pre-fill).
• Changed: Classified END_USER_CATEGORY, END_USER_CATEGORIES, and parseEndUserCategory as internal in scripts/sdk-types/public-surface.json — runtime helpers behind screening.endUserType's postMessage-boundary validation, not reachable from the browser global (Intellirent exposes only init/version/SdkErrorCode) and redundant with the already-documented EndUserCategory string-literal union.
• Fixed: Re-snapshotted scripts/sdk-types/public-surface.json — the above plus a stale init signature (recorded as an arrow-typed property from before the drift-check's member-signature comparison was added) — bringing npm run check-sdk-types to a clean pass (34 types checked, 0 unclassified) for the first time since the hand-written reference replaced the generated one.
• Fixed: scripts/sdk-types/check-drift.mjs's shapeOf() reduced every function-typed alias to existence-only, including LifecycleEventListener — so an upstream change to its parameter, return, or generic constraint (<T extends LifecycleEventType>(payload: LifecycleEventMap[T]) => void) would have passed the nightly sdk-type-drift check while Lifecycle Events' documented declaration silently went stale. Added signature rendering (generics included) for this case, comparable like any other member, and re-snapshotted.

2026-08-04 - SDK Documentation Audit (Application Fee Wording, Theming Color Gaps)​

Scheduled audit of intellirent-services (source of truth) against this docs site, focused on the Embedded SDK's public surface. This audit predates the 2026-07-31 reference-replacement work above and its endUserType/productId scope discipline; its screening.endUserType finding and its edits to the generated ScreeningOptions/InitMessage reference pages were superseded before merge — the former by the 2026-08-05 audit, the latter by that page's removal entirely (InitMessage is iframe-protocol-internal and was never in scope for a consumer-facing reference; see the SDK Documentation Scope section of CLAUDE.md). Only the two fixes below survived reconciliation.

Getting Started​

• Fixed: Step 3: Screen a Consumer said an invalid applicationFee "throw[s] a synchronous error before the iframe mounts." sdk.mount() is declared async (apps/sdk/src/sdk.ts), so this validation failure surfaces as a rejected mount() Promise, not a synchronous throw — only Intellirent.init()'s publishableKey check is genuinely synchronous. Reworded to match SDK Methods, which already had this right.

Theming​

• Fixed: Theming listed background, error, and success as configurable Color properties with no caveat. Verified against apps/experian-screening: the PUT /theme API and account_theme_config schema accept and store these three fields, but the dashboard's Color settings screen (ColorSettings.tsx) has no input for them and the embedded form's theme provider (useAccountThemeConfig.ts) never reads them — only primary*, secondary*, textPrimary, textSecondary, and link* are both editable and actually applied today. Added a caution note, consistent with the existing Shape caveat on the same page.

2026-08-03 - SDK Documentation Audit (Session Tokens)​

SDK Documentation​

• Added: New Session Tokens guide documenting the sessionToken / onTokenExpired options on Intellirent.init() (shipped in SDK v0.12.0, apps/sdk/src/types.ts's SdkConfig, IDT-955/959) — entirely undocumented on this site until now despite already being live in the published SDK's type declarations. Covers the mint-and-consume flow, the single-use 15-minute grant lifecycle, the onTokenExpired retry-once semantics, and the backing POST /v1/sessions server-to-server API (secret-key authenticated, apps/api/src/handlers/server/sessions.ts) including its request fields and error codes. Linked from SDK Methods and added a What's New entry.
• Noted: Documented as a known limitation that whether a supplied sessionToken was accepted (TokenResponse.grant.consumed/reason) is not currently surfaced to the host page via any public callback — it drives the SDK's internal retry only. Deliberately did not publish a base URL for the session-mint API, since infra/src/stacks/server-api-stack.ts states no custom domain has been settled yet; pointed integrators to their account team instead.
• Regenerated: SDK Reference (generated TypeDoc output, since replaced — see 2026-07-31 below) was stale against current apps/sdk/src/types.ts — missing SdkConfig.sessionToken/onTokenExpired and TokenResponse.grant entirely. Regenerated against the current source.

2026-07-31 - SDK Reference Replaced With a Hand-Written Type Reference​

SDK Reference​

• Removed: The generated TypeDoc reference (docs/sdk/reference/**, 65 pages, including the seven iframe-protocol interface pages added earlier the same day — see below) and the "SDK Reference" sidebar section. It published 27 SDK-internal types with no consumer use — every *Message interface of the iframe postMessage protocol, the SdkToFormMessage/FormToSdkMessage unions, the *MessageType constant maps, PROTOCOL_VERSION, and the TokenResponse/TokenErrorResponse token-exchange shapes. None was referenced from any hand-written page. It also carried 241 "Defined in" source links into the private intellirent-services repository, every one of which 404s for an external reader, and duplicated each public type across an index re-export stub and a types page.
• Added: Type Reference — a hand-written page carrying the TypeScript declarations for the SDK's full consumer-facing surface: the global object, initialization, mount settings, callback payloads, error codes, and lifecycle events. Replaces ~2,825 lines of generated output with one page and no dead links.
• Added: Previously undocumented members of the global Intellirent object are now documented on the Type Reference page: Intellirent.version appeared only in the generated reference, and the object's full shape (init, version, SdkErrorCode — and nothing else) was never stated.
• Fixed: Lifecycle Events now documents LifecycleEventType, LifecycleEventMap, and LifecycleEventListener — the typed sdk.on() contract, previously only visible in the generated reference. Also corrected in the process: the SDK ships as a browser global exposing only init/version/SdkErrorCode, so the LifecycleEvent constant object is not reachable at runtime as Intellirent.LifecycleEvent; event names must be passed as string literals.
• Changed: SDK Methods now names SdkConfig, SdkUserType, SdkView, ResizeDimensions, LifecycleEventType, and LifecycleEventListener at the points they apply, and documents the ResizeDimensions shape inline at onResize. The SdkError links on Billing and the Billing Technical Addendum now point at the Type Reference.

Build & Tooling​

• Removed: docusaurus-plugin-typedoc and typedoc-plugin-markdown, and the intellirent-services sparse checkout from both deploy workflows. The docs site now builds from this repository alone — no cross-repo checkout and no SDK_REPO_PAT on the deploy path. The obsolete sdk-updated repository_dispatch trigger, which existed only to regenerate the reference, has been dropped.
• Added: A nightly sdk-type-drift workflow (npm run check-sdk-types) that extracts the SDK's type surface from intellirent-services with TypeDoc and diffs it against scripts/sdk-types/public-surface.json, failing with a member-level report when the documented surface no longer matches source. The comparison covers member types and signatures, not just names, so a field retyped, a callback signature changed, or a readonly dropped upstream fails the check even when nothing was renamed. It publishes nothing — it exists so hand-written docs cannot silently rot, and so the documentation audit gets a deterministic drift signal instead of eyeballing source. typedoc is retained as a dev dependency for this check only.

2026-07-31 - SDK Documentation Audit (Iframe Protocol Gaps)​

SDK Reference (Iframe Protocol)​

• Added, later removed same day: Seven SdkToFormMessage/FormToSdkMessage union members had no interface reference page — AuthReadyMessage, AuthFailedMessage, NavigationGuardMessage, WarningMessage, ScrollToTopMessage, StepUpRequiredMessage, and VerificationStartedMessage were all named directly in the SdkToFormMessage / FormToSdkMessage union type pages as unlinked plain text, with the corresponding message-type string constants present in SdkToFormMessageType/FormToSdkMessageType but no documented payload shape anywhere on the site. Added all seven interface pages (payload fields verified directly against libs/shared/types/src/iframe-protocol.ts) and linked them from the union pages and the types index. The entire generated reference tree — these seven pages included — was replaced by a hand-written Type Reference later the same day (see above); per that page's scope contract, the iframe postMessage protocol is explicitly SDK-internal and out of scope for consumer-facing docs, so the pages were not recreated.

2026-07-30 - SDK Documentation Audit (onError Error Code Corrections)​

SDK Methods / Error Codes​

• Fixed: SDK Methods and Error Codes both listed Intellirent.SdkErrorCode.VALIDATION_INVALID_FORMAT and INVALID_PUBLISHABLE_KEY as codes delivered to the onError mount callback. Verified against apps/sdk/src/sdk.ts, apps/sdk/src/index.ts, and the SDK test suite (sdk.spec.ts) — neither code is ever actually emitted. Intellirent.init() throws a plain, uncoded Error synchronously when publishableKey fails format validation; sdk.mount()'s returned Promise rejects with a plain, uncoded Error for a missing/invalid screening.unitAddress or an out-of-range screening.applicationFee. Neither path touches onError. Documented both failure modes explicitly (with a try/catch example) instead of implying they surface via onError.code.
• Added: The token-exchange failure codes that are actually delivered to onError (via the generic TOKEN_EXCHANGE_FAILED/TOKEN_REFRESH_FAILED codes, or directly as the upstream error.code when present) were previously undocumented: MISSING_KEY, INVALID_KEY, KEY_INACTIVE, MISSING_ORIGIN, ORIGIN_NOT_ALLOWED, RATE_LIMITED, INTERNAL_ERROR (from TokenExchangeErrorCode in libs/modules/auth/src/types.ts, returned by apps/api/src/handlers/auth/token-exchange.ts).
• Fixed: Both pages claimed the IFRAME_LOAD_FAILED / IFRAME_TIMEOUT / IFRAME_ERROR / TOKEN_EXCHANGE_FAILED / TOKEN_REFRESH_FAILED runtime codes are "generally recoverable." Per apps/sdk/src/create-iframe.ts, the three iframe-embedding codes are hard-coded recoverable: false in every case; only the two token codes vary, and only by HTTP status class (true for 5xx, false otherwise). Replaced the blanket claim with a table stating the actual recoverable value per code.
• Fixed: The then-generated SDK Reference page for the global Intellirent object (since removed — see 2026-07-31) produced the same "delivered via onError" claim for the whole SdkErrorCode object straight from its source JSDoc — a documentation bug at the source, not just in the hand-written guides. Opened intellirent-services#595 to reword the JSDoc on apps/sdk/src/index.ts's SdkErrorCode export and add per-constant comments on VALIDATION_INVALID_FORMAT/INVALID_PUBLISHABLE_KEY in apps/sdk/src/errors.ts stating they're reserved. Regenerated the three affected reference pages to match.

2026-07-30 - SDK Documentation Audit (Screening Session Error Codes)​

SDK Documentation​

• Added: Error Codes now documents the ScreeningErrorCode string codes returned by the screening session endpoints (POST /screening/submit, /otp, /otp/resend, /kba) — 16 codes including the new ACCOUNT_NOT_PROVISIONED (added upstream in IDT-969, previously masked as ALREADY_REGISTERED) — none of which were documented anywhere on the site before this pass. Clarified that these codes reach an integration only via a direct call to those endpoints; through the embedded SDK they are rendered by the iframe's own UI and are not delivered to the host page's onError callback (the sole exception being PAYMENT_REQUIRED, documented separately).
• Changed: Cross-referenced ACCOUNT_NOT_LIVE (Platform API Codes) and the new ACCOUNT_NOT_PROVISIONED (Screening Session Codes) as the same underlying condition surfaced under two different codes on two different endpoint families, to avoid the two being confused for unrelated errors.
• Fixed: SDK Methods stated flatly that onScreeningSuccess fires "after payment completes" for CONSUMER. Some accounts are configured by Intellirent to waive the payment step entirely (the skipPaymentStep flag, WizardStepGuard.tsx), in which case the callback fires right after verification and onPaymentSuccess never fires for that session — noted as an exception rather than a blanket rule.

2026-07-29 - SDK Documentation Audit (IDT-969 Follow-up)​

REST API Documentation​

• Added: ACCOUNT_NOT_PROVISIONED (409) documented in the Error Codes Screening Session Codes table, cross-referenced from ACCOUNT_NOT_LIVE in the Report / Sharing Codes table. Introduced by IDT-969, which stopped the screening-submission flow from masking this condition as ALREADY_REGISTERED; it is now surfaced to the client unchanged. Distinct from the existing ACCOUNT_NOT_LIVE code — same underlying TSP-onboarding condition, but raised at EIS submission time rather than the earlier pk_live gate.

2026-07-28 - SDK & Platform API Documentation Audit​

Scheduled audit of intellirent-services (source of truth) against this docs site, focused on the Embedded SDK's public surface and the platform API endpoints backing it.

SDK Reference (TypeDoc)​

• Fixed: typedoc.tsconfig.json and docusaurus.config.ts pointed the SDK reference generator at ../V2/intellirent-services, a path that only resolved on one contributor's local machine layout — npm run gen-api-docs could not find the source repo anywhere else, including CI. Repointed to the sibling-checkout convention (../intellirent-services) matching how the repos are actually cloned.
• Fixed: Regenerated docs/sdk/reference/**, which had been stale since SDK v0.9.0 (2026-07-07) despite the SDK shipping through v0.10.4 since. Now reflects current source, including the flags?: Record<string, boolean> field added to TokenResponse/AuthReadyMessage.

Architecture Overview​

• Fixed: The Payment request-flow diagram described a POST /payments/webhook client-facing webhook — this endpoint was retired (IDT-650); there is no HTTP webhook entry point for the platform payment flow. Replaced with the actual flow: POST /payments/create-intent → client confirms with Stripe.js → POST /payments/{transactionId}/confirm, with server-to-server EventBridge events as the authoritative status source.
• Added: POST /payments/{transactionId}/confirm was not documented anywhere on the site. Added with request/response detail.
• Added: The Screening request-flow only showed a KBA example and never mentioned OTP, /screening/{id}/otp/resend, or /screening/{id}/status. Rewrote with concrete request/response bodies for all five /screening/* endpoints and the session state machine (SUBMITTED → STEP_UP_REQUIRED → OTP_PENDING|KBA_PENDING → VERIFIED|BLOCKED|EXPIRED|ERROR, plus the derived overallStatus), which was previously undocumented on this site despite being central to the flow.

Error Codes​

• Added: Error codes for /screening/submit, /otp, /otp/resend, /kba (VALIDATION_INVALID_FIELD_FORMAT, ACCOUNT_NOT_PROVISIONED, IDENTITY_NOT_FOUND, etc.) — previously undocumented and easy to conflate with the similarly-named but distinct Report/Sharing codes (SCREENING_IDENTITY_NOT_FOUND, SCREENING_NOT_FOUND, etc.), which come from a different endpoint family. Split into two clearly-labeled tables.
• Changed: Noted that Intellirent.SdkErrorCode is a stable typed subset of what onError.code can deliver, not an exhaustive list — the embedded view forwards its own error codes (including the Screening Submission codes above) through the same callback.

SDK Methods​

• Added: UnitAddress collects the full rental address, but only zip is forwarded to Experian for the background/housing-court search — previously only noted in generated reference comments, not in the hand-written guide.
• Added: The SDK intercepts Ctrl/Cmd+P on the host page while a view is mounted and forwards it to the embedded view for printing — automatic behavior with no mount option, previously undocumented.

Security​

• Added: POST /auth/token/exchange response shape, including the flags field added alongside token issuance.

2026-07-27 - SDK Documentation Audit​

SDK Documentation​

• Fixed: Theming claimed buttonBorderRadius/cardBorderRadius ("Shape") could be configured through the TSP dashboard. There is no dashboard UI or API for it, and account_theme_config has no column to persist it — only colors and fontFamily are actually stored per account today. Added a caution note; the validation rules (0–24, clamped, rounded) are documented as the contract that will apply once this ships, not as available now.
• Fixed: Theming said theme settings "apply automatically to all SDK instances using your publishable key." Theme is keyed by accountId, not by individual publishable key, so all keys under one account share a theme; also noted that an END_USER account without its own override inherits its parent TSP's theme.
• Fixed: Getting Started version-pinning example used a malformed URL (v0/v0.0.1.js, with a redundant v inside the filename) that doesn't match the actual deploy pipeline's v{major}/{version}.js naming (deploy-sdk.yml) and would 404 if followed literally.
• Added: Error Codes reference was missing REPORT_SHARING_NOT_FOUND (403) and REPORT_SHARING_REVOKED (403) from the Platform API Codes table, and was missing an entire second, differently-prefixed ScreeningErrorCode set (VALIDATION_ERROR, INVALID_ADDRESS, INVALID_OTP, INVALID_KBA, USER_BLOCKED, IDENTITY_NOT_FOUND, MINOR_CONSUMER, etc.) returned by the screening submit/OTP/KBA endpoints. Added a new "Screening Submission & Verification Codes" subsection covering these.

2026-07-23 - SDK Documentation Audit​

SDK Documentation​

• Fixed: Screening Pre-fill phone field documented no format constraint beyond (XXX) XXX-XXXX/raw digits, but IDT-932 added server- and client-side validation requiring exactly 10 digits with no country code and an area code that cannot start with 1. Undocumented, a pre-filled E.164-style number (e.g. +15551234567) silently fails validation and leaves the step incomplete with no onWarning. Documented the constraint in the field table, the reference type doc, and a new Notes clarification that format failures don't trigger onWarning.
• Fixed: Screening Pre-fill currentZip/previousZip were documented as accepting "5 or 9 digits," but the validation regex (^\d{5}(-\d{4})?$) requires a hyphen before the ZIP+4 suffix — 9 raw digits without one fails. Corrected the format description in the field table and the reference type doc.
• Note for maintainers: the corresponding JSDoc on ScreeningPrefillData in libs/shared/types/src/iframe-protocol.ts (intellirent-services) carries the same generic wording that produces the TypeDoc-generated reference page. Since docs must follow source, that JSDoc should also be updated so the reference page doesn't regress on the next TypeDoc regeneration.

TBD (early access available) - Prepaid Credit Billing and 402 Payment Required (IDT-877, IDT-886, IDT-887, IDT-888)​

General availability date is TBD — prepaid credit billing is rolling out to TSPs on a staged basis rather than a fixed public launch date. Partners interested in early access can contact their Intellirent account manager or integration support to discuss eligibility.

• Added: Billing: What's Changing — a plain-language overview for both business and engineering stakeholders, covering what's changing, what isn't, and an FAQ, with links out to the REST API and SDK technical references for both integration types.

REST API Documentation​

• Added: New Billing section covering the prepaid credit balance model, how it gates report access, the pre-flight balance check, the 402 Payment Required response, and how to purchase credits / configure auto-recharge.
• Added: 402 Payment Required (error code PAYMENT_REQUIRED) documented as a response on all report-pull endpoints — Consumer (get-renter-report), IRO End User (get-agent-renter-report), and PMC End User (get-organization-renter-report). Note: these are OpenAPI-generated pages; the 402 response should also be added to the upstream eis-micronaut spec so it survives regeneration.
• Added: Getting Started Step 4 (Retrieve the Report) and the Error Codes reference now note the 402 / PAYMENT_REQUIRED billing block.
• Added: Billing Technical Addendum — condensed 402-handling reference for REST API-integrated TSP engineering teams.
• Changed: API Billing docs are now grouped under a Billing sidebar category (Overview + Technical Addendum).
• Fixed: Consumer API's 402 on report retrieval was conflating two distinct conditions — the legacy per-transaction Stripe Checkout payment gate (errorCode 285, reason: "NO_COMPLETED_PAYMENT") and the new organizational prepaid-credit-balance gate (PAYMENT_REQUIRED). Both are now documented separately across getting-started.mdx, error-codes.md, troubleshooting.md, and the OpenAPI specs.

SDK Documentation​

• Added: New Billing guide covering the prepaid credit model's effect on SDK report requests and the PAYMENT_REQUIRED balance error delivered to onError.
• Added: Billing Technical Addendum — condensed engineering reference for SDK-integrated TSPs, including the minimum SDK version required for typed error delivery.
• Added: What's New page with the v0.9.0 billing entry — the onError callback now delivers a typed SdkError (code: "PAYMENT_REQUIRED", recoverable: false) when a report view is mounted against a $0 balance, per IDT-905.
• Changed: SDK Billing docs are now grouped under a Billing sidebar category (Overview + Technical Addendum).

2026-07-22 - SDK Documentation Audit (Follow-up)​

SDK Documentation​

• Fixed: What's New still claimed both the report and reports views were gated by the PAYMENT_REQUIRED balance check — missed in the July 21 audit pass that corrected this same claim in Billing and Step 4: View Reports. Only the report (single) view is gated; the reports list view is unaffected.
• Fixed: Getting Started listed email address as an example userId value, directly contradicting the "avoid" guidance in Best Practices (email is mutable and can orphan a user's screenings if it changes). Replaced with a safe example.
• Fixed: Getting Started step summaries referred to report.id as though it were the field name returned from onScreeningSuccess. Clarified that the callback returns id, which is then passed as report.id when mounting the report view in Step 4.
• Fixed: Step 3: Screen a Consumer said test-mode PII "will be rejected." Standardized to match the actual behavior (test-mode screenings route to Experian's test environment, where real PII will not work) already used in Getting Started and Step 2.
• Added: Step 3: Screen a Consumer now documents the optional screening.applicationFee override, previously only covered in the SDK Methods reference and absent from the walkthrough itself.

2026-07-21 - SDK Documentation Audit​

SDK Documentation​

• Fixed: Billing and Step 4: View Reports no longer claim the reports (list) view is gated by the prepaid credit balance check. Only the report (single) view is blocked with PAYMENT_REQUIRED when the balance is exhausted — GET /screenings (backing the reports list) has no balance/entitlement gate.
• Fixed: Step 4: View Reports "Authorization Requirement" section no longer states a single blanket rule for report access. The userId-must-match-the-original-screener rule applies only to userType: CONSUMER; END_USER access instead requires TSP-account registration (account_users) plus an active, non-revoked report share.
• Fixed: Removed ScreeningOptions.productId from the auto-generated SDK reference (ScreeningOptions, InitMessage) — it had resurfaced as a side effect of the July 7 TypeDoc regeneration fix, contradicting the "2026-06-10 - Remove productId from SDK Documentation" decision below to withhold productId documentation until the feature is production-ready. No GA announcement has been made since; restore once product/engineering confirm production-readiness.

2026-07-15 - IRO End User API Doc Fixes​

REST API Documentation​

• Fixed: get-agent-auth-token-status (IRO End User API) and get-organization-auth-token-status (PMC End User API) were missing their generated parameter, request schema, and status code files — both endpoints now render full documentation instead of an incomplete page.
• Changed: The IRO End User API info page's embedded re-authentication flowchart is now a link to the End User Re-Authentication workflow page, which documents the same flow in more depth — avoids two diagrams of the same flow drifting apart.

2026-07-14 - Workflows Section​

Resources​

• Added: New Workflows category under Resources — nine journey-level diagrams color-coded by actor (End User UX / Partner Backend / Intellirent API), each with numbered steps linking to the corresponding endpoint reference pages: End User Authentication, Consumer Authentication, Authentication w/ OTP Step Up, Authentication w/ KBA Step Up, End User Re-Authentication, Consent to Share Report, Revoke Consent to Share Report, End User View Shared Report, and Consumer View Requested Report.

2026-07-10 - Run in Postman Button​

Guides & Resources​

• Added: "Run in Postman" button on the Getting Started guide and on every API reference page (next to the Copy Markdown button). One click opens the public Relay API collection — all endpoints pre-configured with X-API-KEY auth, with a Relay UAT environment ready to fork; just set your apiKey variable.

2026-07-08 - Test JSC & HDIM Payloads Page​

Resources​

• Added: New Test JSC & HDIM Payloads page documenting the Intellirent-provided jscPayload/hdimPayload test values accepted in UAT, field constraints (required/optional, 4,000-char max, allowed charset), how real payloads are generated by Experian's FraudNet collector, and handling guidance (UAT-only; never log real payloads).
• Changed: Getting Started Step 2 registration example now uses documented stand-in payload values instead of bare placeholders, and links to the new page.

2026-07-07 - Test Consumers Page Restructure​

Resources​

• Changed: The Test Consumers page now shows each consumer as a compact labeled identity table (Name, SSN, Address, DOB, Phone, Notes) with their KBA Answers in a show/hide panel directly below — replacing the single summary table and the separate "KBA Answers by Test Consumer" section. Consumers without KBA question sets link to their Special Test Cases entry instead.
• Changed: Age/astrological-sign tip clarified — these KBA questions are not documented in the KBA Answers panels and must be calculated from the Test Consumer's DOB.

2026-07-07 - Documentation Accuracy Audit (Docs vs Services)​

Full audit of the documentation against the intellirent-services codebase. Corrections below describe existing service behavior — no API/SDK behavior changed.

SDK Documentation​

• Changed: TypeDoc reference regenerated from current SDK source (v0.9.0). The generation pipeline was repointed at the correct repository and now outputs directly into the served docs tree; the reference now covers all public callback/result types (VerificationResult, ScreeningResult, PaymentResult, ReportSharedEvent, ReportRevokedEvent, SdkWarning, ScreeningOptions, ReportOptions, UserContext, UnitAddress, and more). Removed the stale ApplicationResult page and stale flat MountOptions properties (prefill, unitAddress, screeningId).
• Changed: Theming defaults corrected to the current design system: primary #1E293B (was documented as #17ADBC), textSecondary #667A81, background #FFFFFF, success #137B40, buttonBorderRadius default 8, cardBorderRadius default 5.
• Added: link, linkHover, linkActive theme color options.
• Added: Stable SDK error codes documented (Intellirent.SdkErrorCode): VALIDATION_INVALID_FORMAT, INVALID_PUBLISHABLE_KEY, and PAYMENT_REQUIRED (402 — always recoverable: false), plus runtime codes (TOKEN_EXCHANGE_FAILED, IFRAME_LOAD_FAILED, …). Removed fictional example codes (NETWORK_ERROR, VALIDATION_ERROR).
• Fixed: screeningId on result objects documented as always the empty string "" (the real identifier is never sent); use id instead. id is optional-typed.

REST API Documentation (OpenAPI)​

• Fixed: addAgent / addOrganization 200 response schemas — the payload is the Experian passive-user response passed through (KBA/OTP challenge or registration result), not {agentId} / {organizationId}.
• Fixed: Auth-status and re-auth-questions 200 schemas — payloads are Experian responses passed through, not {isAuthenticated, requiresReauth} / {questions} shapes.
• Fixed: unitAddress on link/share endpoints documented as not server-enforced (strongly recommended); documented legacy zipCode/propertyZip zip-only forms.
• Changed: OTP submission field labeled with canonical key code (otp accepted as alias) across all OTP endpoints.
• Added: Reachable status codes documented: 402/code 285 (prepaid balance exhausted) on consumer report retrieval; 409/292, 423/300, 503/123 on registration; common-error-code tables (121, 123, 130, 131, 138, 278, 285, 292, 293, 300, 324, 341) in each spec.
• Added: GET /agents/{agentId}/auth/token-status and GET /organizations/{organizationId}/auth/token-status — non-destructive token expiry checks returning {expired, expirationDate}.
• Added: Registration bodies now document jscPayload, ipAddress, hdimPayload for agents and organizations.
• Fixed: API-key failures documented as 403 with errorCode 324 ("Invalid client secret."); documented the non-envelope error bodies on report content negotiation (406, JSON-forbidden 403, invalid exclude* 400).

Guides & Resources​

• Added: error-codes.md — new sections for the current REST numeric codes and the SDK/platform string codes (including SCREENING_REPORT_EXPIRED 410, PAYMENT_REQUIRED 402, ACCOUNT_NOT_LIVE 409), with a note on how report expiration differs by surface.
• Fixed: security.md — rate limiting corrected to 60 requests/minute per publishable key (429 + Retry-After); iframe origin corrected to embedded.ir.app; lockout described as Experian-driven (423/300 with unblock time); report-sharing endpoints corrected (POST /reports/{id}/consent-to-share, POST /reports/{id}/revoke-sharing for the SDK path).
• Fixed: Stale KBA request format (answers: [1, 3, ...] with authSession) replaced with kbaAnswers: [{answer}] in architecture.md and troubleshooting.md.
• Fixed: getting-started.mdx — auth-failure example (403/324, not 401/7001), consumer KBA endpoint (/renters/{renterId}/kba), report expiry example honors the 30-day window, common-error table rebuilt from live codes, registration response documented as Experian pass-through.
• Fixed: troubleshooting.md — nonexistent test consumer "Janet Ruth Rowe" replaced with Samuel Bullock (frozen file); report-expired statuses corrected (REST 400/138, SDK 410); added a Payment Required (402) troubleshooting entry.
• Added: test-consumers.md — Rent Bureau report outcomes for the seven registry personas (security freeze, service-error, and collection-data scenarios).

2026-06-17 - Correct onScreeningSuccess vs onVerificationSuccess Documentation​

SDK Documentation​

• Fixed: Step 3 (Screen a Consumer) and Step 4 (View Reports) now correctly use onScreeningSuccess — not onVerificationSuccess — to capture the report ID. onScreeningSuccess is the terminal event that fires when the entire flow completes (after payment for CONSUMER); onVerificationSuccess is an intermediate event that fires when the identity verification step passes.
• Fixed: sdk-methods.md now clearly distinguishes the two callbacks: onVerificationSuccess fires at the identity verification step and returns liveKey/testKey for END_USER enrollment; onScreeningSuccess fires when the full flow is done and is the correct place to capture result.id for mounting the report view.
• Fixed: VerificationResult.id description no longer instructs CONSUMER integrators to store it for the report view — onScreeningSuccess.id is the correct source for that.
• Fixed: ApplicationResult migration note updated to point to onScreeningSuccess as the equivalent terminal callback (not onVerificationSuccess).
• Added: onScreeningSuccess property added to MountOptions reference page.
• Added: ScreeningResult interface reference page.
• Note: onVerificationSuccess remains correct for END_USER enrollment flows (it is the only callback that returns liveKey/testKey).

2026-06-10 - Remove productId from SDK Documentation​

SDK Documentation​

• Removed: ScreeningOptions.productId temporarily removed from all documentation — getting started guide, sdk-methods.md, and MountOptions reference. Documentation will be restored when the feature is production-ready.

2026-06-10 - Getting Started Revamp and screeningId Deprecation (IDT-795)​

SDK Documentation​

• Changed: Getting Started restructured from a single long page into four focused child pages: Step 1 (Dashboard), Step 2 (Enroll End User), Step 3 (Screen Consumer), Step 4 (View Reports). Each step includes expanded guidance, key callouts, and cross-links to reference pages.
• Added: Step 2 documents the distinction between TSP publishable keys and end-user publishable keys, with a warning that the TSP key cannot be used for consumer screenings.
• Added: Steps 2 and 3 include callouts that pk_test_* keys require test consumers — real PII is rejected in test mode.
• Added: Step 3 explicitly advises storing result.id from onVerificationSuccess — this UUID is required to mount the report view later.
• Added: Step 4 documents report visibility scoping by user type and publishable key, and the user_id authorization requirement.
• Deprecated: screeningId on VerificationResult, VerificationFailure, and ScreeningResult — use id instead. screeningId is an internal alias retained for backwards compatibility.
• Deprecated: MountOptions.screeningId — use report.id ({ report: { id: '...' } }) instead.
• Changed: All guide examples updated to use result.id in place of result.screeningId.

2026-06-05 - SDK Report Share/Revoke Callbacks​

SDK v0.6.11​

• Added: onReportShared callback on MountOptions — fires when the consumer consents to share their screening report. Payload: ReportSharedEvent (reportId: string, sharedAt: string ISO 8601).
• Added: onReportRevoked callback on MountOptions — fires when the consumer revokes sharing. Payload: ReportRevokedEvent (reportId: string, revokedAt: string ISO 8601).
• Added: ReportSharedEvent and ReportRevokedEvent interface reference pages.

2026-06-04 - SDK productId Option for Report Bundles (IDT-736)​

SDK v0.6.10​

• Added: productId field to ScreeningOptions — pass screening.productId when mounting view='screening' to select an Experian report bundle for that session. Valid values: 71 (full bundle + RentBureau), 72 (Credit + RentBureau), 73 (Credit + background, no RentBureau), 74 (Credit only). When omitted, the account-level default configured in the dashboard is used.
• Added: report (ReportOptions) and screening (ScreeningOptions, including productId) property documentation to the MountOptions reference page.

2026-06-01 - Re-Authentication Documentation (IDT-717)​

Enriched the agent and organization re-authentication endpoints, reconciled against the eis-micronaut implementation (source of truth). All re-auth Experian paths were validated as correct — no behavior changes, documentation only.

IRO End User API (Agents)​

• Added: authSession sequencing precondition — auth/kba and auth/otp now document that POST /agents/{agentId}/auth must be called first to establish the session, and return 400 (errorCode 138, errorOnField: authSession) otherwise.
• Added: Required-field guidance on POST /agents/{agentId}/auth — only jscPayload and ipAddress are used (dedicated AuthRequest body, not the full registration DTO); both are forwarded to Experian, and omitting them can trigger Experian error 103. Added a request example.
• Fixed: Submit OTP re-auth body documented with code as the canonical field (otp still accepted as an alias).
• Added: 400 responses (missing consumerToken) on initiate, expire, status, and OTP-resend re-auth endpoints.

PMC End User API (Organizations)​

• Added: authSession sequencing precondition — GET /organizations/{organizationId}/auth must be called before POST /organizations/{organizationId}/auth/kba, which returns 400 (errorCode 138, errorOnField: authSession) otherwise.
• Added: Clarified organizations re-authenticate via KBA only (no OTP path).
• Added: 400 responses (missing consumerToken) on initiate, expire, status, and KBA re-auth endpoints.

2026-05-29 - API Documentation Accuracy Pass​

Reconciled the REST API documentation against the eis-micronaut and stripe-micronaut implementations (source of truth). The changes below correct request/response schemas, query parameters, and status codes, and document previously-missing endpoints.

Consumer API​

• Fixed: KBA submission body corrected — answers are sent as kbaAnswers: [{ answer: <integer> }], not answers: [{ questionId, answerId }].
• Fixed: Report query parameters renamed to excludeBackground and excludeHousingCourt (previously documented as exclude-background / exclude-housingCourt).
• Added: format, contentType, productId, and testConsumerToken query parameters on the renter report endpoint.
• Changed: Report endpoint documented as content-negotiated (application/json or text/html) — JSON is the default for Intellirent first-party clients, HTML for partner clients. Added 406 Not Acceptable for unsupported formats.
• Fixed: Report-expiry response payload corrected to { tokenExpiration } (previously { expiryDate, expiresInSeconds }).
• Fixed: Expired-report access returns 400 Bad Request, not 410 Gone.
• Fixed: Incorrect OTP/KBA answers return 422 Unprocessable Entity (previously documented as 400); repeated failures return 423 Locked.
• Changed: Path identifiers documented as string (previously inconsistently integer).
• Added: Documented the Intellirent response envelope (payload + errors[] with errorCode/errorOnField/errorMessage); otp may also be submitted as code.

IRO End User API (Agents)​

• Added: Initial registration authentication endpoints — POST /agents/{agentId}/otp, GET /agents/{agentId}/otp/resend, and POST /agents/{agentId}/kba (distinct from the /auth/ re-authentication endpoints).
• Added: GET /agents/{agentId}/renters/{renterId}/credit-score (returns { creditScore }; legacy renter-first path documented as an alias).
• Fixed: Initiate Re-Authentication body corrected to { jscPayload, ipAddress } (previously { firstName, lastName, phoneNumber }).
• Fixed: Re-auth KBA submission body corrected to kbaAnswers: [{ answer }].
• Fixed: Link endpoint 400 error example uses the real envelope (errorCode/errorOnField/errorMessage).
• Changed: Report endpoint documented as content-negotiated with format/contentType params and corrected excludeBackground/excludeHousingCourt names; expired access returns 400 not 410; 406 added.
• Changed: Incorrect OTP/KBA returns 422; path identifiers documented as string.
• Added: Documented legacy aliases (renter-first share path, /report-suffixed report path) and the Intellirent response envelope.

PMC End User API (Organizations)​

• Fixed: Add Organization body corrected — registration uses the contact person's passive-user payload (firstName, lastName, email, phoneNumber, address fields, companyName for the business name, optional productId); there is no name/taxId/address object.
• Added: Initial registration endpoints — POST /organizations/{organizationId}/kba and PUT /organizations/{organizationId}?token=... (Add Organization with Token).
• Added: GET /organizations/{organizationId}/renters/{renterId}/credit-score (returns { creditScore }; legacy renter-first path documented as an alias).
• Fixed: Re-auth KBA submission body corrected to kbaAnswers: [{ answer }].
• Fixed: Link endpoint 400 error example uses the real envelope (errorCode/errorOnField/errorMessage).
• Changed: Report endpoint documented as content-negotiated with format/contentType params and corrected excludeBackground/excludeHousingCourt names; expired access returns 400 not 410; 406 added.
• Changed: Incorrect KBA returns 422; path identifiers documented as string.
• Added: Documented legacy aliases and the Intellirent response envelope.

Stripe Integration API​

• Added: Optional request fields documented — propertyAddress, customerEmail, customerUserIdTsp, consumerIdTsp, consumerEmail, customerRoleTsp, and reportFlags.
• Fixed: Error envelope corrected to errorCode/errorOnField/errorMessage (previously code/field/message); success response documents the errors: [] field.

Documentation Site​

• Fixed: Getting Started guide — renter registration example uses the real flat field names (currentAddress, dob as MMDDYYYY, ipAddress, jscPayload, hdimPayload); KBA example uses kbaAnswers: [{ answer }]; KBA failure documented as 422/423; added report content-negotiation (?format=json) guidance.
• Fixed: Troubleshooting guide — report exclusion examples use excludeBackground / excludeHousingCourt.

Note: The low-level Experian proxy endpoints (/access-token, /refresh-token, /passive-user, /report, /report-archive, /share, /share/get) remain intentionally undocumented as internal/advanced surface.

2026-05-18 - SDK v0.6.2​

Embedded SDK​

• Removed: Top-level screeningId mount option — replaced by report: { id }. Update any sdk.mount() call that passed screeningId: "..." to use report: { id: "..." } instead.
• Changed: Top-level prefill and unitAddress mount options replaced by the screening namespace. Pass as screening: { prefill, unitAddress, applicationFee } and report config as report: { id }.
• Added: ScreeningOptions type documented — { prefill?: ScreeningPrefillData; unitAddress?: UnitAddress; applicationFee?: number; }.
• Added: ReportOptions type documented — { id: string }.
• Changed: VerificationResult now includes userType: 'CONSUMER' | 'END_USER' | 'TSP'. Update any onVerificationSuccess handler to access result.userType.
• Added: onScreeningSuccess(result: ScreeningResult) callback documented — fires when a screening is fully completed.
• Added: onPaymentSuccess(result: PaymentResult) callback documented — fires when a payment step completes.
• Added: ScreeningResult type documented — { screeningId: string; userType: SdkUserType; id?: string }.
• Added: PaymentResult type documented — { transactionId: string; amount: number }.
• Changed: All screening-prefill examples updated to use the new screening.prefill nested structure.
• Fixed: IframeInstance.id corrected to readonly id: string.
• Fixed: PaymentResult.amount documented as cents, not dollars.
• Fixed: All Intellirent.init() examples in lifecycle.md and screening-prefill.md updated to include required userContext.
• Changed: Theming documentation rewritten — theme is configured exclusively through the TSP dashboard UI, not via Intellirent.init(). Removed the stale theme init-time config example and Validation section. Added primaryLight, primaryDark, secondaryLight, secondaryDark color fields and 'Open Sans' to the allowed fonts list.

2026-05-18 - SDK v0.6.1​

Embedded SDK​

• Added: screening.applicationFee mount option — override the default TSP account application fee on a per-session basis. Accepts a positive integer in cents (1–1,000,000; e.g., 3500 = $35.00). Invalid values cause a fatal SDK error before mounting.

2026-05-15 - Diagram Support​

Documentation Site​

• Added: Mermaid diagram support across all documentation pages — use fenced ```mermaid ``` blocks in any .md or .mdx file
• Added: Expand button on diagrams (appears on hover) opens a fullscreen modal view
• Added: Zoom in / out / reset controls within the expanded modal

2026-05-14 - SDK v0.5.0​

Embedded SDK​

• Changed: SdkConfig.userContext is now required. Previously marked optional for backwards compatibility, the SDK now enforces that userContext must be provided on every Intellirent.init() call.

2026-05-13 - SDK v2.2 Documentation​

Embedded SDK​

• Changed: VerificationResult shape updated — publishableKey field replaced by liveKey?: string and testKey?: string (plus new id?: string). Update any onVerificationSuccess handler that reads result.publishableKey to use result.liveKey and/or result.testKey instead.
• Removed: onSubmit callback and ApplicationResult type — these no longer exist in the SDK. The equivalent success signal is onVerificationSuccess with a VerificationResult payload.
• Added: onVerificationSuccess(result: VerificationResult) and onVerificationFailure(failure: VerificationFailure) documented in SDK Methods with full type signatures and usage examples.
• Added: onWarning, onChange, onStepStart, onStepComplete callbacks fully documented in SDK Methods.
• Added: prefill mount option documented in SDK Methods.
• Added: displayName? and email? optional fields documented on UserContext.
• Removed: environment config option removed from Intellirent.init() documentation — environment is auto-detected from the publishable key prefix and cannot be overridden.
• Fixed: SdkError.recoverable corrected to optional (recoverable?: boolean).
• Fixed: component_loaded, component_ready, component_error, component_destroyed lifecycle events added to Lifecycle Events reference table and payload documentation.

Documentation Site​

• Added: New Best Practices guide covering live vs test publishable key usage and stable userId / authentication requirements.

2026-05-13 - SDK v0.4.0 — UUID Session IDs​

Embedded SDK​

• Changed: Report endpoints now require a UUID session ID instead of the deterministic hash. The screeningId value returned in VerificationResult and VerificationFailure is now a UUID (e.g., 550e8400-e29b-41d4-a716-446655440000). Update any code that stored or passed the old con_ / agt_ / org_-prefixed hash — use the UUID value instead.
• Changed: MountOptions.screeningId now expects a UUID. Pass result.screeningId from VerificationResult when mounting the report view.

2026-04-30 - SDK v0.3.0 — Verification Keys​

Embedded SDK​

• Changed: VerificationResult interface updated — publishableKey has been replaced by two separate fields: liveKey and testKey. Any onVerificationSuccess handler that reads publishableKey must be updated to use liveKey and/or testKey instead.
• Added: End user enrollment now always generates and returns both a live and a test publishable key. Previously, only one key was issued based on the deployment environment.

2026-03-30 - SDK Mount Options & User Context Updates​

Embedded SDK​

• Changed: userType removed from MountOptions — user type is now set via userContext on SdkConfig at initialization
• Changed: environment and embeddedUrl removed from SdkConfig (environment is auto-detected from the publishable key)
• Added: prefill option on MountOptions for pre-filling screening form fields (personal information, address, and business fields)
• Added: unitAddress option on MountOptions for providing the rental property address (required for CONSUMER screening)
• Added: onWarning callback on MountOptions for non-fatal warnings (e.g., invalid prefill fields)
• Added: onStepStart and onStepComplete callbacks on MountOptions for tracking wizard step progress
• Added: onVerificationSuccess and onVerificationFailure callbacks on MountOptions for verification flow results
• Added: dashboard view option on MountOptions
• Added: New interfaces: SdkWarning, VerificationResult, VerificationFailure
• Added: Component lifecycle events: component_loaded, component_ready, component_error, component_destroyed with corresponding payload interfaces

2026-03-28 - Unit Address Requirement​

IRO End User API​

• Changed: unitAddress is now a required field when linking a renter to an agent
• Added: 400 error response with body schema for missing or invalid unit address on the link endpoint

PMC End User API​

• Changed: unitAddress is now a required field when linking a renter to an organization
• Added: 400 error response with body schema for missing or invalid unit address on the link endpoint

2026-03-27 - API Reference Refresh​

Stripe Integration API​

• Added: New Stripe Integration API section with full endpoint documentation for checkout session creation and webhook handling

Consumer API​

• Added: exclude-background and exclude-housingCourt query parameters on the report retrieval endpoint
• Added: Additional optional fields (middleName, companyName, mothersMaidenName, spouseName, propertyZip) to the Add Renter request schema
• Changed: Add Renter endpoint path now includes {renterId} path parameter
• Changed: Report endpoint response documented as text/html
• Fixed: Resend OTP endpoint method corrected to GET
• Fixed: Report expiry endpoint path corrected to /report-expiry

IRO End User API​

• Added: exclude-background and exclude-housingCourt query parameters on the report retrieval endpoint
• Added: unitAddress request body on the Link Renter to Agent endpoint
• Added: Additional optional fields to the Add Agent request schema
• Changed: Add Agent endpoint path now includes {agentId} path parameter
• Changed: Link Renter to Agent endpoint method updated to PUT
• Changed: Report endpoint response documented as text/html
• Removed: Delete Agent endpoint (not available)

PMC End User API​

• Added: exclude-background and exclude-housingCourt query parameters on the report retrieval endpoint
• Added: unitAddress request body on the Link Renter to Organization endpoint
• Added: Additional optional fields to the Add Organization request schema
• Changed: Add Organization endpoint path now includes {organizationId} path parameter
• Changed: Link Renter to Organization endpoint method updated to PUT
• Changed: Report endpoint response documented as text/html
• Removed: Delete Organization endpoint (not available)

2026-03-11 - Resources Section​

Documentation Site​

• Added: New top-level Resources navigation section, accessible from the main navbar between SDK Documentation and Changelog
• Changed: Error Codes and Test Consumers moved from the API Documentation section to the universal Resources section, making them accessible to both API and SDK integrators
• Fixed: Error code 2802 stated expiration period of reports from 60 days to 30 days.

2026-03-09 - Integration Guide Expansion (IDT-144)​

Documentation Site​

• Added: Architecture Overview — system component diagram showing how the Embedded SDK, REST API, API Gateway, and backend services connect
• Added: Security Best Practices — authentication patterns, key management, and API security guidelines
• Added: Troubleshooting guide — common integration issues with causes and resolutions, including KBA lockout prevention and authentication session management
• Changed: SDK Quickstart expanded with additional integration examples and clarifications
• Changed: Test Consumers updated with OTP trigger instructions and ITIN test consumer callouts
• Fixed: userContext required status corrected in documentation
• Fixed: KBA answer format corrected in SDK Quickstart examples
• Removed: Internal backend and Experian integration implementation details from Architecture and Troubleshooting pages

2026-02-06 - Initial Release​

Documentation Site​

• Added: Interactive API reference for Consumer API, IRO End User API, and PMC End User API
• Added: Getting Started guide with authentication instructions
• Added: Error codes reference
• Added: Test consumers reference
• Added: Full-text search across all documentation

Consumer API​

• Added: Complete API specification with all endpoints documented
• Added: Request/response examples for every endpoint

IRO End User API​

• Added: Complete API specification with all endpoints documented
• Added: Request/response examples for every endpoint

PMC End User API​

• Added: Complete API specification with all endpoints documented
• Added: Request/response examples for every endpoint

Changelog Format​

Each entry uses these tags:

• Added: New features or endpoints
• Changed: Changes in existing functionality
• Deprecated: Soon-to-be removed features
• Removed: Removed features
• Fixed: Bug fixes
• Security: Security improvements