# 19 January 2026 (v2.149) URL: /release-notes/2149.html **Production** ✅ `Purse Identity v2.149` brings a few new features: - [Multiple Hosted Pages configurations](#release-highlight) - [Exclude certain Management clients from Account Synchronization](#exclude-certain-management-clients-from-account-synchronization) - [Mandatory Redirect URL and URL lifetime for message templates](#mandatory-redirect-url-and-url-lifetime-for-message-templates) We also made some [general improvements](#general-improvements) for you. ## Release highlight Multiple Hosted Pages configurations You can now add multiple Hosted Pages sets to support different use cases for your setup for things such as separate pages for different applications or environments (e.g., development, staging, production). ![hosted pages actions](../docs/_images/hosted-pages/hosted-pages-actions.jpg) 1. Edit the desired Hosted Pages set by clicking the pencil icon. 2. Delete a Hosted Pages set by clicking the trash icon. 3. Duplicate a Hosted Pages set by clicking the copy icon. 4. Set a Hosted Pages set as the default by clicking the star icon. 5. Create a new Hosted Pages set by clicking the **New configuration** button. For full details, see [Hosted Pages](../docs/hosted-pages.html). * * * ## Exclude certain Management clients from Account Synchronization You can now exclude specific Management clients from the Account Synchronization profile sharing process. This allows for greater control over which clients are synchronized, helping to optimize performance and reduce unnecessary data processing. ![exclude management clients](../docs/_images/ice/exclude-management-clients.jpg) For more details on this topic, see [Account Synchronization](../docs/global-consumers/account-synchronization.html). * * * ## Mandatory Redirect URL and URL lifetime for message templates In order to ensure your email and SMS templates are ready for production use, the redirect URL and URL lifetime fields are now mandatory for message templates. This feature enhances security by ensuring that all links within your messages are valid and time-bound. For more details on this topic, see [Email templates](../docs/email-templates.html) and [SMS templates](../docs/sms-templates.html) respectively. * * * ## General improvements - We now display the URL lifetime in seconds where applicable in relevant templates in the Purse Identity Console, providing clearer information on link validity. --- # 29 January 2026 (v2.150) URL: /release-notes/2150.html **Production** ✅ `Purse Identity v2.150` brings a few new features: - [Hosted Pages Profile Management](#release-highlight) - [Customise Hosted Pages look and feel](#customise-hosted-pages-look-and-feel) - [Search for users by Synchronization ID](#search-for-users-by-synchronization-id) - [New hashing algorithm](#new-hashing-algorithm) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Release highlight Hosted Pages Profile Management You can now fully customise the profile management experience on your Hosted Pages by directly integrating UI SDK widgets from the Purse Identity Console. ![2150 hosted pages profile management](_images/2150_hosted-pages-profile-management.jpg) This feature gives you granular control over what your users see and do: - **Widget selection**: Choose exactly which widgets you want to use in your Hosted Pages. - **Controlled configuration**: Assign user-friendly titles and pass standard UI SDK configuration objects via JSON to tailor widget behavior. - **Custom styling**: Apply custom CSS specific to these widgets to match your brand identity. For full details, see [Hosted Pages: Profile Management](../docs/hosted-pages.html#profile-management-hp). * * * ## Customise Hosted Pages look and feel You can now customise the look and feel of all of your [Hosted Pages](../docs/hosted-pages.html). To do so: 1. In the Purse Identity Console, go to **Settings**  **Hosted Pages**. 2. Go to your desired Hosted Page. 3. Add any desired custom styles in standard CSS format. ![hosted pages custom css](../docs/_images/hosted-pages/hosted-pages-custom-css.jpg) For guidelines on safe selectors and common pitfalls (for example, rules that hide password or phone number field borders), see [Hosted Pages: Custom styles](../docs/hosted-pages.html#custom-styles-for-hosted-pages). * * * ## Search for users by Synchronization ID It was already possible to search for users by Synchronization ID in with the [`GET /users` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/searchUsers), but now you can also do this from the Purse Identity Console. ![2150 search sync id](_images/2150_search-sync-id.jpg) What is a Synchronization ID? 🤔 A system-generated unique identifier assigned to a user profile during the Account Synchronization process, used to consistently identify and correlate the same user across source and target Purse Identity accounts independently of their standard Purse Identity user IDs. See [Account synchronization process](../docs/global-consumers/account-synchronization.html) for more details. * * * ## New hashing algorithm In order to further support you, we have added an additional hashing algorithm to our supported list for importing passwords, `scrypt`. For more details, see [Import user passwords](../docs/import-passwords-from-the-console.html). * * * ## General improvements - We now explicitly ensure that values added to the **Reply to** field when configuring [SMTP email settings](../docs/emails.html#smtp-providers) are valid email addresses. - We no longer return the `isTrusted` field in the [Trusted Devices model](../docs/models-trusted-devices.html). - We now ensure the `user_id` is properly valued when there is a `post_event_failure` [user event](../docs/models-user-events.html). ## Fixes ##### In some limited cases, some user emails in SCIM mappings weren’t synchronizing correctly. ✓ ##### The updated\_at field was temporarily not being set correctly when some actions around suspending and unblocking a user were performed. ✓ ##### Creating a Lite profile when using the Account Synchronization feature sometimes did not sync/create the profile on the target account as expected. ✓ --- # 12 February 2026 (v2.151) URL: /release-notes/2151.html **Production** ✅ `Purse Identity v2.151` brings a few new features: - [Configurable retry policy for webhooks](#configurable-retry-policy-for-webhooks) - [Allowed identifiers in Hosted Pages and UI SDK](#allowed-identifiers-in-hosted-pages-and-ui-sdk) As always, we [fixed](#fixes) a few items for you. ## Configurable retry policy for webhooks We are happy to introduce an update to our webhook system that allows you to configure the retry policy for failed webhook deliveries. This means that if a webhook fails to deliver to your endpoint, you can now specify how many times it should retry and the interval between retries. This gives you more control over how webhooks are handled. Previously, when a webhook failed to deliver, a set number of retries would be attempted with a fixed interval. ![console retry policy section](../docs/_images/webhooks/console_retry-policy-section.jpg) To configure the retry policy for a webhook: 1. Go to **Settings**  **Webhooks**  **Pre/Post-event webhooks** in your Purse Identity Console. 2. Select your desired webhook. 3. Under **Retry Policy**: 1. Set the **Base delay between retries** (in seconds). This is the initial delay before the first retry attempt. The next retry attempts will have an exponentially increasing delay based on this base delay. 2. Set the number of **Max retries** (`0` to `3`). 3. Set the **Timeout** (in seconds) for each retry attempt. This is the maximum number of seconds to wait for a response from your endpoint before considering the attempt a failure and moving on to the next retry. 4. Optionally, click **Proceed anyway if the webhook fails** to allow the webhook to be marked as successful even if all retry attempts fail. For more on this topic, see [User-event webhooks](../docs/webhooks.html). * * * ## Allowed identifiers in Hosted Pages and UI SDK [Hosted Pages](../docs/hosted-pages.html) and the [UI SDK](../sdk-ui/index.html) now automatically reflect the Allowed identifiers defined in your project settings for users that login with password. This allows you to customize the login experience for your users and only show the login options that are available to them. Supported identifiers: - **Email** - **Phone Number** - **Custom identifier** See [Specify allowed identifiers](../docs/block-unverified-logins.html#specify-allowed-identifiers) for setup instructions. * * * ## Fixes ##### There was a small issue when searching for users when filtering with IN and OR operators. ✓ ##### In some limited instances, updating a custom field did not return the expected custom field in the response. ✓ ##### Purse Identity Console ##### There was temporarily a problem with displaying user events in a user’s Recent activity feed. ✓ --- # 26 February 2026 (v2.152) URL: /release-notes/2152.html **Production** ✅ `Purse Identity v2.152` brings a few new features: - [Pushed Authorization Request (PAR) endpoint](#pushed-authorization-request-par-endpoint) - [Start token exchange flow from the frontend](#start-token-exchange-flow-from-the-frontend) - [Use JavaScript directly in Hosted Pages](#use-javascript-directly-in-hosted-pages) - [Account Synchronization updates](#account-synchronization-updates) As always, we made some [general improvements](#general-improvements) for you. ## Pushed Authorization Request (PAR) endpoint We have added the Pushed Authorization Request (PAR) `/oauth/par` endpoint, which lets clients push the authorization request parameters directly to the authorization server, improving security and efficiency in the authorization process. ### Key advantages - Prevents sensitive parameters from being exposed in query strings. - Eliminates issues caused by excessively long URLs (especially when using PKCE). - Allows a backend to prepare and validate the authorization request before redirecting the user. - Improves security and integrity of the authorization flow. ### How it works 1. The client sends a `POST` request to `/oauth/par` endpoint > Because this is a direct server-to-server call, confidential clients must authenticate (e.g., by including their `client_secret`). 2. The server validates and stores the request. 3. The server returns `request_uri` 4. The client then redirects the user to `/oauth/authorize` with the `request_uri` as a query parameter. ```sh /oauth/authorize?client_id=&request_uri=... ``` For more details, see the [`/oauth/par` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/pushedAuthorize). * * * ## Start token exchange flow from the frontend You can now start the token exchange flow directly from the frontend by calling [/oauth/authorize](https://docs.identity.purse.eu/openapi/identity.html#operation/authorizeUser) with the query parameter `provider=custom_provider:`. You must ensure that the [**Allow token exchange from trusted external provider**](../docs/clients.html#set-up-a-client) setting is enabled for your desired First-party Identity client in the Purse Identity Console. This flow is ideal for public clients, such as single-page applications (SPAs), that cannot securely store a `client_secret`. By initiating the token exchange from the frontend, you can directly interact with the authorization server without needing an intermediate backend step, while still maintaining security best practices. ![auth with par flow fe](../docs/_images/authentication/auth-with-par-flow-fe.png) For more details on how to implement this flow, see [Set up a client](../docs/clients.html#set-up-a-client) and [Trusted providers](../docs/trusted-providers.html) respectively. * * * ## Use JavaScript directly in Hosted Pages You can now use JavaScript directly in your Hosted Pages, allowing you to create more dynamic and interactive user experiences. This includes the ability to add custom scripts for enhanced functionality, such as form validation, dynamic content updates, and integration with third-party services. Leverage available callback events to trigger your JavaScript code at specific points in the user journey. The available events are `OnError`, `OnReady`, and `OnSuccess`, which provide flexibility in how and when your scripts are executed. For more details, see [Hosted Pages: Custom scripts](../docs/hosted-pages.html#custom-scripts-for-hosted-pages). To add custom JavaScript to your Hosted Page: 1. Go to your desired Hosted Page in the Purse Identity Console at **Settings**  **Hosted Pages**. 2. Scroll to Custom scripts on the page configuration screen. 3. Enter your JavaScript code in the **Custom scripts** area. ![2152 hostedPages customScripts](_images/2152_hostedPages-customScripts.jpg) 4. Don’t forget to **Save** your input. * * * ## Account Synchronization updates With this release, we made several improvements to our **Account Synchronization** feature. This includes: - [Expanded user event information for account synchronization events](#expanded-user-event-information-for-account-synchronization-events) - [Account Synchronization mapping improvements](#account-synchronization-mapping-improvements) ### Expanded user event information for account synchronization events We have expanded the depth of information provided for the account synchronization events: - `account_synchronization_error` - `account_synchronization_conflict` We did this to provide more context for these events, which help you troubleshoot and resolve synchronization issues more effectively. The additional information provides the specific conflict or synchronization [error](../docs/errors.html) encountered during the account synchronization process as well as source and target user IDs for easier identification. Possible errors: - `error.profile.identifiersNotVerified` - `error.profile.timestampOutdated` - `error.emailOrPhoneNumber.required` - `error.email.required` - `error.profile.tooManyMatching` For more on this topic, see [Account Synchronization events](../docs/global-consumers/account-synchronization.html#synchronization-events). ```json { "date": "2026-10-07T09:54:34.183123Z", "synchronization_id": "660e8400-e29b-41d4-a716-446655440000", "source_user_id": "550e8400-e29b-41d4-a716-446655440000", "type": "account_synchronization_error", "failed_sync_error": "error.profile.identifiersNotVerified", "failed_sync_message": "Can't synchronize because the identifier of the `target` profile isn't verified", (1) "target_user_id": ["250e8401-e29c-41d3-a726-146655440001"] } ``` - (1) `` is used in this example, but it can be caused by either the target or source not being verified. ```json { "date": "2026-10-07T09:54:34.183123Z", "synchronization_id": "660e8400-e29b-41d4-a716-446655440000", "source_user_id": "550e8400-e29b-41d4-a716-446655440000", "type": "account_synchronization_conflict", "failed_sync_error": "error.Profile.timestampOutdated", "failed_sync_message": "Can't synchronize because the target profile has already updated since synchronization attempt", "target_user_id": ["250e8401-e29c-41d3-a726-146655440001"] } ``` ### Account Synchronization mapping improvements For [Account Synchronization](../docs/global-consumers/account-synchronization.html), we now only consider consent **types** for mapping to be accepted or rejected, meaning as long as the type (such as opt-in or opt-out) match, the consent mapping is accepted. Additionally, for [custom fields](../docs/custom-fields.html) with the `SELECT` type, we ensure only keys are needed to map between accounts. * * * ## General improvements - In the case of confidential clients, we have disabled reCAPTCHA verification for the [`signup-token` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/signupToken), allowing a more streamlined integration during while maintaining security. --- # 12 March 2026 (v2.153) URL: /release-notes/2153.html **Production** ✅ `Purse Identity v2.153` brings a few new features: - [Attribute-Based Access Control](#attribute-based-access-control) - [R5 AI Assistant](#r5-ai-assistant) As always, we made some [general improvements](#general-improvements) for you. ## Attribute-Based Access Control We are excited to announce the release of Attribute-Based Access Control (ABAC) in Purse Identity. ABAC is a dynamic and context-aware access control model that evaluates policies at runtime using user profile attributes and authentication context to make fine-grained access decisions. Unlike Role-Based Access Control (RBAC) which relies on predefined roles, ABAC allows you to seamlessly control who can enter specific user journeys—such as `signup`, `login`, or application access. This securely lets you prevent unauthorized access early, enforce fine-grained eligibility rules before authentication completes, and maintain a highly scalable security design. For full details, see [Attribute-Based Access Control (ABAC)](../docs/security/attribute-based-access-control.html). ![abac flow](../docs/_images/security/abac/abac-flow.png) ![abac create rule](../docs/_images/security/abac/abac_create-rule.jpg) * * * ## R5 AI Assistant We have added a dedicated **R5 AI Assistant (Ask AI)** to our documentation site to help you find the information you need faster and more efficiently. This assistant is trained exclusively on our documentation, ensuring that the answers you receive are accurate and relevant to your needs. We appreciate any and all feedback which you can give directly in the assistant with a thumbs up, a thumbs down, and optional message. ![2153 r5 ai assistant quick view](_images/2153_r5-ai-assistant-quick-view.gif) * * * ## General improvements - We now ensure that if a field is unavailable because it has changed or has been removed, we let the user know directly in the Purse Identity Console for [account synchronization](../docs/global-consumers/account-synchronization.html) mapping. --- # 26 March 2026 (v2.154) URL: /release-notes/2154.html **Production** ✅ `Purse Identity v2.154` brings a few new features: - [MFA orchestrated flow](#mfa-orchestrated-flow) - [Naver Connecting Information (CI)](#naver-connecting-information-ci) - [Line Profile](#line-profile) - [UI SDK updates](#ui-sdk-updates) As always, we [fixed](#fixes) a few items for you. ## MFA orchestrated flow We have enhanced our SDK process for MFA orchestrated flows. To prevent users from being prematurely redirected due to typos, the SDKs now silently pre-validate the verification code under the hood. When your application triggers the MFA verification step, the SDK automatically checks the code via the API before attempting any redirects. This allows you to easily build a seamless user experience: - **Automatic Pre-validation:** The SDK ensures the code is correct before finalizing the passwordless verify redirection. - **Graceful Error Handling:** If a user submits an invalid code, the SDK returns the error directly to your UI, keeping the user on the current page. - **Built-in Attempt Limits:** Your UI can now easily catch and display inline errors for the first two attempts, and show a final lockout message on the third failed attempt, all without breaking the orchestrated flow. * * * ## Naver Connecting Information (CI) You can now retrieve the Naver Connecting Information (CI) for users who log in with [Naver](../docs/naver.html). This information is stored in the `provider_metadata` field in the user profile. Example ```json "provider_metadata": { "naver": { "naver_age_range": "30-39", "ci": "V2/abc123def456.." (1) } ``` - (1) **Connecting Information (CI)**: An encrypted string used to securely verify a user’s real-world identity. Your Naver Developer application must be explicitly approved for the CI scope to receive this data. * * * ## Line Profile You can now retrieve additional profile information from users who log in with [Line](../docs/line.html) including Line Profile by requesting the appropriate scopes. For Line Profile , the `openid` scope is required. Additionally, there are several new scopes required to retrieve the following new profile fields: **Format**: **Profile field** (`scope`) - **Given name pronunciation** (`real_name`) - **Middle name** (`real_name`) - **Family name** (`real_name`) - **Family name pronunciation** (`real_name`) - **Gender** (`gender`) - **Date of Birth** (`birthdate`) - **Phone Number** (`phone`) - **Address** (`address`) For full details, see [Line Connect](../docs/line.html). * * * ## UI SDK updates With our `1.42.0` UI SDK release, we support using both an email and a phone number at the same time as part of the authentication journey for your users. You can do this by passing an array in the `authType` field. When you pass an array, the widget parses the user input from a single text area: - If a phone number is detected, we initiate the passwordless flow with a `phone_number`. - Otherwise, we initiate the passwordless flow with an `email`. ```js client.showPasswordless({ container: 'passwordless-container', authType: ['sms', 'magic_link'], (1) ... }) ``` - (1) Passing both `sms` and `magic_link` as an array allows your users to enter either an email or a phone number in the same input field. See [showPasswordless.authType](../sdk-ui/showPasswordless.html#authType) for full details. ### Enable verification code You can now optionally pass the `enableVerificationCode` boolean as a property in `showPasswordless()`. This attribute allows you to explicitly control whether users can manually enter a 6-digit verification code in the widget, independently of the `authType` used. - If set to `true`: Verification code entry is enabled for both email and SMS. - If set to `false`: Verification code entry is disabled. The widget expects the user to authenticate by clicking a link, whether they use SMS or email. - If undefined: The widget defaults to its legacy behavior to prevent breaking changes (codes are only accepted for `sms`, and links are only expected for `magic_link`). ```js client.showPasswordless({ container: 'passwordless-container', authType: ['sms', 'magic_link'], enableVerificationCode: true, (1) ... }) ``` - (1) Explicitly allows the entry of a verification code in the UI, regardless of whether the user inputs an email or a phone number. See [showPasswordless.enableVerificationCode](../sdk-ui/showPasswordless.html#enableVerificationCode) for more details. * * * ## Fixes ##### We fixed several issues related to the Attribute-Based Access Control (ABAC) feature, including a few UI bugs in the Purse Identity Console and some issues with user error messages. ✓ --- # 09 April 2026 (v2.155) URL: /release-notes/2155.html **Production** ✅ `Purse Identity v2.155` brings a few new features and updates: - [Access Control (ABAC) updates](#access-control-abac-updates) - [Comprehensive endpoint protection](#comprehensive-endpoint-protection) - [Migrate to Access Control](#migrate-to-access-control) - [Access tier downgrade behavior (full to basic)](#access-tier-downgrade-behavior-full-to-basic) - [Improved account suspension logic](#improved-account-suspension-logic) - [`email_verified` event](#email-verified-event) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Access Control (ABAC) updates Our Attribute-Based Access Control (ABAC) feature is a dynamic and context-aware access control model that grants or denies user access to journeys based on attributes associated with users and their context. We have made several updates to Access Control in this release, including: - [Comprehensive endpoint protection](#comprehensive-endpoint-protection) - [Migrate to Access Control](#migrate-to-access-control) - [Access tier downgrade behavior (full to basic)](#access-tier-downgrade-behavior-full-to-basic) ### Comprehensive endpoint protection To ensure consistent security across all authentication methods, ABAC rules are now strictly enforced across all Identity API endpoints that handle registrations and logins. This guarantees that your access configurations cannot be bypassed by alternative authentication routes. ABAC is now fully applied to the following endpoints: - [signup](https://docs.identity.purse.eu/openapi/identity.html#operation/signup) - [signupToken](https://docs.identity.purse.eu/openapi/identity.html#operation/signupToken) - [loginWithPassword](https://docs.identity.purse.eu/openapi/identity.html#operation/loginWithPassword) - [verifyPasswordlessPost](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyPasswordlessPost) - [signupWithCredentials](https://docs.identity.purse.eu/openapi/identity.html#operation/signupWithCredentials) - [authenticateWithCredentials](https://docs.identity.purse.eu/openapi/identity.html#operation/authenticateWithCredentials) ### Migrate to Access Control If you were previously using the the legacy [Block unverified login attempts](../docs/block-unverified-logins.html) feature, you’ll see the option in the [Attribute-Based Access Control (ABAC)](../docs/security/attribute-based-access-control.html) section of the Purse Identity Console to automatically migrate your existing block on unverified logins configuration to an equivalent ABAC rule. Migration process: 1. Click **Switch to Access Control** in the ABAC section of the Purse Identity Console if prompted. ![Screenshot of the migration prompt in the console.](../docs/_images/security/abac/migration-prompt.png) 2. A dialog appears letting you know that your existing block on unverified logins configuration will be converted into an ABAC rule. It also informs you of API error format changes that are required if you were previously relying on the old error response for unverified logins. The error changes from `error.unverifiedLogin` to `error.accessControl.login.forbidden`. Click **Proceed** to migrate to Access Control. ![Screenshot of the migration dialog in the console.](../docs/_images/security/abac/migration-dialog.png) 3. And voila! Your existing configuration is now an ABAC rule, and you can further customize it as needed. ![Screenshot of the migrated ABAC rule in the console.](../docs/_images/security/abac/migrated-rule.png) ### Access tier downgrade behavior (full to basic) We have introduced new safeguards and UI behaviors for accounts that transition their ABAC access level from full to basic. To prevent unintended enforcement of legacy rules while on a basic tier, the following logic now applies automatically: - **Rules automatically disabled:** All existing ABAC rules are immediately set to **Disabled** upon transitioning to Basic access. - **Visibility to read-only:** Your previously created rules will remain safely stored and visible in the Purse Identity Console. - **Actions restricted:** While in Basic access mode, you can no longer edit existing rules, and the "Copy" functionality is disabled. - **Manual Deletion:** Brand and account owners retain full rights to manually delete any disabled rules to manage their workspace. For more details, see [Attribute-Based Access Control (ABAC)](../docs/security/attribute-based-access-control.html). * * * ## Improved account suspension logic We have adapted our account suspension algorithm to better handle use cases where a user has a second factor enabled. This enhancement prevents unnecessary account lockouts when a login attempt is successfully blocked by secondary authentication requirements like Multi-Factor Authentication (MFA) or Risk-Based Authentication (RBA). For more details on this topic, see [Risk-based Authentication](../docs/rba.html). * * * ## `email_verified` event The `email_verified` event is now emitted after any email verification, regardless of the verification method used. This ensures that the event is consistently triggered, providing better tracking and integration capabilities for applications relying on email verification status. Some examples of when the `email_verified` event is emitted include: - After a user resets a password - After a user registers MFA credentials - After a user receives a [Double opt-in consents](../docs/doi.html) - After a user completes a passwordless flow - After an admin updates the `email_verified` field of a user or bulk updates users - After a [pre-event webhook](../docs/webhooks.html) updates the `email_verified` field For more details, see [User Events](../docs/models-user-events.html). * * * ## General improvements - We made some accessibility improvements in the Hosted Pages area of the Purse Identity Console with better tooltips and screen reader labels. * * * ## Fixes ##### The user attributes in the response of a pre-event webhook weren’t being properly validated. Now, these attributes are properly validated and an appropriate error is provided in the API response. ✓ ##### Purse Identity Console ##### There was a small issue when enabling the Notify email update option in the Email update template. ✓ --- # 23 April 2026 (v2.156) URL: /release-notes/2156.html **Production** ✅ `Purse Identity v2.156` brings a few new features and updates: - [Import existing IDs into Purse Identity](#import-existing-ids-into-purse-identity) - [Lite merged into managed user event during token exchange](#lite-merged-into-managed-user-event-during-token-exchange) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Import existing IDs into Purse Identity We understand that many of our customers have existing user databases and identity management systems in place which may require IDs to be imported and maintained. To facilitate a smooth transition to Purse Identity, we have introduced a new feature that allows you to import your existing IDs directly into our platform. To import your existing IDs into Purse Identity, follow these steps: 1. In your Purse Identity Console, go to **Settings**  **Import definitions**. 2. Click **New definition**. 3. Under **Advanced**, check the box for **Use customer IDs from file**. When enabled, the IDs from the file are used to populate the `id` field for the Purse Identity user profile. ![Importing IDs from a file](_images/2156_import-ids-from-file.jpg "Importing IDs from a file") > All other steps for importing user profiles remain the same. You can find more details on this process at [Import job definition](../docs/imports.html). * * * ## Lite merged into managed user event during token exchange We now emit the `lite_merged_into_managed` user event when a lite account is merged into a managed account through token exchange, providing better visibility into account transitions and enabling more accurate tracking of user journeys. For more on this topic, see [`oauth/authorize` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/authorizeUser) and [`lite_merged_into_managed` user event](../docs/models-user-events.html#user-event-types) respectively. * * * ## General improvements - In order to make styling Hosted Pages more streamlined, you can now see the **Default styles** under the [Profile Management Hosted Page](../docs/hosted-pages.html#profile-management-hp) and [Third party consents Hosted Page](../docs/hosted-pages.html#hp-consents) directly under **Custom styles** allowing you to more easily copy and adjust styles to your needs. * * * ## Fixes ##### In some cases, the Origin field was not being valued as expected when authenticating via Social Login through the UI and Core SDKs. ✓ --- # 06 May 2026 (v2.157) URL: /release-notes/2157.html **Production** ✅ `Purse Identity v2.157` brings a few new features and updates: - [New audit logs for user profile discovery and access](#new-audit-logs-for-user-profile-discovery-and-access) - [Variant field user event](#variant-field-user-event) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## New audit logs for user profile discovery and access We now produce detailed audit logs whenever a user profile is viewed (`users:get`) or when a search is performed (`users:search`) within the Purse Identity Console. - **Individual views**: Records the profile ID accessed. - **Search & list views**: Records the IDs of all profiles displayed on the current page, including the filter criteria used. - **Continuous tracking**: A new log is generated for every page of results the user navigates through to ensure a complete record of data visibility. For more details, see [Audit logs](../docs/audit-logs.html). * * * ## Variant field user event We now provide the provider `variant` field in user events. This ensures that you’re able to see more clearly in the user event which provider variant was used. For more details on this topic, see [provider variants](../docs/trusted-providers.html#add-trusted-provider-variants) and [User events: `variant`](../docs/models-user-events.html#variant) respectively. * * * ## General improvements - We updated the default length for verification codes to **6**. * * * ## Fixes ##### There was a small issue when removing a social provider from a user profile. ✓ ##### Purse Identity Console ##### Temporarily, administrators were unable to see MFA credentials for a user from the Purse Identity Console. ✓ --- # 28 May 2026 (v2.158) URL: /release-notes/2158.html **Production** ✅ `Purse Identity v2.158` brings a few new features and updates: - [Set session cookie duration for users based on user platform](#set-session-cookie-duration-for-users-based-on-user-platform) - [Linking verified social identities](#linking-verified-social-identities) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Set session cookie duration for users based on user platform You can now set session cookie duration uniquely for mobile or desktop users visiting your site. - **Default settings** apply to all platforms unless explicitly configured in other platform sections. - **Desktop settings** apply to desktop or laptop devices. - **Mobile settings** apply to both native mobile applications as well as webviews or custom tabs on mobile. This flexibility lets you optimize the authentication experience for different devices. You can enforce stricter security requirements on desktops while reducing login fatigue for users on their personal mobile apps. To set the session cookie duration: 1. Go to **Settings**  **Security**  **SSO** in your Purse Identity Console. 2. Set the **Session lifetime** (in days) and **Require log in after** (in days) for your desired platform. 3. If setting a specific platform (like Mobile), toggle the platform to **Active**. Otherwise, the default settings are used. 4. Ensure you enter the **Allowed logout callback URLs** under **Global settings**. 5. Don’t forget to **Save** your input. ![session duration configuration](../docs/_images/console/security/session-duration-configuration.jpg) For more on this topic, see [SSO](../docs/sso.html). * * * ## Linking verified social identities When a user links a social identity containing an email address already verified by the social provider, their Purse Identity email status will now automatically update to "verified." This process also emits an `email_verified` user event for your tracking purposes. This streamlines the authentication flow by eliminating redundant verification steps. Users who have already verified their email with a trusted social provider will no longer face unnecessary friction, such as fallback OTP prompts, resulting in a smoother, faster login experience. For more on this topic, see [User event types](../docs/models-user-events.html#user-event-types) and [Social Login](../docs/social-login-overview.html) respectively. * * * ## General improvements - For [Kakao Connect](../docs/kakao-connect.html), you can now retrieve the `birth_day` and `birth_month` individually to ensure compliance or meet requirements where the birth year is not needed or allowed. * * * ## Fixes ##### There was a minor issue affecting those customers using the frontend token exchange flow. ✓ ##### Temporarily, there was an issue retrieving the birthdate for Google Connect users when the birth year was empty. ✓ --- # 11 June 2026 (v2.159) URL: /release-notes/2159.html **Production** ✅ `Purse Identity v2.159` brings a few new features and updates: - [Access Control v2](#release-highlight) - [Additional audit log actions for Pub/Sub hooks](#additional-audit-log-actions-for-pubsub-hooks) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Release highlight Access Control v2 We are excited to launch **Access Control v2**, which extends our Attribute-Based Access Control (ABAC) engine with a powerful new capability: **Access Token Entitlements**. While the ABAC engine initially focused on blocking or allowing entry to signup and login journeys, this upgrade empowers you to inject dynamic authorization attributes directly into user access tokens at runtime. This bridges the gap between authentication and downstream authorization, allowing your applications to make instant, context-aware access decisions without repetitive API lookups. With the introduction of Entitlements, the access token becomes a self-contained vehicle for fine-grained authorization. **What’s new?** - **Dynamic token enrichment:** Automatically populate a top-level `entitlements` claim array with custom authorization attributes (such as roles, classifications, or permissions) mapped from user profile data. - **Continuous evaluation:** Entitlements are evaluated globally whenever a new access token is generated or refreshed. This includes standard logins, passwordless flows, and third-party authentications. - **Dedicated audit trail:** Monitor and troubleshoot configurations effortlessly using the new, standalone `entitlement_provided` user event, which cleanly separates authorization tracking from standard authentication logs. **Immediate Benefits:** - **Zero extra API overhead:** Offload application-level access logic to the token itself. Your downstream services and APIs can inspect the token’s `entitlements` claim locally to grant rights, eliminating the need to query the Purse Identity Identity API post-login. - **Real-time security syncing:** Because entitlement rules are re-evaluated during token refresh, any modifications to a user’s profile attributes automatically update downstream when their token rotates, ensuring permissions are always accurate. For more details on this topic, see [Attribute-Based Access Control (ABAC)](../docs/security/attribute-based-access-control.html). * * * ## Additional audit log actions for Pub/Sub hooks The [`users:get` and `users:search`](2157.html#new-audit-logs-for-user-profile-discovery-and-access) actions are now included in the audit logs for Pub/Sub hooks, providing more comprehensive tracking of user profile access and search activities. ![Audit log actions for Pub/Sub hooks](_images/2159_audit-log-actions.jpg) Audit log actions for Pub/Sub hooks For more details, see [Audit logs: Create Pub/Sub hook from console](../docs/audit-logs.html#create-pubsub-hook-from-console). * * * ## General improvements - When a user authenticates with a second social provider, we now ensure that the existing `email` for the user is retained and not overwritten by the new provider’s email, which may be different. The new email is still kept as part of the [`identities`](../docs/models-user-profile.html#identities-object) and [`emails`](../docs/models-user-profile.html#emails-object) objects. - Provider [variants](../docs/models-user-events.html#variant) are now included in a user’s [recent activity](../docs/support/manage-profiles-from-console.html#recent-activity) so it’s more clearly visible which provider variant was used for each event. * * * ## Fixes ##### In some limited instances, logins with Paypal Connect were failing unexpectedly. ✓ ##### When using the /oauth/par endpoint, against non-existent profiles, the response was a 404. The response is now a 303 with a query parameter showing the error so the user is redirected accordingly and you can handle the error in your application. ✓ ##### There was temporarily an issue when sorting by email when searching for users via the Management API. ✓ --- # 25 June 2026 (v2.160) URL: /release-notes/2160.html **Production** ✅ `Purse Identity v2.160` brings a few new features and updates: - [Display richer details under user Recent Activity](#display-richer-details-under-user-recent-activity) - [Store birthdate without a year](#store-birthdate-without-a-year) - [Improved fields precedence logic for Managed and Lite profiles](#improved-fields-precedence-logic-for-managed-and-lite-profiles) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Display richer details under user Recent Activity In the Purse Identity Console, you can now see richer details under a user’s Recent Activity. This includes details such as the user’s IP address, the involved Purse Identity client, scope, and more. When creating or editing a [recent activity filter](../docs/support/recent-activity-filter.html), you can set the filter to show the full details by default if desired. For more details on this topic, see [Managing users from the Purse Identity Console](../docs/support/manage-profiles-from-console.html). To view more details on an individual event: 1. Go to **Analytics**  **Profiles**. 2. Click your desired user. 3. Go to the **Recent activity** tab. 4. On your desired event, click **Show more** to see the details. ![user recent activity showMore](../docs/_images/console/users/user-recent-activity-showMore.jpg) You can see details for all events by enabling the new **Show all details** toggle. 1. Go to **Analytics**  **Profiles**. 2. Click your desired user. 3. Go to the **Recent activity** tab. 4. Enable the new **Show all details** toggle to see details for all events. ![user recent activity](../docs/_images/console/users/user-recent-activity.jpg) * * * ## Store birthdate without a year In some cases, you may need to store a user’s birthdate without a year for compliance or other reasons. To do this, you can now set the [`birthdate` user profile field](../docs/models-user-profile.html#birthdate) to `0000-DD-MM`. By setting the year to `0000`, the year will be omitted from the `birthdate` when retrieving the user profile. ```json { "id": "550e8400-e29b-41d4-a716-446655440000", "name": "John Doe", "given_name": "John", "family_name": "Doe", "auth_types": [ "password", "phone_number_password" ], "birthdate": "0000-01-01" (1) } ``` - (1) In this example, the year is omitted from the `birthdate`. * * * ## Improved fields precedence logic for Managed and Lite profiles We have updated the synchronization logic for fields between Managed and Lite profiles. Now, any changes made to a standard or custom field within a Managed profile automatically propagates to the corresponding Lite profile to ensure data consistency. Importantly, this update prevents legacy Lite profile fields from repopulating a Managed profile once the user has transitioned to a managed state, ensuring your managed user data remains the single source of truth. The feature must be enabled on your account by your [Purse Identity representative](mailto:support@reach5.co) to take effect. For more on this topic, see [User profiles in Purse Identity](../docs/user-profiles.html). ![Diagram showing the flow of field updates between Managed and Lite profiles.](../docs/_images/user-profiles/lite-managed-field-flow.png) * * * ## General improvements - Now if you change your [custom domain](../docs/console/custom-domains-and-certificate-management.html), access tokens continue to work as expected. * * * ## Fixes ##### In some limited instances, a password\_reset\_requested user event was being emitted inadvertently during a Risk-based Authentication flow. ✓ ##### During the /oauth/par and /oauth/authorize flow, some integrators were receiving a 400 error response instead of redirecting the user. ✓ --- # 9 July 2026 (v2.161) URL: /release-notes/2161.html **Production** ✅ `Purse Identity v2.161` brings the new [session device management](#session-device-management) feature. As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Session device management You can now track and manage where users are logged in across devices, browsers, and applications. Session device management records a session device for each authentication, giving you visibility into active logins including device name, location, and last activity. Additionally, you can revoke access when a device is lost or suspicious. To get started, enable **Session device storage** in **Settings**  **Security**  **Attack protection policy** in the Purse Identity Console for SSO and/or refresh token flows. You can also set how many authorized devices a user may have at once (from `1` to `10`). For full details, see [Session device management](../docs/session-management/session-devices.html). ![user device sessions](../docs/_images/device-sessions/user-device-sessions.jpg) * * * ## General improvements - Now, [Social logins](../docs/social-login-overview.html) through [Hosted Pages](../docs/hosted-pages.html) no longer require email verification before users can sign in again after signup. * * * ## Fixes ##### Purse Identity Console ##### The updated\_at field wasn’t immediately refreshing in the Purse Identity Console when a user profile was updated. Now, the field updates in real-time without needing to refresh the page. ✓ ##### Deleted user profiles were still briefly appearing in the Purse Identity Console profiles list after being deleted. Now, they are removed immediately from the list without needing to refresh the page. ✓ --- # 23 July 2026 (v2.162) URL: /release-notes/2162.html **Production** ✅ `Purse Identity v2.162` brings a few new features and updates: - [Custom identity providers](#release-highlight) - [Accurate `updated_keys` on import events](#accurate-updated_keys-on-import-events) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Release highlight Custom identity providers You can now create **custom identity providers** directly in the Purse Identity Console. When Purse Identity does not already ship a connector for your identity provider, you configure the provider yourself and use it like any other identity provider. **What you can configure** ![add custom provider step1](../docs/_images/social-providers/custom-providers/add_custom_provider_step1.jpg) - **Provider identity**: Display name, provider key, logo, color, and visibility for hosted pages and widgets - **OAuth 2.0 connection**: Authorization, token, and user info HTTPS endpoints, client credentials, scopes, and optional PKCE - **Attribute mappings**: Standard OpenID Connect claims by default, with optional custom overrides to profile fields After you save the provider, pass its **provider key** to the Core SDK, UI SDK, or [`/oauth/authorize`](https://docs.identity.purse.eu/openapi/identity.html#operation/authorizeUser) the same way you use built-in providers such as `facebook` or `google`. For full setup steps and examples, see [Custom identity providers](../docs/custom-identity-providers.html). * * * ## Accurate `updated_keys` on import events Previously, [import jobs](../docs/imports.html) could emit `user_updated` and `managed_user_created` [user events](../docs/models-user-events.html) with an empty [`updated_keys`](../docs/models-user-events.html#updated_keys) array even when the profile was updated. Now, `updated_keys` lists only the fields that were actually changed, so you can reliably react to import updates in webhooks, Pub/Sub hooks, and other integrations. For example, when an import adds a birthdate to an existing profile, the event can look like this: ```json { "type": "user_updated", "canal": "job", "job_type": "import", "updated_keys": [ "birthdate", "birth_day", "birth_month", "birth_year", "age" ] } ``` For more details, see [`updated_keys`](../docs/models-user-events.html#updated_keys). * * * ## General improvements - In the Purse Identity Console, the [user profile](../docs/support/manage-profiles-from-console.html) now displays a partial birth date from `birth_day` and `birth_month` when the birth year is unavailable on the profile (for example due to provider limitations or data-processing requirements). Age is not calculated when the year is missing. - You can now see the session type under the [Session devices](../docs/session-management/session-devices.html) tab in the Purse Identity Console for a user. ![2162 user device sessions](_images/2162_user-device-sessions.jpg) * * * ## Fixes ##### In some cases, the updated\_at field was not updated when profile fields changed, such as after suspending a user. ✓ ##### Temporarily, a risky\_login\_notification event was being generated even when the RBA template was not configured, meaning no notification was sent to the user. ✓ ##### In some limited instances, the user’s IP address was not updated when the user’s location changed. ✓ --- # 06 August 2026 (v2.163) URL: /release-notes/2163.html **Production** ✅ `Purse Identity v2.163` is primarily a maintenance release with [general improvements](#general-improvements) and [fixes](#fixes). Additionally, we also released version `2.0.2` of our UI SDK. - [UI SDK 2.0.2 release](#ui-sdk-2-0-2-release) ## UI SDK 2.0.2 release **Released 13 August 2026** Our UI SDK `2.0.2` release focuses on resolving several issues reported after the recent UI SDK `2.0.x` releases, plus a [small password field improvement](#show-password-on-password-confirmation). For full changelog details, see [UI SDK releases](https://github.com/ReachFive/identity-web-ui-sdk/releases). ### Show password on password confirmation You can now pass [`canShowPassword`](../sdk-ui/showPasswordEditor.html#canShowPassword) to `showPasswordEditor`. When enabled, the eye icon is available on password fields, including password confirmation (and the old password field when `promptOldPassword` is enabled). The same clear-text toggle also applies to relevant password fields in [`showAuth`](../sdk-ui/showAuth.html) when `canShowPassword` is enabled. For more on this topic, see the [UI SDK documentation](../sdk-ui/index.html). * * * ## General improvements - Now, any changes to [Data Breach Detection](../docs/security/data-breach-detection.html) settings are logged as `settings:update` events in [audit logs](../docs/audit-logs.html). - We did a small update to the Purse Identity Console menu to ensure consistency on menu labels. - We updated our [phone number validation](../docs/validating-phone-numbers.html) library metadata so numbering plans stay current. * * * ## Fixes ##### In some limited instances, calling /oauth/authorize would emit a login event even when the login attempt failed. ✓ --- # 20 August 2026 (v2.164) URL: /release-notes/2164.html **Production** ✅ `Purse Identity v2.164` brings a few new features and updates: - [Pass `state` parameter on logout endpoint](#pass-state-parameter-on-logout-endpoint) - [Passkey changes in `updated_keys`](#passkey-changes-in-updated_keys) As always, we [fixed](#fixes) a few items for you. ## Pass `state` parameter on logout endpoint You can now pass a `state` query parameter on the [`/identity/v1/logout`](https://docs.identity.purse.eu/openapi/identity.html#operation/destroySSOsession) endpoint. Purse Identity returns this value as-is in the query string of the post-logout redirect URL (`redirect_to`, `post_logout_redirect_uri`, or the `Referer` header). This lets you encode the original page (typically as Base64) so you only need to whitelist one logout callback URL in the Purse Identity Console. Your application then decodes `state` on that page and redirects the user to their original location. The Core SDK [`logout`](../sdk-core/logout.html) method also accepts this optional `state` parameter. For more details, see [`/identity/v1/logout`](https://docs.identity.purse.eu/openapi/identity.html#operation/destroySSOsession) and [logout](../sdk-core/logout.html). * * * ## Passkey changes in `updated_keys` **What’s new:** when a passkey is added to or removed from an existing profile, the accompanying `user_updated` event now lists `webauthn_credentials` in [`updated_keys`](../docs/models-user-events.html#updated_keys). **What’s unchanged:** Purse Identity still emits `webauthn_credential_created` and `webauthn_credential_deleted` for the passkey lifecycle. Those events fire alongside `user_updated`. The following situations show which events fire and what `updated_keys` contains: Add a passkey Events: `webauthn_credential_created` and `user_updated`. `auth_types` does not gain a WebAuthn value until the user later authenticates with the passkey. ```json { "type": "user_updated", "updated_keys": [ "webauthn_credentials" ] } ``` Delete a passkey Events: `webauthn_credential_deleted` and `user_updated`. ```json { "type": "user_updated", "updated_keys": [ "webauthn_credentials" ] } ``` If this was the user’s last passkey **and** they had already logged in with WebAuthn, `auth_types` is included as well: ```json { "type": "user_updated", "updated_keys": [ "webauthn_credentials", "auth_types" ] } ``` Sign up with passkey The sign up flow is unchanged. - **Events**: `signup` and `webauthn_credential_created`. There is no `user_updated` event. Authenticate with passkey The passkey’s last-used timestamp is updated, but that change is not listed in `updated_keys`. A completed WebAuthn login adds a WebAuthn value to [`auth_types`](../docs/models-user-profile.html#auth_types). That change is reported on the `login` event, not on `user_updated`. For more details, see [`updated_keys`](../docs/models-user-events.html#updated_keys) and [Passkeys: User events](../docs/biometrics/passkeys.html#passkey-user-events). * * * ## Fixes ##### In some limited instances, custom fields weren’t displaying properly for some user profiles. ✓ ##### For some customers using Outlook and similar email clients, the signup invitation wasn’t working properly. Users were being denied access unexpectedly. ✓ ##### Purse Identity Console ##### There was a display issue on the Purse Identity Console when viewing some client details. ✓ --- # 03 September 2026 (v2.165) URL: /release-notes/2165.html **Production** ✅ `Purse Identity v2.165` brings a few new features and updates: - [Merged profiles now list changed fields](#merged-profiles-now-list-changed-fields) - [Control which custom fields Dialog Insight receives](#control-which-custom-fields-dialog-insight-receives) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Merged profiles now list changed fields When two profiles are merged, the `user_updated_by_merge` event on the surviving profile now includes [`updated_keys`](../docs/models-user-events.html#updated_keys), so [webhooks](../docs/webhooks.html) and [Pub/Sub hooks](../docs/pub-sub-hook.html) can see which fields the merge changed. For example, Ada has no `company`. You merge Grace into Ada; Grace’s profile has `company: Acme`. Ada’s profile survives, keeps her existing fields, gains `company`, and the event lists which fields specifically changed: ```json { "type": "user_updated_by_merge", "updated_keys": [ "company" (1) ] } ``` - (1) As per the example, Ada now has `company: Acme` and the event lists `company` as the field that changed. For more details, see [`updated_keys`](../docs/models-user-events.html#updated_keys), [Merging rules](../docs/merging-rules.html), and the [`mergeUsers`](https://docs.identity.purse.eu/openapi/management.html#operation/mergeUsers) endpoint. * * * ## Control which custom fields Dialog Insight receives You can now choose which [custom fields](../docs/custom-fields.html) Purse Identity forwards to [Dialog Insight](../docs/emails.html#dialog-insight). Previously, every custom field on the profile was sent with the message. If Dialog Insight did not already define that parameter, the send could fail. In the Purse Identity Console at **Emails**  **Providers**, select **Dialog Insight** and use **Custom Fields** to send only the fields your Dialog Insight messages need. For more details, see [Dialog Insight](../docs/emails.html#dialog-insight). ![dialog insight](../docs/_images/console/emails/dialog-insight.jpg) * * * ## General improvements - Now, the [Data Breach Detection scanning job](../docs/security/data-breach-detection.html#scanning-job) emits a single [`leaked_credentials_usage`](../docs/models-user-events.html#user-event-types) event per profile, even when several identifiers on that profile match leaked credentials. * * * ## Fixes ##### Purse Identity Console ##### There was temporarily an issue with type-ahead search when searching for Job reports in the Purse Identity Console. ✓ ##### In some cases, long webhook URLs were being truncated in the Purse Identity Console which made it difficult to see or interact with the full URL. ✓ --- # 17 September 2026 (v2.166) URL: /release-notes/2166.html **Production** ✅ `Purse Identity v2.166` brings your expected product updates and fixes along with an exciting company-wide announcement: - [ReachFive becomes Purse Identity](#reachfive-becomes-purse-identity) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## ReachFive becomes Purse Identity ![Purse Identity](../docs/_images/icons/purse-identity-mark.svg) We are excited to announce that ReachFive is now Purse Identity. Purse Identity is the Customer Identity and Access Management (CIAM) solution that unifies identity, authentication, and consent so you can better recognize your customers, simplify every login, and secure their access. The Purse Identity Console, this documentation site, Support, and other touch points now carry the Purse Identity brand. - You can now find Support at [https://support.identity.purse.eu/](https://support.identity.purse.eu/). - The platform’s status page is now at [https://status.identity.purse.eu/](https://status.identity.purse.eu/). ![ReachFive Console](../docs/_images/security/on-demand-scaling-console-instructions.jpg) ![Purse Identity Console](_images/2166_console-rebrand-light.jpg) > Screenshots on this documentation site are being currently being updated to match the new Purse Identity brand. Purse Identity and Purse Payment now make Purse the go-to Buying Flow company for the full ecosystem from identity through payment. For more, see [Purse Identity’s product site](https://purse.eu/en/products/purse-identity). * * * ## General improvements - The [`login_as_profile_id`](../docs/login-as.html#login-as-auditing) user event field is now set on every event generated while a session is logged in as another user, not only on the initial `login` event. It also appears as **Login As - User** in the [recent activity](../docs/support/manage-profiles-from-console.html#recent-activity) view in the Purse Identity Console. - Passwordless signup can now optionally accept profile `data`, applied the same way as other signup flows. * * * ## Fixes ##### There was a temporary issue where we were unable to retrieve emails for Paypal Connect accounts. ✓ ##### Purse Identity Console ##### The session\_device\_updated user event was inadvertently missing the human-readable label in the recent activity view in the Purse Identity Console. ✓ --- # 5 October 2026 (v2.167) URL: /release-notes/2167.html **Production** ✅ `Purse Identity v2.167` primarily handles internal maintenance and in-progress feature development (_stay tuned_) and brings an improved feature: - [Custom fields on user profiles in the Purse Identity Console](#custom-fields-on-user-profiles-in-the-purse-identity-console) As always, we [fixed](#fixes) a few items for you. ## Custom fields on user profiles in the Purse Identity Console The custom fields panel on a user’s profile in the Purse Identity Console now shows each field’s label above its value for better readability, and no longer renders custom fields that have no value for that user. ![user profile card](../docs/_images/console/users/user-profile-card.jpg) For more details, see [Managing users from the Purse Identity Console](../docs/support/manage-profiles-from-console.html#user-profiles). * * * ## Fixes ##### In some limited instances, users being redirected through the /passwordless/verify endpoint were receiving unclear error messages. ✓ ##### Purse Identity Console ##### You were temporarily unable to delete a profile’s birthdate fields from the Purse Identity Console. ✓ ##### After adding a passkey to the profile from WebAuthn Devices in the Purse Identity Console, subsequently opening the same profile from Profiles was throwing an error. ✓ ##### The date picker was prefilling the current date even when there was a previously-configured date. Now, the current date is only shown when there is no previously-configured date. ✓ --- # 19 October 2026 (v2.168) URL: /release-notes/2168.html **Production** ✅ `Purse Identity v2.168` brings a few new features and updates: - [Fields sent to custom email and SMS providers](#fields-sent-to-custom-email-and-sms-providers) - [Social identity in pre-event webhooks](#social-identity-in-pre-event-webhooks) As always, we [fixed](#fixes) a few items for you. ## Fields sent to custom email and SMS providers You can now choose which profile and message fields a custom [email](../docs/emails.html#custom-providers) or [SMS](../docs/setup-sms-provider.html#set-up-custom-sms-provider) provider receives in `personalizations`. - The recipient (`email` or `phone_number`) and `template_id` are always sent. - An empty **Fields** list sends only those keys. In the Purse Identity Console, **Fields** groups those keys into **Standard fields**, **Message fields**, and **Custom fields**. - A new provider starts with **Standard fields** and **Message fields** selected. - **Custom fields** stay unselected until you add them. - A provider configured before this release keeps the fields it already sent, plus any custom fields already selected. For example, with **Fields** set to `given_name`, `has_password`, and `custom_fields.loyalty_id`, a password reset email looks like this: ```json { "email": "clarence@example.com", (1) "template_id": "password_reset", (1) "personalizations": { "given_name": "Max", "has_password": true, (2) "custom_fields": { "loyalty_id": "123456" (3) } } } ``` - (1) `email` and `template_id` are always present. - (2) `has_password` appears only for the `password_reset` template. - (3) `loyalty_id` appears only when that custom field is present on the profile. For more details, see [Custom email providers](../docs/emails.html#custom-providers) and [Custom SMS providers](../docs/setup-sms-provider.html#set-up-custom-sms-provider). * * * ## Social identity in pre-event webhooks The `login` [pre-event webhook](../docs/webhooks.html#pre-event-webhooks) now includes the social identity being attached to an existing profile in `user.identities`. This applies when a user logs in with a new provider that matches an existing profile by email or phone number, or links a provider from the [social accounts](../sdk-ui/showSocialAccounts.html) screen. The identity has the same fields as on `signup`, so you can accept or reject the link based on the social account being attached. For more details, see [Social identity in pre-event webhooks](../docs/webhooks.html#social-identity-in-pre-event-webhooks). * * * ## Fixes ##### The custom\_fields and lite\_only fields were not being included in the personalizations object sent to custom email and SMS providers. ✓ ##### There was a temporary issue when no captcha\_provider parameter was specified on some calls. ✓ --- # Release notes URL: /release-notes/index.html The release notes describe new features, enhancements, and fixes for the Purse Identity platform. The latest release notes are found below. For previous releases, check out the sidebar. For upcoming changes that require your attention, see the [Attention](../attention/index.html) page. ## Other releases The following shows other Purse Identity releases for your convenience. ##### Core SDK ![identity core](https://img.shields.io/npm/v/@reachfive/identity-core.svg?color=darkslategrey) ##### UI SDK ![identity ui](https://img.shields.io/npm/v/@reachfive/identity-ui.svg?color=darkslategrey) ##### Android SDK **MavenCentral** `11.2.0` ##### iOS SDK **SPM** `11.1.0` ##### SFCC Cartridge **SFCC Cartridge** `20.10.0` ## 29 October 2026 (v2.169) **Production** ✅ `Purse Identity v2.169` brings a few new features and updates: - [Passkeys as a second factor](#passkeys-as-a-second-factor) - [Replacing an MFA phone number](#replacing-an-mfa-phone-number) - [Consent log creation date](#consent-log-creation-date) - [Choose when your Hosted Pages move to a new UI SDK version](#choose-when-your-hosted-pages-move-to-a-new-ui-sdk-version) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ### Passkeys as a second factor Offer your users a faster, safer way to confirm a sensitive action: a passkey instead of a code by email or SMS. **For your users**, it takes one touch with their fingerprint, face, or device PIN. There’s no message to wait for and no code to type, and a passkey can’t be handed over the way a code can. **For your integration**, it’s one more method in the step-up you already use, so there’s no new flow to build. **For your team**, you can see and remove a user’s passkeys from the Purse Identity Console, on the **Passkeys** tab of their profile, or with the Management API. For example, you can help a user who lost their device. #### How it works - When a user has a passkey and you’ve turned passkeys on, the [`stepup`](https://docs.identity.purse.eu/openapi/identity.html#operation/stepup) response lists `webauthn` next to the other methods, and you choose whether to offer it. - The tokens you get back are the same as with any other second factor, with `mfa` in `amr`, so your existing checks keep working. - Nothing changes for users without a passkey, or for accounts that haven’t turned it on. Email and SMS codes stay available as a fallback. ```json { "amr": ["sms", "webauthn"], (1) "token": "cf21S_kHIzh3cF_CHWH...ombTt58Dju7Ic" (2) } ``` - (1) The methods available for this step-up. `webauthn` means the user can use a passkey. - (2) The step-up token. Send it to start the passkey prompt. #### Enable passkeys as a second factor To turn passkeys on as a second factor, use the **Webauthn** switch under **MFA**  **Settings** in the Purse Identity Console. If you don’t see the switch, contact your Purse Identity representative. For more details, see [Passkey as a second factor](../docs/mfa/passkey-second-factor.html). * * * ### Replacing an MFA phone number Users can now replace the phone number they use as an MFA second factor without removing it first. When users who already have an MFA phone number start [phone number registration](https://docs.identity.purse.eu/openapi/identity.html#operation/startPhoneNumberRegistration) with a different phone number, the new phone number replaces the existing one once it’s verified, or immediately if it’s already the user’s verified phone number. The existing phone number stays active until then, so the account keeps its second factor throughout. Previously, this request returned an error, and users had to delete their existing MFA phone number first. > Because users already have an MFA credential, replacing the phone number through the Identity API requires a [step-up](../docs/stepup-required.html). * * * ### Consent log creation date Incremental consent log exports no longer miss consents that arrive late. Before, an incremental export decided which logs were new by looking at `date`, the day the user gave consent. If you import consents from partners once a week, a consent given on October 20 and imported on October 27 was older than your last export, so it was skipped. Now, consent logs have a `created_at` field: when Purse Identity wrote the log. Incremental exports use it, so the imported consent is exported at the next run. The first run after this release can include logs you hadn’t seen before. The `date` field is unchanged. Logs written before this release return the same value for both fields. ```json { "consent_key": "partner-offers", "granted": true, "date": "2026-10-20T14:30:00.000Z", (1) "created_at": "2026-10-27T02:00:12.418Z" (2) } ``` - (1) When the user gave consent, as sent by your import file or API call. - (2) When Purse Identity wrote the log. Incremental exports select on this value. `created_at` is also available in the [consent log object](../docs/models-consent-logs.html), the [Management API](https://docs.identity.purse.eu/openapi/management.html#operation/getUserConsentLogs), [exports](../docs/export-consent-logs.html), and webhooks. In the Purse Identity Console, it appears as **Created At** in the export fields and filters. * * * ### Choose when your Hosted Pages move to a new UI SDK version You can now decide when your Hosted Pages adopt a new version of the UI SDK. Before, Purse Identity chose the UI SDK version for your whole environment. If you customized your pages with CSS or scripts, an update could change the page structure under your customizations before you had time to test. Now, each Hosted Pages configuration has an **SDK version** setting. Keep the environment default to get updates as soon as they’re released, or select a fixed version and move to a newer one when you’ve tested it, for example on a separate configuration. ![hosted pages sdk version](../docs/_images/hosted-pages/hosted-pages-sdk-version.jpg) See [Choose the UI SDK version](../docs/hosted-pages.html#sdk-version). * * * ### General improvements - Tell users where a login attempt or verification request came from. The **Risky login notification**, MFA **Activation**, and MFA **Step-up** email and SMS templates now accept `{{city}}` and `{{country}}`, for example: ```html A new login was detected from {{city}}, {{country}}. ``` The location comes from the IP address of the request. If it can’t be determined, the variables are empty and the message is still sent. If you use a custom provider, select **City** and **Country** under **Fields** to receive them in `personalizations`. See [RBA templates](../docs/rba.html#rba-templates). - Password reset emails can now welcome users who don’t have a password yet. In the SMTP [**Password reset** template](../docs/email-templates.html#password-reset), `{{user.has_password}}` is `false` until the user sets a password, so you can adapt the wording: ```html {% if user.has_password %}Reset your password{% else %}Create your password{% endif %} ``` Custom email providers already have this value. - Now, when entering a custom field with the type [`Phone`](../docs/custom-fields.html#custom-field-data-types) without a country code, the Purse Identity Console automatically adds the country code based on the user’s [account settings](../docs/console.html#account-settings). If a user enters a country code directly, that value is still saved instead. * * * ### Fixes ##### The import job was not considering the Purse Identity ID as a valid identifier and was rejecting the import when a user did not have a valid email, phone, or social identity. ✓ ##### Purse Identity Console ##### The Purse Identity Console was not correctly saving custom fields with the type Decimal. ✓ ##### In some limited instances, entering a value of 0 for a custom field with the type Integer through the Purse Identity Console or API was not saving the value correctly. ✓ --- # 29 October 2026 (v2.169) URL: /release-notes/latest.html **Production** ✅ `Purse Identity v2.169` brings a few new features and updates: - [Passkeys as a second factor](#passkeys-as-a-second-factor) - [Replacing an MFA phone number](#replacing-an-mfa-phone-number) - [Consent log creation date](#consent-log-creation-date) - [Choose when your Hosted Pages move to a new UI SDK version](#choose-when-your-hosted-pages-move-to-a-new-ui-sdk-version) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Passkeys as a second factor Offer your users a faster, safer way to confirm a sensitive action: a passkey instead of a code by email or SMS. **For your users**, it takes one touch with their fingerprint, face, or device PIN. There’s no message to wait for and no code to type, and a passkey can’t be handed over the way a code can. **For your integration**, it’s one more method in the step-up you already use, so there’s no new flow to build. **For your team**, you can see and remove a user’s passkeys from the Purse Identity Console, on the **Passkeys** tab of their profile, or with the Management API. For example, you can help a user who lost their device. ### How it works - When a user has a passkey and you’ve turned passkeys on, the [`stepup`](https://docs.identity.purse.eu/openapi/identity.html#operation/stepup) response lists `webauthn` next to the other methods, and you choose whether to offer it. - The tokens you get back are the same as with any other second factor, with `mfa` in `amr`, so your existing checks keep working. - Nothing changes for users without a passkey, or for accounts that haven’t turned it on. Email and SMS codes stay available as a fallback. ```json { "amr": ["sms", "webauthn"], (1) "token": "cf21S_kHIzh3cF_CHWH...ombTt58Dju7Ic" (2) } ``` - (1) The methods available for this step-up. `webauthn` means the user can use a passkey. - (2) The step-up token. Send it to start the passkey prompt. ### Enable passkeys as a second factor To turn passkeys on as a second factor, use the **Webauthn** switch under **MFA**  **Settings** in the Purse Identity Console. If you don’t see the switch, contact your Purse Identity representative. For more details, see [Passkey as a second factor](../docs/mfa/passkey-second-factor.html). * * * ## Replacing an MFA phone number Users can now replace the phone number they use as an MFA second factor without removing it first. When users who already have an MFA phone number start [phone number registration](https://docs.identity.purse.eu/openapi/identity.html#operation/startPhoneNumberRegistration) with a different phone number, the new phone number replaces the existing one once it’s verified, or immediately if it’s already the user’s verified phone number. The existing phone number stays active until then, so the account keeps its second factor throughout. Previously, this request returned an error, and users had to delete their existing MFA phone number first. > Because users already have an MFA credential, replacing the phone number through the Identity API requires a [step-up](../docs/stepup-required.html). * * * ## Consent log creation date Incremental consent log exports no longer miss consents that arrive late. Before, an incremental export decided which logs were new by looking at `date`, the day the user gave consent. If you import consents from partners once a week, a consent given on October 20 and imported on October 27 was older than your last export, so it was skipped. Now, consent logs have a `created_at` field: when Purse Identity wrote the log. Incremental exports use it, so the imported consent is exported at the next run. The first run after this release can include logs you hadn’t seen before. The `date` field is unchanged. Logs written before this release return the same value for both fields. ```json { "consent_key": "partner-offers", "granted": true, "date": "2026-10-20T14:30:00.000Z", (1) "created_at": "2026-10-27T02:00:12.418Z" (2) } ``` - (1) When the user gave consent, as sent by your import file or API call. - (2) When Purse Identity wrote the log. Incremental exports select on this value. `created_at` is also available in the [consent log object](../docs/models-consent-logs.html), the [Management API](https://docs.identity.purse.eu/openapi/management.html#operation/getUserConsentLogs), [exports](../docs/export-consent-logs.html), and webhooks. In the Purse Identity Console, it appears as **Created At** in the export fields and filters. * * * ## Choose when your Hosted Pages move to a new UI SDK version You can now decide when your Hosted Pages adopt a new version of the UI SDK. Before, Purse Identity chose the UI SDK version for your whole environment. If you customized your pages with CSS or scripts, an update could change the page structure under your customizations before you had time to test. Now, each Hosted Pages configuration has an **SDK version** setting. Keep the environment default to get updates as soon as they’re released, or select a fixed version and move to a newer one when you’ve tested it, for example on a separate configuration. ![hosted pages sdk version](../docs/_images/hosted-pages/hosted-pages-sdk-version.jpg) See [Choose the UI SDK version](../docs/hosted-pages.html#sdk-version). * * * ## General improvements - Tell users where a login attempt or verification request came from. The **Risky login notification**, MFA **Activation**, and MFA **Step-up** email and SMS templates now accept `{{city}}` and `{{country}}`, for example: ```html A new login was detected from {{city}}, {{country}}. ``` The location comes from the IP address of the request. If it can’t be determined, the variables are empty and the message is still sent. If you use a custom provider, select **City** and **Country** under **Fields** to receive them in `personalizations`. See [RBA templates](../docs/rba.html#rba-templates). - Password reset emails can now welcome users who don’t have a password yet. In the SMTP [**Password reset** template](../docs/email-templates.html#password-reset), `{{user.has_password}}` is `false` until the user sets a password, so you can adapt the wording: ```html {% if user.has_password %}Reset your password{% else %}Create your password{% endif %} ``` Custom email providers already have this value. - Now, when entering a custom field with the type [`Phone`](../docs/custom-fields.html#custom-field-data-types) without a country code, the Purse Identity Console automatically adds the country code based on the user’s [account settings](../docs/console.html#account-settings). If a user enters a country code directly, that value is still saved instead. * * * ## Fixes ##### The import job was not considering the Purse Identity ID as a valid identifier and was rejecting the import when a user did not have a valid email, phone, or social identity. ✓ ##### Purse Identity Console ##### The Purse Identity Console was not correctly saving custom fields with the type Decimal. ✓ ##### In some limited instances, entering a value of 0 for a custom field with the type Integer through the Purse Identity Console or API was not saving the value correctly. ✓ --- # 21 September 2023 (v2.100) URL: /release-notes/previous-years/2100.html `Purse Identity v2.100` updates our [risky login email template](#risky-logins), improves our [Line social provider configuration](#line-updates), and added a field to the [User event model](#user-event-model). As always, we [fixed](#fixes) a few issues. ## Risky logins It’s always nice to know the exact information from any login, particularly when it’s considered risky. With this release, you can now send your users the relevant device information related to risky logins with the following added variables: - `{{ip}}` - `{{userAgent}}` - `{{operatingSystem}}` - `{{deviceClass}}` - `{{deviceName}}` For more on this topic, see [Risk-based Authentication](../../docs/rba.html). * * * ## Line updates With this release, those customers using [Line](https://line.me/en/) for authentication purposes with Purse Identity are able to manage multiple variants of the provider, which allows you to have different Line variants for your subsidiaries or brands. For more, see [Line Connect](../../docs/line.html). ![2100 lineVariants](../_images/2100-lineVariants.jpg) * * * ## User event model We’ve added a new field to the user event model with this release. The field is called `canal` (channel) and it represents the channel through which the event was triggered. This could be via a hook, an SMS, or even a remote client. For more on this, see [User Events](../../docs/models-user-events.html). ```json ... "canal": "management", (1) ... ``` - (1) In this case, the event was triggered by the Management client. ## Fixes ##### In some instances, user were being unexpectedly disconnected during a session. ✓ ##### Suspending a large volume of users via the Management API was degrading performance for some customers. ✓ ##### The user.id and user.addresses fields were temporarily appearing under the same label in the Purse Identity Console. ✓ --- # 5 October 2023 (v2.101) URL: /release-notes/previous-years/2101.html `Purse Identity v2.101` introduces our [Premium Analytics](#release-highlight), updates the [Identity Fraud Protection](#identity-fraud-protection) module, makes some important updates to our [WeChat Connector](#wechat-connector-updates), and brings some [other improvements](#other-improvements) as well. As always, we [fixed](#fixes) a few issues. ## Release highlight Premium Analytics Purse Identity’s **Premium Analytics** offers deeper insight into your user base’s behaviour beyond that of just the standard analytics package as shown in [Analytics](../../docs/analytics.html). Combined with the powerful out-of-the-box analytics that come standard with Purse Identity, these **Premium Analytics** help you to better understand how your users are interacting with your sites so you can best tailor experiences for them and respond to new patterns as they emerge. For a complete look, check out [Premium Analytics](../../docs/premium-analytics.html) . To get started with **Premium Analytics**, go to **Analytics**  **Premium Analytics** in your Purse Identity Console. ![premium analytics home dashboard](../../docs/_images/console/analytics/premium-analytics-home-dashboard.jpg) ## Identity Fraud Protection We have made some updates to our Identity Fraud Protection (IFP) module whereby you’re now able to protect requests from the backend, ensuring all customers are able to leverage the powerful IFP functionality. This is done via a new secure header called **True-Client-IP** that contains the user’s IP. You can find this on your Purse Identity Console at **Settings**  **Attack protection policy**. For more, see [Identity Fraud Protection](../../docs/ifp.html). ![width-450px](../_images/2101-trueClientIp.jpg) * * * ## WeChat Connector updates WeChat is now fully available in our Android SDK. Users are redirected to their WeChat app on Android, allowing you to leverage the full potential of our connector on Android devices. To ensure optimal functionality with our WeChat Connector, we updated the Purse Identity Console so that you can configure your mobile app Client ID and Client Secrets separately. For more, see [WeChat Connect](../../docs/wechat.html). For more on Android integration, see our [Android SDK docs](../../sdk-android/index.html). * * * ## Other improvements - We have ensured that expired trusted devices are properly removed from the database. For more, see [Risk-based Authentication](../../docs/rba.html). * * * ## Fixes ##### We fixed an X-Frame-Options security vulnerability. ✓ ##### There was a minor issue exporting user events for some customers. ✓ --- # 19 October 2023 (v2.102) URL: /release-notes/previous-years/2102.html `Purse Identity v2.102` now enables you to [block unverified login requests](#release-highlight), brings some [SDK updates](#sdk-updates), introduces support for more [Chinese language variations](#chinese-language-support), and provides an update to our [LINE social provider](#line-social-provider-updates). We also made some [other improvements](#other-improvements). And as always, we [fixed](#fixes) a few issues for you. ## Release highlight Block unverified users The Blocking Unverified Login Request feature helps to ensure that only users that have intended to sign up or register and have properly verified their correct details are allowed to log into your site. For more details, see [Block unverified login attempts](../../docs/block-unverified-logins.html). ![block unverified flow](../../docs/_images/security/block-unverified-flow.jpg) ## SDK updates We made some updates to our SDKs in support of this release. We added two new methods to our Core SDK which allow you to better manage trusted devices: - [listTrustedDevices](../../sdk-core/listTrustedDevices.html) - [deleteTrustedDevices](../../sdk-core/deleteTrustedDevices.html) For a full list of methods, see our [Core SDK](../../sdk-core/index.html). Now, you need to add your `GOOGLE_CLIENT_ID` to the `Info.plist` file. This is only applicable from our iOS SDK version `5.9.0`. ```xml ... GIDClientID GOOGLE_CLIENT_ID (1) ... ``` - (1) This is your Google Client ID in standard format. For example, `1234567890-abcdefg.apps.googleusercontent.com`. For more details, see our [iOS SDK](../../sdk-ios/index.html). * * * ## Chinese language support We have added more variations of our support for Chinese including: - `zh-CN` - _People’s Republic of China Simplified Chinese_ - `zh-Hans` - _Simplified Chinese_ - `zh-Hant` - _Traditional Chinese_ - `zh-HK` - _Hong Kong Traditional Chinese_ - `zh-MO` - _Macao Traditional Chinese_ - `zh-SG` - _Singapore Simplified Chinese_ - `zh-TW` - _Taiwan Traditional Chinese_ For a full list, see [Supported languages](../../docs/global-consumers/languages.html). * * * ## LINE social provider updates You can now configure your LINE social provider login to prompt users to add LINE friends directly in their consent screen or in a follow-up screen depending on the configuration. You handle the configuration directly in the Purse Identity Console. For more details, see [Line Connect](../../docs/line.html). ![2102 lineBotPrompt](../_images/2102-lineBotPrompt.jpg) * * * ## Other improvements - We improved the wording on errors for some customers. - We enhanced the mapping for Oracle Responsys for unknown users, and in the process, removed the need for the Folder Name and Object Name. For more, see the Oracle Responsys section at [Set up email provider](../../docs/emails.html). - You can now connect to the Purse Identity Console with [Ping Identity](../../docs/ping.html). * * * ## Fixes ##### Some customers were unable to user filters successfully when searching user events. ✓ ##### There was a minor issue related to roles when creating new users on the console. ✓ ##### There was a small issue using custom fields with the data type Date with the UI SDK. ✓ ##### A technical issue was causing some issue when exporting consent logs. ✓ --- # 9 November 2023 (v2.103) URL: /release-notes/previous-years/2103.html `Purse Identity v2.103` introduces a [new field in the Identities object](#new-provider_variant-field). We also made some [other improvements](#other-improvements). And as always, we [fixed](#fixes) a few issues for you. ## New `provider_variant` field We have introduced the new `provider_variant` field in the Identities object as part of the User Profile model. A `provider_variant` is the variant of a particular social provider such as a country or brand-specific variant. With this, you can also filter profiles by provider variant as well. For more details on the Identities object and user profile fields, see [User Profile](../../docs/models-user-profile.html). - With the API, you can filter by `provider_variant` as a query parameter. Filter example ```sh curl https:///api/v2/users/?filter==provider_variant="" ``` - In the Purse Identity Console, you can use the **Filter** icon to filter profiles and choose User Provider Variant. ![2103 filterbyVariant](../_images/2103-filterbyVariant.jpg) ## Other improvements - We have increased the job timeout when exporting users via S3 to accommodate larger user volumes. - We have improved the UX for custom fields with the `date` type. - We now ensure that the `kid` as part of the [JSON Web Key Sets](../../docs/jwks.html) does not expire on behalf of customers. * * * ## Fixes ##### Large exports, such as yearly user event exports, were causing issues with databases. ✓ --- # 12 December 2023 (v2.104) URL: /release-notes/previous-years/2104.html `Purse Identity v2.104` introduces some new additions to the [user event model](#user-event-fields) including a new [user event type](#user-event-types). You can now check the status of a user’s IP with our [Management API’s new endpoint](#check-ip-status). On top of this, you can now value [`updated_at` in a request payload](#valuing-updated_at-in-request-payload). We also made some [other improvements](#other-improvements). And as always, we [fixed](#fixes) a few issues for you. ## User event fields We have added some new fields to the User Event model which are emitted after a job is executed, giving you important details about the job. - `job_name`: The name of the job that was run. - `job_execution_id`: The ID for the execution of the job. - `job_type`: The type of job such as `import` or `export`. For more details, see [User Events](../../docs/models-user-events.html). ## User event types For users attempting to log in with an unverified identifier, a new user [event type](../../docs/models-user-events.html) is emitted: - `login_unverified_identifier` For more details, see [Block unverified login attempts](../../docs/block-unverified-logins.html). ## Check IP status In this release, we’re introducing a new endpoint for the Management API that allows you to check an IP’s status. This means that you’re able to see: - If an IP is currently blocked. - If an IP has been blocked before. - When the blockage expires for the IP. For more details, see the [Get IP status endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/getIpStatus). * * * ## Valuing `updated_at` in request payload Now, when you pass `updated_at` as part of the request payload for user profiles (Managed and Lite), the profile is set with the value passed via the API. Impacted endpoints - [Create user](https://docs.identity.purse.eu/openapi/Management.html#operation/createUser) - [Update user](https://docs.identity.purse.eu/openapi/Management.html#operation/updateUser) - [Create LITE profile](https://docs.identity.purse.eu/openapi/Management.html#operation/pushLiteProfile) - [Update LITE profile](https://docs.identity.purse.eu/openapi/Management.html#operation/updateLiteProfile) ## Other improvements - We have made some UX improvements for [MFA for console users](../../docs/mfa-on-console.html). - We have ensured that the Purse Identity `name` field is valued from the equivalent `name` field for [Kakao Connect](../../docs/kakao-connect.html). - We have added the `origin` field to certain iOS methods. For more, see our [iOS SDK documentation](../../sdk-ios/index.html). * * * ## Fixes ##### In very limited cases, some session cookies weren’t properly invalidated at logout. ✓ ##### Activating Purse Identity Console users via email registration resulted in a loop in some instances. ✓ ##### There was a minor issue with the showSocialAccounts function where provider variants weren’t updating properly. ✓ --- # 11 January 2024 (v2.105) URL: /release-notes/previous-years/2105.html `Purse Identity v2.105` introduces a new [user event field](#user-event-model), improves error messaging when [updating emails](#updating-email-with-management-api) through the Management API, and now ensures that all [imports](#imports) always contain a `created_at` and `updated_at` field. In addition, we are now able to provide a [new `locale` parameter](#new-locale-parameter) for a user’s country. We also made some [other improvements](#other-improvements). And as always, we [fixed](#fixes) a few issues for you. ## User event model With this release, we have added a new field to the user event model. This new field is called `updated_keys`. The `updated_keys` field is an array of strings that lists the fields that were modified for the following event types. - `signup` - `managed_user_created` - `user_created` - `user_updated` For more details, see [User Events](../../docs/models-user-events.html). * * * ## Updating email with Management API Previously when updating an email with [Update user](https://docs.identity.purse.eu/openapi/management.html#operation/updateUser), you would receive a `200` even if the email already exists, which could cause some issues with email management. Now, if the email currently exists when you try this, you’ll receive a `400` response in the API, letting you know the email already exists. > This only applies to verified emails. * * * ## Imports We now ensure that all imports always contain a `created_at` and `updated_at` field even when choosing Lite only. The following rules apply: - If `created_at` is present in the import file, keep this value in the file. - If `created_at` is not present in the import file, value it with the execution date of the import. - If `updated_at` is present in the import file, keep this value in the file with maximum tolerance of + 10 minutes compared to execution date. If the date exceeds tolerance, bring it back to execution date + 10 minutes. - If `updated_at` is not present in the import file, value it with the execution date of the import. For more details, see [Import Lite profiles only](../../docs/imports.html#lite-profiles). * * * ## New `locale` parameter We have introduced a new optional `locale` parameter. It can be passed via any API endpoint that generates an email or SMS as a header parameter called `Custom-Locale`. The parameter is automatically added to any requests called from the Core or UI SDK so long as the SDK is instantiated with the parameter valued. ```none Custom-Locale: fr-FR ``` For more details, see [Identity API User Locale](https://docs.identity.purse.eu/openapi/identity.html#section/User-locale). ```js const client = createClient({ // Required parameters domain: DOMAIN, clientId: CLIENT_ID, // Optional parameter language: 'Here paste a language code' , locale: 'fr-FR' (1) }); ``` - (1) Where `fr-FR` is the locale and the value is automatically added in the `Custom-Locale` header parameter. ### Use `locale` in email template You can also pass it as the `{{locale}}` variable in email templates. For more details, see [Email templates](../../docs/email-templates.html). ## Other improvements - You are now able to exchange authorization codes without redirection with the [verifyPasswordless](../../sdk-core/verifyPasswordless.html) method by passing the `useWebMessage` boolean as part of the `authOptions` object. - When creating or updated a user profile, you are now limited to valuing the `created_at` or `updated_at` fields at the current time plus 10 minutes, ensuring no nonsensical dates are allowed. * * * ## Fixes ##### Searching for blacklisted IPs resulted in slow responses and intermittent timeouts. ✓ ##### In some very limited cases, silent authentication invalidated the access token/refresh token. ✓ ##### User profiles that were permanently suspended were losing their custom fields, making it difficult to search by a specific custom field. ✓ --- # 25 January 2024 (v2.106) URL: /release-notes/previous-years/2106.html `Purse Identity v2.106` introduces an entirely new object for handling [custom fields for addresses](#release-highlight). This release provides an [update for KakaoTalk](#kakaotalk-age-range) where you retrieve the age range for users. In addition, we are now able to [map genders to the `other` value](#social-provider-genders) when retrieved from social providers. We have also enhanced our [Identity Fraud Protection](#identity-fraud-protection) module and as always, we [fixed](#fixes) some issues for you. ## Release highlight Address custom fields There is now a dedicated object for custom fields within the Addresses object. This ensures that custom fields dedicated to addresses are managed uniquely from the custom fields elsewhere in the user profile model. This allows you to create fields such as latitude, longitude, or location codes. Any custom field created for the address object is filterable in the Purse Identity Console and can be imported as part of the overall user profile model. ![2106 customFields addresses](../_images/2106-customFields-addresses.jpg) ```json ... "addresses": [ { "id": 0, "default": true, "address_type": "billing", "street_address": "10 rue Chaptal", "address_complement": "4 étage", "locality": "Paris", "postal_code": "75009", "region": "Île-de-France", "country": "France", "recipient": "Matthieu Winoc", "phone_number": "0723538943", "custom_fields": { (1) "latitude": "48.801407", "longitude": "2.130122", } } ], ... ``` - (1) The `custom_fields` object as part of Addresses. With this update, there are a few new API endpoints so you can manage those custom fields. Go to [Address custom Field Schemas](https://docs.identity.purse.eu/openapi/management.html#tag/Address-custom-field-schemas) in our Management API documentation to see the full set. Want to know more? - For more on the addresses object, see [User Profile](../../docs/models-user-profile.html). - For more on custom fields, see [Custom fields](../../docs/custom-fields.html). * * * ## KakaoTalk age range You are now able to retrieve and leverage the `age_range` information from KakaoTalk. This is possible through the `provider_metadata` object in the User Profile model. You can also filter by the age range directly in the Purse Identity Console for exports, pub/sub hooks, and webhooks. For more details, see [Kakao Connect](../../docs/kakao-connect.html). ```json { ... "provider_metadata": { "kakaotalk": { "ci": "OUBQAU1Uc...L6r2BuT1S33A==", "ci_authenticated_at": "2024-01-24T08:41:03Z", "age_range": "30~39" (1) } } ... } ``` - (1) The full list of potential values retrieved from Kakao: - `1-9` - `10-14` - `15-19` - `20-29` - `30-39` - `40-49` - `50-59` - `60-69` - `70-79` - `80-89` - `90+` You can filter by age range in [Export job definitions](../../docs/exports.html), [Pub/Sub hooks](../../docs/pub-sub-hook.html), and [User-event webhooks](../../docs/webhooks.html). ![2106 kakao ageRange](../_images/2106-kakao-ageRange.jpg) * * * ## Social provider genders We now accept genders other than male or female when retrieving from a social provider. When a gender is not male or female, it is assigned with `other` in Purse Identity. Currently, this only applies to [Google Connect](../../docs/google.html). However, we are working on applying this to more providers. Previously, though we already had the `other` category, it was not possible to use that value when retrieved from a social provider. For more details, see [User Profile](../../docs/models-user-profile.html). * * * ## Identity Fraud Protection We have made some performance and logic improvements for the Identity Fraud Protection (IFP) module to ensure that legitimate accounts don’t get blocked while the module protects against attacks. For more on our _Attack Protection policy_ and how we handle suspicious requests, see [Identity Fraud Protection](../../docs/ifp.html). * * * ## Fixes ##### There was a small discrepancy in the preconfigured counter reset time for the Identity Fraud Protection module. ✓ --- # 08 February 2024 (v2.107) URL: /release-notes/previous-years/2107.html `Purse Identity v2.107` now allows you to [delete addresses via imports](#delete-addresses-via-import). You can also [include session tokens in the `/oauth/token` response](#include-session-tokens-in-oauthtoken-response). There are now [Pub/sub hook failure events](#pubsub-hook-failure-events) for improved monitoring, as well as the ability to [invalidate all sessions for a user](#invalidate-all-sessions-for-a-user) via a dedicated endpoint. As always, we [fixed](#fixes) some issues for you. ## Delete addresses via import We have introduced a new boolean to the **Addresses object** called `to_delete`. When you pass `to_delete` with a value of `true` as part of an import file, you can successfully delete an address for a user. For more information, see [Delete an address](../../docs/imports.html#delete-an-address) and [User Profile](../../docs/models-user-profile.html). ```json { "email": "test@example.com", "addresses": [ { "id": 1, "to_delete": true (1) } ] } ``` - (1) Pass `to_delete` as `true` along with the desired address `id` to delete the address. ```csv email;addresses.0.id;addresses.0.to_delete (1) test@example.com;1;true (1) ``` - (1) Pass `to_delete` as `true` along with the desired address `id` to delete the address. * * * ## Include session tokens in `/oauth/token` response For flows where custom tabs are required or where using Webviews to manage session cookies isn’t possible, you can now include a session token as a part of the `/oauth/token` endpoint response. For more details, see [Retrieve access token](https://docs.identity.purse.eu/openapi/identity.html#operation/retrieveAccessToken). To apply this option to a client: 1. From your Purse Identity Console, go to **Settings**  **Clients**. 2. Go to your desired First-party Identity client or create a new one. 3. At the bottom of the client page, check the box with the title **Include SSO cookie in token endpoint response**. 4. Don’t forget to **Save** your input. ![2107 sessionCookieOauthTokenEndpoint](../_images/2107-sessionCookieOauthTokenEndpoint.jpg) * * * ## Pub/sub hook failure events There are now Pub/sub failure events so that it’s easier to monitor when something goes wrong. For more details, see [Pub/Sub hooks](../../docs/pub-sub-hook.html). Pub/sub hook ```json { "date": "2024-01-07T09:54:34.183123Z", "id": "AWUTz0..6KwGSiAAIMN", "type": "pub_sub_event_failure", "canal": "hook", "failed_hook_project": "webhook_host_unreachable", "failed_hook_message_key": "NOT_FOUND", "failed_hook_key": "failing_event", "failed_hook_user_event_type": "login_matching_password", "failed_hook_message": "…​ NOT_FOUND: Resource not found (resource=blah1234).", "failed_hook_topic": "blah1234" } ``` ##### date The date on which the event occurred. ##### id User event id. ##### type User event type. ##### canal The channel through which the event was triggered. ##### failed\_hook\_key The unique webhook key. ##### failed\_hook\_user\_event\_type The user event for which the webhook was triggered. ##### failed\_hook\_topic The topic ID of the pub/sub hook that failed. ##### failed\_hook\_message\_key The error message key. For example, `NOT_FOUND`. ##### failed\_hook\_message The error message for the failed hook. This describes why it failed. For example, the topic ID may have not been found for pub/sub hooks or there is a duplicated external ID. example ```json ... "failed_hook_message": "{\"detail\": \"Duplicated external id\", \"code\": \"711\"}" ... ``` ##### failed\_hook\_project The project name of the pub/sub hook that failed. * * * ## Invalidate all sessions for a user In some cases, you may want to invalidate all sessions for a user and force them to reauthenticate. This could be for security reasons or merely a precautionary measure. To do this, you can use our Management API to revoke long-lived tokens for a user. - POST [`/api/v2/users/:uid/revoke-long-lived-tokens`](https://docs.identity.purse.eu/openapi/Management.html#operation/revokeLongLivedTokens) * * * ## Fixes ##### There was some minor Purse Identity Console maintenance for Management client screens. ✓ ##### You could not edit a user if an empty streetAddress was entered for their profile. ✓ ##### In some cases, when updating a user from the Purse Identity Console, the updated\_at field was not valued with the latest date and time, but instead kept the existing value. ✓ --- # 7 March 2024 (v2.108) URL: /release-notes/previous-years/2108.html `Purse Identity v2.108` brings some exciting updates to our [Recent activity feature](#release-highlight) in the Purse Identity Console. The improvements in this release also let you [retrieve addresses from KakaoTalk](#kakaotalk-user-addresses) users. As always, we [fixed](#fixes) some issues for you. ## Release highlight Recent activity improvements With the `v2.108` release, you can see much more related to user activity directly from the Purse Identity Console. Previously, this only showed when a user logged in. Now, the **Recent activity** tab displays a wealth of user activity information. As well as being able to view more details on user activity, you can set and save filters so that you get exactly the information you need. For more details, see [Managing users from the Purse Identity Console](../../docs/support/manage-profiles-from-console.html). Now, more events are shown under **Recent activity** just like in the screenshot below. For more details, see [Recent activity](../../docs/support/manage-profiles-from-console.html#recent-activity). ![user recent activity expanded list](../../docs/_images/console/users/user-recent-activity-expanded-list.jpg) You can view a user’s recent activity from the Purse Identity Console. To help alleviate long lists of activity or if you simply want to have certain activities grouped together, you can create a filter. For more details, see [Recent activity filter](../../docs/support/recent-activity-filter.html). ![user recent activity filter](../../docs/_images/console/users/user-recent-activity-filter.jpg) ## KakaoTalk user addresses With this release, you can now retrieve addresses from KakaoTalk users. Once the user consents, you can pull in all the address information directly into Purse Identity. You first need to create a few custom address fields called `kakaotalk_address_id`, `receiver_phone_number2`, and `zone_number`. Otherwise, the address won’t be imported. This helps to avoid duplicating any addresses. For more details, see [Kakao Connect](../../docs/kakao-connect.html). Address example ```json "addresses": [ { "id": 0, "to_delete": true, "default": true, "address_type": "delivery", "street_address": "10 rue Chaptal", "address_complement": "4 étage", "locality": "Paris", "postal_code": "75009", "region": "Île-de-France", "country": "South Korea", "recipient": "Matthieu Winoc", "phone_number": "0723538943", "custom_fields": { "receiver_phone_number2": "0723538944", (1) "zone_number": "12345", (2) "kakaotalk_address_id": "333" (3) } } ], ``` - (1) The `receiver_phone_number2` custom address field ([`phone` data type](../../docs/custom-fields.html#custom-field-data-types)) to map to the Kakao equivalent field. - (2) The `zone_number` custom address field ([`string` data type](../../docs/custom-fields.html#custom-field-data-types)). This is the 5 digit code for a road name system. It is required for the road name address system. - (3) The `kakaotalk_address_id` custom address field ([`string` data type](../../docs/custom-fields.html#custom-field-data-types)). This must be present. * * * ## Fixes ##### In some cases, custom fields were lost when unifying profiles (lite, managed, social). ✓ --- # 25 March 2024 (v2.109) URL: /release-notes/previous-years/2109.html `Purse Identity v2.109` introduces [job report filtering](#release-highlight), allowing you to filter job reports directly from the Purse Identity Console. You can now also [sync Naver consents](#naver-consents) to Purse Identity. We also made some [other improvements](#other-improvements). As always, we [fixed](#fixes) some issues for you. ## Release highlight Filter job reports You can now filter job reports from the Purse Identity Console. Filtering the reports helps you more easily find the job report you’re looking for. The job report filters offers several ways to filter as shown in the table below. This includes setting a timeframe and how the results are displayed. For more, see [Job reports](../../docs/job-reports.html). ![2109 filter reports](../../docs/_images/console/jobs/2109-filter-reports.gif) ##### Job ID Filter by a specific job ID that has been run. This filter is particularly useful when you need to look into a specific job. Perhaps, you obtained the ID through logs or need to investigate further. ##### Job definition ID Filter by a job definition ID. This filter is useful when you want to look at a particular job definition. Maybe, you want to see how often it’s been run, or why a specific job definition is succeeding or failing. ##### Job type Filter by the type of job such as export or import. The job type filter is good to filter out only the type of jobs you want to see. ##### Job status Filter by the status of the job. Statuses - `SUCCESS` - `RUNNING` - `WAITING` - `WAITING_CANCELLATION` - `CANCELED` - `FAILURE` * * * ## Naver consents In order to receive the user consents from Naver into Purse Identity, you need to ensure that during integration, Purse Identity consents are assigned the [`opt-in` type](../../docs/consents.html#definitions) and that the consent’s [`key`](../../docs/consents.html#definitions) matches the same consent key in Naver. You must also specify every consent used in your brand’s Naver app in the Purse Identity Console. If the consent does not exist, the user is still able to authenticate. Consents are only collected the first time a user authenticates via Naver. For more, see [Naver](../../docs/naver.html). ![social Naver console steps](../../docs/_images/console/social-providers/social-Naver-console-steps.jpg) * * * ## Other improvements - Previously, the `authenticator_selection` object in the WebAuthn Identity API responses was empty. Now. the `resident_key` and `user_verification` fields are valued with `preferred`. ```json ... "authenticator_selection": { "resident_key": "preferred", (1) "user_verification": "preferred" (1) }, ... ``` - (1) Indicates the Relying Party strongly prefers creating a client-side discoverable credential, but will accept a server-side credential. See the [`/webauthn/signup-options` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/createSignupOptions) and [`/webauthn/signup-options` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/createRegistrationOptions) for more details. * * * ## Fixes ##### In some cases when creating a user with the Management API, the created\_at date on the associated user event was incorrect. ✓ ##### Consents logs on the Purse Identity Console were temporarily display in chronological order by default instead of the expected reverse chronological order. ✓ ##### Activating the Multi-factor Authentication feature without SMS activated caused the email templates to be unintentionally unavailable. ✓ --- # 11 April 2024 (v2.110) URL: /release-notes/previous-years/2110.html `Purse Identity v2.110` brings several new features, improvements, and needed bug fixes. You can now [export CSV fields](#export-csv-fields-in-order) in your desired order from the Purse Identity Console. We have added an [additional hashing algorithm](#scrypt-hashing-algorithm) for importing passwords to further support our customers. In addition, we have improved our [WebAuthn API responses](#webauthn-api-responses). As always, we made some [other improvements](#other-improvements) and [fixed](#fixes) a few items for you. ## Export CSV fields in order You can now choose the order in which your CSV fields are displayed in the exported columns of the CSV file. The fields are colour-coded to help differentiate between the categories: ##### Standard fields ##### Address fields ##### Custom fields ##### Consents ##### Client fields ##### User event fields You can do this directly in the Purse Identity Console: See in console **Webhook example** ![2110 order csv columns](../_images/2110-order-csv-columns.gif) 1. Go to **Settings**  **Export definitions**  **User \***. Where _User \*_ is either User Profiles, User Events, or User Consents. 2. Scroll down to the **File format** section. 3. Ensure the **Format** is CSV. 4. In the **Column** subsection, choose the fields you want displayed. You can drag and drop the fields to sort the order in which you want the columns displayed as part of the export job. 5. Don’t forget to **Save** your input. For full details, see [Export user profiles](../../docs/export-user-profiles.html). Including pre and post-event webhooks. 1. Go to **Settings**  **Webhooks**  **\*-event webhooks**. Where _\*-event_ is either Pre-event or Post-event. 2. Scroll down to the **Select a field** section. 3. Choose the fields you want displayed. You can drag and drop the fields to sort the order in which you want the columns displayed as part of the export job. 4. Don’t forget to **Save** your input. For full details, see [User-event webhooks](../../docs/webhooks.html). 1. Go to **Settings**  **Pub/Sub Hooks**  **User Events**. 2. Scroll down to the **Select a field** section. 3. In the **Column** subsection, choose the columns you want displayed. You can drag and drop the fields to sort the order in which you want the columns displayed as part of the export job. 4. Don’t forget to **Save** your input. For full details, see [Pub/Sub hooks](../../docs/pub-sub-hook.html). * * * ## Scrypt hashing algorithm In order to further support you, our customers, we have added an additional hashing algorithm to our supported list for importing passwords, [Firebase Scrypt](https://github.com/firebase/scrypt). For more details, see [Import user passwords](../../docs/import-passwords-from-the-console.html). * * * ## WebAuthn API responses We have improved the responses for WebAuthn endpoints so that when an empty list is returned via the endpoint, you receive a `200` status code instead of a `204`. This ensures there are no downstream issues where an empty list is unable to be parsed. Affected endpoints: - [Get specific credential](https://docs.identity.purse.eu/openapi/identity.html#operation/getCredentials) - [Get all credentials](https://docs.identity.purse.eu/openapi/identity.html#operation/getCredentials) - [Register credentials](https://docs.identity.purse.eu/openapi/identity.html#operation/registerWithCredentials) - [Delete a credential](https://docs.identity.purse.eu/openapi/identity.html#operation/deleteCredential) * * * ## Other improvements - We have improved whitelist error responses ensuring that if an entry is formatted incorrectly, an error message is thrown informing you there are `"Invalid entries in [the] whitelist"`. - We now ensure the `authenticator_selection` values are set appropriately to initiate flows. In this case, setting `resident_key` and `user_verification` to `preferred`. For more details, see [Create signup options](https://docs.identity.purse.eu/openapi/identity.html#operation/createSignupOptions) and [Create registration options](https://docs.identity.purse.eu/openapi/identity.html#operation/createRegistrationOptions). * * * ## Fixes ##### There was an issue where some users were unable to see segments in the Purse Identity Console. ✓ ##### There was a temporary UI issue where the Recent activity filter wasn’t appearing in the Purse Identity Console. ✓ --- # 25 April 2024 (v2.111) URL: /release-notes/previous-years/2111.html `Purse Identity v2.111` introduces a few improvements and needed bug fixes. You can now retrieve the [age range for Naver users](#naver-user-age-range). We have also updated some of our [MFA endpoints](#return-credentials-in-mfa-verification-endpoints) to better improve integration with your site(s). With this release, you can leverage the [WeChat mini program](#wechat-mini-program) flow. As always, we made some [general improvements](#other-improvements) and [fixed](#fixes) a few items for you. ## Naver user age range You are now able to retrieve and leverage the `naver_age_range` information from Naver users. This is possible through the `provider_metadata` object in the User Profile model. You can also filter by the age range directly in the Purse Identity Console for exports, pub/sub hooks, and webhooks. For more details, see [Naver](../../docs/naver.html). ```json { ... "provider_metadata": { "naver": { "naver_age_range": "30~39" (1) } } ... } ``` - (1) The full list of potential values retrieved from Naver: - `0-9` - `10-19` - `20-29` - `30-39` - `40-49` - `50-59` - `60-` You can filter by age range in [Export job definitions](../../docs/exports.html), [Pub/Sub hooks](../../docs/pub-sub-hook.html), and [User-event webhooks](../../docs/webhooks.html). ![2111 naver ageRange](../_images/2111-naver-ageRange.jpg) * * * ## Return credentials in MFA verification endpoints We have improved a few of our MFA endpoints so that integrators can provide useful information to users upon verifying credentials. The following updates now return the verified credential in the response: - **Verify MFA email**: [Get `/mfa/credentials/emails/verify`](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyEmailRegistration) - **Verify MFA email via query parameters**: [Post `/mfa/credentials/emails/verify`](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyEmailRegistrationQuery) - **Verify MFA phone number**: [Post `/mfa/credentials/phone-numbers/verify`](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyPhoneNumberRegistration) - **Verify MFA email**: [Post `/mfa/credentials/emails/verify`](https://docs.identity.purse.eu/openapi/management.html#operation/verifyEmailRegistration) - **Verify MFA phone number**: [Post `/users/{user_id}/mfa/credentials/phone-numbers/verify`](https://docs.identity.purse.eu/openapi/management.html#operation/verifyPhoneNumberRegistration) ### Response example ```json { "created_at": "2024-04-18T13:57:31.650Z", "phone_number": "+33612345680", "friendly_name": "+33612345680", "type": "sms" } ``` ```json { "created_at": "2024-04-18T13:57:31.650Z", "email": "john.doe@example.com", "friendly_name": "john.doe@example.com", "type": "email" } ``` * * * ## WeChat mini program With this release, we introduce Purse Identity integration with WeChat mini programs. A mini program does not follow the same flow as other Social Login providers. In the case of this release, we are introducing the mini program for WeChat. 1. Configure a variant with `mini_program` as part of the name in the WeChat connector in the Purse Identity Console. Accepted names - `my_mini_program` - `mini_program` - `mini_program_production` - `tiny_program` 2. Start the flow using the [`wx.login` method](https://developers.weixin.qq.com/miniprogram/en/dev/api/open-api/login/wx.login.html), where you’ll receive a `code` in the response. 3. Using this `code`, call the Purse Identity [`/oauth/provider/token` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/retrieveAccessTokenProvider). For more details, see [WeChat Connect](../../docs/wechat.html). * * * ## Other improvements - As part of the improvements to be able to retrieve the [Naver user age range](#naver-user-age-range), we have renamed the related Kakao user age range from `age_range` to `kakaotalk_age_range` in the User Profile model. This helps to ensure integrators are using the correct fields and avoids any confusion. * * * ## Fixes ##### Some endpoints such as searchUsers and exportUsers were returning unexpected results. ✓ --- # 16 May 2024 (v2.112) URL: /release-notes/previous-years/2112.html `Purse Identity v2.112` introduces a few improvements and needed bug fixes. We have delivered a new [account recovery process](#release-highlight) for users with identification keys. We are happy to announce that we have added [TikTok](#tiktok-social-provider) to our social provider options. You can now also [trigger password reset flows](#trigger-password-reset-flow-with-custom-identifier) with custom identifiers. To ensure user profile data freshness, you can use the new [`check_updated_at` request body field](#new-check_updated_at-field-for-validating-user-data-freshness) in certain Management API endpoints. As always, we made some [general improvements](#other-improvements) and [fixed](#fixes) a few items for you. ## Release highlight Recover accounts using identification keys Users can now recover accounts that use identification keys. Much like the ability to reset a password for those users using traditional credentials, the new API endpoints and templates for account recovery allow users using identification keys to successfully recover their account. There is a new **Account recovery** template for both email and SMS. You can find this on the Purse Identity Console at **Settings**  **Emails**  **Templates** and **Settings**  **SMS**  **Templates**. For more, see [Email templates](../../docs/email-templates.html) and [SMS templates](../../docs/sms-templates.html). ![2112 accountRecoveryTemplate](../_images/2112-accountRecoveryTemplate.jpg) - **Starts account recovery process:** [`/account-recovery` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/requestAccountRecovery) - **Resets the passkey options:** [`/webauthn/reset-options` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/resetPasskeyOptions) - **Resets the passkey** [`/webauthn/reset` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/resetPasskey) ## TikTok social provider We’ve added a new option to our growing list of social providers, [TikTok](https://developers.tiktok.com/doc/overview). Purse Identity collects the following user information from TikTok. - `open_id` - `union_id` - `avatar_url` - `username` For more details on using this social provider, see [TikTok](../../docs/tiktok.html). * * * ## Trigger password reset flow with custom identifier You can now trigger the reset password flow using a custom identifier. Previously, you could only achieve this with an email or phone number. ![2112 forgotPassword](../_images/2112-forgotPassword.jpg) For more details, see the [`/forgot-password` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/requestPasswordReset) in the Identity API. * * * ## New `check_updated_at` field for validating user data freshness We have a new `check_updated_at` field that you can pass that prevents profile data from being updated if the `updated_at` value in the payload is older than the `updated_at` value in the Purse Identity user database. **Affected endpoints**: - [Update a user](https://docs.identity.purse.eu/openapi/Management.html#operation/updateUser) - [Create a lite profile](https://docs.identity.purse.eu/openapi/Management.html#operation/pushLiteProfile) - [Update a lite profile](https://docs.identity.purse.eu/openapi/Management.html#operation/updateLiteProfile) Why is this important? 🤔 You may have several contributing stakeholders in your technical ecosystem that handle use profile data. The `updated_at` value is critical in knowing how fresh the user data is, and when many stakeholders contribute to that data, you don’t want stale data to remain or accidentally remove the latest data. The following scenarios result in the user profile data being updated with the request. **Scenario 1**: `check_updated_at` is `false` or null In this case, it doesn’t matter if the `updated_at` value is the same age, older, or newer. **Scenario 2**: `check_updated_at` is `true` If the payload’s `updated_at` value is newer than the database `updated_at` value, the update proceeds with the newer request data. `check_updated_at` is `true` If the payload’s `updated_at` value is older (or the same age as) than the database `updated_at` value, the update does not occur and you receive an error response. response ```none 400 Bad Request “Can't update the profile since updated_at value passed is anterior to the current record” ``` * * * ## Other improvements - We made some minor cosmetic improvements to the [Recent Activity](../../docs/support/manage-profiles-from-console.html#recent-activity) for user profiles on the Purse Identity Console. * * * ## Fixes ##### It was possible to bring in invalid provider values when importing identities. ✓ ##### The error for failed discoverable login attempts for the WebAuthn signup flow was inconclusive. We improved this error messaging to state explicitly that "Your account is not associated with the provided credentials" when this happens. ✓ --- # 30 May 2024 (v2.113) URL: /release-notes/previous-years/2113.html `Purse Identity v2.113` introduces a few improvements and needed bug fixes. Notably, you can now [remove the ban for specified IP addresses](#unblock-ip-addresses) with a dedicated endpoint. This includes the ability to [add the assetlinks.json or apple-app-site-association files](#passkeys-domain-association) directly in the Purse Identity Console. You can now add [reCAPTCHA actions](#recaptcha-actions) in the console reCAPTCHA configuration. We also made a few improvements related to [Purse Identity Console](#job-improvements) jobs. As always, we made some [general improvements](#other-improvements) and [fixed](#fixes) a few items for you. ## Unblock IP addresses You can already check the status of an IP address using the [`/ips/{IpAddress}` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/getIpStatus). Now, you’re able to "unban" or unblock a specific IP in the event a legitimate IP address was blocked by our security mechanisms. You can unban specific IPs using the [`/ips/{IpAddress}/unban` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/unbanIp). > You must have the `manage:ip` permissions to use this endpoint. Each time it’s used, an [audit log](../../docs/audit-logs.html) is produced ensuring you have full oversight of any unblocked IP addresses. ## Passkeys domain association Customers using a custom domain with our [Hosted Pages](../../docs/hosted-pages.html), your Relying Party ID is `[https://](https://);` and therefore, your Digital Asset Links file is served at `https:///.well-known/assetlinks.json`. However, for those without a custom domain, you can now add your `assetlinks.json` file directly in the Purse Identity Console at **Settings**  **Webauthn**. ![2113 well known passkeys](../_images/2113-well-known-passkeys.jpg) Want to know more? - For more details, see our [Android SDK documentation](../../sdk-android/index.html). - iOS documentation coming soon. * * * ## reCAPTCHA actions For Purse Identity Console users with reCAPTCHA configuration permissions, you can now add a list of user actions in the reCAPTCHA configuration in the console. If you do not add any actions, actions validation is disabled and does not affect your configuration. If you do add an action, it is checked against the reCAPTCHA API response and if not in the list, the action request is not authorized. ![recaptcha on console](../../docs/_images/security/recaptcha-on-console.jpg) Want to know more? - For more on actions, see [reCAPTCHA actions](https://cloud.google.com/recaptcha-enterprise/docs/actions-website). - For more details on using reCAPTCHA with Purse Identity, see [Enable reCAPTCHA from the console](../../docs/captcha/recaptcha.html). * * * ## Job improvements We have made a couple of improvements around jobs and particularly job reports and job definitions in the Purse Identity Console. This includes: - Ensuring that all job reports associated to a job definition are kept even if the job definition itself is removed from the Purse Identity Console. - Ensuring that the **Show job reports** link in the job definition console pages does in fact show associated job reports for the specified definition. Want to know more? - [Job reports](../../docs/job-reports.html) - [Import job definition](../../docs/imports.html) - [Export job definitions](../../docs/exports.html). ## Other improvements - We now ensure that the `{{verification_code}}` is sent in the email template for those using [Dialog Insight](../../docs/emails.html#dialog-insight) as their email provider. - We have improved the RBA score calculation to make sure that registering a second factor decreases the risk score. For more on this topic, see [Risk-based Authentication](../../docs/rba.html). - We have aligned the documentation and Purse Identity Console logos, icons, and branding to reflect our recent acquisition. For more on this topic, see [Purse Identity and Purse](https://www.reachfive.com/blog/fintech-purse-completes-acquisition-of-reachfive). * * * ## Fixes ##### Some error logs were producing duplicate error IDs. ✓ --- # 13 June 2024 (v2.114) URL: /release-notes/previous-years/2114.html `Purse Identity v2.114` introduces a few improvements and needed bug fixes. We have added additional [metadata](#metadata-in-passkeys-response) in the response when retrieving passkey credentials for a user. We’ve also improved some of our [user event messaging](#improved-user-event-messaging) and created a new endpoint to help you [get a list of blocked IPs](#retrieve-list-of-blocked-ips). As always, we made some [general improvements](#other-improvements) and [fixed](#fixes) a few items for you. ## Metadata in passkeys response To help better manage passkey identifiers, we have added metadata to the response when you retrieve a user’s passkey credentials. Now, when calling either the [`/webauthn/registration/{id}` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/getCredential) or [`/webauthn/registration` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/getCredentials), you’ll get information such as a unique identifier for the key, when the key was created and last used, a friendly name, and in some cases, the Authenticator Attestation Global Unique Identifier, also known as the `aaguid` which helps to identify the passkey provider. Example response ```json { "friendly_name": "My Sweet key", "aaguid": "adce0002-xxxx-0000-yyyy-0b25f1f05503", "created_at": "2026-06-04T13:24:46.505Z", "last_used_at": "2026-06-05T08:38:46.270Z", "id": "f7nfAfGW…​NA_lRoPQo=" } ``` * * * ## Improved user event messaging Previously, when an email, SMS, or hook (such as a webhook or Pub/Sub hook) failure occurred, we only logged generally that an error had occurred. Now, more information is provided when the error occurs, so you’re able to more easily resolve the issue. We have updated one existing user event and also added a new event to help with this: - `failed_hook_message` now contains both the message and error code so you have more specific information handling errors. ```json ... "failed_hook_message": "{\"detail\": \"Duplicated external id\", \"code\": \"711\"}" ... ``` - **New** `failed_message_error` is a new user event field gives more information about why an email or SMS attempt failed. For more details, see [User Events](../../docs/models-user-events.html). * * * ## Retrieve list of blocked IPs We have created a new management endpoint that allows you to retrieve a list of blocked (banned) IPs so you have a comprehensive view of those IPs that have been blocked by our security protocol. **New endpoint:** [GET `/api/v2/ips`](https://docs.identity.purse.eu/openapi/management.html#operation/getBlockedIps) Example response ```json { "total": 2, (1) "items": [ (2) { "ip" : "1.1.1.1", "report": { "expires": "2026-11-21T13:51:50Z", "created_at": "2026-11-25T13:51:50Z" } }, { "ip" : "2.2.2.2", "report": { "expires": "2026-11-21T13:51:50Z", "created_at": "2026-11-25T13:51:50Z" } } ] } ``` - (1) Lists the total of blocked IPs. - (2) Blocked IPs are sorted by the most recent first. The list is paginated to ensure there are no performance issues. * * * ## Other improvements - We improved the error messages provided to end users through the UI SDK as they were not specific enough for the user to understand why the error occurred. * * * ## Fixes ##### In some limited cases, newly-created lite profiles containing an email from an existing managed profile weren’t properly associated with the managed profile as expected. ✓ ##### It was temporarily possible to attempt to delete compromised profiles before the Identity Fraud Protection feature was enabled, meaning the deletion attempt would fail. ✓ ##### There was a small discrepancy when editing custom fields in the Purse Identity Console whether the expected response should be camelCase or snake\_case. For more details, see Management API: Custom field schemas. ✓ --- # 01 July 2024 (v2.115) URL: /release-notes/previous-years/2115.html `Purse Identity v2.115` introduces a few improvements and needed bug fixes. With this release, you can now [revoke user tokens at the client level](#revoke-tokens-at-the-client-level). The `transports` claim is now fully available in the [public key response](#transports-in-webauthn-endpoint-response) for the `/webauthn/authentication-options` endpoint. You can also now [perform the stepup operation](#perform-stepup-with-other-authentication-methods) in more ways including using social provider logins for MFA second factors. As always, we made some [general improvements](#other-improvements) and [fixed](#fixes) a few items for you. ## Announcements Mobile MFA methods We are happy to announce that alongside this release, we have also introduced mobile MFA methods for both Android and iOS. For more on each release, check out [Android SDK releases](https://github.com/ReachFive/identity-android-sdk/releases/) and [iOS SDK releases](https://github.com/ReachFive/identity-ios-sdk/releases/). The following methods are now available to use: - [endStepUp](../../sdk-android/endStepUp.html) - [listMfaCredentials](../../sdk-android/listMfaCredentials.html) - [removeMfaEmail](../../sdk-android/removeMfaEmail.html) - [removeMfaPhoneNumber](../../sdk-android/removeMfaPhoneNumber.html) - [startMfaEmailRegistration](../../sdk-android/startMfaEmailRegistration.html) - [startMfaPhoneNumberRegistration](../../sdk-android/startMfaPhoneNumberRegistration.html) - [startStepUp](../../sdk-android/startStepUp.html) - [verifyMfaEmailRegistration](../../sdk-android/verifyMfaEmailRegistration.html) - [verifyMfaPhoneNumberRegistration](../../sdk-android/verifyMfaPhoneNumberRegistration.html) - [mfaStart(Registering credential)](../../sdk-ios/mfaStart.html) - [mfaStart(WithStepUp)](../../sdk-ios/mfaStartWithStepUp.html) - [mfaVerify(Credential)](../../sdk-ios/mfaVerify.html) - [mfaVerify(WithStepUp)](../../sdk-ios/mfaVerifyWithStepUp.html) - [mfaListCredentials](../../sdk-ios/mfaListCredentials.html) - [mfaDeleteCredential](../../sdk-ios/mfaDeleteCredential.html) ## Revoke tokens at the client level You can now revoke user tokens at the client level directly from the Purse Identity Console. This is applicable to both First-party and Third-party Identity clients, but not Management clients. For more information, see [Clients](../../docs/clients.html). ![revoke tokens client console](../../docs/_images/console/clients/revoke-tokens-client-console.jpeg) * * * ## `transports` in WebAuthn endpoint response The `transports` claim is now fully available in the public key response in the `allow_credentials` object. Affected endpoints: - [`/webauthn/authentication-options` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/createAuthenticationOptions) The `transports` field assists the Relying Party (the service requesting authentication) in understanding how the authenticator can be communicated with. > This is useful for optimizing both user experience and troubleshooting any potential authentication issues. Example response ```json { "public_key": { "allow_credentials": [ { "id": "X9FrwMfmzj...", "type": "public-key", "transports": ["ble", "internal"] (1) } ], "challenge": "kYhXBWX0HO5GstIS02yPJVhiZ0jZLH7PpC4tzJI-ZcA=", "rp_id": "demo.reachfive.com", "timeout": 120000, "user_verification": "discouraged", }, } ``` - (1) List of transport types supported by the authenticator. For more details, see [WebAuthn `transports`](https://www.w3.org/TR/webauthn-2/#dom-authenticatorattestationresponse-transports-slot). * * * ## Perform stepup with other authentication methods Previously, for users to perform a stepup operation, they needed to have initially logged in with a username and password combination. Now, they can authenticate with their chosen method, including Social Login providers such as Google, Apple, Facebook, or any other supported [social provider](../../docs/social-login-overview.html) and still partake in the stepup flow. In the social login case, `amr` is valued with the authentication method `slo`. For more details, see [Multi-factor Authentication](../../docs/mfa.html). * * * ## Other improvements - We now ensure that any invalid provider type is ignored during user imports, ensuring a smoother, more reliable import process. - We improved the error messaging for when users attempt to use MFA on a lite profile. Now, you’ll receive the `error.mfa.noLiteOnly` with the message that "A lite profile cannot register a mfa credential". Affected endpoints include [`mfa/credentials/phone-numbers`](https://docs.identity.purse.eu/openapi/identity.html#operation/startPhoneNumberRegistration) and [`/mfa/credentials/emails`](https://docs.identity.purse.eu/openapi/identity.html#operation/startEmailRegistration) - You can now manage your employees that authenticate via Okta using our SCIM feature. For more information, see [System for Cross-domain Identity Management (SCIM)](../../docs/integration/scim.html). * * * ## Fixes ##### In some cases, there was a discrepancy between the expiry of the challenge and the verification code. ✓ ##### In some limited circumstances, the User Event ID wasn’t being exported as part of export jobs. ✓ ##### When confirming a Double opt-in consent, users were unexpectedly receiving an invalid token error. ✓ --- # 18 July 2024 (v2.116) URL: /release-notes/previous-years/2116.html `Purse Identity v2.116` introduces a few improvements and needed bug fixes. We’re happy to introduce [two new user event types](#new-user-event-types). You can also now retrieve the [`account_name`](#account-name-in-pubsub-audit-response) in a Pub/Sub audit log response. It’s possible from this release to [modify `origins`](#modify-origins-with-import-job) through import jobs. We’ve also updated the Purse Identity Console to ensure [consent types are not preselected](#no-preselected-consent-type) and made some improvements for [orchestrated flows](#improved-orchestrated-flows). As always, we made some [general improvements](#other-improvements) and [fixed](#fixes) a few items for you. ## New user event types We’ve introduced two new user event types related to passkeys. - `webauthn_credential_created`: Emitted after a passkey was successfully created. - `webauthn_credential_deleted`: Emitted after a passkey was successfully deleted. For more information, see [User Events](../../docs/models-user-events.html). How can I use them? 🤔 The new user event types are searchable with the following endpoints: - GET [`/identity/v1/userevents`](https://docs.identity.purse.eu/openapi/identity.html#operation/searchUserEvents) - GET [`/api/v2/user-events`](https://docs.identity.purse.eu/openapi/management.html#operation/searchUserEvents) - GET [`/api/v2/users/{userId}/events`](https://docs.identity.purse.eu/openapi/management.html#operation/searchUserEventsByUserID) You can also use them with [Pub/Sub hooks](../../docs/pub-sub-hook.html) and [Post-event webhooks](../../docs/webhooks.html). * * * ## Account name in Pub/Sub audit response In order for administrators to more closely follow and make decisions on how critical or important an event is, we now retrieve the `account_name` in the Pub/Sub audit log response. > `account_name` is only present in the Pub/Sub message, not the API response. For more information, see [Audit logs](../../docs/audit-logs.html). Example ```json { "user_email": "user@gmail.com", "entity_name": "jobs", "user_name": "My user name", "action_name": "create", "account_name": "top-account", (1) "created_at" : "2021-09-09T09:21:22.107809Z", "id": "a040230b-60...998", "ip_address": "x.x.x.x", "action_data": { "jobId": "AXvK4s..UnUYyz", "jobType": "export" }, "client_id": "Console ReachFive", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36" } ``` - (1) `account_name` specifies the name of the Purse Identity account. * * * ## Modify `origins` with import job You can now modify the `origins` user profile field through import jobs. This is valuable in recovery situations, error resolution, or integration issues. > The import job overwrites any existing origin(s). **What is an origin? 🤔** An origin is the channel through which the user authenticated. This could be a website, or perhaps a mobile app. It is defined via user interaction and only authenticated profiles contain `origins`. This means [lite profiles](../../docs/lite-profiles.html) **do not** contain the field. You can value this field via the Identity API, our SDKs, and through [imports](../../docs/imports.html). However, the field cannot be valued through the Management API. ```json ... "origins": [ "web", "xbox" ], ... ``` For more information, see [User Profile](../../docs/models-user-profile.html). * * * ## No preselected consent type We now ensure there is no consent type preselected when creating a new consent in the Purse Identity Console. This ensures all consent types are intentionally chosen by the person creating the consent. For more information, see [Consents](../../docs/consents.html). ![2116 consent default select type](../_images/2116-consent-default-select-type.jpeg) * * * ## Improved orchestrated flows We now handle `prompt=none` in a standard fashion to better support orchestrated flows, meaning that the flow can now properly perform silent authentication. This was made possible through a much needed [fix described below](#orchestrated-fix). > Silent authentication mandates no user interaction, which is why we redirect back with an error if no session exists. ![diagram](../_images/bcdaded0860757bfec2ad41ad4e01657e26d075a.svg) * * * ## Other improvements - We’ve improved the wording under the [recent activity](../../docs/support/manage-profiles-from-console.html#recent-activity) section of the Purse Identity Console for when users log in with a custom identifier. **New wording**: Logged-in using password with custom\_identifier - You can now connect to the Purse Identity Console with [Okta](../../docs/okta.html). - We’ve made some changes to ensure better stability for [import jobs](../../docs/imports.html). - For those using Oracle Responsys, we now include a `boolean` to check if a user’s email is verified so you can better customise your email templates. * * * ## Fixes ##### There was an issue with editing consents if changes were made (such as archiving a consent) in the Purse Identity Console. This was affecting consent validation, but it has now been fixed. ✓ ##### In some cases, even when toggled off, some social providers continued to be shown as available in the Purse Identity Console. This was causing some providers to inadvertently appear in UI widgets and hosted pages. ✓ ##### It was temporarily impossible to add URLs with hyphens (-) in a consent description. ✓ ##### We now ensure all MFA activations are shown properly in our Premium Analytics . ✓ ##### response\_mode=web\_message was dropped, causing /oauth/authorize to respond with HTTP 303 instead of HTTP 200; the --- # 1 August 2024 (v2.117) URL: /release-notes/previous-years/2117.html `Purse Identity v2.117` introduces a few improvements and needed bug fixes. You can now [validate the verification code with query parameters](#validate-verification-code-with-query-parameters) for the MFA flow. We have also [increased control over profile visibility](#increased-control-over-profile-visibility) for our customers that want more control over the default profile view. There is now an option to [return the `__Host-trusted-device-id` cookie](#trusted-device-cookie-returned-in-oauthtoken) in the `/oauth/token` endpoint. As always, we [fixed](#fixes) a few items for you. ## Validate verification code with query parameters You can now validate the verification code needed for the MFA flow using the GET `/identity/v1/passwordless/verify` endpoint. Previously, it had to be done solely through the POST `/identity/v1/passwordless/verify` endpoint. There are three possible query parameters needed if using the endpoint for the MFA flow, two of which are required: - **required** `challenge_id` - **required** `verification_code` - **optional** `trust_device` (default is `false`) For more details, see the [`/identity/v1/passwordless/verify` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyPasswordless). * * * ## Increased control over profile visibility With `v2.117`, we have introduced a feature flag called "Mandatory search filters" where you can enforce the use of filters when viewing your user profiles on the Purse Identity Console. When enabled, no profiles are shown by default, meaning to see profiles, the Purse Identity Console user needs to use the filter option. If not explicitly enabled, the default view shows all profiles. To enable the feature, you should contact your Purse Identity [Support or PS representative](mailto:support@reach5.co). ![2117 filter profiles](../_images/2117_filter-profiles.jpg) Filter profiles example * * * ## Trusted device cookie returned in `/oauth/token` We have introduced the option to return the `__Host-trusted-device-id` cookie with the `/oauth/token` endpoint if certain features are enabled for an account. This builds on the ability to [validate the `verification_code` with query parameters](#validate-verification-code-with-query-parameters) mentioned above and is primarily used for backend integrations that want to retain control on this cookie. What is the `__Host-trusted-device-id` cookie? 🤔 This cookie identifies the device is marked as trusted. It is used as a header cookie parameter when logging in. Example ```sh Set-Cookie: __Host-trusted-device-id=00112233-4455-6677-8899-aabbccddeeff ``` In order to be able to retrieve the `__Host-trusted-device-id` cookie in the response, you need to do the following: 1. Ensure the option to "Include cookies in token endpoint" is checked on the desired client in the Purse Identity Console. View from the console ![2117 include cookie console](../_images/2117_include-cookie-console.jpg) 2. [Risk-based authentication](../../docs/rba.html) must be enabled for your account. 3. And of course, during the flow, the user must have trusted the device during the verification process. For more details, see [Clients](../../docs/clients.html) and [`/oauth/token` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/retrieveAccessToken). * * * ## Fixes ##### It was temporarily impossible to add URLs that contained hyphens (-) as part of the path (/path-with-url/consents/) for a consent description. ✓ --- # 27 August 2024 (v2.118) URL: /release-notes/previous-years/2118.html `Purse Identity v2.118` introduces a few improvements and needed bug fixes. We have introduced a new [user event type](#new-logout-user-event-type). You can also now [delete a user’s phone number](#delete-phone-number-with-endpoint) with the update-phone-number endpoint. In addition, [KakaoTalk connecting information](#kakaotalk-updates) is available as a filter on webhooks. As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## New `logout` user event type We have introduced a new user event type with this release. The new user event type is called `logout` and it is emitted anytime a user logs out. Monitoring `logout` events is useful for better understanding user session patterns and strengthening security and auditing. For more, see [User Events](../../docs/models-user-events.html). * * * ## Delete phone number with endpoint You can now delete a user’s phone number from his or her profile using the [`/identity/v1/update-phone-number` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePhoneNumber) by passing a null or empty value in the request body. POST `/identity/v1/update-phone-number` ```json { "phone_number": null (1) } ``` - (1) Pass either `null` or "" (empty value). * * * ## KakaoTalk updates The KakaoTalk "Connecting Information" user profile field is now filterable with webhooks. For more, see [User Profile](../../docs/models-user-profile.html) and [User-event webhooks](../../docs/webhooks.html) respectively. ![2118 kakaoConnectingInformation](../_images/2118_kakaoConnectingInformation.jpg) * * * ## General improvements - We made a small change to the Purse Identity Console to indicate that we support JSONL files. What is JSONL? 🤔 [JSON Lines (JSONL)](https://jsonlines.org/), represents each JSON object on a new line where each line is a valid JSON object. We use JSONL to optimise performance since it’s better for processing large datasets and easier to append additional JSON objects. Example JSONL ```json {"id": 1, "name": "Alejandro", "email": "alejandro@example.com"} {"id": 2, "name": "Lucille", "email": "lucille@example.com"} {"id": 3, "name": "Bertrand", "email": "bertrand@example.com"} ``` - Custom identifiers can now be between **3-100** characters as opposed to 4-100 characters as before. - You can now jump to the job definition directly from the job reports page by clicking the job definition ID. ![2118 link job definition id](../_images/2118_link-job-definition-id.jpg) - Audit logs older than one year are now removed. * * * ## Fixes ##### In some instances, the last\_login\_type value was empty for users even after successful login. ✓ ##### For some users authenticating via Social Login such as with Facebook, the updated\_at value was being modified even if there was nothing modified on the profile. ✓ ##### In some limited circumstances, Risk-based Authentication (RBA) user events were being generated in standard MFA flows unexpectedly. ✓ --- # 12 September 2024 (v2.119) URL: /release-notes/previous-years/2119.html `Purse Identity v2.119` introduces a few improvements and needed bug fixes. You can now view the cluster for your account in your [Purse Identity Console settings](#console-settings-cluster-name). It’s also now possible to [initiate a stepup flow](#no-fresh-token-needed-to-initiate-stepup-flow) without a fresh access token. As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Console settings cluster name You can now view the specific cluster that your Purse Identity account is on directly in your Purse Identity Console settings. For more on your Purse Identity Console settings, see [Account settings](../../docs/console.html#account-settings). ![2119 settings cluster](../_images/2119_settings_cluster.jpg) * * * ## No fresh token needed to initiate stepup flow Before, it was required that a fresh access token\[[1](#_footnotedef_1 "View footnote.")\] was needed to initiate the stepup flow. Due to the tight security protocols of the stepup flow, there is now no longer a need for a fresh access token to initiate the flow. For more, see the [`/identity/v1/mfa/stepup` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/stepup). * * * ## General improvements - In order to optimise response times when searching audit logs, you can now only search audit logs by filtering on the following fields: - `id` - `action_name` - `entity_name` - `created_at` For more details, see the [`/api/v1/audit-logs` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/searchAuditLogs). - We have improved the error messaging for when a user tries to log in with a social provider with an unverified email to ensure it’s easier to recognize how to resolve the issue. ```none The email address associated with this account is unverified for the profile ID: PROFILE_ID (1) ``` - (1) Where `PROFILE_ID` is the Purse Identity profile ID. For more, see [SDK and API errors](../../docs/errors.html). * * * ## Fixes ##### There was a minor issue related to trusted device cookies that has now been resolved. ✓ ##### For a brief period of time, the Purse Identity Console settings were unavailable for some customers. ✓ * * * [1](#_footnoteref_1). A fresh token is a token less than 5 minutes old. --- # 26 September 2024 (v2.120) URL: /release-notes/previous-years/2120.html `Purse Identity v2.120` introduces a few improvements and needed bug fixes. We are happy to announce new releases of both our [Android and iOS mobile SDKs](#mobile-sdk-releases). We have introduced [new Management API endpoints](#new-management-api-endpoints) for fetching users by different ID types. As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Mobile SDK releases Alongside this release, we have released new versions of both our Android and iOS mobile SDKs, each containing exciting updates. The Android `9.3.0` release includes new methods allowing you to manage trusted devices for [Risk-based Authentication](../../docs/rba.html) support. - [listMfaTrustedDevices](../../sdk-android/listMfaTrustedDevices.html) - [removeMfaTrustedDevice](../../sdk-android/removeMfaTrustedDevice.html) You can also now [start the stepup flow](../../sdk-android/startStepUp.html) using the [`loginWithPassword` method](../../sdk-android/loginWithPassword.html) when MFA is required. The iOS `7.1.0` release now supports native [Sign in with Apple](https://developer.apple.com/sign-in-with-apple/). For more on this topic, see [iOS use cases](../../sdk-ios/guides/use-cases.html). ## New Management API endpoints We have created dedicated endpoints to fetch users more specifically by email, phone number, custom IDs, and external IDs. This means, the previously deprecated `/users/email/:email` endpoint is available again. The three new endpoints are: - **GET user by external ID**: [`/users/external_id/:externalId` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/getUserByExternalId) - **GET user by custom ID**: [`/users/custom_id/:customId` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/getUserByCustomId) - **GET user by phone number**: [`/users/phone_number/:phoneNumber` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/getUserByPhoneNumber) * * * ## General improvements - We updated the Purse Identity Console Job related screens (such as Job reports and Job definitions) to display the **Last updated** column with specific date and time information instead of the general X days/months/years ago. ![2120 lastUpdated console](../_images/2120_lastUpdated-console.jpg) - We’ve improved the labelling on the Purse Identity Console so that when you select the fields to send in a [Pub/Sub hook](../../docs/pub-sub-hook.html) or [webhook](../../docs/webhooks.html), it’s clear that **Login Time (Deprecated - Use Date instead)** is just an alias for **Event - Date**. Unless your setup explicitly requires Login Time, it’s best to use **Event - Date**. ![2120 event date console](../_images/2120_event-date-console.jpg) * * * ## Fixes ##### Some import jobs were taking longer than expected to import user profiles. ✓ ##### In some limited cases when a user was created, the auth\_type user event was unexpectedly empty. ✓ --- # 10 October 2024 (v2.121) URL: /release-notes/previous-years/2121.html `Purse Identity v2.121` introduces a few improvements and needed bug fixes. We have several updates to our [UI SDK](#ui-sdk-updates). We also made some improvements to the [Identity Fraud Protection](#identity-fraud-protection-updates) feature. You can now [use a Custom login page](#openid-as-a-service-updates) with your Third-party Identity clients. As always, we [fixed](#fixes) a few items for you. ## UI SDK updates There are several updates to the UI SDK as part of the UI SDK version `1.28.0` release. This includes: - A new [`allowAuthentMailPhone` parameter](#allowAuthentMailPhone-parameter). - A new [`phoneNumberOptions` parameter](#countryCode-parameter). - The ability to [use i18n keys](#use-i18n-keys-to-override-text) to override social login page titles. - The ability to use a [visual marker for required fields](#visual-marker-for-required-fields). ### `allowAuthentMailPhone` parameter You may only want your users to authenticate using a [custom identifier](../../docs/models-user-profile.html#custom_identifier). In cases like this, it’s important to hide the option to login with an email or phone number. With this in mind, we’ve introduced the `allowAuthentMailPhone` parameter. The `allowAuthentMailPhone` parameter is a `boolean` that you can set to show (or not show) the email and/or phone number option to your users. It is `true` by default, meaning your users will see the option unless you explicitly set it to `false`. For more on this topic, see [UI SDK: showAuth.allowAuthentMailPhone](../../sdk-ui/showAuth.html#allowAuthentMailPhone). Example ```js client.showAuth({ container: 'auth-container', auth: { redirectUri: 'https://example.com/auth-callback' }, allowAuthentMailPhone: false (1) }) ``` - (1) In this case, users don’t see the option to authenticate with email or phone number. ### `phoneNumberOptions` parameter You now also have the option to display a country code option in any widget where phone numbers are displayed, meaning users can select the country from the dropdown menu. To display the country code, you have to use the new `phoneNumberOptions` object that allows you to set a the `withCountrySelect` boolean to `true`. Otherwise, the country code selected when you instantiated the UI SDK is used. If you didn’t select a country code at instantiation, no country code is shown. For more on this topic, see [UI SDK: showAuth.phoneNumberOptions](../../sdk-ui/showAuth.html#phoneNumberOptions). ![widget phone select country](../../sdk-ui/_images/widget_phone-select-country.jpeg) ```js client.showAuth({ container: 'auth-container', auth: { redirectUri: 'https://example.com/auth-callback' }, phoneNumberOptions: { withCountrySelect: true (1) } }) ``` - (1) In this case, users are shown the option to select a country for their mobile number. By default, `withCountrySelect` is `false`. ### Use i18n keys to override text You can now override a social login button text by with an `i18n` key. For example, if you wanted to use Korean (한국인) (or another one of our [Supported languages](../../docs/global-consumers/languages.html)) for the login title, you could do it this way. For more on this topic, see [UI SDK: showAuth.i18n](../../sdk-ui/showAuth.html#i18n). Example ```js client.showAuth({ container: 'auth-container', auth: { redirectUri: 'https://example.com/auth-callback' }, i18n: { "socialButton.kakaotalk.title": "카카오톡으로 로그인" (1) } }) ``` - (1) Users see "카카오톡으로 로그인" (Log in with KakaoTalk) for the KakaoTalk login option in this example. ### Visual marker for required fields You can now ensure users better know which fields are required in your forms with the `showLabels` parameter. When set to `true`, the widget shows which fields are required with an asterisk (`*`) next to the required field. When set to `false`, the widget does not show which fields are required. For more on this topic, see [UI SDK: showAuth.showLabels](../../sdk-ui/showAuth.html#showLabels). ![showLabels true required fields](../../sdk-ui/_images/showLabels_true_required_fields.jpg) Example ```js client.showAuth({ container: 'auth-container', auth: { redirectUri: 'https://example.com/auth-callback' }, showLabels: true (1) }) ``` - (1) In this case, users see the asterisk (`*`) next to required fields. * * * ## Identity fraud protection updates We’ve made some updates to the [Identity Fraud Protection](../../docs/ifp.html) which ensures that compromised profiles listed in the Purse Identity Console have even more accuracy on the identifier type ensuring optimal protection for your site. To view compromised profiles: 1. Log in to your Purse Identity Console. 2. Go to Analytics. 3. Select Compromised profiles. ![compromised profiles](../../docs/_images/console/compromised-profiles.png) ## OpenID as a Service updates Our [OpenID as a service](../../docs/oaas.html) feature now lets you use a **Custom Login URL**. This means you no longer are required to use the [Hosted Pages](../../docs/hosted-pages.html) login page as part of the implementation. If you do not explicitly enable the **Custom login page** feature, the Hosted Pages login is still used. To enable the feature: 1. Log in to your Purse Identity Console. 2. Go to **Settings**  **Clients**. 3. Choose your desired Third-party Identity client. 4. Scroll down until you see **Custom login page**. 5. Click **Custom login page**. 6. Enter your custom login page URL. ![2121 custom login 3client](../_images/2121_custom_login_3client.jpg) * * * ## Fixes ##### There was temporarily an issue with pagination in the Purse Identity Console. ✓ --- # 24 October 2024 (v2.122) URL: /release-notes/previous-years/2122.html `Purse Identity v2.122` introduces a few improvements and needed bug fixes. This includes being able to view [MFA credentials in a user profile card](#mfa-credentials-in-user-profile-card). You can also now [use multiple social provider accounts](#use-multiple-social-accounts-for-purse-identity-account) for select social providers and [filter by social provider ID](#filter-by-social-provider-id). As always, we [fixed](#fixes) a few items for you. ## MFA credentials in user profile card If enabled and present for an account, MFA credentials are now displayed on the user profile card in the Purse Identity Console. An MFA credential is a mobile or email that the user has verified for use as a second factor for our MFA feature. For more on these topics, see [Multi-factor Authentication](../../docs/mfa.html) and [Managing users from the Purse Identity Console](../../docs/support/manage-profiles-from-console.html) respectively. ![2122 MFA profile](../_images/2122_MFA_profile.jpg) * * * ## Use multiple social accounts for Purse Identity account You can now use multiple social accounts for your Purse Identity account by providing a `provider_variant` when configuring the social account in the Purse Identity Console. This update applies to Facebook, Google, and Apple social login accounts. To have a different "variant" of the social login, you’ll add a variant tab in the social configuration where you provide the `client_id` and `client_secret` needed for that particular account, allowing you to have multiple associated with your Purse Identity account. For more on this topic, see [Meta Connect (Facebook Login)](../../docs/facebook.html), [Sign in with Apple](../../docs/apple.html), and [Google Connect](../../docs/google.html) respectively. You must create a variant for [Sign in with Apple](../../docs/apple.html) now unless you use [webviewLogin](../../sdk-ios/webviewLogin.html) for all authentication flows, including Sign in with Apple (SiWA). It’s important to note that the Purse Identity **Client ID** mapping differs depending if you’re creating a connection for web context or native app context. The text `ios` must be in the name of the variant. ![add apple variant](../../docs/_images/social-providers/apple/add-apple-variant.jpg) Adding a variant with [Meta Connect (Facebook Login)](../../docs/facebook.html): ![2122 provider variant facebook](../_images/2122_provider_variant_facebook.jpg) Adding a variant with [Google Connect](../../docs/google.html): ![add google variant](../../docs/_images/social-providers/google/add-google-variant.jpg) * * * ## Filter by social provider ID You can now filter by the social provider ID (`identities.id`) on the [`/api/v2/users` search users endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/searchUsers). This is useful in cases where a user has unlinked his or her profile from their social provider and you need to also unlink it from your brand’s side. For more on this topic, see [Identities object](../../docs/models-user-profile.html#identities-object). Example call ```none GET /api/v2/users?filter=identities.id=="kakaotalk:4211574058" ``` * * * ## Fixes ##### There was briefly an issue with retrieving custom fields when attempting to login as a user. ✓ --- # 7 November 2024 (v2.123) URL: /release-notes/previous-years/2123.html `Purse Identity v2.123` introduces a few improvements and needed bug fixes. We’re happy to introduce our [Data Breach Detection](#release-highlight) feature. We now retrieve an [additional field from Kakao](#kakao-verified-phone-numbers). You can also now [filter users by MFA credentials](#filter-by-mfa-users) on the Purse Identity Console. As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Release highlight Data Breach Detection ![2123 dbd](../_images/2123_dbd.jpg) Our Data Breach Detection feature enhances your security by identifying leaked passwords before they lead to unauthorized access on your site. The feature actively scans for known leaked credentials and cross-references them with attempts to log in, sign up, or update a password. When a leaked password is detected, the user can be temporarily suspended (if configured), preventing continued use of the compromised password. When you choose to add the Data Breach Detection feature to your Purse Identity integration, you get added protection against data breaches, ensuring your users know your brand is dedicated to mitigating security risks on their behalf. Staying on top of leaked passwords builds trust and ensures valuable user information isn’t put at risk. Enable the protection directly in the Purse Identity Console knowing user events are logged to mark when leaked credentials are in use and deleted for further auditing purposes. Automatically notify users with dedicated email and SMS templates (Log in option). For more, see [Data Breach Detection](../../docs/security/data-breach-detection.html). ## Kakao verified phone numbers You are now able to retrieve and leverage the `phone_number_verified` information from KakaoTalk. The information below outlines what happens when users authenticate using Kakao with Purse Identity. > If the `phone_number` scope does not exist for the account, neither the `phone_number` or `phone_number_verified` fields are retrieved or valued inside the Purse Identity profile for the user. If the SMS feature is enabled and the `phone_number` scope exists, we retrieve the `phone_number_verified` and set the boolean on their Purse Identity profile to the appropriate value `true` if verified and `false` if unverified. If the SMS feature is not enabled, even if the `phone_number` scope exists, `phone_number_verified` remains `false`. For more details, see [Kakao Connect](../../docs/kakao-connect.html). * * * ## Filter by MFA users You can now filter users by those who have enrolled their identifier (email or phone number) for [Multi-factor Authentication](../../docs/mfa.html). This can help you analyse or produce reports of how many of your users are using MFA. This includes filtering by the MFA credential type, when it was created, and the phone number. Email is the email associated with the user account and is returned as normal in a search. This is available for filtering: - User profiles on the Purse Identity Console - Pre and post-event [webhooks](../../docs/webhooks.html) - [Pub/Sub hooks](../../docs/pub-sub-hook.html) - With the [GET `api/v2/users` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/searchUsers) using the MFA credential object. Example ```none GET api/v2/users?filter=credentials.type=="email" ``` ### Example scenario You want to get a quick reference of how many of your users have enrolled their mobile or email for MFA. 1. Go to your Purse Identity Console. 2. Navigate to **Analytics**  **Profiles**. 3. Click Filter. 4. In the field, type **MFA** and you see the options to filter by the following: - User - MFA - Type (Authentication) - User - MFA - Email - Created At - User - MFA - Phone Number - Created At - User - MFA - Phone Number - Value ![2123 MFA profile filter](../_images/2123_MFA_profile_filter.jpg) > See the [MFA credentials object](../../docs/models-user-profile.html#mfa-credentials-object) for details on each of these fields. ## General improvements - We made some improvements to ensure that `external_id` is valued and retained properly in the [User profile object](../../docs/models-user-profile.html). ## Fixes ##### The logout user event wasn’t being properly displayed under Recent activity on the Purse Identity Console. ✓ ##### There were some role issues for users authenticating to the Purse Identity Console with Azure. ✓ ##### There was temporarily an access issue for those using MFA on the Purse Identity Console. ✓ ##### There was a brief issue with updating roles for clients in the Purse Identity Console. ✓ ##### For a brief period, you could not save changes to Email templates. ✓ --- # 21 November 2024 (v2.124) URL: /release-notes/previous-years/2124.html `Purse Identity v2.124` introduces a few improvements and needed bug fixes. You can now [specify which identifiers](#allowed-identifiers) are allowed to attempt to log in to your site. We made some important [Risk-based authentication updates](#risk-based-authentication-updates). You can also now pass the [`variant` name](#define-provider-variant) for social providers directly through the [iOS SDK](../../sdk-ios/index.html). For the [UI SDK](../../sdk-ui/index.html), we have added the `allowPhoneNumberResetPassword` parameter so users can [use a phone number](#ui-sdk-updates) to initiate the password reset flow. In addition to the above, you can now [update a user password hashing algorithm with the Management API](#update-user-password-with-management-api). As always, we [fixed](#fixes) a few items for you. ## Allowed identifiers You can now specify which identifiers are allowed to attempt to log in to your site. The feature provides an added layer of control to ensure that only matching identifiers are allowed to log in, streamlining the authentication process and enhancing security for your setup. This configuration only applies to password authentication. The configuration does not affect social logins, passwordless, or passkeys. For more details, see [Specify allowed identifiers](../../docs/block-unverified-logins.html#specify-allowed-identifiers). Enable this in the Purse Identity Console: 1. Go to **Settings**  **Attack protection policy**  **Allowed identifiers**. 2. Toggle which identifiers you want to be able to attempt to log in to your site. Those that are not enabled will no longer be able to attempt logins. - Email - Phone Number - Custom identifier 3. Don’t forget to **Save** your input.. ![allowed identifiers login](../../docs/_images/security/allowed-identifiers-login.jpg) ### Error message Users that attempt to login with an unverified identifier receive an [error message](../../docs/errors.html) informing them that they cannot log in with the specified identifier. > You cannot authenticate using {0} — Error key: error.invalidLoginType Affected endpoints - [`/password/login` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/loginWithPassword) - [`/oauth/token` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/authorizeUser) * * * ## Risk-based authentication updates We’ve enhanced our Risk-based authentication (RBA) feature to give you greater flexibility and control. You can now exclude specific client IDs from RBA protections directly through the Purse Identity Console, ensuring tailored security configurations that suit your unique needs. For more, see [Risk-based Authentication](../../docs/rba.html). ![2124 rba exclude](../_images/2124_rba_exclude.jpg) * * * ## Define provider variant We’re happy to introduce a new capability in our iOS SDK for social providers like Apple, Facebook, Google, and WeChat. You can now pass a specific "variant" name directly through the provider object to tailor the behavior for your use case. If no variant is specified, the SDK uses the first variant with "ios" in the name. ```swift static let reachfive: ReachFive = ReachFive( sdkConfig: sdkRemote, providersCreators: [ GoogleProvider(), (1) FacebookProvider(variant: "ios_app"), (2) AppleProvider(variant: "ios_default"), WeChat(variant: "ios17")] ) ``` - (1) Here, no `variant` is passed so the object takes the first variant containing `ios` in its name. - (2) Example of defining an `ios` variant. This feature provides added flexibility for scenarios like: 1. **Multi-brand Apps**: Seamlessly support distinct branding or custom login flows for different app versions by specifying the appropriate variant. 2. **Testing and Debugging**: Quickly switch between variants for A/B testing or troubleshooting without altering server-side configurations. For more details, see [iOS SDK](../../sdk-ios/index.html). * * * ## UI SDK updates We have introduced a new `allowPhoneNumberResetPassword` parameter to [showAuth](../../sdk-ui/showAuth.html) so users can use a phone number to reset their password. For more, see [showAuth](../../sdk-ui/showAuth.html). ## Update user password with Management API You can now update a user password hashing algorithm through the Management API. To do this, you should use the [`/users/:userId` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/updateUser) and pass the following as part of the request body: ```json { ... "password_hash": { "value": "$2b$12$KIXwPlj7FZ9dTjph4GxGhu3ofk1KFe.KjLw6gNlD72zyGIBlIL7H6", (1) "algorithm": "plaintext" (2) } ... } ``` - (1) Pass the hashed password. - (2) Specify the encryption algorithm, such as `bcrypt`. See [Allowed algorithms](../../docs/import-passwords-from-the-console.html) for more details. * * * ## Fixes ##### There were some inconsistencies on custom fields with the data type integer. In some cases, the API response would signal the custom field was not updated, when in fact it was. ✓ ##### Some user login data returned from a webhook was not taken into account on the user profile. ✓ ##### There were some minor UX issues for Analytics on the Purse Identity Console. ✓ ##### For a brief period, changes to SMS templates were not being saved on the Purse Identity Console. ✓ ##### You were temporarily unable to save updates to the Adobe Campaign email template. ✓ --- # 5 December 2024 (v2.125) URL: /release-notes/previous-years/2125.html `Purse Identity v2.125` introduces a few improvements and needed bug fixes. You can now pass [`locale` in SMS templates](#sms-templates-locale). We also made some [UI SDK updates](#ui-sdk-updates). As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## SMS templates `locale` You can now pass the `locale` for a user via SMS templates for all providers including custom providers. This leverages the [Custom-Locale](https://docs.identity.purse.eu/openapi/identity.html#section/User-locale) header parameter. For more, see [SMS templates](../../docs/sms-templates.html). ```none Hi {{user.given_name}}. Your updated settings show that your locale is now {{user.locale}}. (1) ``` - (1) Pass the `{{user.locale}}` in the SMS message template. ```json { "phone_number": "+33688888884", "template_id": "password_reset", "personalizations": { "id": "id", "external_id": "externalId", "given_name": "Max", "last_name": "Robertson", "gender": "M", "sms_code": "smsCode", "lang": "fr", "locale": "fr-FR", (1) "has_password": true, } } ``` - (1) In this case, `locale` is set to `fr-FR`, which is French in France. * * * ## UI SDK updates Available from the UI SDK version [`1.30.0`](https://github.com/ReachFive/identity-web-ui-sdk/releases/tag/v1.30.0) and higher. As part of the initiative to help customers move to passwordless, we have introduced a new boolean called `enablePasswordAuthentication` available on the `showAuth` method. The `enablePasswordAuthentication` boolean specifies whether password authentication is enabled or not. For more details, see [showAuth.enablePasswordAuthentication](../../sdk-ui/showAuth.html#enablePasswordAuthentication). * * * ## General improvements - We now ensure the [`updated_at`](../../docs/models-user-profile.html#updated_at) user profile field remains unchanged after a passwordless login, aligning with the existing behaviour for password logins. - You no longer need to have a "fresh" access token to use the [Identity API: List MFA credentials](https://docs.identity.purse.eu/openapi/identity.html#operation/listCredentials) endpoint. * * * ## Fixes ##### The User event ID was missing in some webhook responses. ✓ ##### Some customers were receiving errors in the OaaS flow during Third-party authentication when users were already logged in through First-party. ✓ ##### In some limited instances, the case for custom fields was inconsistent when retrieving the custom field. ✓ --- # 19 December 2024 (v2.126) URL: /release-notes/previous-years/2126.html `Purse Identity v2.126` ![christmas wreath](../_images/novelty/christmas-wreath.png) introduces a few improvements and needed bug fixes. You can now see the total number of [compromised profiles](#compromised-profiles) directly in the Purse Identity Console. The [`{{verification_code}}`](#verify-email-updates-with-verification-code) variable is now available to more email templates, allowing users to verify email updates. [Adobe Campaign](#adobe-campaign-credential-changes) made some credential changes that impacts configuring the provider in the Purse Identity Console. As always, we [fixed](#fixes) a few items for you. ## Compromised profiles You can now see the total number of compromised profiles directly in the Purse Identity Console, giving you a quick overview of the number of currently compromised profiles from your user pool. To view this: 1. Go to **Analytics**  **Compromised profiles** on your Purse Identity Console. 2. See the total number of compromised profiles at the top of the screen. ![2126 compromised profiles](../_images/2126_compromised-profiles.jpg) For more on this topic, see [Identity Fraud Protection](../../docs/ifp.html). * * * ## Verify email updates with verification code Your users can now verify their email updates with a verification code, ensuring the update is legitimate and secure. This is possible because the `{{verification_code}}` templating variable is now available to even more templates including: - [Signup template](../../docs/email-templates.html#signup) - [Verify email template](../../docs/email-templates.html#verify-email) - [Email update template](../../docs/email-templates.html#email-update) This change introduces a new [`/identity/v1/verify-email` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyEmailUpdate) that verifies the updated email. POST `/verify-email` ```json { "email": "joe.bloggs@example.com", "verification_code": 123456 } ``` * * * ## Adobe Campaign credential changes Adobe has [deprecated using JWT credentials](https://developer.adobe.com/developer-console/docs/guides/authentication/ServerToServerAuthentication/#service-account-jwt-credential-deprecated) in favor of OAuth Server-to-Server credentials. This goes into action on January 27, 2025. In light of this, we have updated the [Adobe Campaign Standard provider template](../../docs/emails.html#adobe-campaign) configuration setup to use the OAuth Credential. 1. Go to **Settings**  **Emails**  **Providers** on your Purse Identity Console. 2. Select **Adobe Campaign Standard** from the list of options. 3. Enable **Use OAuth Credential**. 4. Enter your **Client ID**, **Client secret**, and desired **Scope(s)**. You can find these in your [Adobe Developer Console](https://developer.adobe.com/console). 5. Don’t forget to **Save** your input. ![2126 adobe](../_images/2126_adobe.jpg) * * * ## Fixes ##### We were briefly unable to fetch addresses from Kakao Connect. ✓ --- # 9 January 2025 (v2.127) URL: /release-notes/previous-years/2127.html `Purse Identity v2.127` introduces several improvements and needed bug fixes. We have added the [`{{link}}` variable to the SMS passwordless template](#sms-passwordless-magic-links) which also impacts the SDK Core passwordless methods. We now better support [email updates for Social Logins](#improved-synchronization-for-email-updates-with-social-login). We also now [retrieve the full Identities objects with webhooks and Pub/Sub hooks](#retrieve-full-identities-objects-with-hooks). The improvements in this release also let you [retrieve addresses from Naver](#naver-user-addresses) users. In addition, we have some security enhancements, where it’s now possible for you to [configure the lifetime of trusted devices](#configure-lifetime-of-trusted-devices) and [hide suspension reasons](#hide-suspension-reason) directly from the Purse Identity Console. As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## SMS passwordless magic links We have added the `{{link}}` variable to the SMS passwordless template combined with enhanced redirect functionality which includes the ability to override the default `redirect_to` in the template. The `{{link}}` variable is a magic link that verifies the start of the passwordless flow. Magic links verify the user’s identity and ownership, ensuring secure and authorized access to the passwordless flow. SDK Core updates These updates also impact the [startPasswordless](../../sdk-core/startPasswordless.html) method since a `redirect_uri` is now required either through the default redirect set in the template or through the method itself. _The redirect address must be whitelisted in your client settings._ The [verifyPasswordless](../../sdk-core/verifyPasswordless.html) method now has the possibility to respond with `AuthResult` in addition to `void`. - `AuthResult`: If the verification is successful and results in an authentication (e.g., the user is logged in after clicking the magic link), the method returns an `AuthResult`. - `void`: If the verification is successful but no authentication (such as a user login) is performed, the method resolves with void. To create an SMS passwordless template: 1. Go to **Settings**  **Passwordless**  **SMS verification code**. 2. Enter the **Verification Code Lifetime** in seconds. 3. Set the **Redirect to**. _This must be whitelisted in your client settings._ 4. Write your **Message**. ![passwordless sms template](../../docs/_images/console/passwordless/passwordless_sms_template.jpg) * * * ## Improved synchronization for email updates with Social Login Purse Identity now correctly recognizes and authenticates users based on their unchanged Social Provider ID, even when the email address has been updated on the Social provider side. Example flow 1. A user logs in with an updated email linked to the same Social Provider ID, 2. Purse Identity detects the existing profile associated with the Social Provider ID. 3. Purse Identity authenticates the user based on the existing profile. 4. Purse Identity updates the email address in the profile to reflect the new one. * * * ## Retrieve full Identities objects with hooks You can now retrieve the full [Identities object](../../docs/models-user-profile.html#identities-object) with webhooks and Pub/Sub hooks. Previously, it was only possible to retrieve the name of the provider and any associated provider variants. When you select `Identities` and `Identities Id` in the Filterable fields section, you will receive the whole Identities object. ![2127 hooks identities](../_images/2127_hooks_identities.jpg) For more on this topic, see [User-event webhooks](../../docs/webhooks.html) and [Pub/Sub hooks](../../docs/pub-sub-hook.html) respectively. * * * ## Naver user addresses With this release, you can now retrieve addresses from Naver users. Once the user consents, you can pull in all the address information directly into Purse Identity. You first need to [create a new custom address field](../../docs/custom-fields.html#create-custom-fields) called `is_naver_address`. This field is always set to `true`. If this field is not present in your client settings, Naver addresses can’t be imported. If you would like to receive the `roadNameYn` field from Naver, you must also create an [address custom field](../../docs/custom-fields.html#create-custom-address-fields) called `road_name` ([`checkbox` data type](../../docs/custom-fields.html#custom-field-data-types)). For more details, see [Naver](../../docs/naver.html). Address example ```json "addresses": [ { "id": 0, "to_delete": true, "default": true, "address_type": "delivery", "street_address": "1200 Seomun 10", "address_complement": "2nd floor", "locality": "Seogwipo-si", "postal_code": "46 KR", "region": "Jeju-do", "country": "South Korea", "recipient": "Suh Minh", "phone_number": "0723538943", "custom_fields": { "is_naver_address": true, (1) "road_name": true (2) } } ], ``` - (1) The `is_naver_address` custom address field ([`checkbox` data type](../../docs/custom-fields.html#custom-field-data-types)) to let our system know it is a Naver address so we won’t overwrite the address. - (2) The `road_name` custom address field ([`checkbox` data type](../../docs/custom-fields.html#custom-field-data-types)) is optional but needed if you want to retrieve the `roadNameYn` field from Naver. * * * ## Configure lifetime of trusted devices You can now configure the lifetime of a trusted device directly in the Purse Identity Console. By default, the lifetime is set to `90` days, meaning after a successful authentication, the device is considered as trusted for the specified number of days (between `1` and `365`). For more, see [Risk-based Authentication](../../docs/rba.html). Why is this useful for me? This option enhances security by allowing you to adjust how long devices remain trusted, reducing risk in case of loss or compromise. We hope this flexibility empowers you to balance security and user experience, tailoring authentication policies to your specific needs. ![mfa settings rba](../../docs/_images/mfa/mfa-settings-rba.jpeg) * * * ## Hide suspension reason And last but certainly not least, you can now hide the `suspension_reason` returned in the API error response for suspended users. When enabled, a default error message is sent in the response. For more on this topic, see [Data Breach Detection](../../docs/security/data-breach-detection.html). To hide the suspension reason: 1. Go to **Settings**  **Security**  **Data Breach Detection**. 2. Scroll to **Suspension reason**. 3. Enable the **Hide suspension reason in API error response** option. ![2127 suspensionReason](../_images/2127_suspensionReason.jpeg) 4. Don’t forget to **Save** your input. * * * ## General improvements - We now ensure that the [`auth_types`](../../docs/models-user-profile.html#auth_types) field in the [User Profile object](../../docs/models-user-profile.html) only contains active methods, ensuring no stale information is present related to how users authenticate. * * * ## Fixes ##### In some limited cases, browsers were autofilling the username and password fields on the Purse Identity Console, leading to an extra manual step for users. This has been resolved and the fields are no longer autofilled. ✓ ##### For a brief period, the "Send test email" feature on the Purse Identity Console wasn’t working properly. ✓ ##### There was a minor issue importing profiles with passwords encrypted with ISO-8859-1. ✓ ##### For a brief period, the last\_login field wasn’t being updated during logins for passwordless logins. ✓ ##### In some limited cases, customers using our API directly to log out of the Purse Identity Console were experiencing some issues. ✓ --- # 29 January 2025 (v2.128) URL: /release-notes/previous-years/2128.html `Purse Identity v2.128` introduces several improvements and needed bug fixes. You are now able to [use MFA for phone numbers without SMS enabled](#mfa-for-phone-numbers-without-sms-enabled). You can also now [create a user password hash with the Management API](#create-a-user-password-hash-with-the-management-api). Additionally, we have introduced a [new hashing algorithm](#new-hashing-algorithm). And finally, we removed [PayPal permissions](#paypal-permissions) from the provider configuration in the Purse Identity Console. As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## MFA for phone numbers without SMS enabled We have introduced the ability to use a `phone_number` as a second factor for [Multi-factor Authentication](../../docs/mfa.html) without enabling the SMS feature. This change lets you maintain duplicate `phone_number` values while configuring MFA. Key changes These changes only apply when the SMS feature is disabled. Existing rules remain in effect if the feature is enabled. - **Phone number verification**: When the SMS feature is disabled, [`phone_number_verified`](../../docs/models-user-profile.html#phone_number_verified) is always `false`, even if the same number is used as an MFA credential. - **SMS provider configuration**: You can [configure an SMS provider](../../docs/setup-sms-provider.html), but [templates](../../docs/sms-templates.html) unrelated to Passwordless or MFA remain disabled. - **Independent MFA credentials**: - Updating a `phone_number` does not update the associated MFA credential. - Adding a `phone_number` as a credential does not automatically mark it as verified. ## Create a user password hash with the Management API You can now create a user password hash through the Management API. To do this, you should use the [`/users` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/createUser) and pass the following as part of the request body: ```json { ... "password_hash": { "value": "$2b$12$KIXwPlj7FZ9dTjph4GxGhu3ofk1KFe.KjLw6gNlD72zyGIBlIL7H6", (1) "algorithm": "plaintext" (2) } ... } ``` - (1) Pass the hashed password. - (2) Specify the encryption algorithm, such as `bcrypt`. See [Allowed algorithms](../../docs/import-passwords-from-the-console.html) for more details. * * * ## New hashing algorithm In order to further support you, we have added an additional hashing algorithm to our supported list for importing passwords, `bcryptSha1`. For more details, see [Import user passwords](../../docs/import-passwords-from-the-console.html). * * * ## PayPal permissions PayPal permissions configured in our Purse Identity Console had no effect on retrieved user data. Instead, the scopes set in the PayPal app determine access. To avoid confusion, we removed the PayPal permissions section from the provider configuration on the Purse Identity Console. **You should configure PayPal scopes directly in your [PayPal developer portal](https://developer.paypal.com).** For more on PayPal provider configuration, see [Paypal Connect](../../docs/paypal.html). ![paypal console overview](../../docs/_images/paypal-console-overview.jpg) ## General improvements - We have officially deprecated the [Facebook Likes and Insights feature](../../attention/2023/june/deprecation_likes-and-insights.html). - We have improved the security around [Twilio provider configuration](../../docs/setup-sms-provider.html#set-up-twilio) ensuring no sensitive information is displayed. * * * ## Fixes ##### The Compromised profiles page on the Purse Identity Console wasn’t correctly displaying the total number of compromised profiles. ✓ ##### When the Google Cloud Platform (GCP) reported issues that affected our Pub/Sub hooks, it caused the Purse Identity app to become unavailable. We have resolved this in a way that prevents future disruptions if GCP has any issues affecting Pub/Sub hooks. ✓ ##### In some limited instances, session cookies weren’t being deposited for custom domains in the RBA flow. ✓ --- # 13 February 2025 (v2.129) URL: /release-notes/previous-years/2129.html `Purse Identity v2.129` introduces several improvements and needed bug fixes. We want to highlight a recent [UI SDK release](#ui-sdk-updates) which has exciting updates. In addition to this, you can now [import Lite profiles by ID](#import-lite-profiles-by-id). And finally, there are now more [fields](#exportable-fields) available to export with our Purse Identity export jobs. As always, we made some [general improvements](#general-improvements). ## UI SDK updates We have some exciting updates to our [UI SDK](../../sdk-ui/index.html) including: - A [new endpoint to get user password strength](#new-endpoint-to-get-user-password-strength) - A [new field to display the option to trust a device](#new-field-to-display-option-to-trust-a-device) ### New endpoint to get user password strength We have introduced a new endpoint with this release that lets you retrieve the password strength based on your password policy. We did this so that any point of integration needs only to rely on a single way of retrieving this information. So, whether you use our full API or just our SDKs, you can leverage this method to retrieve password strength. You can use the [`/password/strength` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/passwordStrength). POST `/password/strength` ```json { "client_id": "z6fhT..5uV3i", (1) "password": "passwordDeluxe1234000!!!!***##*" (2) } ``` - (1) The Purse Identity [client ID](../../docs/clients.html). - (2) The user password. If using our Core SDK, you can use the [getPasswordStrength](../../sdk-core/getPasswordStrength.html) method. ```js client .getPasswordStrength(clientId,password) (1) .then(PasswordStrength => { // Display strength of password }) .catch(err => console.error(err)) ``` - (1) Pass the Purse Identity [client ID](../../docs/clients.html) and user password. ### New field to display option to trust a device In our latest [UI SDK release (`1.32.0`)](../index.html#other-releases), we added a new parameter which allows you to display to users the option to trust a device. This helps build on our [Risk-based Authentication](../../docs/rba.html) flows and is only applicable after the user has validated the second factor step. This parameter is available on our `showAuth` method as `allowTrustDevice`. Setting it to `true` displays the option and the property defaults to `false`. To accompany this update, there is a new label which you can customise as needed `mfa.stepUp.trustDevice`. For more, see [showAuth](../../sdk-ui/showAuth.html). ```js client.showAuth({ container: 'auth-container', auth: { redirectUri: 'https://example.com/auth-callback' }, allowForgotPassword: false, allowPhoneNumberResetPassword: false, allowTrustDevice: true, (1) initialScreen: 'login', redirectUrl: 'https://example-email-validate.com', signupFields: [ { key: 'given_name', label: 'Given name', required: false }, { key: 'family_name', label: 'Family name', required: false }, 'email', 'password', 'password_confirmation', 'consents.newsletter', 'custom_fields.loyalty_card_number' ], ... }) ``` - (1) Setting `allowTrustDevice` to `true`. * * * ## Import Lite profiles by ID We’ve updated the merge logic for import jobs so that you can update Lite profiles using a Purse Identity ID. This is in addition to the existing methods of importing and updating by email, phone number, or external ID as well as the ability to update lite profiles with the [`lite-update/:id` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/updateLiteProfile) For more, see [Lite profiles](../../docs/lite-profiles.html) and [Import job definition](../../docs/imports.html) respectively. * * * ## Exportable fields With this release, you’re now able to export more fields using an [Export job](../../docs/export-user-profiles.html). The additional fields that can now be exported are: - `auth_types` (_array_) - `origins` (_array_) - `devices` (_array_) - `identities` (_object_) For more, see [User Profile](../../docs/models-user-profile.html). ## General improvements - We have improved the error messaging when using the [UI SDK](../../sdk-ui/index.html) to enter a verification code. Instead of a generic message, you’ll receive more meaningful messaging like `"Invalid verification code"` or `"Expired verification code"`. --- # 27 February 2025 (v2.130) URL: /release-notes/previous-years/2130.html `Purse Identity v2.130` introduces several improvements and needed bug fixes. We’re happy to announce that you can now create [structured custom fields](#release-highlight) directly in the console. Another exciting option for customers now is the option to implement [on-demand scaling](#on-demand-scaling) to accommodate high traffic during anticipated periods for your site. You can also now [manage MFA credentials from the console](#manage-mfa-credentials-from-console). In addition to this, you can now [search for users based on third-party grants](#search-for-users-by-grants). As always, we [fixed](#fixes) a few items for you. ## Release highlight Structured custom fields With the v2.130 release, you can now create structured custom fields, by associating several custom fields to a parent in a JSON object. This means that you can create custom fields whose path is expanded into a JSON object in the API responses. For full details and instructions, see [Custom fields](../../docs/custom-fields.html). ![structured custom overview](../../docs/_images/custom-fields/structured-custom-overview.jpg) **Benefits** - Improved data organisation - Better scalability for future use cases - Greater flexibility for custom fields, enabling richer metadata storage **Actions** - **Purse Identity Console** - Create [structured custom fields](../../docs/custom-fields.html#create-custom-fields) - Search for [structured custom fields](../../docs/custom-fields.html#search-for-custom-fields) - **API** - Add structured custom fields to a user’s profile with [`/users/:id` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/updateUser) ```json "custom_fields": { "has_loyalty_card": true, "gaa": { "football": "Kerry", "hurling": "Clare", "watches_weekly": true } } ``` - Retrieve structured custom fields for a user [`/users/?fields=` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/searchUsers) ```sh GET /api/v2/users?fields=gaa.football == "Kerry" ``` * * * ## On-demand scaling Our On-demand scaling feature lets you temporarily scale our authentication infrastructure to handle increased login activity. It is particularly useful for those of you experiencing predictable traffic surges, such as product launches, seasonal sales, or marketing campaigns, ensuring smooth and uninterrupted authentication for this higher volume of users. For more details, see [On-demand scaling](../../docs/on-demand-scaling.html). ![on demand scaling](../../docs/_images/security/on-demand-scaling.jpg) * * * ## Manage MFA credentials from console You can now manage a user’s MFA credentials directly from the Purse Identity Console. This was previously only available through our [Management API](https://docs.identity.purse.eu/openapi/management.html#tag/MFA). For more, see [Manage MFA credentials from console](../../docs/mfa/manage-mfa-credentials-from-console.html). Instructions **To manage a user’s MFA credentials from the console**: 1. Log in to your Purse Identity Console. 2. Go to **Analytics**  **Profiles**. 3. Click your desired user. 4. Click the Actions button. 1. Click **Edit**. ![edit user profile](../../docs/_images/console/users/edit-user-profile.jpg) 2. Go to the **MFA Credentials** tab. In the **MFA Credentials** tab, you can remove existing MFA credentials and add email or SMS as an MFA credential. Passkeys are managed in their own tab. 5. Don’t forget to **Save** your input. ![addMfaconsole](../../docs/_images/console/users/addMfaconsole.jpg) ![removeMfaconsole](../../docs/_images/console/users/removeMfaconsole.jpg) * * * ## Search for users by grants You can now search for users by third party grant information including. This includes via the Purse Identity Console and the Management API. - `client_id`: The `client_id` of the third party grant. - `date`: The `date` on which the third party grant was issued. Use the **Filter** section on the Purse Identity Console when [filtering user profiles](../../docs/support/manage-profiles-from-console.html#default-profiles-view), or on your export or hook. ![2130 export filter grants](../_images/2130_export_filter_grants.jpg) Use the `filter` query parameter with the Management API as shown here. ```sh GET api/v2/users?filter=third_party_grants.client_id==="k6ShTTsHfVE5aXu5uW0i" ``` * * * ## Fixes ##### The is none of operator for job definitions was briefly not working as expected. This has now been resolved and is working properly again. ✓ ##### You were unable to create a custom field with an existing prefix. This means that if you created the custom field really\_awesome, you were unable to create another custom field called really\_freaking\_awesome. This has been resolved and you can, once again, create custom fields with matching prefixes as expected. Duplicated custom field names are still prevented. Duplicated custom field names are still prevented. ##### It was temporarily impossible to create a custom address field with an underscore (custom\_field). ✓ ##### There was a small issue retrieving the trusted device cookie for the loginWithPassword method. ✓ --- # 13 March 2025 (v2.131) URL: /release-notes/previous-years/2131.html `Purse Identity v2.131` introduces several improvements and needed bug fixes. We are happy to inform of you some [updates to our UI SDK](#ui-sdk-updates) . We have also added the ability to see past events for our [On-demand scaling feature](#on-demand-scaling-past-events). As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## UI SDK updates We are happy to announce a few updates to our [UI SDK](../../sdk-ui/index.html) . We introduced the [`showTrustedDevices`](../../sdk-ui/showTrustedDevices.html) method that allows you to show a user’s trusted devices. Example ```js const accessToken = // Here paste the authorization token of the profile retrieved after login client.showTrustedDevices({ container: 'mfa-container', accessToken, showRemoveTrustedDevice: false, onReady: instance => { // Destroy the widget // if (...) instance.destroy() }, onSuccess: (event: SuccessEvent) => { console.log("Success!") }, onError: (error: ErrorResponse) => { console.error(error) }, theme: { primaryColor: '#274890', borderRadius: '#374890' } }) ``` We added the [`showRemoveMfaCredential`](../../sdk-ui/showMfaCredentials.html#showRemoveMfaCredential) parameter to the [showMfaCredentials](../../sdk-ui/showMfaCredentials.html) method. ##### showRemoveMfaCredential boolean Boolean indicating whether to show the option to remove an MFA credential. Defaults to `false`. * * * ## On-demand scaling: past events You can now see past events in addition to scheduled and ongoing events for our On-demand scaling feature. To use On-demand scaling, go to **Settings**  **On-demand scaling** in your Purse Identity Console. For more details and instructions, see [On-demand scaling](../../docs/on-demand-scaling.html). * * * ## General improvements - We improved the form validation when configuring an [SMTP provider](../../docs/emails.html#smtp-providers) to ensure no required fields are omitted when setting it up in the Purse Identity Console. - We improved the labelling for the [`leaked_credentials_usage` event type](../../docs/models-user-events.html#user-event-types) in the [Recent activity](../../docs/support/manage-profiles-from-console.html#recent-activity) section of the Purse Identity Console. * * * ## Fixes ##### In some limited cases, the updated\_at field for users was valued incorrectly during passwordless flows. ✓ ##### We fixed some errors related to CORS policy. ✓ --- # 27 March 2025 (v2.132) URL: /release-notes/previous-years/2132.html `Purse Identity v2.132` introduces several improvements and needed bug fixes. Alongside this release, we have introduced new methods for the [Android SDK](#android-sdk-updates) . You can also now [trust a device when enrolling a second factor](#trust-device-section) for MFA. In addition to those, it’s now possible to [enroll users in MFA through import jobs](#enroll-users-in-mfa-with-import). We’re also excited to show you our [improved console design](#improved-console-design). As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Android SDK updates We are happy to announce a few updates to our [Android SDK](../../sdk-android/index.html) . This includes two new methods where you can initiate and complete the email verification process for users through a verification code. For more, see: - [verifyEmail](../../sdk-android/verifyEmail.html) - [sendEmailVerification](../../sdk-android/sendEmailVerification.html) * * * ## Trust device when enrolling second factor ![2132 trust device](../_images/2132_trust-device.jpg) Previously, you could only trust your device when logging in with [Multi-factor Authentication](../../docs/mfa.html). With this release, you can now trust your device when registering a second factor for MFA, giving you more flexibility right from the setup process. To do this, you can set `trust_device` to `true` using the following endpoints and methods, allowing you to integrate in a way that suits your Purse Identity setup best. When you need to set `trust_device` to `true` or not depends on if the identifier involved is verified or not. As the table below shows, you can trust a device and return the `__Host-trusted-device-id` cookie for already verified identifiers when starting MFA registration. However, for unverified identifiers, you must complete both the **start** and **verify** steps. ##### Verified: Start MFA registration ##### Verified: Verify MFA registration Not required ##### Unverified: Start MFA registration ##### Verify MFA registration - **Start MFA email registration**: [Identity API: `/mfa/credentials/emails`](https://docs.identity.purse.eu/openapi/identity.html#operation/startEmailRegistration) - **Start MFA phone number registration**: [Identity API: `/mfa/credentials/phone-numbers`](https://docs.identity.purse.eu/openapi/identity.html#operation/startPhoneNumberRegistration) - **Verify MFA email registration**: [Identity API: `/mfa/credentials/emails/verify`](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyEmailRegistration) - **Verify MFA phone number registration**: [Identity API: `/mfa/credentials/phone-numbers/verify`](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyPhoneNumberRegistration) - **Start MFA email registration**: [`startMfaEmailRegistration` method](../../sdk-core/startMfaEmailRegistration.html) - **Start MFA phone number registration**: [`startMfaPhoneNumberRegistration` method](../../sdk-core/startMfaPhoneNumberRegistration.html) - **Verify MFA email registration**: [`verifyMfaEmailRegistration` method](../../sdk-core/verifyMfaEmailRegistration.html) - **Verify MFA phone number registration**: [`verifyMfaPhoneNumberRegistration` method](../../sdk-core/verifyMfaPhoneNumberRegistration.html) * * * ## Enroll users in MFA with import You can now enroll your users for [Multi-factor Authentication](../../docs/mfa.html) through an import. This lets you quickly protect users instead of waiting for user interaction, which is helpful for less active profiles on your system. If the user’s email and/or phone number is unverified, the profile is still imported, but the user is not registered for MFA. A warning is logged in the import logs for your records. For the successfully enrolled users, the following event types are emitted: - [`mfa_email_verify_registration`](../../docs/models-user-events.html#mfa_email_verify_registration) - [`mfa_phone_number_verify_registration`](../../docs/models-user-events.html#mfa_phone_number_verify_registration) To enroll a user through import, you need to pass `enroll__as_mfa_credential` set to `true` on the [user profile](../../docs/models-user-profile.html). User profile model example ```json { "external_id": "1", "email": "foo@gmail.com" } \n { "email": "bar@gmail.com", "name": "Joe", "gender": "M", "enroll_email_as_mfa_credential": true, (1) "enroll_phone_as_mfa_credential": true, (2) "custom_fields": { "has_loyalty_card": true }, ... } ``` - (1) Enrolling email for MFA (only registers if the email is verified). - (2) Enrolling phone number for MFA (only registers if the phone number is verified). * * * ## Improved console design We are excited to announce that we have improved the design for the Purse Identity Console, giving it a much-needed facelift. The design provides a cleaner look and feel and is more responsive and user friendly. This includes the ability to choose light or dark mode (or system) and sleeker navigation design. [Check it out](https://console.reach5.co/login) Please bear with us as we update screenshots in documentation related to console features. ![2132 console light](../_images/2132_console_light.jpg) ![2132 console dark](../_images/2132_console_dark.jpg) * * * ## General improvements - We now return an improved [error response](../../docs/errors.html) for when a user attempts to authenticate through social login and there is a match on an unverified `phone_number` for the user’s profile. Error example ```none error.socialAccountPhoneNumberAlreadyInUse (1) error.socialAccountPhoneNumberUnverified (2) ``` - (1) "The phone number associated with this `{0}` account is already used by an other account". - (2) "The phone number associated with this `{0}` account is unverified for the profile ID: `{1}` ". - You can now export [MFA credentials](../../docs/mfa.html) in user export jobs. * * * ## Fixes ##### There was temporarily an issue where some SLO provider signup details were not being included as expected when used with a Pre-event webhook. The provider details are now again returned as expected. ✓ ##### Session cookies were being lost prematurely during the passwordless verification code flow. This was causing some limited issues for users, but it is now resolved. ✓ ##### In some instances, custom fields for a user profile that were imported were subsequently not included in an export as expected. ✓ --- # 10 April 2025 (v2.133) URL: /release-notes/previous-years/2133.html `Purse Identity v2.133` introduces several improvements and needed bug fixes. We now ensure that [existing KakaoTalk and Naver users](#address-updates-for-kakao-and-naver-users) can have their address information added to their profiles. We’re also happy to share that you can now [customize templates for MFA user journeys](#customizable-templates-for-mfa-user-journeys). As always, we [fixed](#fixes) a few items for you. ## Address updates for Kakao and Naver users Existing Kakao and Naver user profiles can now have the address information from their social profiles added to their Purse Identity profile on their next login, provided you have configured the required [custom fields](../../docs/custom-fields.html) (`kakaotalk_address_id` for KakaoTalk, `is_naver_address` for Naver) in the [Purse Identity Console user profile model](../../docs/models-user-profile.html). This helps ensure consistency for users who logged in prior to custom field configuration, aligning their profiles with new logins. We also added checks to prevent duplicate addresses by checking existing field values. If no address exists with the `kakaotalk_address_id`, the address is retrieved and added. **Example**: Min-jae (민재) has already logged into your site with KakaoTalk. You configure the correct custom fields (`kakaotalk_address_id`). Min-jae (민재) logs in after the custom field configuration. He has an address on his KakaoTalk profile. The address is imported to his Purse Identity user profile. See [Kakao Connect](../../docs/kakao-connect.html) for more information. If no address exists with the `is_naver_address` value, the address is retrieved and added. **Example**: Ji-yeon (지연) has already logged into your site with Naver. You configure the correct custom fields (`is_naver_address`). Ji-yeon (지연) logs in after the custom field configuration. She has an address on her Naver profile. The address is imported to her Purse Identity user profile. See [Naver](../../docs/naver.html) for more information. * * * ## Customizable templates for MFA user journeys You can now customize your MFA templates to better reflect the user journey. We have introduced the new dynamic `{{action}}` variable, which is set based on the action in the `/identity/v1/mfa/stepup` endpoint, which make it available in the email and SMS templates. This allows you to write conditions in the templates to pass certain messages to the user depending on their _action_ or more generally, how they’re using the MFA flow. **How does it work? 🤔** 1. You pass `action` in the `/stepup` endpoint request body. `action` is a free string (`snake_case`). It must match the action value in the [template](#template). `/stepup` endpoint ```json { "client_id": "nvR2y0ks...EgCW2dqy", "action": "transaction", (1) "response_type": "code", "code_challenge": "xxxxxxxxxxxxxx", "code_challenge_method": "S256", "scope": "openid phone address profile mfa", "redirect_uri": "https://redirect_uri.com/", "tkn": "xhNGxw...70zx32" } ``` - (1) Here `action` is `transaction`. 2. Assuming a successful call, `action` is included in the step-up `token` as part of the response. 3. Use the `token` from the response and pass it as `step_up` (which includes `action`) in the request body of the `/passwordless/start` endpoint. 1. A successful call then triggers the email and/or SMS template which contains the `{{action}}` logic and sends your user the appropriate message for their MFA journey. Example template ```source Hello {{user.name}}, {% if action == "login" %} Use this code to log in: {{verification_code}} {% endif %} {% if action == "transaction" %} Use this code to validate your transaction: {{verification_code}} {% endif %} ``` Want to know more? - [`/mfa/stepup` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/stepup) - [`/passwordless/start` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/startPasswordlessFlow) - [MFA templates](../../docs/mfa-templates.html) * * * ## Fixes ##### Import jobs were temporarily showing some dynamic field configuration only applicable to export jobs. ✓ ##### The filter for some fields for job definitions was briefly not working as expected. This has now been resolved and is working properly again. ✓ ##### There was a small issue with the passwordless authentication flow where the system incorrectly accepted the first code verifier instead of the latest one. ✓ ##### There was a temporary issue with our Test SMS button for Twilio that has now been resolved. ✓ ##### For a brief period, it was not possible to enroll a phone number as an MFA credential on the Purse Identity Console if SMS was disabled. This was unexpected since enabling SMS is no longer a requirement for Multi-factor Authentication. This is now resolved. ✓ ##### The Phone number verified checkbox appeared on user profiles in the Purse Identity Console even when SMS was disabled. ✓ ##### Searching profiles on the Purse Identity Console was temporarily slower than expected. Users with slow connections were entirely unable to search. ✓ --- # 24 April 2025 (v2.134) URL: /release-notes/previous-years/2134.html `Purse Identity v2.134` introduces a couple of improvements and needed bug fixes. We have improved the error messaging when passing the [`check_updated_at` field](#improved-check_updated_at-error-messaging) with the Management API. We also ensure now that [Identity Fraud Protection (IFP) is activated for signups](#ifp-activation-on-signup) for all accounts with this feature. As always, we [fixed](#fixes) a few items for you. ## Improved `check_updated_at` error messaging The [`check_updated_at` field](2112.html#new-check_updated_at-field-for-validating-user-data-freshness) helps you validate user data freshness. We have improved the error messaging for when the request payload’s `updated_at` value is older (or the same age as) than the database’s `updated_at` value by making the error code more specific as shown below. This helps differentiate from other causes for an error such as a formatting issue. ```json { "error_id": "XOpYpK04Zl", "error_description": "Validation failed", "error": "invalid_request", "error_details": [ { "field": "updated_at", "message": "Can't update the profile since the provided `updated_at` value is anterior to the current record", "code": "check_updated_at_failed" (1) } ] } ``` - (1) The error `"code"` is now `check_updated_at_failed`. * * * ## IFP activation on signup Purse Identity’s **Identity Fraud Protection (IFP)** module analyzes events to determine if a particular IP is exhibiting suspicious behaviour. In particular, the Identity Fraud Protection module consumes login and signup attempts where it determines if the IP is suspicious or not. If the Identity Fraud Protection module determines that the IP is suspicious, the IP is flagged and siloed into a separate database where its access is immediately blocked. Pair Identity Fraud Protection with clear error messaging in your UI (and, if desired, automated notifications) so legitimate users know why their access was blocked and how to regain it. For those who integrate IFP with the backend, you should ensure the [True Client IP Key](../../docs/ifp.html#enable-true-client-ip-key) is enabled. * * * ## Fixes ##### Users who created a Lite profile with a phone number were unable to sign up with a social account if that same phone number existed on the social account. ✓ ##### The Purse Identity Console was temporarily not detecting system preferences for light or dark mode. ✓ ##### There were some minor inconsistencies with the error.socialAccountEmailAlreadyInUse error message. ✓ ##### There were data structure issues when exporting Segments from the Purse Identity Console. ✓ --- # 22 May 2025 (v2.135) URL: /release-notes/previous-years/2135.html `Purse Identity v2.135` introduces several improvements and needed bug fixes. We’re happy to announce that you now have [customizable templates for MFA registration journeys](#customizable-templates-for-mfa-registration-journeys). We’ve also added [device metadata variables for MFA templates](#device-metadata-variables-for-mfa-templates). As well, we made it possible to configure the redirect to home link for [the Email confirmation hosted page](#email-confirmation-hosted-page-redirect-option). Additionally, [dark mode is now available on analytics pages](#dark-mode-available-on-analytics-pages). As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Customizable templates for MFA registration journeys You can now customize your MFA enrollment templates for email and SMS to reflect the user’s registration journey. The dynamic `{{action}}` variable, previously introduced for the `/identity/v1/mfa/stepup` endpoint, is now available in the `/identity/v1/mfa/credentials/emails` and `/identity/v1/mfa/credentials/phone-numbers` endpoints. This variable is set based on the action specified in the request, enabling its use in email and SMS enrollment templates. This allows you to include conditional logic in the templates to deliver tailored messages to users based on their _action_ or the specific MFA registration path they are following. **How does it work? 🤔** 1. You pass `action` in the request body of the `/identity/v1/mfa/credentials/emails` or `/identity/v1/mfa/credentials/phone-numbers` endpoint. `action` is a free string (`snake_case`). It must match the action value in the [template](#template). `/mfa/credentials/emails` endpoint example ```json { "email": "user@example.com", "redirect_url": "https://www.example.com/redirect", "action": "enroll_email", (1) } ``` - (1) Here `action` is `enroll_email`. 2. Assuming a successful call, `action` is included in the response token. 3. The token is used to trigger the email and/or SMS enrollment template, which contains the `{{action}}` logic, sending the user the appropriate message for their MFA registration journey. Example template ```source Hello {{user.name}}, {% if action == "enroll_email" %} Use this code to enroll your email for MFA: {{verification_code}} {% endif %} {% if action == "enroll_phone" %} Use this code to enroll your phone number for MFA: {{verification_code}} {% endif %} ``` Want to know more? - [`/mfa/credentials/emails` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/startEmailRegistration) - [`/mfa/credentials/phone-numbers` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/startPhoneNumberRegistration) - [MFA templates](../../docs/mfa-templates.html) * * * ## Device metadata variables for MFA templates It’s always nice to know the exact information from any MFA action. With this release, you can now send your users the relevant device information related to MFA step-up and registration with the following added variables: - `{{ip}}` - `{{userAgent}}` - `{{operatingSystem}}` - `{{deviceClass}}` - `{{deviceName}}` For more on this topic, see [MFA templates](../../docs/mfa-templates.html). * * * ## Email confirmation hosted page redirect option You can now choose to enable or hide the option for users to return to your site’s home page after confirming their email via [hosted pages](../../docs/hosted-pages.html). Previously, the option to return to the home page was displayed without the option to hide it. Now, you must choose to **Display a link to redirect to homepage** in the Hosted Pages settings. Otherwise, no link is displayed on the email confirmation page. To display the redirect to home page link: 1. Go to **Settings**  **Hosted Pages**  **Email confirmation** in the Purse Identity Console. 2. Click **Display a link to redirect to homepage**. 3. Don’t forget to **Save** your input. ![email confirmation enable homepage redirect](../../docs/_images/hosted-pages/email-confirmation_enable-homepage-redirect.jpg) * * * ## Dark mode available on analytics pages We have now enabled dark mode for our analytics pages continuing our improvements for an aesthetically pleasing and streamlined user experience in the Purse Identity Console. ![2135 analytics darkMode](../_images/2135_analytics-darkMode.jpg) * * * ## General improvements - We added a timeout when retrieving [cluster IPs](../../docs/console.html#outgoing-cluster-ips) to ensure optimal performance. - You can now retrieve the user’s phone number from [B.connect](https://www.bconnect.net/) (official site). Retrievable fields - new phone number - B.connect user ID - email - whether the email is verified - name - first name (give name) - last name (family name) For more details, see [B.connect](../../docs/bconnect.html). - We improved sorting for exporting segments to ensure filtering options prioritise type for easier use. ![2135 segments export](../_images/2135_segments-export.jpg) * * * ## Fixes ##### There were a few minor issues with the Roles and Profiles pages in the Purse Identity Console. This includes an orphan character and some responsiveness issues. ✓ ##### There was an additional user event (user\_updated) emitted during Multi-factor Authentication events. These events are covered by their own corresponding MFA user events, so the superfluous event is no longer emitted. ✓ ##### There was a minor discrepancy (disappearing custom fields) between the information fetched when calling Get user profile and Get profile custom field schema when custom scopes were removed. ✓ ##### In some limited cases, there were some errors when linking a Purse Identity user profile with a social provider. ✓ ##### There were some minor issues where existing custom fields weren’t appearing on some user profiles. ✓ ##### There was a minor issue where the Name fields on some imported user profiles were being incorrectly encoded. ✓ --- # 12 June 2025 (v2.136) URL: /release-notes/previous-years/2136.html `Purse Identity v2.136` introduces several improvements and needed bug fixes. You can now perform a [token exchange with trusted providers](#release-highlight). We’re happy to announce that social providers can now be added [to a user’s profile](#add-social-identity-provider-with-management-api) through the Management API. In addition to those, a new user event type is generated when you [remove passwords through our APIs](#remove-passwords-through-api). Finally, we have [improved the performance for sending verification messages](#improved-performance-for-sending-verification-messages). In addition to these product updates, we also released [version `8.2.0` of our iOS SDK](#ios-sdk-8-2-0). As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Release highlight Token exchange with trusted providers You can now configure **Trusted providers** in the Purse Identity Console to enable [OAuth 2.0 Token Exchange (RFC 8693)](https://datatracker.ietf.org/doc/html/rfc8693) with external Identity providers, starting with Akamai. This allows seamless user session retrieval, supporting single sign-on and migration use cases. You can also add custom trusted providers directly in the Purse Identity Console. A `login` user event is generated after a token exchange with a custom provider. When the event is emitted, it is added to the [`auth_types` array](../../docs/models-user-profile.html#auth_types) on the user profile. The user event also appears on the user’s [Recent activity filter](../../docs/support/recent-activity-filter.html) and is present in the user profile’s [`provider_details`](../../docs/models-user-profile.html#provider_details). For more details, see [Trusted providers](../../docs/trusted-providers.html). ![click akamai](../../docs/_images/trusted-providers/click-akamai.jpg) * * * ## Add Social Identity provider with Management API You can now add Social Identity providers to user profiles directly through our Management API. Previously, this was only possible through [Import jobs](../../docs/imports.html#social-login). See the [`/api/v2/users/:uid/providers/identity` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/addSocialProviderToProfile) for full details. Example call: POST `/api/v2/users/:uid/providers/identity` ```json { "provider": "google", (1) "provider_variant": "emea", (2) "user_id": "google_id", (3) "username": "google_username", (4) "created_at": "2026-12-06T10:40:24.071Z", (5) "updated_at": "2026-12-07T10:40:24.071Z" (6) } ``` - (1) **Required** The Social Identity provider (e.g., "google", "facebook"). - (2) The provider’s regional or specific variant (e.g., "emea"). - (3) **Required** The unique user ID from the Social Identity provider. - (4) The user’s display name or username from the provider. - (5) Timestamp when the identity was created. - (6) Timestamp when the identity was last updated. * * * ## Remove passwords through API Since passwords are now optional with Purse Identity, as there are passwordless options available, you can remove passwords from user profiles when needed through certain endpoints. When a password is removed, a [user event](../../docs/models-user-events.html) is now generated with a `password_deleted` user event type. **Benefits of passwordless**: - **Enhanced User Experience**: Simplifies authentication for users adopting passwordless methods, reducing friction. - **Increased Security**: Eliminates password-related risks, such as weak passwords or credential theft. - **Flexibility**: Supports seamless transitions to modern authentication methods, aligning with user preferences. **Endpoints to remove a password**: - [Identity API: `/v1/update-password`](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePassword) - [Identity API: `/v1/update-profile`](https://docs.identity.purse.eu/openapi/identity.html#operation/updateUserProfile) - [Management API: `/v2/users/:uid`](https://docs.identity.purse.eu/openapi/management.html#operation/updateUser) * * * ## Improved performance for sending verification messages We have improved the performance for sending verification messages to minimize disruptions, particularly when custom providers are used. This includes: - [`/send-email-verification` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/sendEmailVerification) - [`/send-phone-number-verification` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/sendPhoneNumberVerification) * * * ## iOS SDK `8.2.0` This week, we also released iOS SDK `8.2.0`. We added two new methods for sending and verifying email verification. - [sendEmailVerification](../../sdk-ios/sendEmailVerification.html) - [verifyEmail](../../sdk-ios/verifyEmail.html) * * * ## General improvements - We now return the `cico` field in the [`id_token` payload](../../docs/models-auth-result.html#cico) after connecting with [B.connect](../../docs/bconnect.html). This helps ensure payment processing is quick and efficient. - We no longer require a fresh access token (<5 minutes old) for the following endpoints since a verification code is already used for security purposes: - [`/identity/v1/verify-email`](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyEmailUpdate) - [`/identity/v1/verify-phone-number`](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyPhoneNumber) - In addition, we now ensure users are allowed up to 3 attempts before a verification code is considered no longer valid when calling [`/identity/v1/verify-email`](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyEmailUpdate). * * * ## Fixes ##### There were temporary some issues related to user roles. ✓ ##### There was a small alignment issue for some user profile columns in the Purse Identity Console. ✓ ##### For a brief period, users were unable to authenticate via SLO in an OaaS flow. ✓ --- # 26 June 2025 (v2.137) URL: /release-notes/previous-years/2137.html `Purse Identity v2.137` is primarily a bug fixing release. However, we also improved a few items of note: - [Fresh token no longer required for several endpoints](#fresh-token-no-longer-required-for-several-endpoints) - [Adobe Campaign Classic available as an email provider](#adobe-campaign-classic) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Fresh token no longer required for several endpoints As part of our ongoing API improvements, the following endpoints no longer _require_ a fresh access token. These endpoints accept either a fresh access token or an access token containing an amr claim that indicates multi-factor authentication (e.g., `"amr": ["mfa"]`). When an MFA-related amr claim is present, the system does not enforce token freshness. This change simplifies API usage by reducing the need for repeated MFA prompts while maintaining security. - **Update email**: [/update-email](https://docs.identity.purse.eu/openapi/identity.html#operation/updateEmailAddress) - **Verify email**: [/verify-email](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyEmailUpdate) - **Delete email MFA credential**: [/mfa/credentials/emails](https://docs.identity.purse.eu/openapi/identity.html#operation/deleteEmailCredential) - **Add email as second factor**: [/mfa/credentials/emails](https://docs.identity.purse.eu/openapi/identity.html#operation/startEmailRegistration) - **Update phone number**: [/update-phone-number](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePhoneNumber) - **Verify phone number**: [/verify-phone-number](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyPhoneNumber) - **Delete phone number MFA credential**: [/mfa/credentials/phone-numbers](https://docs.identity.purse.eu/openapi/identity.html#operation/deletePhoneNumberCredential) - **Add phone number as second factor**: [/mfa/credentials/phone-numbers](https://docs.identity.purse.eu/openapi/identity.html#operation/startPhoneNumberRegistration) - **Unlink social account**: [/unlink](https://docs.identity.purse.eu/openapi/identity.html#operation/unlinkSocialAccount) - **List trusted devices**: [/mfa/trusteddevices](https://docs.identity.purse.eu/openapi/identity.html#operation/getTrustedDevices) - **Delete trusted device**: [/mfa/trusteddevices/{deviceId}](https://docs.identity.purse.eu/openapi/identity.html#operation/deleteTrustedDevices) - **Update password**: [/update-password](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePassword) This update also applies to [WebAuthn endpoints](https://docs.identity.purse.eu/openapi/identity.html#tag/FIDO2) and [Grants](https://docs.identity.purse.eu/openapi/identity.html#tag/Grants). * * * ## Adobe Campaign Classic We now offer Adobe Campaign Classic as an email provider in the Purse Identity Console. You can configure Adobe Campaign Classic as an email provider in the Purse Identity Console by going to **Settings**  **Email**  **Providers**. Then, select **Adobe Campaign Standard/Classic** from the list of available providers under Client type. For more details, see [Add Adobe Campaign Classic as an email provider](../../docs/emails.html#adobe-campaign). ![2137 adobe classic](../_images/2137_adobe_classic.jpg) * * * ## General improvements - Now, when [Data Breach Detection](../../docs/security/data-breach-detection.html) is enabled, the **Suspend user** option is disabled by default. This gives you the chance to customise your configuration before proceeding with the Data Breach Detection feature. - We have brought back the **HTML?** to the [Update email template](../../docs/email-templates.html#email-update) to ensure users can send HTML in the message if desired. * * * ## Fixes ##### MFA data wasn’t being retrieved properly in Webhooks and Pub/Sub hooks. ✓ ##### In some instances related to MFA data, there were duplicate fields for Webhooks and Pub/Sub hooks. ✓ ##### Purse Identity Console ##### For a brief period, the users page on the needed to be manually refreshed to pick up changes. ✓ ##### Some dialogs in the weren’t correctly applying dark mode . ✓ ##### There were some minor fixes around label wording that were corrected. ✓ ##### For a brief period, older user profiles weren’t being fetched properly. ✓ --- # 10 July 2025 (v2.138) URL: /release-notes/previous-years/2138.html `Purse Identity v2.138` introduces a couple of improvements and needed bug fixes. - [New audit log for when users are suspended](#new-audit-log-for-when-users-are-suspended) - [CaptchaFox integration](#captchafox-integration) - [New query parameter for logout](#new-query-parameter-for-logout) We also have a new [UI SDK release](#ui-sdk-release-1-36-0) where several enhancements have been made. As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## New audit log for when users are suspended With this release, we’re introducing a new audit log for when users are suspended or unsuspended from the Purse Identity Console. This helps you keep track of user account changes more effectively. It is available for use with [Pub/Sub hooks](../../docs/pub-sub-hook.html). For more details, see [Audit logs](../../docs/audit-logs.html). ```json { "total": 1, "items": [ { "user_email": "admin@company.com", "entity_name": "console", "user_name": "Admin User", "action_name": "suspension", "created_at": "2025-07-10T14:21:45.123Z", "id": "a1b...g7h8i9j0", "action_data": { "userId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "suspensionStatus": "temporary", "suspensionReason": "violatedTermsOfService" }, "client_id": "Console Admin" } ] } ``` ```json { "total": 1, "items": [ { "user_email": "admin@company.com", "entity_name": "console", "user_name": "Admin User", "action_name": "unsuspension", "created_at": "2025-07-10T14:22:45.123Z", "id": "a1b...g7h8i9j0", "action_data": { "userId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", }, "client_id": "Console Admin" } ] } ``` * * * ## CaptchaFox integration You can now integrate CaptchaFox to enhance security during user authentication, in addition to the already available reCaptcha configuration option. This integration helps prevent automated login attempts and further strengthens account protection. For more details, see [Enable CaptchaFox from the console](../../docs/captcha/captcha-fox.html). ![captchafox on console](../../docs/_images/security/captchafox-on-console.jpg) * * * ## New query parameter for logout We now support a new query parameter for the logout endpoint: `post_logout_redirect_uri`. This parameter allows you to specify a URL to redirect users to after they log out in the same way our `redirect_to` query parameter currently works for the logout endpoint. For more details, see [/logout](https://docs.identity.purse.eu/openapi/identity.html#operation/destroySSOsession). * * * ## UI SDK release `1.36.0` The latest version of the UI SDK, `1.36.0`, introduces several enhancements: - We’ve added support for CaptchaFox including the following parameters: - `captchaFoxEnabled`: Boolean that specifies whether the CaptchaFox is enabled or not. - `captchaFoxSiteKey`: The CaptchaFox site key that comes from your [CaptchaFox](https://www.captchafox.com) setup. - `captchaFoxMode`: Specifies how CaptchaFox is displayed. Defaults to `hidden`. - The `onSuccess()` function now takes a `SuccessEvent` object which specifies what event triggered the success callback. onSuccess() function details ##### onSuccess function Callback function called when the request was successful. Takes a `SuccessEvent` object which specifies what event triggered the success callback. For a full list of event types, [user event types](../../docs/models-user-events.html#user-event-types). - We’ve also made the postal address fields available in [showAuth()](../../sdk-ui/showAuth.html). - Additionally, you can allow users to view and update addresses through the [showProfileEditor()](../../sdk-ui/showProfileEditor.html). * * * ## General improvements - We added translations for several address labels. See a comprehensive label list ##### gender Gender ##### givenName First name ##### familyName Last name ##### email Email address ##### phoneNumber Phone number ##### identifier Email address or phone number ##### verificationCode Verification code ##### password Password ##### oldPassword Old password ##### newPassword New password ##### friendlyName Device’s name ##### passwordConfirmation Password confirmation ##### biometrics Biometrics ##### birthdate Birth date ##### save Save ##### resetPassword Please enter your new password. ##### send Send ##### lastTimeYouLoggedInWith Last time you logged in with ##### notYourAccount Not your account? ##### unexpectedErrorOccurred Unexpected error occurred. Please retry later. ##### confirmYourIdentity To continue, please confirm your identity. ##### rememberMe Remember me ##### or or ##### back Back ##### remove Remove ##### add Add ##### address.streetAddress Street address ##### address.locality City ##### address.region Region ##### address.postalCode Postal code ##### address.country Country ##### address.title Title ##### address.addressType Address type ##### address.addressType.billing Billing address ##### address.addressType.delivery Delivery address ##### address.addressComplement Address complement ##### address.raw Raw ##### address.deliveryNote Delivery note ##### address.recipient Recipient ##### address.company Company ##### address.phoneNumber Phone number ##### login.title Log in ##### login.submitLabel Log in ##### login.withBiometrics Login with biometrics ##### login.withPassword Login with password ##### login.forgotPasswordLink Don’t remember your password? ##### login.signupLinkPrefix Do not have an account? ##### login.signupLink Sign up ##### login.password.userAnotherIdentifier Use another identifier ##### signup.title Sign up ##### signup.submitLabel Sign up ##### signup.loginLinkPrefix Already have an account? ##### signup.loginLink Log in ##### signup.withBiometrics Signup with biometrics ##### signup.withPassword Signup with password ##### signup.awaiting.identifier.verification Account created successfully. To login, please verify your identifier with the email or the SMS that you received. ##### forgotPassword.title Forgot password ##### forgotPassword.prompt Enter the email address associated with your account, and we’ll email you a link to reset your password. ##### forgotPassword.prompt.phoneNumber Please enter the phone number associated with your account. We will text you a code to reset your password. ##### forgotPassword.useEmailButton Use email address ##### forgotPassword.usePhoneNumberButton Use phone number ##### forgotPassword.backToLoginLink Back to Login ##### forgotPassword.submitLabel Send reset link ##### forgotPassword.submitLabel.code Send reset code ##### forgotPassword.verificationCode Please enter the verification code we’ve sent to your phone, along with your new password. ##### forgotPassword.successMessage An email containing a link to update your password has been sent to you. ##### passwordless.intro Enter your email to sign in or create an account. ##### passwordless.emailSent We sent you a link to sign in to your email. ##### passwordless.sms.intro Enter your phone number to sign in or create an account. ##### passwordless.email.verification.intro Please enter the verification code we sent to your email. ##### passwordless.sms.verification.intro Please enter the verification code we sent to your phone. ##### passwordReset.title Reset your password ##### passwordReset.intro Please type your new password. ##### passwordReset.successTitle Password updated ##### passwordReset.successMessage Your password has been modified. Go back to login page to authenticate yourself. ##### passwordReset.loginLink Login ##### accountRecovery.title Recover your account ##### accountRecovery.prompt Enter the email address associated with your account, and we will send you a link to reset your credentials. ##### accountRecovery.submitLabel Send reset link ##### accountRecovery.successMessage An email containing a link to reset your credentials has been sent to you. ##### accountRecovery.backToLoginLink Back to Login ##### accountRecovery.password.title Create your password ##### accountRecovery.passkeyReset.title Create a new passkey ##### accountRecovery.passkeyReset.successTitle Passkeys updated ##### accountRecovery.passkeyReset.successMessage Your previous passkeys have been invalidated. You can remove them from your credential manager as well. You can go back to the Login page to authenticate yourself. ##### accountRecovery.passkeyReset.loginLink Login ##### accountRecovery.passkeyReset.intro Sign-in faster and safer with passkeys. ##### accountRecovery.passkeyReset.subtitle1 What are passkeys? ##### accountRecovery.passkeyReset.legend1 Passkeys are encrypted digital keys you create using your fingerprint, face, or screen lock. ##### accountRecovery.passkeyReset.subtitle2 Where are passkeys saved? ##### accountRecovery.passkeyReset.legend2 Passkeys are saved to your password manager, so you can sign in on other devices. ##### accountRecovery.passkeyReset.button Continue ##### emailEditor.intro Please enter your new email address ##### emailEditor.successMessage Your request has been processed successfully. Please check now your mailbox: a verification email has been sent to it. ##### emailEditor.successMessage Your request has been processed successfully. Please check now your mailbox: a verification email has been sent to it. ##### phoneNumberEditor.intro Please enter your new phone number ##### phoneNumberEditor.verification.intro Please enter the verification code we sent to your phone. ##### socialAccounts.noLinkedAccount No linked third-party account ##### socialAccounts.linkNewAccount Link new account ##### webauthn.registredDevices.list List of registered devices ##### webauthn.registredDevices.no.list No registered device ##### webauthn.registredDevices.add Enter a device name below to add a device ##### webauthn.registredDevices.confirm.removal Do you confirm that you want to remove the device? ##### webauthn.registredDevices.createdAt Created at ##### webauthn.registredDevices.lastUsedAt Last used at ##### webauthn.friendly.name Device’s name ##### passwordStrength.minimum.required The minimum required strength is ##### passwordStrength.score0 Very weak ##### passwordStrength.score1 Weak ##### passwordStrength.score2 Medium ##### passwordStrength.score3 Good ##### passwordStrength.score4 Excellent ##### day Day ##### month Month ##### year Year ##### january January ##### february February ##### march March ##### april April ##### may May ##### june June ##### july July ##### august August ##### september September ##### october October ##### november November ##### december December ##### dateFormat mm/dd/yyyy ##### genders.male Male ##### genders.female Female ##### genders.other Other ##### form.required.fields Required fields ##### validation.birthdate.dayOfMonth The day doesn’t look right. Be sure to use a 2-digit number that is a day of the month. ##### validation.birthdate.yearLimit Age must be between 6 and 129. ##### validation.birthdate.year The year doesn’t look right. Be sure to use an actual date of birth with four digits. ##### validation.required This field is required. ##### validation.checked Please check the box to continue. ##### validation.email This is not a valid email. ##### validation.phone This is not a valid phone number. ##### validation.identifier This is not a valid email or phone number. ##### validation.integer This is not a valid integer. ##### validation.float This is not a valid float number. ##### validation.date This is not a valid date. The expected format is 'mm/dd/yyyy' ##### validation.passwordMatch Passwords are not the same. ##### validation.password.must.contain Your password must contain: ##### validation.password.minLength At least {min} characters. ##### validation.password.maxLength Please limit your password to a maximum of {max} characters. ##### validation.password.minStrength Some of the most used words and names may be prohibited. ##### validation.password.specials.characters At least one special character. ##### validation.password.specials.lowercase At least one lowercase character. ##### validation.password.specials.uppercase At least one uppercase character. ##### validation.password.specials.digit At least one digit character. ##### mfa.register.email Enable email 2FA ##### mfa.verify.email Please enter the code you received by Email ##### mfa.email.explain Use your email identifier as a 2FA ##### mfa.email.explain.required Please activate your email as second factor to log in ##### mfa.email.registered Email registered as 2FA ##### mfa.phoneNumber.explain Use this phone number as a 2FA ##### mfa.verify.sms Please enter the code you received by SMS ##### mfa.phoneNumber.registered Phone number registered as 2FA ##### mfa.register.phoneNumber Enable 2FA ##### mfa.email.alreadyRegistered Email already registered as a 2FA ##### mfa.stepUp.start Start a strong authentication ##### mfa.stepUp.trustDevice Trust this device ##### mfa.select.factor Please select your factor ##### mfa.email.remove.explain Disable email second factor ##### mfa.phoneNumber.remove.explain Disable phone number second factor ##### mfa.remove.email Disable email second factor ##### mfa.remove.phoneNumber Disable phone number as second factor ##### mfa.email.removed Email as a second factor has been disabled ##### mfa.phoneNumber.removed Phone number disabled as a second factor ##### mfaList.noCredentials No credentials. ##### mfaList.createdAt Created at - We updated the library we use to [validate phone numbers](../../docs/validating-phone-numbers.html) to the latest version. - We removed the `risk_score` scope from our [B.connect](../../docs/bconnect.html) connector since it is no longer used by the provider. * * * ## Fixes ##### Purse Identity wasn’t correctly sending a code\_verifier for B.connect authentication attempts. ✓ ##### When merging an SLO user account with a managed profile using a pre-event webhook, has\_password was being inadvertently set to false. ✓ ##### Purse Identity Console ##### The Purse Identity Console API was using the incorrect operator NOT\_IN instead of the correct NOT IN operator. ✓ ##### In some limited cases, the display URL (label) in Purse Identity Console links was not showing custom domains as defined in client settings. ✓ --- # 31 July 2025 (v2.139) URL: /release-notes/previous-years/2139.html `Purse Identity v2.139` introduces a couple of improvements and needed bug fixes. - [Third-party grants visible in Purse Identity Console](#third-party-grants-visible-in-purse-identity-console) - [Improved Data Breach Detection messaging](#improved-data-breach-detection-messaging) - [Name included in reCAPTCHA configuration](#name-included-in-recaptcha-configuration) We also have a new [iOS SDK release](#release-highlight) where several enhancements have been made including breaking changes related to how futures are handled. As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Release highlight iOS SDK release `9.0.0` There are several updates with our iOS SDK release that are considered breaking due to the migration from BrightFutures to Swift’s native concurrency. The main Purse Identity iOS SDK now uses `async throws` for asynchronous operations. See [Migrating from BrightFutures to Swift Concurrency](../../sdk-ios/guides/migrate-futures.html) for details on migrating from BrightFutures to Swift’s native concurrency. We have introduced the **Reach5Future SDK** compatibility bridge to maintain support for BrightFutures-based methods, allowing customers to continue using `Future` without immediate migration. See [Migrating to the Reach5Future SDK compatibility bridge](../../sdk-ios/guides/migrate-reach5future.html) for details on using the **Reach5Future SDK**. * * * ## Third-party grants visible in Purse Identity Console We have made third-party grants visible in the Purse Identity Console to improve transparency and user awareness. You can see the third-party grants in the _Third-party consents_ tab of a user profile by going to **Profiles**  **User Details**. ![third party consents](../../docs/_images/console/users/third-party-consents.jpg) * * * ## Improved Data Breach Detection messaging When a user’s credentials are detected as leaked by our [Data Breach Detection scanning job](../../docs/security/data-breach-detection.html#scanning-job), the Purse Identity Console now displays more specific messages to ensure you understand what happened. These messages appear in the [Recent Activity section](../../docs/support/manage-profiles-from-console.html#recent-activity) of the user profile. ![2139 recent activity](../_images/2139_recent_activity.jpg) * * * ## Name included in reCAPTCHA configuration We have added the name of the reCAPTCHA configuration to the Purse Identity Console to make it easier to identify which configuration is being used. The name is in brackets (parentheses) next to the Client ID. ![2139 recaptcha name](../_images/2139_recaptcha_name.jpg) * * * ## General improvements - In some cases, [MFA](../../docs/mfa-on-console.html) is required to access certain accounts on the Purse Identity Console. We now provide clearer information to a user if MFA is required and they do not have MFA on their console account. * * * ## Fixes ##### There was a temporary issue where users were being redirected inadvertently to the Purse Identity Console instead of the Microsoft Portal when authenticating with Entra ID (formerly Azure AD). ✓ ##### In some limited cases when a user trusted a device, the device was being registered multiple times, leading to duplicate entries in the trusted device list. ✓ ##### We removed an unnecessary scope for Listing trusted devices. ✓ ##### Google login was temporarily not working for native mobile SDKs. ✓ ##### Purse Identity Console ##### For a brief period, you were unable to delete a CaptchaFox configuration in the Purse Identity Console. ✓ --- # 14 August 2025 (v2.140) URL: /release-notes/previous-years/2140.html `Purse Identity v2.140` introduces several improvements and needed bug fixes. Here are some new features and notable updates: - [Configurable MFA session expiry](#configurable-mfa-session-expiry) - [iOS SDK 9.1.0 release](#ios-sdk-9-1-0) As always, we [fixed](#fixes) a few items for you. ## Configurable MFA session expiry You can now configure how long the MFA AMR scope remains valid in the MFA settings section of the Purse Identity Console. Set the session lifetime anywhere between 1-720 hours (default: 72 hours). The MFA session resets after a strong authentication; for example, after re-entering a password plus OTP, or completing a step-up operation like approving a high-value purchase. ![mfa settings session duration](../../docs/_images/mfa/mfa-settings-session-duration.jpg) Example A user who completes MFA on Monday at 09:32 can access MFA-protected features until Thursday at 09:32 (72 hours), even if their SSO session remains active for other tasks. If they perform MFA again within that period (e.g., during a step-up), the MFA validity resets — for example, to Saturday at 17:12 if triggered on Wednesday at 17:12. This feature helps reduce hijacking risk, supports compliance requirements, and gives you flexibility to balance security with convenience. For full details, see [MFA settings](../../docs/mfa.html#mfa-settings). * * * ## iOS SDK 9.1.0 We are pleased to announce the release of the [iOS SDK 9.1.0](https://github.com/ReachFive/reachfive-ios/releases/), which includes updates to the [logout](../../sdk-ios/logout.html) method. The `logout` method now takes parameters for web and native sessions to revoke brower sessions and cookies. For full details, see our [iOS SDK documentation](../../sdk-ios/index.html). * * * ## Fixes ##### In some cases, the OaaS flow wasn’t working as expected with Hosted Pages. ✓ ##### Lite profiles weren’t being properly synced between source and target accounts in our Account Synchronization feature as expected. ✓ ##### New users were unable to enroll a trusted device if a trusted device cookie already existed. See Risk-based Authentication for more on this topic. ✓ --- # 28 August 2025 (v2.141) URL: /release-notes/previous-years/2141.html `Purse Identity v2.141` introduces an improvement for [MFA retries](#step-up-token-can-now-be-reused-for-mfa-retries) in Risk-based authentication flows. And of course, as always, we [fixed](#fixes) a few items for you. ## Step-up token can now be reused for MFA retries When [Risk-based Authentication](../../docs/rba.html) requires [Multi-factor Authentication](../../docs/mfa.html), the `step_up` token is no longer limited to a single use. You can now reuse the same `step_up` token to request a new code (for example, if the user did not receive the first one), ensuring your users don’t need to restart the entire authentication process over each time. The verification code requests in the MFA flow are subject to a limit. This limit helps protect against abuse and can be configured by Purse Identity administrators. If you’d like details on the limit or to adjust this setting, contact your [Purse Identity representative](mailto:project@reach5.co). See [Retry MFA step-up](../../docs/rba.html#retry-mfa-step-up) for more details. ![retry token flow](../../docs/_images/authentication/mfa/retry-token-flow.svg) * * * ## Fixes ##### For a brief time, the MFA flow wasn’t working as expected in web sessions for the iOS and Android SDKs. We now ensure the step-up token contains an Orchestration Token at the startPasswordless point. ✓ ##### Purse Identity Console ##### We corrected a small wording issue in the MFA Session duration in hours section of Settings  MFA  Settings. ✓ --- # 11 September 2025 (v2.142) URL: /release-notes/previous-years/2142.html `Purse Identity v2.142` brings a few improvements including: - [MFA step-up token retries](#mfa-step-up-token-retries) - [Users not suspended by default for Data Breach Detection](#users-not-suspended-by-default-for-data-breach-detection) - [Improved search on custom fields](#improved-search-on-custom-fields) And as always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## MFA step-up token retries We enhanced security around MFA step-up token retries, ensuring that users can request a new verification code without compromising their account security. For more details, see [Retry MFA step-up](../../docs/mfa.html#retry-mfa-step-up). * * * ## Users not suspended by default for Data Breach Detection When you enable [Data Breach Detection](../../docs/security/data-breach-detection.html), the **Suspend user** toggle in the Log In section is now disabled by default. This gives you the chance to customise your configuration before proceeding with the Data Breach Detection feature. For more details, see [Data Breach Detection](../../docs/security/data-breach-detection.html). ![2142 dbd login defaultSuspend](../_images/2142_dbd_login_defaultSuspend.jpg) * * * ## Improved search on custom fields You can now perform full-text searches on custom fields with a type of `string`. Previously, searches on custom string fields required exact matches and were sensitive to case and accents (for example, searching for `Jean Foret` would not return `Jean Forêt`). This feature is available directly when searching on the Purse Identity Console as well as with the [Management API: Search users endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/searchUsers). ![search custom string](../../docs/_images/console/users/search-custom-string.jpg) Full-text search: Use the `.ANALYZED` suffix with your field key: `custom_fields..ANALYZED`. This performs a full-text search that is case and accent insensitive. ```bash GET /api/v2/users?filter=custom_fields.birthplace.ANALYZED == "Île de Ré" (1) ``` - (1) Returns profiles with matching values even if the search string ignores accents or casing. For example, searching for `"Ile de Re"` or `"ile"` also returns results. With this improvement, when you enable the **full text search** option on a custom string field: - Searches become case and accent insensitive. - You can search by individual words instead of the full string (e.g. searching `Foret` will match `Éric Forêt`). - Results are more consistent with how standard fields like `given_name` and `family_name` behave. This makes it easier to find profiles even when users enter names or custom values with variations in spelling, casing, or accents. For more details, see [Search custom `string` fields](../../docs/custom-fields.html#search-custom-string-fields) and [Management API: Search users](https://docs.identity.purse.eu/openapi/management.html#operation/searchUsers). * * * ## General improvements - We updated the minimum duration for an [On-demand scaling](../../docs/on-demand-scaling.html) event to 24 hours on the Purse Identity Console side, aligning it with backend requirements and improving user experience. - We now ensure that the Risk Score threshold defined in the [Risk-based Authentication section](../../docs/rba.html#rba-risk-calculation) of the Purse Identity Console cannot be set to a `null` value. Go to **Settings**  **MFA**  **Settings**  **Use risk based authentication** to configure this setting. * * * ## Fixes ##### When exporting user profiles with JSONL, all lite profiles were unexpectedly being marked as lite\_profile=false even for users with a lite profile. ✓ ##### Purse Identity Console ##### For a brief period, administrators were only able to see the first 10 users in the Purse Identity Console in the Users (console) section. This was a small pagination issue and only affected console users (not user profiles). ✓ ##### There were a few UX issues in the Purse Identity Console that have been addressed. These included suboptimal field validation, inconsistent button focus points, and other minor visual issues. ✓ --- # 25 September 2025 (v2.143) URL: /release-notes/previous-years/2143.html `Purse Identity v2.143` brings several new features: - Now, you can [prevent unverified users logging in at signup](#release-highlight). - You can also [track password reset request origins](#track-password-reset-request-origins). - Additionally, you can now use [Pub/Sub hooks for import events](#use-pubsub-hooks-for-import-events). And as always, we [fixed](#fixes) a few items for you. ## Release highlight Prevent unverified users logging in at signup You can now prevent unverified users from logging at signup. This strengthens your defenses against fraudulent accounts and ensures only verified users gain access from the very start. By default, unverified users could sign up and log in once, only being blocked on their next attempt. With the new **Forbid unverified identifiers login after signup** option, they cannot log in at all until their email or phone number is verified. This option is disabled by default to avoid breaking existing flows. For more details, see [Block unverified login attempts](../../docs/block-unverified-logins.html). 1. Go to **Security**  **Attack protection policy**. 2. Enable **Forbid unverified identifiers login after signup**. ![enable block unverified logins](../../docs/_images/security/enable-block-unverified-logins.jpg) When **Forbid unverified identifiers login after signup** is enabled and a user is unverified: - Signup endpoints do not issue tokens or redirect users: - [`/identity/v1/signup` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/signup) - [`/identity/v1/signup-token` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/signup) - [`/identity/v1/webauthn/signup` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/signupWithCredentials) - The Core SDK [`signup` method](../../sdk-core/signup.html) returns an `AuthResult` without an access token or redirect. - The UI SDK [`showAuth` method](../../sdk-ui/showAuth.html) displays an overridable message (`signup.awaiting.identifier.verification`) telling users to verify their identifier. By default, the message the user sees is "Account created successfully. To login, please verify your identifier with the email or the SMS that you received." - A new `isIdentifierVerificationRequired` field is included in the `signupEvent` callback to simplify flow handling. We have introduced a new Management API endpoint as part of this feature. This endpoint consumes the `verification_code` received by email to verify the user’s email address. - [`POST /api/v2/users/{user_id}/verify-email/consume` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/consumeUserEmailVerificationCode) - Accepts the `verification_code` sent to the user and verifies the identifier. - Requires the `manage:users` scope. ## Track password reset request origins You can now track the origin of users when they request a password reset. This makes it easier to audit reset activity, monitor for suspicious behavior, and analyze trends across different applications or regions. For more information on this subject, see [Track user origins](../../docs/track-user-origins.html). The [`/identity/v1/forgot-password` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/requestPasswordReset) now accepts an `origin` field. This value is stored in the user’s `origins[]` array and included in the [`password_reset_requested` event](../../docs/models-user-events.html#user-event-types). Supports passing an `origin` parameter with [`requestPasswordReset`](../../sdk-core/requestPasswordReset.html). The [`showAuth` widget](../../sdk-ui/showAuth.html) automatically forwards the configured `origin` when triggering a password reset. * * * ## Use Pub/Sub hooks for import events You can now use Pub/Sub hooks to receive events related to user import jobs. - **Import job events on hooks** Import jobs with user events (e.g., `user_created`, `user_deleted`, `user_updated`, `managed_user_created`) are now published through Pub/Sub hooks. - **Event Source configuration** A new configuration option in the Purse Identity Console allows you to include or exclude import job events, preventing existing hooks from receiving unexpected messages. When you choose `api` or `import`, only relevant events for that event source is filterable, allowing only relevant information for you. View from the console ![2143 pubsub import](../_images/2143_pubsub_import.jpg) - **Job definition tracking** You can now filter events by **job definition ID** directly in the Purse Identity Console to reduce noise when running multiple jobs. For full details, see [Pub/Sub hooks](../../docs/pub-sub-hook.html). * * * ## Fixes ##### The trusted device authentication cookie had a fixed expiration period, which did not align with the configurable trusted device lifetime set in the Purse Identity Console. ✓ --- # 9 October 2025 (v2.144) URL: /release-notes/previous-years/2144.html `Purse Identity v2.144` brings several new features: - [Pass `state` in forgot password endpoint](#pass-state-in-forgot-password-endpoint) - [New `scope` field for login user events](#new-scope-field-for-login-user-events) - [LinkedIn Connect updates](#linkedin-connect-updates) - [Failure indicator for duplicate import jobs](#failure-indicator-for-duplicate-import-jobs) As always, we [fixed](#fixes) a few items for you. Mobile SDK updates We also have several updates to both our Android and iOS SDKs. This includes some **breaking changes**, so please review the [Mobile SDK updates](#mobile-sdk-updates) section carefully. You can jump directly to the SDK repositories and documentation with the links below. ##### Android SDK `10.0.0` ##### iOS SDK `10.0.0` ## Pass `state` in forgot password endpoint You can now include an optional `state` parameter when calling the [`POST /identity/v1/forgot-password` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/requestPasswordReset). This enhancement lets frontends access and use the `state` parameter before calling `POST /identity/v1/update-password`, for example to warn users if the verification code has expired. The value of `state` is returned unchanged in the password reset URL sent to the user (by email or SMS). This allows you to pass contextual information, such as the code expiration time, session identifiers, or any other client-specific metadata, between the reset request and the password reset page. The `state` value must be URL-encoded to ensure it is safely included in the password reset link. For example: `POST` /identity/v1/forgot-password ```json { "email": "user@example.com", "state": "expires_at=1761936000" (1) } ``` - (1) In this case, `state` specifies that the verification code expires on October 10, 2025 (in Unix timestamp format, seconds). The resulting password reset link includes the encoded `state` value: ```sh https://YOUR_URL/password-reset?verification_code=558885362&email=user@example.com&state=expires_at%3D1761936000 ``` * * * ## New `scope` field for login user events Login-related user events (such as `SuccessfulLogin`) now include a new field: - `scope` (array of strings) — The list of OAuth/OpenID scopes granted to the user during this login or token refresh. This addition allows auditing and debugging of the permissions granted at the time of authentication. For more details, see [User Events](../../docs/models-user-events.html). Example ```json { "event": "login", "user_id": "123456", "client_id": "mobile-app", "auth_type": "password", "scope": ["openid", "profile", "email"], (1) "time": "2025-10-07T12:34:56Z" } ``` - (1) In this case, `scope` is `openid`, `profile`, and `email`. * * * ## LinkedIn Connect updates We have updated Purse Identity to support the latest LinkedIn authentication API. The previous API used for LinkedIn Connect was deprecated by LinkedIn on August 1, 2023. To ensure a smooth transition and avoid breaking changes, Purse Identity now supports **both** the old and new LinkedIn APIs. The correct API is automatically selected based on the configured scopes. Clients using LinkedIn Connect should create a new LinkedIn app and update their configuration to include the new scopes. ![2144 linkedin](../_images/2144_linkedin.jpg) ##### New API - `openid` - `email` - `profile` ##### Old API (deprecated) - `r_liteprofile` - `r_emailaddress` - `w_member_social` > The old LinkedIn API has been deprecated and may be removed by LinkedIn in the future. We recommend migrating to the new API as soon as possible to ensure continued compatibility. > > For more details, see [LinkedIn Connect](../../docs/linkedin.html). * * * ## Failure indicator for duplicate import jobs Import jobs that are stopped due to duplicate user entries in the uploaded data now clearly indicate a failure. Previously, a job containing duplicates would stop without processing any rows but still report successful. This improvement ensures you can immediately understand and act on duplicate-related import issues. With this update: - The job status is marked as FAILURE when duplicates are detected. - A clear error message is logged and visible in the Purse Identity Console, explaining that the job was interrupted due to duplicate entries. * * * ## Mobile SDK updates We have released new versions of our mobile SDKs with several improvements and breaking changes. - [Breaking change : Prevent unverified users logging in at signup](#breaking-change-prevent-unverified-users-logging-in-at-signup) - [Trust device during MFA enrollment](#trust-device-during-mfa-enrollment) - [Customizable MFA email and SMS templates for step-up and enrollment](#customizable-mfa-email-and-sms-templates-for-step-up-and-enrollment) - [Trace origin for password reset requests](#trace-origin-for-password-reset-requests) ### Breaking change : Prevent unverified users logging in at signup The mobile SDKs (iOS and Android) now support the "Forbid login on signup with unverified email" feature introduced in [Purse Identity 2.143](2143.html#release-highlight). When this feature is enabled, the signup flow may not return an `AuthToken` if the user’s email or phone number is unverified during signup. This introduces a breaking change, as the signup callbacks now return a flow object rather than always returning a token. [signup](../../sdk-android/signup.html) now returns a `SignupResponse` which can be: - `AchievedLogin(authToken)`: signup completed and the user is immediately logged in. - `AwaitingIdentifierVerification`: signup pending verification (email or phone). In this case, no `AuthToken` is provided. [signup](../../sdk-ios/signup.html) now returns a `SignupFlow` with the same possible outcomes: - `.AchievedLogin(authToken: AuthToken)`: signup completed and the user is immediately logged in. - `.AwaitingIdentifierVerification`: signup pending verification. In this case, no `AuthToken` is provided. **Impact on Integrators:** - Your application logic must handle both possible outcomes of the signup flow (`AchievedLogin` vs `AwaitingIdentifierVerification`) to prevent runtime issues. - Ensure that your UI and backend processes can gracefully handle cases where the user must verify their identifier before receiving an authentication token. - This may require updates to existing signup handling logic, token storage, and error handling in both mobile SDKs. ### Trust device during MFA enrollment The mobile SDKs (Android only at this time) now allows users to trust their device when enrolling a second factor for multi-factor authentication (MFA), providing greater flexibility during the setup process. This feature extends the existing trust device capability, previously available only during login ([Multi-factor Authentication](../../docs/mfa.html)), to the MFA enrollment process. To enable this, set the `trustDevice` parameter to `true` (default is `false`) in the following SDK methods: - [startMfaEmailRegistration](../../sdk-android/startMfaEmailRegistration.html) - [verifyMfaEmailRegistration](../../sdk-android/verifyMfaEmailRegistration.html) - [startMfaPhoneNumberRegistration](../../sdk-android/startMfaPhoneNumberRegistration.html) - [verifyMfaPhoneNumberRegistration](../../sdk-android/verifyMfaPhoneNumberRegistration.html) - [mfaStart(Registering credential)](../../sdk-ios/mfaStart.html) - [mfaVerify(Credential)](../../sdk-ios/mfaVerify.html) - [mfaStart(WithStepUp)](../../sdk-ios/mfaStartWithStepUp.html) - [mfaVerify(WithStepUp)](../../sdk-ios/mfaVerifyWithStepUp.html) **Behavior:** - For **verified** identifiers (email or phone number), setting `trustDevice` to `true` during the `startMfaEmailRegistration` or `startMfaPhoneNumberRegistration` methods will trust the device and return the `__Host-trusted-device-id` cookie. - For **unverified** identifiers, the `trustDevice` parameter is only taken into account during the `verifyMfaEmailRegistration` or `verifyMfaPhoneNumberRegistration` methods, after the verification code is submitted. - When `trustDevice` is set to `true`, the device is trusted in the backend, and the `__Host-trusted-device-id` cookie is deposited, consistent with the login flow behavior. **Impact on Integrators:** `trustDevice` is an optional parameter (default is `false`), so existing integrations will continue to function without modification. - Update your mobile SDK integration to include the `trustDevice` parameter where applicable, ensuring proper handling based on the identifier’s verification status. - Refer to the table in the [Purse Identity 2.132 Release Notes](2132.html#trust-device-section) for a summary of when the `trustDevice` parameter is applicable and when the cookie is returned: ### Customizable MFA email and SMS templates for step-up and enrollment The mobile SDKs (iOS and Android) now support customization of email and SMS templates for both step-up MFA and MFA enrollment processes, allowing you to tailor messaging based on specific user journeys. This is achieved by introducing the `action` parameter in the following SDK methods: - [startStepUp](../../sdk-android/startStepUp.html) - [startMfaEmailRegistration](../../sdk-android/startMfaEmailRegistration.html) - [startMfaPhoneNumberRegistration](../../sdk-android/startMfaPhoneNumberRegistration.html) - [mfaStart(WithStepUp)](../../sdk-ios/mfaStartWithStepUp.html) - [mfaStart(Registering credential)](../../sdk-ios/mfaStart.html) **Behavior:** - The `action` parameter allows you to specify the journey context, enabling the use of customized email or SMS templates configured in the Purse Identity Console. - This feature enhances the flexibility of MFA workflows by aligning notification content with specific user interactions or application requirements. **Impact on Integrators:** `action` is an optional parameter, so existing integrations will continue to function without modification. - Update your mobile SDK integration to include the `action` parameter in the listed methods to leverage customized email and SMS templates. - Ensure that corresponding templates are configured in the Purse Identity Console to match the specified `action` values for seamless integration. ### Trace origin for password reset requests The mobile SDKs (iOS and Android) now support tracing the `origin` of password reset requests, allowing you to provide context for where the request originated. This is achieved by introducing the `origin` parameter in the following SDK methods: - [requestPasswordReset](../../sdk-android/requestPasswordReset.html) - [requestPasswordReset](../../sdk-ios/requestPasswordReset.html) **Behavior:** - The `origin` parameter is passed to the [`/identity/v1/forgot-password` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/forgotPassword), enabling tracking of the request’s source (e.g., app, website, or specific feature). - This feature enhances auditability and allows for better monitoring of password reset activities. **Impact on Integrators:** `origin` is an optional parameter, so existing integrations will continue to function without modification. - Update your mobile SDK integration to include the `origin` parameter in the `requestPasswordReset` method to provide context for password reset requests. - Ensure the `origin` value is meaningful and aligns with your application’s tracking requirements. ## Fixes ##### Purse Identity Console ##### Longer MFA Credentials on a user profile weren’t displayed correctly. ✓ --- # 23 October 2025 (v2.145) URL: /release-notes/previous-years/2145.html `Purse Identity v2.145` brings several new features: - [Certificate management](#certificate-management) - [Custom fields for custom email providers](#custom-fields-for-custom-email-providers) - [Customise the Third party consents Hosted Page](#customise-the-third-party-consents-hosted-page) - [Support for symfonySha512 password hashes](#support-for-symfonysha512-password-hashes) - [Audit log viewer](#audit-log-viewer) As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Certificate management You can now manage SSL/TLS certificates for your custom domains directly from the Purse Identity Console. Each environment (staging or production) requires a separate certificate. Certificates are stored securely in base64 format for integrity checks. - **Automatically managed certificates**: When you configure a new custom domain, a Let’s Encrypt certificate is automatically requested and installed on your cluster. Renewals are handled automatically; no manual action is required. - **Custom certificates**: If you prefer to use your own certificate, you can upload your PEM-formatted certificate, private key, and any intermediate certificates directly in the console. The system compares the new certificate with existing data and installs it only if it has changed. ![cert management](../../docs/_images/console/cert-management.jpg) What information can I see about the certificate? 🤔 The **IP resolved from the custom domain** section lets you see that the custom domain DNS is configured correctly. In other words, the IP displayed corresponds to the IP of the Purse Identity default domain (e.g clientName.reach5.net) ) The **Current Certificate** section lets you see information about the current existing certificate which you previously uploaded or created with Let’s Encrypt. ![cert management top](../../docs/_images/console/cert-management-top.jpg) For more details, see [Custom domains and certificate management](../../docs/console/custom-domains-and-certificate-management.html). * * * ## Custom fields for custom email providers You can now define custom fields when configuring a [custom provider](../../docs/emails.html#custom-providers). These fields are sent alongside the standard custom personalization data, enabling richer integration with external ESPs like Adobe Campaign, Salesforce Marketing Cloud, or in-house systems. **Benefits include:** - Pass provider-specific IDs, alternate names, or metadata (e.g., `loyalty_id`, `region_code`) - No code or API changes needed - Perfect for ETL mediation and advanced personalization workflows Here is an example of a custom provider payload request that includes custom fields configured from the Purse Identity Console: ```json { "email": "testhash+3@gmail.com", "template_id": "password reset", "personalizations": { "id": "AZoAn..LiySU32", "given_name": "Kristian", "last_name": "Parisian", "gender": "male", "has_password": true, "verification_code": "720795", "redirect_url": "https://local-sandbox.og4.me/consent?verification_code=720795&email=testhash%2B3%40gmail.com", "lang": "en", "client_id": "sg48Cd..WZ9j1H", "custom_fields": { "checkbox": true, "email": "test@gmail.com", "test_cp": "test custom field" } } } ``` ![2145 custom providers fields](../_images/2145_custom_providers_fields.jpg) * * * ## Customise the Third party consents Hosted Page You can now customise the text displayed on the [Third party consents Hosted page](../../docs/hosted-pages.html). This Hosted page is only used in the [OaaS flow](../../docs/oaas.html#hosted-pages-configuration). To do so: 1. In the Purse Identity Console, go to **Hosted Pages**  **Third party consents**. View from the Purse Identity Console ![2145 hp consents](../_images/2145_hp_consents.gif) 2. Add the desired text in the **Content of the consent page** text area. 3. Specify the **Accept button text**. Multilingual support All [supported languages](../../docs/global-consumers/languages.html) are available for localisation. When added, the language code (e.g., En for English, Fr for French) turns green to the signal a customisation has been added. ![2145 consents languages](../_images/2145_consents_languages.jpg) 4. Specify the **Decline button text**. Multilingual support All [supported languages](../../docs/global-consumers/languages.html) are available for localisation. When added, the language code (e.g., En for English, Fr for French) turns green to the signal that a customisation has been added. ![2145 consents languages](../_images/2145_consents_languages.jpg) 5. Add any desired custom styles in standard CSS format. * * * ## Support for symfonySha512 password hashes We’ve added support for `symfonySha512` password hashes. This uses the following parameters: - **Algorithm**: `sha512` - **Iterations**: `5000` - **Salt**: concatenated as a postfix in braces (`password{salt}`) - **Hash output**: encoded as Base64 For more details, see [Import user passwords](../../docs/import-passwords-from-the-console.html). * * * ## Audit log viewer You can now view [audit logs](../../docs/audit-logs.html) directly from the Purse Identity Console under the **Analytics**  **Audit logs** section. You need a Manager or Administrator [role](../../docs/roles.html) to see the audit logs. 1. In your Purse Identity Console, go to **Analytics**  **Audit logs**. 2. Click **Audit logs**. ![2145 audit logs](../_images/2145_audit-logs.jpg) For more details, see [audit logs](../../docs/audit-logs.html#view-audit-logs-from-the-console-as-a-manager). ## General improvements - We upgraded to the latest API version for [Meta Connect (Facebook Login)](../../docs/facebook.html). - We now ensure that users with a high volume of consents do not negatively impact system performance * * * ## Fixes ##### In limited cases, pre-event webhooks configured for the login event type were not triggering on every login as expected. ✓ --- # 20 November 2025 (v2.146) URL: /release-notes/previous-years/2146.html `Purse Identity v2.146` brings several new features: - [Account Synchronization](#release-highlight) - [Identities object retrieved in Kakao signup](#identities-object-retrieved-in-kakao-signup) In addition, we have a new [UI SDK 1.39.0](#ui-sdk-1-39-0) release which includes several important enhancements. As always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Release highlight Account Synchronization Purse Identity’s **Account Synchronization** feature empowers seamless profile management across multiple Purse Identity accounts, allowing you to unify your user data across disparate systems with precision and efficiency. By syncing profiles between a **Source account** and a **Target account**, you can ensure consistent user experiences while adhering to regional data models and compliance requirements. For instance, a global e-commerce platform operating in France and Korea can synchronize user profiles from its French Source account to its Korean Target account, mapping fields like language preferences or regional identifiers to maintain a cohesive customer journey. This reduces operational silos, streamlines data governance, and enhances personalization, all while leveraging Purse Identity’s robust CIAM infrastructure to maintain security and scalability. ![ice overview](../../docs/_images/ice/ice-overview.jpg) For full details, see [Account Synchronization](../../docs/global-consumers/account-synchronization.html). ## Identities object retrieved in Kakao signup We now retrieve the [Identities object](../../docs/models-user-profile.html#identities-object) when users sign up or log in using Kakao. This allows for better management of user identities and improves the overall authentication process. For more details on this provider, see [Kakao Connect](../../docs/kakao-connect.html). * * * ## UI SDK 1.39.0 We have introduced several improvements in the latest UI SDK release. This includes: - [UI SDK improvements](#ui-sdk-improvements) - [UI SDK fixes](#ui-sdk-fixes) ### UI SDK improvements - The `birthdate` field in the [signup form](../../sdk-ui/showAuth.html#signupFields) now lets you select the month and year directly from a dropdown menu, ensuring consistency for your users. Use `min` and `max` to enforce who is allowed to sign up, and `yearRange` to decide which years are actually selectable in the dropdown. Set `yearRange` wide enough to cover the same span that `max` allows; otherwise eligible users might pass validation but be unable to pick their birth year. These attributes are available on all date fields in the UI SDK and help you enforce age restrictions. ```js client.showAuth({ ... signupFields: [ { key: 'birthdate', (1) min: 18, (1) max: 115, (1) yearRange: 116 (2) }, ... // other signup fields ], ... }) ``` - (1) Sets the minimum and maximum age for the user and the range of years available in the dropdown from the current year. If not set, defaults to `6` and `129` for the minimum and maximum age. If users attempt to sign up outside of the defined age range, they will see an error message indicating the valid age limits. - (2) Sets the range of years available in the dropdown from the current year. Pick a value that covers the maximum age you allow (for example, 116 years for a `max` of 115). If not set, defaults to `10`. **Year range dropdown:** ![birthdate dropdown](../../sdk-ui/_images/birthdate-dropdown.png) **Min/Max set error message**: ![birthdate dropdown error](../../sdk-ui/_images/birthdate-dropdown-error.png) - You can also now override the default label for any language in the UI SDK by passing it through the [`i18n` configuration option](../../sdk-ui/showAuth.html#i18n). This allows for greater customization and localization of the user interface. If undefined, it will fall back to the default label provided by the SDK. `showAuth` example ```js client.showAuth({ i18n: { "fr": { "rememberMe": "Garder ma session ouverte pour 3 jours", (1) } "en": { "rememberMe": "Keep my session opened for 3 days", (2) } }, …​ }) ``` - (1) French label override. Defaults to "Se souvenir de moi" if not provided. - (2) English label override. Defaults to "Remember me" if not provided. ### UI SDK fixes - The asterisk (`*`) indicating a consent was [required](../../sdk-ui/showAuth.html#signupFields) wasn’t appearing as expected. * * * ## General improvements - We have improved the user experience in the Purse Identity Console for [Email templates](../../docs/email-templates.html) and [SMS templates](../../docs/sms-templates.html) by updating the tabs to be positioned vertically, allowing for easier navigation between different template types. ![2146 template vertical scroll](../_images/2146_template_vertical_scroll.jpg) - We have also brought our token revocation policy more in line with [RFC 9700 Section 4.14.2](https://datatracker.ietf.org/doc/html/rfc9700#section-4.14.2). * * * ## Fixes ##### In some cases, Social Login buttons weren’t appearing correctly on the Authentication hosted page. ✓ ##### When importing user profile information, the MFA email enrolment wasn’t being accepted even with the Force data update from file activated. ✓ ##### In some limited instances, users attempting to log in with B.connect following a Google Connect login would receive an error message and be unable to log in. ✓ ##### Purse Identity Console ##### Custom fields with underscores weren’t mapping correctly for Account Synchronization integrations. ✓ --- # 8 December 2025 (v2.147) URL: /release-notes/previous-years/2147.html `Purse Identity v2.147` brings a few new features: - [Export and retrieve trusted device data](#export-and-retrieve-trusted-device-data) - [Whitelist IPs for RBA](#whitelist-ips-for-rba) We also have an important notice for those of you using Microsoft Entra ID (Azure AD) with SCIM. Expand for Entra ID/SCIM details If you are using Microsoft Entra ID (formerly Azure AD) as your identity provider, you must append a specific compatibility flag to your Tenant URL. This only applies to automatic provisioning and not on-demand provisioning. Entra ID’s default SCIM implementation does not fully comply with the SCIM 2.0 specification regarding group updates. Without this flag, removing a single user from a group in Entra ID may cause the entire group to become empty in Purse Identity. To fix this: When configuring the Tenant URL in the Microsoft Entra ID portal, add the query parameter `?aadOptscim062020` to the end of your Purse Identity SCIM URL. - **Standard URL**: `https:///scim/v2` - **Required URL for Microsoft Entra ID (Azure AD)**: `https:///scim/v2?aadOptscim062020` > For details, refer to the [Microsoft documentation on SCIM compatibility](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/application-provisioning-config-problem-scim-compatibility). As always, we [fixed](#fixes) a few items for you. ## Export and retrieve trusted device data You can now export and retrieve detailed trusted device information across [Pub/Sub hooks](../../docs/pub-sub-hook.html), [Webhooks](../../docs/webhooks.html), and [exports](../../docs/exports.html). This enhancement improves visibility into trusted devices and enables more comprehensive identity event processing. Previously, trusted device data was not included in these payloads. You can choose to select **TrustedDevices** which will include the `trusted_devices` field in the payload and include all trusted device attributes as shown below. Each attribute of a trusted device is also available individually for easier filtering and downstream processing: - **User - Trusted Devices - Created At**: The date the device was added as a trusted device. - **User - Trusted Devices - Device Class**: Class of the trusted device. - **User - Trusted Devices - Device Name**: User provided name for the trusted device. - **User - Trusted Devices - ID**: Unique identifier of the trusted device. - **User - Trusted Devices - IP**: IP address of the trusted device. - **User - Trusted Devices - Operating System**: Operating system of the trusted device. - **User - Trusted Devices - User Agent**: User agent string of the trusted device. ![2147 trustedDevices](../_images/2147_trustedDevices.jpg) * * * ## Whitelist IPs for RBA You can now whitelist specific IP addresses or ranges to bypass [Risk-based Authentication](../../docs/rba.html). This feature allows trusted networks to avoid unnecessary authentication prompts, enhancing user experience while maintaining security. To whitelist IPs for RBA: 1. Go to **Settings**  **Security**  **Attack protection policy** in your Purse Identity Console. 2. Under **IP addresses allowed to bypass attack protection**, add the desired IP addresses. This can be a single IP address or a range in CIDR notation. Enter one per line. ```none 203.0.113.42 192.168.1.0/24 ``` 3. Don’t forget to **Save** your input. ![ip inspector whitelist](../../docs/_images/ip-inspector/ip-inspector-whitelist.jpg) * * * ## Fixes ##### There was a temporary issue with reCAPTCHA that is now resolved. ✓ --- # 18 December 2025 (v2.148) URL: /release-notes/previous-years/2148.html `Purse Identity v2.148` brings a few new features: - [Identify Login as users](#identify-login-as-users) more easily through the Management API - [New `lite_only` variable for Password Reset email templates](#new-lite_only-variable-for-password-reset-email-templates) to customize emails for lite profiles And as always, we made some [general improvements](#general-improvements) and [fixed](#fixes) a few items for you. ## Identify Login as users When a user logs in as another user, Purse Identity now clearly identifies the `login-as` user in the user event and in an access token claim. This makes it easier to track actions performed by `login-as` users for security and auditing purposes. ### How does it work? 🤔 You can pass an optional `name` query parameter in the [GET `/users/:id/login-as` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/loginAs). This `name` is then included in the `https://reach5.co/login-as-name` claim in the access token and also appears in a `login` user event with the `auth_type: login_as` under `login_as_profile_id`. ```sh GET /users/:id/login-as?name=JohnDoe (1) ``` - (1) Here, `JohnDoe` is the name of the user performing the `login-as` action. This appears in the user event and in the access token claims as `https://reach5.co/login-as-name`. If logging in as a user from the Purse Identity Console, the `https://reach5.co/login-as-name` access token claim is automatically taken from the email of the console user. ![Login-as user event example](../_images/2148_login-as.jpg) ```json { "date": "2025-11-07T09:54:34.183123Z", "type": "login", (1) "id": "AWUTz0naD6KwGSiAAIMN", "user_id": "550e8400-e29b-41d4-a716-446655440000", "auth_type": "login_as", (2) "login_as_profile_id" : "JohnDoe", (3) ... } ``` - (1) The event type is `login`, indicating a login action. - (2) `auth_type` will be equal to `login_as`. - (3) The `login_as_profile_id` will display the `name` passed in the Management API call or the Purse Identity Console user email depending on the method used. For full details, see [Login as](../../docs/login-as.html). * * * ## New `lite_only` variable for Password Reset email templates We’ve introduced a new `lite_only` variable for [password reset email templates](../../docs/email-templates.html#password-reset). This variable allows you to customize the content of password reset emails specifically for lite profiles. For example, you can use the `lite_only` variable to include instructions or information that is relevant only to users with lite profiles such as full account activation. ```html {% if user.lite_only %}

Complete your account setup

Thanks for visiting our store! Click below to create a password and access your loyalty points.

Activate Account {% else %}

Reset your password

We received a request to change your password. Click below to proceed.

Reset Password {% endif %} ``` ```json { "email": "clarence@example.com", "template_id": "password_reset", "personalizations": { "id": "id", "client_id": "jQy...TGlj", "external_id": "externalId", "given_name": "Max", "last_name": "Robertson", "gender": "M", "has_password": true, "lang": "fr", "locale": "fr-FR", "verification_code": "verificationCode", "redirect_url": "https://www.example.com/redirect", "lite_only": true, (1) "custom_fields": { "loyalty_id": "123456" } } } ``` - (1) The `lite_only` boolean is only included in the payload for the `password_reset` template to customize the email content for lite profiles. * * * ## General improvements - For users configuring [Data Breach Detection](../../docs/security/data-breach-detection.html) in the Purse Identity Console, when navigating to the email or SMS templates, you now jump straight to the proper template instead of the generic page. * * * ## Fixes ##### In some limited cases, when there were quick sign ups with social login, duplicated profiles occurred. This has been resolved. ✓ ##### There was a minor inconsistency with IDs in the Identities object in the response of the POST /update-profile endpoint. ✓ ##### The MISSING filter was temporarily not working on consent-related endpoints. ✓ ##### Purse Identity Console ##### In some cases, certain UI elements would break when using full text search for custom fields with Account synchronization: Profile sharing. ✓ ##### We fixed a few other minor UI issues related to Account Synchronization. ✓ --- # 02 September 2019 (v2.15) URL: /release-notes/previous-years/215.html ## New features ### Authentication - **Credentials Management API** - Add `saveCredentials` option for Chrome browser on signUp flow - **SMS API** - Add a new generic SMS API endpoint which enables clients to send _Forgot password_, _Verify phone number_ and other SMSes with their own SMS solution. - **Core** - Invalidate refresh tokens when a request for a new access token is initiated - Encryption of the Sign In with Apple private key ### Integrations - **Android SDK** - Improvements on `Errors` model and `ProfileAddress` model - Remove use of Android webview - Investigation on Android 4.4 compatibility issues ### Imports - Investigate and test import performance improvements ### Tooling - **Android SDK** - Improvements on test stack - **Core** - Migration of import/export test stack on Kafka - Factorization of email providers - Refactored profile management - Verify phone number flow - Verify email flow - Verify passwordless flow ## Fixes - Fix error when trying to obtain refresh access token with an auth token - Fix login fail with Facebook social account on Android - Fix login fail with Google social account on Android - Fix forbidden access on profiles without consents - Fix signedUid value on mobile SDKs - Fix import for profiles with missing attributes - Fix webhook filters - Fix the error for custom fields with a specific format --- # 18 September 2019 (v2.16) URL: /release-notes/previous-years/216.html ## New features ### Authentication - **Core** - Add external\_id in the id\_token - Replace extId with external\_id in the accessToken ### Integrations - **Android SDK** - Implement passwordless flow - **iOS SDK** - Implement passwordless flow - Refresh token for iOS clients ### Imports - Bulk write imports and import logs for import performance improvement - Improve external\_id LITE import by supporting import of LITE accounts that have only an external\_id as an identifier ### Tooling - **Android SDK** - Improvements on test stack - **Core** - Add brute force alerting on authentication endpoint for ROPC - **iOS SDK** - Improvements of CircleCI for iOS ## Fixes - Fix email sent even if deactivated - Fix custom\_fields keys containing number not displaying on the console - Fix mail update - Fix search error in profile page - Make redirectURL configurable for the SDK UI - Fix Linkedin Connect error --- # 27 September 2019 (v2.17) URL: /release-notes/previous-years/217.html ## New features ### Authentication - **Core** - Add custom\_fields in id\_token - **Android** - Make redirectUri configurable for Android passwordless flow - **Integrations** - **Email providers** - Add Dialog Insight support - **Tooling** - **Core** - Add brute force alerting on authentication endpoint for ROPC ## Fixes - Fix email verification link for non SMTP providers - Fix Paypal Connect - Fix custom scopes management - Fix consents with invalid snake case - Fix ADFS connection problem - Fix phone number international format support - Fix issues on user import - Fix interests page --- # 15 October 2019 (v2.18) URL: /release-notes/previous-years/218.html ## New features ### Authentication - **Core** - Add custom\_fields in ID tokens - **Android** - Make redirectUri configurable for Android passwordless flow ### Integrations - **Mail provider** - Add Dialog Insight support ### Tooling - **Core** - Add brute force alerting on Authentication endpoint for ROPC ## Fixes - Fix email verification link for non SMTP providers - Fix Paypal Connect - Fix custom scopes management - Fix consents with invalid snake case - Fix ADFS connection problem - Fix phone number international format support - Fix issues on user import - Fix interests page --- # 29 October 2019 (v2.19) URL: /release-notes/previous-years/219.html ## New features ### Authentication - Improved password policy to match CNIL recommendations - Added the possibility to disable Implicit flow in the client configuration ### Integrations - **Hosted Pages** - Added update password page - Generic SMS and email support for passwordless authentication - Added consent date in exports ## Fixes - Fixed HTTP error handling in iOS SDK - Fixed getProfile response in iOS SDK - Fixed the header within the console SMS template - Fixed widget language in Safari - Fixed has\_password filter in the [/api/v2/users](https://docs.identity.purse.eu/openapi/management.html#operation/searchUsers) endpoint - Fixed the access to webhooks for the Developer role in the Purse Identity Console - Fixed minimum password length handling --- # 18 November 2019 (v2.20) URL: /release-notes/previous-years/220.html ## New features ### Authentication - Support additional password hash algorithm (password + salt ⇒ SHA256 x rounds) - Invalidate all profile refresh tokens on the same client when a revoked refresh token is used - Implement PKCE flow for username/password login ### Integrations - **Hosted pages** - Error management for the verified email page - Consent display on the sign up hosted page - Addition of error parameters on the verification page - Edit postal addresses via the Purse Identity Console ## Fixes - Fixed city and country code set to USA for French users - Fixed HTTP 400 error handling while creating a profile - Deleted ABTasty entry from the Purse Identity Console Integration menu - Changed default role to `Analytics user` for ADFS creation - Identity endpoints can no longer be called with a Management client - Fixed birthdate and profile address management in iOS and Android SDKs --- # 02 December 2019 (2.21) URL: /release-notes/previous-years/221.html ## New features ### Authentication - Added the ability to whitelist IP addresses to bypass rate limiting - Added calling domain into well-known OpenID configuration ### User data management - Updating a lite profile in the Purse Identity Console no longer turns it into a managed profile - Improved lite profile management to allow deletion of attributes - Improved bulk consents update to also search for managed profiles - Improved user email management via API ### Integrations - **Export module** - New `runNow` parameter to launch a job directly after creation - New parameter to use complete or differential mode for export jobs - Export logs now display progression - **Email & SMS providers** - New Email update template for Email providers - New Password updated template for SMS providers - Added `id` and `external_id` fields in generic API payload - **SDKs** - Improved IE11 compatibility for SDK UI widgets & SDK core - Changed behavior to open providers login page in the same page - **Hosted pages** - New Password reset page - **Jobs** - New button to duplicate a job - **Import module** - New option in Purse Identity Console to enable/disable Google Geocoding API for import jobs - Import logs now give rows in error ## Fixes - Fixed errors occurring when using PKCE method for the UMD bundle - Removed phone number validation in export jobs to avoid global export failure - Fixed Twitter social provider connection - Fixed an error occurring during the sign up process when a webhook URL is not configured properly - Fixed the display of icons in widgets --- # 17 December 2019 (2.22) URL: /release-notes/previous-years/222.html ## New features ### Authentication - Support SHA-1 password hashing in import module - Removed Bearer type authorization from Authorization header to let users define the type correctly - Custom scopes are now allowed with the `client_credentials` grant type - Scopes are now enforced by default for new Identity clients ### User data management - Searching by email is now case sensitive ### Integrations - **Hosted pages** - Added `redirectUrl` parameter on Password change page - **Passwordless** - Addition of error parameters on the verification page - **Android SDK** - Removed the sdk-web package: [sdk-webview](https://bintray.com/beta/#/reachfive/identity-sdk/sdk-webview) must be used instead. ## Fixes - Fixed a bug where the service was unavailable after setting a custom domain - Fixed a bug where lite profiles were not unified correctly when using passwordless flow - Deprecated use of Google Geocoding API normalizing city and country attributes --- # 07 January 2020 (v2.23) URL: /release-notes/previous-years/223.html ## New features ### Authentication - Addition of an OAuth-compliant introspection endpoint [/oauth/introspect](https://docs.identity.purse.eu/openapi/management.html#operation/introspectToken) - Invalidation of all access tokens on the same client ID when a revoked refresh token is used ### Integrations - **Android SDK** - Removed the `sdk-web` package to force `sdk-webview` usage. - **UI JS SDK** - Internationalization is complete. For more details, read [here](../../sdk-ui/index.html#installation). ## Fixes - Fixed a bug where JSON export fields were in camelCase - Fixed logout on IE 11 and Safari for the SDK core - Fixed custom scopes addition on Identity clients - Fixed custom scopes deletion on Management clients - Fixed deduplication job to clean Elasticsearch indices --- # 22 January 2020 (v2.24) URL: /release-notes/previous-years/224.html ## New features ### Authentication - An OAuth-compliant [introspection endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/introspectToken) is now available via `/.well-known/openid-configuration` (_introspection\_endpoint_). - A French dictionary has been incorporated to the password validation library to prevent use of unsafe passwords ### Integrations - **Hosted pages** - The `read:clients` and `manage:clients` scopes have been added to enable client management via API ## Fixes - Fixed exports-related errors --- # 04 February 2020 (v2.25) URL: /release-notes/previous-years/225.html ## New features ### Authentication - **Hosted Pages** - Integration of the new SDK UI, which supports the password policy configured in the Purse Identity Console. - **Core** - The Single Sign-On session lifetime is now configurable (`Security`). The session will be renewed if the user is active during the configured period. - Verify the existence of the mail before the password during a sign in to improve user experience. ### Integrations - Addition of a postal address management system, by API or Import ## Fixes - Fix handling of the updated\_at parameter during lite profile import - Fix custom\_fields in JSON format export - Fix console import and export jobs by using a single KafkaProducer from supervisor - The `full_write` scope is now required to use the [/identity/v1/update-password](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePassword) endpoint (except for legacy clients). --- # 18 February 2020 (v2.26) URL: /release-notes/previous-years/226.html ## New features ### Authentication - Addition of a redirection parameter to allow the user to go back to a specified URL when leaving the Hosted Page. Read more about how to setup [Hosted pages](https://docs.identity.purse.eu/docs/hosted-pages.html). - Apple Sign-in scopes are now available and taken into account. The email address and username can be retrieved. Read more about [Sign In with Apple](https://docs.identity.purse.eu/docs/apple.html). - CNIL password constraints are applied in ReachFive widgets, when users create, edit, and reset their password. Read more about [password constraints setup](https://docs.identity.purse.eu/docs/password-management.html#password-policy-constraints) and the [UI SDK JS](https://docs.identity.purse.eu/sdk-ui/index.html). ### User data management - Addition of postal addresses export via the Purse Identity Console export job. - Addition of the **phone\_number\_verified** filter for API search. ## Fixes - Fix `updated_at` management in lite profiles. The field was not correctly set during import and created synchronization issues with external systems. - Fix error response bodies so that you can uniformly use `error` and `error_description` attributes to handle errors. - Fix .well-known content which was displaying the IP address instead of the domain, on Azure environments. - The Apple provider’s configuration is now correctly returned when social providers are listed by the SDKs. --- # 09 March 2020 (v2.27) URL: /release-notes/previous-years/227.html ## New features ### Authentication - Preparation of OpenID as a Service release: - Separation of first and third party flows - Handle authentication from third party clients - Reinstate third party flow - Added the `end_session_endpoint` value into well-known OpenID configuration to expose logout URLs ## Fixes - Fixed a bug preventing from editing profile information in the Purse Identity Console - Fixed the check of password policy when updating user password --- # 11 March 2020 (v2.28) URL: /release-notes/previous-years/228.html ## New features ### Authentication - Preparation of OpenID as a Service release: - Record authorized parties in user profile - List authorized parties - Hosted Pages: - New layout for configuration page in the Purse Identity Console - Logo management is now handled via file upload - New favicon management via file upload For more details on Hosted Pages, read [here](../../docs/hosted-pages.html). ### Integrations - Improved error rendering when an email provider is unavailable ## Removed features - Removed the ability to download all profiles on profiles page in the Purse Identity Console ## Segments - Migrated the Purse Identity Console Segments page from Angular stack to React stack to improve global performances and data visualization ## Fixes - Performance improvement on [/identity/v1/password/callback](https://docs.identity.purse.eu/openapi/identity.html#operation/passwordCallback) calls - Fixed token invalidation on multiple password reset emails - Fixed a bug that prevented users to filter on boolean values in the Purse Identity Console in exports jobs - Fixed a bug that prevented users from login when their password is imported in upper case - Fixed a bug that prevented users to validate custom email providers in the Purse Identity Console configuration if no HTTP Authorization was defined - Fixed error management when payload is malformed, resulting in a stack trace body response - Changed HTTP status code from 204 to 404 when trying to delete an nonexistent identity or management client - Fixed a typo in email confirmation Hosted Page title - Fixed a bug that prevented from deleting users attributes in the Purse Identity Console in the Profiles page --- # 23 March 2020 (v2.29) URL: /release-notes/previous-years/229.html ## New features ### Authentication - First release of OpenID as a Service, you can now become on OpenID provider for your partners and let them take advantage of your user base ![demo oaas](../../docs/_images/demo-oaas.gif) For more information, please read [this page](../../docs/oaas.html). ### Integrations - You can now trigger a webhook by filtering on `client_id` - Rate limiter and Management client whitelisting configuration now accept [ranges of IP v4 and IP v6](../../docs/rate-limiting.html#bypass-rate-limit-configuration). ## Fixes - Performance improvement on [/oauth/token](https://docs.identity.purse.eu/openapi/identity.html#operation/retrieveAccessToken) calls - Fixed a bug that prevented users from managing an account in the Purse Identity Console when a value was not defined in Hosted Pages - Fixed a bug in the Purse Identity Console that allowed users to add multiple spaces after a URL in forms --- # 06 April 2020 (v2.30) URL: /release-notes/previous-years/230.html ## New features ### Authentication - OpenID as a Service (OaaS): - The authorization hosted page is now customizable. For more information, please read [this page](../../docs/oaas.html). ### Integrations - Added a confirmation button for Providers deletion in the Purse Identity Console - The username can now be retrieved after an Apple sign-in. For more information, please read [this page](../../docs/apple.html). ## Fixes - Fixed a bug that prevented from storing IP v6 information on user events - Changed error response code to 400 when trying to upload a too big logo in Hosted Pages configuration - Fixed Rate Limiter behavior that was not always activated when no IPs were defined in the Allowed IPs addresses field in the Purse Identity Console - Fixed a bug that caused crash on the iOS mobile SDK - Fixed a bug that prevented Analytics Users to access Segments in the Purse Identity Console - Fixed a bug on the [/identity/v1/update-password](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePassword) that allowed password update without a fresh token --- # 21 April 2020 (v2.31) URL: /release-notes/previous-years/231.html ## Authentication - OpenID as a Service (OaaS): - The Consent Hosted Page is now only displayed on the first connection to improve user experience and accelerate the login. For more information, please read [this page](../../docs/oaas.html). - Addition of the "Remember Me" login functionality. Users can now choose to stay connected for a long period on your site or not. You can implement this functionality in the: - Core JS SDK, by setting the [persistent](../../sdk-core/loginWithPassword.html#auth) parameter to `true`. - UI JS SDK, using the [showRememberMe](../../sdk-ui/showAuth.html#showRememberMe) checkbox. The duration of the persisted session can be configured on the Purse Identity Console. ## Integrations - Removed the ability to select Third-Party clients in Hosted Pages configuration in the Purse Identity Console ## Fixes - Performance improvement on [/identity/v1/passwordless/verify](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyEmailPasswordless) calls - Fixed a bug that prevented the modification of clients on the Login As configuration page - Improved SSO session cookie handling on Safari --- # 05 May 2020 (v2.32) URL: /release-notes/previous-years/232.html ## Authentication - Management clients can now be set to sign JSON Web Tokens using the RS256 algorithm ## User data management - You can now filter on lite profiles only in the Profiles page in the Purse Identity Console ## Integrations - Your users can now request a verification of their identifiers, by using the [/identity/v1/send-email-verification](https://docs.identity.purse.eu/openapi/identity.html#operation/sendEmailVerification) endpoint to verify the email address, or the [/identity/v1/send-phone-number-verification](https://docs.identity.purse.eu/openapi/identity.html#operation/sendPhoneNumberVerification) endpoint to verify the phone number. - A link to the well-known configuration has been added directly in the Settings page in the Purse Identity Console ## Fixes - Fixed the login with KakaoTalk provider - Fixed a issue where the `updated_at` field was updated on unwanted events - Fixed the retrieval of profiles from Paypal provider - Fixed a bug with the Sign In With Apple provider authentication flow that was taking too long and resulted in the invalidation of the PKCE code verifier --- # 26 May 2020 (v2.33) URL: /release-notes/previous-years/233.html ## User data management - The endpoint [/identity/v1/update-email](https://docs.identity.purse.eu/openapi/identity.html#operation/updateEmailAddress) can be used to update the profile’s email with the email of an existing Lite profile. The profiles will be merged after this update. - New profile filter criteria have been added in the Purse Identity Console filtering options: - Updated At, - Created At, - External ID, - Email Verified, - Phone Number Verified ## Integrations - You can now use the core JS SDK to verify the email address by using the [sendEmailVerification](../../sdk-core/sendEmailVerification.html) function, or the [sendPhoneNumberVerification](../../sdk-core/sendPhoneNumberVerification.html) function to verify the phone number. - You can now see the custom domain defined directly from the **Settings** page of the Purse Identity Console ## Fixes - Fixed a bug that re-enabled Hosted Pages features under specific circumstances - Fixed the signature of the `verifyPasswordless` method of the SDK Core - Fixed the ordering of the country code list in the **Settings** page of the Purse Identity Console - Fixed a bug that erased the name data of the user’s profile when using Sign In With Apple - Fixed a bug that prevented from using only enabled templates for email and SMS - Fixed a bug that allowed the update of a Lite profile with an existing email by calling this endpoint [/api/v2/lite-update/{id}](https://docs.identity.purse.eu/openapi/management.html#operation/updateLiteProfile) - Fixed a bug on the UI JS SDK that didn’t handle correctly required integer fields - Fixed email update template initialization on the Purse Identity Console --- # 10 June 2020 (v2.34) URL: /release-notes/previous-years/234.html ## User data management - The endpoint /identity/v1/lite-registration has been deprecated and is no longer supported in production, please use this Management API endpoint instead [/api/v2/lite-registration](https://docs.identity.purse.eu/openapi/management.html#operation/pushLiteProfile) - We have improved our [/identity/v1/update-password](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePassword) endpoint algorithm and security ## Integrations - `implicit` flow has been added to the grant types of the OpenID well-known configuration page - Legacy settings of Hosted Pages have been removed ### Rate limiting - [/identity/v1/update-password](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePassword) and [/identity/v1/forgot-password](https://docs.identity.purse.eu/openapi/identity.html#operation/requestPasswordReset) rate limits are now configurable in the security section of the Purse Identity Console - Rate limiting is activated on [/identity/v1/update-email](https://docs.identity.purse.eu/openapi/identity.html#operation/updateEmailAddress) and also configurable in the security section of the Purse Identity Console For more information about our Rate Limiting mechanism, please refer to [this page](../../docs/rate-limiting.html). - Our job definitions API is available, you can now manage your jobs without using the Purse Identity Console. Please refer to the [Job definition documentation](https://docs.identity.purse.eu/openapi/management.html#tag/Jobs-and-job-definitions) for more information. ## Fixes - Fixed [/identity/v1/update-email](https://docs.identity.purse.eu/openapi/identity.html#operation/updateEmailAddress) response in case of a merged profile - Fixed import merge login by replacing the `uid` by the `id`. For more information about our import module, please refer to [this page](../../docs/imports.html). --- # 16 June 2020 (v2.35) URL: /release-notes/previous-years/235.html ## New features ### Fast IDentity Online 2 - ReachFive now supports some FIDO2 flows: - Add a device to your user account (from a web browser on Desktop and Android) - Login to your account with the registered device For more information, please refer to our [FIDO2 guide](../../docs/fido2.html). ## Fixes - Fixed a log issue where rate limiting error message is logged for all request - Fix a bug that prevented from overloading a redirect URL in email templates --- # 02 July 2020 (v2.36) URL: /release-notes/previous-years/236.html ## Authentication ### Reset password process - We’ve increased the strength of the verification code when requesting a reset password link (from 6 to 9 digits) ### Deprecated endpoint - `/identity/v1/token-info` endpoint is deprecated and no longer supported. Please use [/oauth/introspect](https://docs.identity.purse.eu/openapi/identity.html#operation/introspectToken) instead. You can also fully decode your tokens by following [this procedure](../../docs/decode-tokens.html). ## User data management ### Signup invitation - First release of the signup invitation flow, you can now capitalize on your Lite profiles data and accelerate your users signup process. For more information, please read [this page](../../docs/lite-profiles.html). ### Email update - The endpoint [/api/v2/users/{user\_id}](https://docs.identity.purse.eu/openapi/management.html#operation/updateUser) can be used to update the profile’s email with the email of an existing Lite profile. The profiles will be merged after this update. - You can now activate and customize a notification message that will be sent to the old email address after an email update. This option is configurable in the Purse Identity Console in the email update template: ![email update notification](../../docs/_images/email-update-notification.png) ## Integrations ### Webhooks - Webhooks now accept all 2xx HTTP status codes as response and do not trigger retry mecanism for these statuses anymore - We’ve updated the retry mecanism to trigger at 15s / 30s / 60s and eventually throwing an error For more information about our Webhook mecanism, please read [this page](../../docs/webhooks.html). ### Apple Sign-In - The Domain Verification File has been deleted from Apple Sign-In configuration in the Purse Identity Console. This parameter is no longer mandatory. For more information on Apple Sign-In configuration, please read [this page](../../docs/apple.html). ### OpenID well-known configuration - If a custom domain is set for your Account, the link of the Purse Identity Console to visit your OpenID well-known configuration now redirects to that custom domain ## Fixes - Fixed an issue where a user could retrieve password from some configuration pages in the Purse Identity Console - Fixed an issue where the port of an IPv4 address wasn’t properly parsed when making some call with a whitelisted address and resulted in the blocking of the request - Fixed security issue in some forms of the Purse Identity Console to prevent re-use of complete configurations for SFTP or Amazon S3 storage providers - Fixed an issue with WebAuthn RSA signature that prevented from using some devices --- # 22 July 2020 (v2.37) URL: /release-notes/previous-years/237.html ## Authentication ### User suspension - You can now suspend users by using the new endpoint [/api/v2/users/suspend](https://docs.identity.purse.eu/openapi/management.html#operation/suspendUser). The suspended users will not be able to login and their previously issued tokens ans sessions will be revoked. You can also unsuspend users with this endpoint [/api/v2/users/unsuspend](https://docs.identity.purse.eu/openapi/management.html#operation/unsuspendUser) ## User data management - Added the `created_at` and `updated_at` fields in the User’s profile view in the Purse Identity Console ### Custom fields - The custom scopes associated with the custom fields are now necessary to be able to update them For more information, please read [this page](../../docs/custom-fields.html). ## Integrations - Added a new `keepLiteProfile` parameter for user deletion endpoint to remove provider and local profile information only, more details at [DELETE /api/v2/users/{user\_id}](https://docs.identity.purse.eu/openapi/management.html#operation/deleteUser) - Added the `RS256` algorithm in the `token_endpoint_auth_signing_alg_values_supported` field of the OpenID well-known configuration ## Fixes - Fixed an issue where the custom fields were not present in the `id_token` - Fixed a security issue with the PKCE flow, the `code_verifier` was not mandatory to exchange the `authorization code` with a token - Fixed a bug with the signup verification code on the telephone, the same code was sent after a profile deletion and a new signup - Fixed an issue with the lite profile merge after an email verification with the management API - Fixed an issue that allowed users to insert blank spaces in input text fields for some configuration pages in the Purse Identity Console --- # 04 August 2020 (v2.38) URL: /release-notes/previous-years/238.html ## Authentication ### SSO - We now display the maximum duration of the SSO session in the Purse Identity Console under **Security**  **SSO** menu, more details at [Configure SSO duration](https://docs.identity.purse.eu/docs/sso.html#configure-session-duration) ## User data management - Custom fields can now be accessed using specific independent read or write scopes ## Integrations - The endpoint [/identity/v1/signup/data](https://docs.identity.purse.eu/openapi/identity.html#operation/getSignupData) now returns the `external_id` attribute - Addition of a new email template dedicated to user’s account suspension - Addition of two user events for account suspension that can be reused into Webhooks - Upgrade of Facebook’s API to version 7.0 --- # 19 August 2020 (v2.39) URL: /release-notes/previous-years/239.html ## Authentication ### User suspension - The user can now unsuspend his account by following the reset password procedure sent via email ## Integrations - The endpoint [/identity/v1/signup/data](https://docs.identity.purse.eu/openapi/identity.html#operation/getSignupData) now returns the custom fields following the rules of the custom scopes ### Exports - Addition of `delivery_note`, `recipient`, `company`, `phone_number` fields in the exports files when the Addresses field is selected - It is now possible to select fields for the JSON Exports, based on what is possible for the CSV Export - We now support `AWS4-HMAC-SHA256` signatures for our Imports / Exports jobs using AWS ## Fixes - Fixed an issue where a user couldn’t authenticate on Purse Identity Console after receiving an invitation email - Fixed an issue where lite profile attributes were merged into the managed profile whereas the email was not verified by the user - Fixed an issue where the user id was regenerated when a WebAuthn device was deleted and then added again --- # 14 September 2020 (v2.40) URL: /release-notes/previous-years/240.html ## Authentication ### FIDO2 - ReachFive now supports FIDO2 flows on the Android SDK - Add a device to your user account - Login to your account with the registered device For more information, please refer to our [FIDO2 guide](../../docs/fido2.html). ### User suspension - The `password_reset` parameter is now deprecated and replaced by `allow_password_reset` on the [/api/v2/users/suspend](https://docs.identity.purse.eu/openapi/management.html#operation/suspendUser) endpoint: - If this parameter is set to `true` the user is temporarily suspended. He will receive a suspension email with a password reset link to unlock his account and he will also be able to unlock it with a password reset. - If this parameter is set to `false` the user is definitely suspended. He will not be able to unlock his account, the only possibility to unlock it is by calling the [/api/v2/users/unsuspend](https://docs.identity.purse.eu/openapi/management.html#operation/unsuspendUser) endpoint. - You can now directly suspend and unsuspend a user on the Purse Identity Console: ![manage suspend user from console](../../docs/_images/manage-suspend-user-from-console.png) For more information, please read [this page](../../docs/suspend-user.html). ### Authentication without redirection - It is now possible to complete an authentication without having to redirect the user with the Core JS SDK. A new parameter [useWebMessage](../../sdk-core/loginWithPassword.html#auth) will leverage the `web_message` response mode when set to `true` in order to avoid having to redirect the user-agent to obtain the authorization response. The redirection remains active by default on the Core JS SDK. ## Removed features - The Terms of service are deprecated and are not supported any more, please refer to [consents](../../docs/consents.html) instead. ## Fixes - Fixed email templates update, in some cases the update didn’t work because the payload was too large. - Fixed ID output in the mobile SDK, the ID wasn’t available in the response. - Fixed space trimming in the Purse Identity Console --- # 05 October 2020 (v2.41) URL: /release-notes/previous-years/241.html ## Authentication ### Redirect URL > `redirect_url` must now be whitelisted to complete the redirection. This improvement was necessary to improve the security of the platform. ### FIDO2 The registration flow is now supported in the SDK Core. > For more information, please refer to our [FIDO2 guide](../../docs/fido2.html). ### New supported language We now support German on our APIs and SDKs. _Jetzt unterstützen wir Deutsch bei unseren APIs und SDKs._ ## User data management You can now edit even more attributes in the user profile from your Purse Identity Console including: - `external_id` - `company` (_for both profile and addresses_) - `recipient` - `phone_number` - `delivery_note` ### Search You can now search users by their `emails`, `emails.verified` and `emails.unverified` attributes through the [Search users](https://docs.identity.purse.eu/openapi/management.html#operation/searchUsers) endpoint. ## Integrations ### User events The following user events have been created: - New `lite_merged_into_managed` event when a lite profile is merged into an authenticated user profile - New `user_created` event when a lite profile is created using the [Push Lite Profile](https://docs.identity.purse.eu/openapi/management.html#operation/pushLiteProfile) endpoint Also, the `user_updated` event is now triggered when consents are updated using the [Update Lite consents](https://docs.identity.purse.eu/openapi/management.html#operation/updateLiteConsents) endpoint. > For more information about export and import jobs, please the [User events model page](../../docs/models-user-events.html). ### Jobs Retrieving jobs through the API Jobs retrieved through the API are now listed in reverse chronological order (_latest first_). This is in line with how they are listed in the Purse Identity Console. Security improvements for credentials Credentials are now masked from the [Get Job definition](https://docs.identity.purse.eu/openapi/management.html#operation/getJobDefinition), [Search job definition](https://docs.identity.purse.eu/openapi/management.html#tag/Jobs-and-job-definitions) and [Run job definition](https://docs.identity.purse.eu/openapi/management.html#operation/runJobDefinition) endpoints. They are also masked in the Purse Identity Console. The [Update job definition](https://docs.identity.purse.eu/openapi/management.html#operation/updateJobDefinition{job_definition_id}) endpoint supports partial updates. Only the `type` field remains mandatory. > See [Importing jobs](../../docs/imports.html) or [Exporting jobs](../../docs/export-user-profiles.html) for more information. ## Fixes We have fixed the following items: - The password policy was not properly validated between the form sent by the user and the server. - Merging a Lite profile with an `external_id`. - The `custom_fields` were not filtered on identity endpoints. --- # 19 October 2020 (v2.42) URL: /release-notes/previous-years/242.html ## Authentication ### Hosted Pages Release Highlight We continue to enhance our [Hosted Pages](../../docs/hosted-pages.html) feature with: - a new Hosted Page that enables [passwordless authentication](../../docs/otp.html) through email or SMS for users. - controls to enable or disable pages individually. - improved navigation between the different Hosted Pages. ![242 rn hosted pages highlights](../_images/highlights/242-rn-hosted-pages-highlights.png) ## User data management ### Update email with secondary email You can now update a user’s primary email address with their secondary email. The list of secondary emails are found under `emails.verified` or `emails.unverified` depending on whether the email is already verified. > For more information, check out the [Emails object page](../../docs/models-user-profile.html#emails-object). ## Integrations Webhooks now fully support `UTF-8` encoding. > For more information, check out the [Webhooks page](../../docs/webhooks.html). ## Fixes We have fixed the following items: - The `updated_at` field in the response of the [Get Signup data](https://docs.identity.purse.eu/openapi/identity.html#operation/getSignupData) endpoint was not in ISO format as expected. - Internet Explorer and Microsoft Edge (_browsers_) were triggering warnings during session checks. --- # 03 November 2020 (v2.43) URL: /release-notes/previous-years/243.html ## Integrations ### Hosted Pages Release Highlight We have even more improvements to our [Hosted Pages](../../docs/hosted-pages.html) feature with: - a new Hosted Page that lets your users manage their [FIDO2](../../docs/hosted-pages.html) devices, making it easier for them to authenticate using biometrics. - activated Hosted Page links under each enabled page. - the ability to override the [UI JS SDK](../../sdk-ui/index.html)'s _origin_ attribute with an _origin_ query parameter for a Hosted Page. ![243 rn hosted pages highlights](../_images/highlights/243-rn-hosted-pages-highlights.png) ### Import jobs It is now possible to configure a webhook in import jobs to be notified with the job result. This new import webhook is called the **End Job Notification Webhook**. > For more information, check out the [End Job Notification Webhook](../../docs/import-webhook.html) page. ### Core JS SDK - The WebAuthn functions now display an error if the device used does not support the WebAuthn API. ### UI JS SDK We now display a validation message if the required minimum strength of password is fulfilled. ### User events We’ve differentiated between the password change and password reset event processes. Previously, we would trigger a `password_updated` event for both processes. Now, we trigger a `password_changed` and a `password_reset` event, respectively. > For a complete list of user events, check out the [User Events](../../docs/models-user-events.html) data model. * * * ## Authentication ### Allowed origins We now accept all valid URL schemes as allowed origins. There is no need to provide a URL starting with `http` or `https`. ### User suspension Users that are indefinitely suspended cannot request a password reset anymore. These are the users that are suspended with the `allow_password_reset` parameter set to `false` or those users suspended via the Purse Identity Console. > For more information about user suspension mechanism, check out the [User suspension page](../../docs/suspend-user.html#reset-via-administrator). * * * ## Fixes We have fixed the following items: - For security reasons, `access_tokens` are forbidden as query parameters in all of our management endpoints. - Imports and export job fields are correctly validated to avoid inserting corrupt values in the configuration. --- # 30 November 2020 (v2.44) URL: /release-notes/previous-years/244.html ## Authentication ### User suspension You can now configure the SMS that is sent to a suspended user. An SMS is sent only if the user doesn’t have an email address in his profile. > For more information about user suspension mechanism, check out the [User suspension page](../../docs/suspend-user.html). ### New supported language We now support Russian on our APIs and SDKs. * * * ## Integrations ### Hosted Pages The URLs of enabled Hosted Pages are now displayed in each tab so you can easily preview the page. > For more information, check out the [Hosted Pages](../../docs/hosted-pages.html) page. ### User events We’ve added two new user events to be used when synchronizing a manual merge of two user profiles. > For more information about user events, check out the [User events page](../../docs/models-user-events.html). * * * ## Fixes We have fixed the following items: - The user was not redirected when an error occurred at the end of the passwordless flow. - An email update notification was sent when the user was updated. - The `return_to_after_email_confirmation` and `return_to_after_password_reset` query parameters weren’t interpreted correctly when calling the [Authentication Hosted Page](../../docs/hosted-pages.html). - We fixed the UMD format of the `showAuth` widget for the UI SDK. --- # 22 December 2020 (v2.45) URL: /release-notes/previous-years/245.html ## Authentication ### OpenID as a Service Release highlight You can now use the [passwordless Hosted page](../../docs/hosted-pages.html) as part of the OaaS flow. See [OpenID as a service](../../docs/oaas.html) for more details. * * * ## Integrations ### Core JS SDK Public clients are now forced to use the PKCE flow for improved security. ### UI SDK Widgets The [showAuth](../../sdk-ui/showAuth.html) widget now supports the `return_to_after_email_confirmation` and `return_to_after_password_reset` parameters when using the biometrics authentication. ### Hosted Pages - We’ve added a **back** button that is configurable when calling the Hosted Page using the `return_to` query parameter. > Check out the [Hosted Pages](../../docs/hosted-pages.html) documentation for more information. - We’ve also added a more secure way to handle the check of the session when not in a SSO context for the Password Editor page. > Check out the [Hosted Pages](../../docs/hosted-pages.html) under the Password Editor tab for more information. ### Android SDK The [signup](../../sdk-android/signup.html) method now supports the `redirect_url` parameter. * * * ## Removed features The `loginWithCustomToken` function is now deprecated and is no longer supported. > Check out the [OpenID as a service](../../docs/oaas.html) page instead if you want to set up a login flow with your partners. * * * ## Fixes We have fixed the following items: - Fixed some translations for french language. - Fixed a bug where auth options weren’t passed through the last step of the passwordless authentication on the Core SDK. --- # 25 January 2021 (v2.46) URL: /release-notes/previous-years/246.html ## Authentication ### Mitigating downgrade attacks Code exchanges with the `code_verifier` parameter outside of a PKCE flow now result in an error to better mitigate PKCE downgrade attacks. ### JSON Web Key Set We have changed the behavior of the RSA public key management used to sign tokens. Previously it was stored directly on the account. We have moved it to each client settings page for a more logical configuration. You can now generate new keys and keep the old ones in the JSON Web Key Set. > You can still check the JWKS configuration of your account at the following URL: `[https:///jwks.json](https:///jwks.json)`. More info > More developments on this topic are coming shortly. > > > If you want to know more on JSON Web Keys, you can check out the corresponding [RFC 7517](https://tools.ietf.org/html/rfc7517). * * * ## Integrations ### API We have adjusted the behavior of the Lite profiles creation with `external_id` only so that it is now possible to register Lite profiles with `external_id` as the only identifier. > Check out [pushLiteProfile](https://docs.identity.purse.eu/openapi/management.html#operation/pushLiteProfile) for more details. * * * ## Removed features `Instagram` is now deprecated as a social connector and is no longer supported. This is due to a decision by `Facebook` to restrict its usage. > You can use [Meta Connect (Facebook Login)](../../docs/facebook.html) instead. * * * ## Fixes We have fixed the following items: - Lite profiles updates are now possible from your Purse Identity Console. - The input parameters of import or export definitions are correctly checked to avoid adding corrupted data and making the section inaccessible. - The WebAuthn signatures during the authentication process weren’t properly checked, resulting in a inefficient error throws that made it possible to continue with the authentication. --- # 22 February 2021 (v2.47) URL: /release-notes/previous-years/247.html ## Integrations ### User data model Release highlight We have modified the behavior of the Management API [update user](https://docs.identity.purse.eu/openapi/management.html#operation/updateUser) endpoint so that it can no longer modify Lite profiles. If you want to modify Lite profiles specifically, use the [Update a LITE profile](https://docs.identity.purse.eu/openapi/management.html#operation/updateLiteProfile) endpoint. * * * ## Authentication ### Whitelisting logout redirect URLs `redirect_to` URLs used in the [logout](https://docs.identity.purse.eu/openapi/identity.html#operation/destroySSOsession) endpoint or using the JS SDK [logout](../../sdk-core/logout.html) method must now be whitelisted under the new parameter `Allowed logout callback URLs` in [SSO Purse Identity Console setting](../../docs/sso.html). Whitelisted URLs can be used with all identity clients for an account. > URLs that are **not whitelisted** can still be used until the end of March. However, this update will be blocking after **31 March 2021**. ### JSON Web Key Set Following our previous developments, we’ve made a few changes to accomodate existing needs and to smooth the transition to better align with [RFC 7517](https://tools.ietf.org/html/rfc7517). As such, we have added: - The ability to re-synchronize every client configured for using the **RS256 algorithm** on the global account RSA key (_the ability of rotating keys to have a specific RSA key on a given client remains available_). - The ability to check the account RSA key directly in the **Settings** page (back from previous behavior). - The ability to invalidate old JWK keys. > For more information, check out our [JWK Sets Guide](../../docs/jwks.html). ### Security We have improved the use of **nonce values** you can find in authorization requests and tokens content to avoid possible conflations. * * * ## GDPR compliance [Attention](../../attention/index.html) We are currently working on a refresh of our consents module. Be aware that these changes will break the compatibility with previous user data models and that some adaptations are required on your side. For more information on the upcoming changes, check out the [Attention](../../attention/index.html) page. For this release, we have added the following items: - Created a new tag component to better categorize your consents. - Updated the current configuration pages so that you can begin to use these new tags. > For more information, you can check out the [consents guide](../../docs/consents.html) or the [dedicated Management API section](https://docs.identity.purse.eu/openapi/management.html#tag/Consents) regarding consents. * * * ## Fixes We have fixed the following items: - The `external_id` field wasn’t unique on Lite profiles. - Third party client logos weren’t saved correctly if the Hosted page already contained a logo. Both logos are now handled appropriately. - `Vkontakte` experienced a connection failure in cases of an empty `personal` field in the user profile. - An `invalid_state` error was thrown when a Lite profile was updated after the user had already updated their email. - It was previously impossible to create a Managed profile sharing an `external_id` with a Lite profile. --- # 16 March 2021 (v2.48) URL: /release-notes/previous-years/248.html ## Authentication ### Simplification of the passwordless flow We have refactored the [Verify passwordless](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyPasswordless) endpoint and simplified its implementation. You only need a `verification_code` and an `opaque token` to finish the flow after a user receives their code. > The old parameters are still supported to guarantee a smooth transition. Our SDKs will be updated shortly to support the new flow. > For more information, check out [One-Time Passwords](../../docs/otp.html). ### User suspension We have improved the suspension check mechanism. A suspension status is only checked after a login attempt with the correct password. This helps to avoid disclosing any information about an account’s status. > For more information, check out [User Suspension](../../docs/suspend-user.html). ### JSON Web Key Set Following our previous developments, we’ve improved our API security control by implementing scopes on routes allowing JSON Web Key deletion. You now have to request the `manage:clients` scope in order to perform these actions. > For more information on JWKS specifics routes, check out the [JWKS API operations](https://docs.identity.purse.eu/openapi/management.html#tag/JWK-Sets). * * * ## Integrations ### German and Russian translations It is now possible to define a German or Russian translation for your consents and custom fields. * * * ## Fixes ##### Android 7.0 users were unable to login. ✓ ##### Some users were unable to verify their email after a signup with a long expiration. ✓ --- # 30 March 2021 (v2.49) URL: /release-notes/previous-years/249.html ## Integrations ### Pub/Sub Hooks Release highlight We have added a new data synchronization method using Pub/Sub technology to publish messages that contain user events information. This approach is based on the current post-event Webhooks behaviour. > See our [Pub/Sub Hooks guide](../../docs/pub-sub-hook.html) for more details. ### Tags export You can now export custom fields with the `multiple` type such as `tags`. > See [Export user profiles](../../docs/export-user-profiles.html) for more details about our export module. * * * ## Authentication ### OpenID as a Service You can now use your own OpenID identity provider as part of the OaaS flow. > See [OpenID As A Service](../../docs/oaas.html#configure-your-authentication-flow) for more details about this flow. ### Refresh token revocation For security reasons, the revocation of refresh tokens with the [Revoke](https://docs.identity.purse.eu/openapi/identity.html#operation/revokeToken) endpoint will also revoke all access tokens that have been generated with the same `client_id` and the same user. > For more information, check out our [Refresh tokens](../../docs/refresh-tokens.html) documentation. * * * ## Fixes ##### Improved performance on /identity/v1/password/login ✓ --- # 13 April 2021 (v2.50) URL: /release-notes/previous-years/250.html ## Authentication ### Whitelisting logout redirect URLs Release highlight `redirect_to` URLs used in the [logout](https://docs.identity.purse.eu/openapi/identity.html#operation/destroySSOsession) endpoint or using the JS SDK [logout](../../sdk-core/logout.html) method must now be whitelisted under the parameter `Allowed logout callback URLs` in the [SSO Purse Identity Console setting](../../docs/sso.html). Whitelisted URLs can be used with all identity clients for an account. > URLs that are **not whitelisted** will be blocked for security reasons. ### Default language for Consents We have added a new default language property to the Account settings model. For now, this will only be applicable to [Consents](../../docs/consents.html). The default language for Consents in the console is French (`fr`). > You must ensure that the `Title` and `Description` of all Consents match your default language. If the `Title` and `Description` are in a language that do not match the default language selection in the Purse Identity Console, your Consent `Title` and `Description` will default to the selected default language, potentially causing translation issues. See [Set the default language for Consents](../../docs/consents.html#set-the-default-language-for-consents) for more details. * * * ## Integrations ### Import jobs The **End Job Notification Webhook** now contains the `job definition name` and the `job definition id` to facilitate its integration. > For more information, check out the [End Job Notification Webhook](../../docs/import-webhook.html) page. #### PBKDF2 encryption We have added the ability to read [PBKDF2](https://tools.ietf.org/html/rfc6070) encrypted files. > See [encrypting import files](../../docs/imports.html#encrypt-import-file) for more details. * * * ## Fixes ##### Lite profiles weren’t merging with existing authenticated profiles with the same external\_id. ✓ ##### It was possible to remove a local identity when updating a lite-profile. ✓ ##### You couldn’t retrieve the consent history log for lite profiles. ✓ ##### Too many connections could be opened for accessing a database resulting in an application freeze. ✓ --- # 27 April 2021 (v2.51) URL: /release-notes/previous-years/251.html ## Authentication ### Filter suspended users You can now filter suspended users on the Purse Identity Console or with the [`/api/v2/users`](https://docs.identity.purse.eu/openapi/management.html#operation/searchUsers) endpoint. > For more, check out [Filter suspended users](../../docs/suspend-user.html#filter-suspended-users). ### Security We now support [PKCE](https://tools.ietf.org/html/rfc7636) as part of the passwordless flow with the Core JS SDK for improved security. > See the Core SDK’s [`startPasswordless` method](../../sdk-core/startPasswordless.html) for more details. * * * ## Fixes ##### The Core JS SDK was not building with certain Angular 9 configurations. ✓ ##### SMTP email templates were not saved correctly on some Purse Identity accounts. ✓ ##### You could not filter or sort the GET consents endpoint on the Management API. ✓ ##### The Purse Identity Console Profiles page sometimes resulted in a 500 error while loading for some accounts. ✓ --- # 11 May 2021 (v2.52) URL: /release-notes/previous-years/252.html ## Security ### Identity Fraud Protection Release highlight Our **Identity Fraud Protection (IFP) Module** is now available. This module is able to analyse events to determine if a particular IP is exhibiting suspicious behaviour. If it determines that the IP is suspicious, the IP is flagged and blocked. This module also lists all user accounts that have been compromised by these suspicious IPs. The administrator can suspend the compromised accounts directly from the Purse Identity Console. > For more, check out the [Identity Fraud Protection](../../docs/ifp.html) page. If the feature is not activated on your account and you’re interested in using it please contact your professional service or CSM contact. * * * ## Authentication ### OpenID as a Service You can now list and delete user grants following a third party flow directly with the [`Grants`](https://docs.identity.purse.eu/openapi/management.html#tag/Grants) management API. > See [OpenID As A Service](../../docs/oaas.html) for more details about this flow. * * * ## Integrations ### Delete users in bulk We have introduced the ability to remove users in mass as part of a bulk delete operation. This works by passing a `boolean` for deletion during an [import job](../../docs/imports.html). Check out the [bulk deletion guide](../../docs/delete-users-bulk.html) for more details. > This method allows you to match the user ID (`Purse Identity ID`, `email`, `external ID`, or `phone number`) and remove those users while retaining Lite Profiles (_if desired_). > > One of the major benefits to this approach is that you can do a test run before completing the deletion to ensure you are happy to proceed with removing the selected users. ### Custom field schema API You can now manage custom field schemas directly via the [Management API](https://docs.identity.purse.eu/openapi/management/#tag/Custom-Field-Schemas). This approach allows you to create, update, retrieve, and delete custom field schemas. > Check out [Manage custom field schemas with API](../../docs/custom-fields.html#manage-custom-field-schemas-with-api) for more details. ### Portuguese language support We have added support for Portuguese in Purse Identity. You can use Portuguese in API error messages or with UI widgets via the [UI SDK](../../sdk-ui/index.html). Currently supported languages Currently supported languages - `ar` - العربية _Arabic_ - `de` - Deutsch _German_ - `en` - English - `es` - Español _Spanish_ - `fr` - Français _French_ - `hu` - Magyar _Hungarian_ - `it` - Italiano _Italian_ - `jp` - 日本 _Japanese_ - `ko` - 한국인 _Korean_ - `nl` - Nederlands _Dutch_ - `pt` - Portuguese - `ru` - Ру́сский _Russian_ - `sk` - Slovenský _Slovak_ - `zh-CN` - _People’s Republic of China Simplified Chinese_ - `zh-Hans` - _Simplified Chinese_ - `zh-Hant` - _Traditional Chinese_ - `zh-HK` - _Hong Kong Traditional Chinese_ - `zh-MO` - _Macao Traditional Chinese_ - `zh-SG` - _Singapore Simplified Chinese_ - `zh-TW` - _Taiwan Traditional Chinese_ ### Password hash support We now support Magento’s `SHA256` and `Argon` password hashes to import users with Purse Identity. > Check out [Import user passwords](../../docs/import-passwords-from-the-console.html) for more details on supported hashes. * * * ## Fixes ##### The consent list was truncated on the console if the account had more than 10 consents configured. ✓ ##### Some import and export jobs were not executed and remained in waiting mode. ✓ ##### Reverted back to the older error message for expired access tokens. The message now reads "Access token invalid or expired". ✓ --- # 02 June 2021 (v2.53) URL: /release-notes/previous-years/253.html Release highlight Our Consents Module has evolved and now supports versioning of any consent. You can now save newer versions of an existing consent, allowing you to easily identify if your customers have accepted the latest version. This feature is part of a general compliance with [GDPR](https://gdpr.eu/gdpr-consent-requirements/). We aim to help you log and store detailed consent information such as: - What consents a customer has consented to - Consent version ID - Consent title and description in the user’s language We have also added the archive feature on consents, allowing you to disable a consent from future acceptance, while preserving the right of rejecting it if customers had previously accepted. > For more information you can check our complete guide on [Consents](../../docs/consents.html). * * * ## Security ### Identity Fraud Protection Our **Identity Fraud Protection (IFP) Module** can now automatically suspend all accounts that have been compromised by malicious IPs. > For more, check out the [Identity Fraud Protection](../../docs/ifp.html) page. If the feature is not activated on your account and you’re interested in using it please contact your professional service or CSM contact. * * * ## Authentication ### Signup with the passwordless flow We have improved the behaviour of the signup with the passwordless flow. If the `email` or the `phone_number` is not yet present in your account, the user account will only be created when the flow is finished and the first login is completed. > For more information, check out [One-Time Passwords](../../docs/otp.html). * * * ## Fixes ##### All refresh tokens of the same grant (client\_id) were revoked once a refresh token was redeemed. ✓ ##### If the login\_url parameter was set to an empty value in the client configuration, the /oauth/authorize endpoint incorrectly redirected to this value instead of the redirect\_uri when the user was not logged in. ✓ ##### Calls to the /api/v2/users/suspend endpoint responded with a timeout when trying to suspend some accounts. ✓ ##### The import file encryption configuration was not allowing the password field to be pre-filled with the existing password. ✓ ##### The import file encryption configuration was not accepting the PBKFD2 iterations parameter into accounts properly. ✓ ##### Importing large files into S3 resulted in a timeout. ✓ --- # 15 June 2021 (v2.54) URL: /release-notes/previous-years/254.html ## Authentication ### OpenID as a Service The description of a custom scope is now displayed on the user consent page instead of via the custom scope key. This way, users are clearly informed about what data your partners are able to access from their profile. > See [OpenID As A Service](../../docs/oaas.html) for more details about this flow. ### SSO cookies We have improved our cookies' security by complying with OWASP recommendations when using the `__Host-` prefix. > More details can be found on [OWASP’s website](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#cookie-with-__host-prefix). * * * ## Integrations ### Support of custom fields in email templates The `string`, `select`, and `tag` custom fields data types can now be used in email templates. With these, you can further personalize the emails that you send to users and provide them with a unique and personal experience. > For more information, check out our [Email templates](../../docs/email-templates.html) page. ### iOS SDK We have upgraded the Google SignIn SDK version from `4.4` to `5.0.2`. ### Bulk delete log messages We have enhanced our deletion job report log messages to make it easier to understand what part of a profile has been deleted. > For more information, check out [Bulk deletion](../../docs/delete-users-bulk.html) guide. ## Fixes ##### Some user accounts were experiencing less than optimal performance. ✓ ##### Users assigned to the CRM role were not able to access the profiles page on the Purse Identity Console. ✓ --- # 29 June 2021 (v2.55) URL: /release-notes/previous-years/255.html ## Integrations ### Support of verification\_code in passwordless email templates The `verification_code` can now be used in passwordless email templates. > For more information, check out [One-Time Passwords](../../docs/otp.html). ### Deprecated endpoint - The `refreshTokens` method is permanently deprecated and no longer supported. Please use [Refresh tokens](../../docs/refresh-tokens.html) or [SSO sessions](../../docs/sso.html) instead to renew the user access token without requesting a new login. - The `/identity/v1/token-info` endpoint is permanently deprecated and no longer supported. Please use [/oauth/introspect](https://docs.identity.purse.eu/openapi/identity.html#operation/introspectToken) instead. You can also fully decode your tokens by following the [decode tokens procedure](../../docs/decode-tokens.html). * * * ## Groups of consents We have created a dedicated page to manage groups of consents from within the Purse Identity Console. Groups of consents contain the same fields as the standalone consents, but can have multiple consents associated. > To have a look at this new page, go to **Consents**  **Consents Groups** in the `Settings` menu of the Purse Identity Console. --- # 29 July 2021 (v2.56) URL: /release-notes/previous-years/256.html ## User data management ### Segments We’ve added some new filters to help you build user segments: - User authentication types (with all `List` search capabilities) - User email (with all `String` search capabilities) - User phone number (with all `String` search capabilities) - User last login type (with all `String` search capabilities) > To see the changes, check the Purse Identity Console under **Analytics**  **Segments** and create or edit an existing segment. Your browser does not support the video tag. ### Consents We’ve added consent groups into the history log so that you are now able to see which consent group and/or standalone consents your users have interacted with. We’ve also changed the layout of the history log to let you see more clearly the information of each consent. > To see the changes, check the Purse Identity Console under **Analytics**  **Profiles** and check the consents of a given profile. ![256 consents history log](../_images/256-consents-history-log.png) * * * ## Integration ### Import and Export definitions We’ve added the option to connect to an SFTP source using an SSH key configuration in the [Import](../../docs/imports.html) and [Export](../../docs/export-user-profiles.html) jobs definitions. ![256 ssh key conf](../_images/256-ssh-key-conf.png) > You can find instructions for doing this on both the [importing profiles](../../docs/import-profiles-from-the-console.html) and [exporting profiles](../../docs/export-user-profiles.html) pages. ### Consents API We now offer a full pagination system on the [/consent-log](https://docs.identity.purse.eu/api/management.html#operation/getUserConsentLogs) Management API endpoint to help you search and scroll over hundreds of results. * * * ## Fixes ##### Deleting an identity on a Lite profile changed the type of the profile to Managed unexpectedly. ✓ ##### Some automatic account suspensions resulted in a HTTP 500 error when it exceeded the client ID character limit. ✓ ##### Import jobs weren’t always running successfully due to longer than expected processing times. ✓ ##### Legacy refresh tokens weren’t refreshing correctly. ✓ --- # 19 August 2021 (v2.57) URL: /release-notes/previous-years/257.html ## Integration ### Import module We’ve added a new option `Force data update from file` to import data from a source file without the classic merging rules. If you want to update ReachFive’s database with an external dataset, use this option on the Purse Identity Console and the import job updates ReachFive’s database with the existing data from your file. Empty attribute values do not erase existing data. All fields with a value present in the import file are used. > For more details, check out [Force data update from file](../../docs/imports.html#force-data-update-from-file). > There may be unwanted behaviour if you use this option so be sure you understand your requirements before choosing this approach. See [Import and merge logic](../../docs/imports.html#import-and-merge-logic) for more details on merge logic. ![257 force data update](../_images/257-force-data-update.png) ### Export module We’ve added a new feature in the Export module to let you extract user events through usual export jobs. You can then benefit from the `CSV` or `JSON` file structures to embed the user events content and import this data into your own BI or data visualization tools for a better understanding of your users interactions. > For more details, check out the [Export user events](../../docs/export-user-events.html) page. * * * ## Fixes ##### Some scheduled jobs were not triggering properly due to the supervisor being misconfigured. ✓ ##### The description attribute of a consent was unexpectedly deleted when creating a new consent version. ✓ ##### The consent decisions (accept/reject) were inadvertently removed from the consent log for some user profiles. ✓ --- # 6 September 2021 (v2.58) URL: /release-notes/previous-years/258.html ## Authentication ### Phone number verification We updated our phone number verification mechanism to avoid excluding valid phone numbers from signup. ### Lite profile merge rules unification We refactored our lite profile merge rules so that the same rules are applied to all Identity and Management endpoints. > The refactor does not impact existing behaviour. * * * ## Integration We added a new `boolean` field called `has_password` in the [request payload](../../docs/emails.html#customer-email-payload) for custom providers. With this, you can easily adapt emails to users whom have no password associated with their account, allowing them to create a password. ```json { "email": "string/email", "template_id": "string", "personalizations": { "given_name": "string", "last_name": "string", "gender": "string", "has_password": boolean, (1) "redirect_url": "string/url" } } ``` - (1) The `has_password` boolean is only included in the payload for the `password_reset` [email template](../../docs/email-templates.html). > For more information, check out [Custom email providers](../../docs/emails.html#custom-providers). * * * ## Fixes ##### The birthdate attribute wasn’t updated when using Import jobs. ✓ ##### The updated\_at attribute wasn’t taken into account properly when applying merging rules in Import jobs. ✓ ##### The updated\_at attribute wasn’t updated when using the "Force data update from file" option in Import definitions. ✓ --- # 21 September 2021 (v2.59) URL: /release-notes/previous-years/259.html ## Security ### Improved audit log module Release highlight We have improved our Audit log module to be able to immediately detect new export job creations and avoid malicious usage. This is the first available event, we will continue to enrich this module in the next releases. > For more information, check out [Audit logs](../../docs/audit-logs.html). * * * ## Authentication ### OpenID as a Service User email is now directly verified when you use your own OpenID identity provider as part of the OaaS flow. > See [OpenID As A Service](../../docs/oaas.html#configure-your-authentication-flow) for more details about this flow. ### Deprecated payload The `User id` field can no longer be used to update the password in the [Update password](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePassword) endpoint. * * * ## Fixes ##### A call to the Update profile endpoint sent an email update notification to the user. ✓ ##### Consent groups were saved on the user profile instead of being saved as individual consents. For more information, go to Consents  Consents Groups. For more information, go to **Consents**  **Consents Groups**. ##### Consents weren’t correctly updated with import jobs. For more information on consents import, check out Import consents. For more information on consents import, check out [Import consents](../../docs/import-user-consents.html). ##### Somes verification codes were consumed incorrectly. ✓ ##### It was possible to create consent groups without any associated consents. ✓ --- # 7 October 2021 (v2.60) URL: /release-notes/previous-years/260.html `Purse Identity v2.60` focuses primarily on fixing known issues and further enhancing our [MFA feature](#release-highlight). ## Authentication ### Release highlight Improved MFA We have improved our **Multi-factor Authentication (MFA)** integration to strike the right balance between unnecessary friction in the user experience and optimal security. We now support Stepup authentication that allows you to verify a user’s identity before allowing them to perform sensitive actions such as updating personal information, paying with a loyalty card, or adding a new payment method. > For more details, check out our [MFA Guide](../../docs/mfa.html) and [MFA API endpoints](https://docs.identity.purse.eu/openapi/identity.html#tag/MFA). * * * ## Fixes ##### Select custom field values weren’t correctly applied. You can no longer set a value that is undeclared in the Purse Identity Console. You can no longer set a value that is undeclared in the Purse Identity Console. ##### Certain archived consents were blocking user profile updates. ✓ ##### Consents are no longer displayed each time a user connects to the Purse Identity Console through Azure AD. ✓ ##### It was possible to accept archived consents at signup. ✓ ##### Some user IDs weren’t deleted even after being set to null with the Update user endpoint. ✓ ##### Update email notifications were being sent to unverified emails after user updates in the Purse Identity Console. ✓ ##### Response times periodically increased after a high volume of calls to the Update user endpoint. ✓ --- # 27 October 2021 (v2.61) URL: /release-notes/previous-years/261.html `Purse Identity v2.61` focuses primarily on our [Analytics module redesign](#release-highlight) and enriching our new [Audit log module](#audit-log-module). ## Analytics ### Release highlight Redesign of our Analytics module We have been working hard to redesign our Analytics module to provide an improved overall experience in viewing and understanding your users' behaviours when interacting with Purse Identity. The new Analytics module is offered in three tiers: - Standard tier gathers and displays existing metrics for free. - Premium tier displays all new metrics. - Custom tier providing metrics and analytics unique to your deployment. > Check out our new [Analytics guide](../../docs/analytics.html) for more details. * * * ## Security ### Audit log module We have improved our Audit log module to immediately detect job and `client_id` update and deletion events. > For more information, check out our [Audit logs](../../docs/audit-logs.html) page. * * * ## User data management ### Consents We’ve added more details in the consent logs of users profiles. You can now see: - the `source` that represents the channel from which the modification of a consent was made (_Identity API, Management API, Jobs, Console_). - the `reporter` that represents the person that made the modification (_when applicable_). > For more information, check out our [Consents documentation](../../docs/consents-use.html#use-consent-data). * * * ## Fixes ##### MFA credentials were deleted from the profile after a successful stepup. ✓ ##### We have improved the performance of our signup and login endpoints. ✓ ##### It was impossible to use Amazon S3 as an Import source when deployed on Yandex. ✓ --- # 9 November 2021 (v2.62) URL: /release-notes/previous-years/262.html `Purse Identity v2.62` focuses primarily on enriching our new [Audit log module](#audit-log-module) and supporting login with a `phone_number` in the [`showAuth`](../../sdk-ui/showAuth.html) widget. ## Authentication ### Login with a phone number in the UI SDK Login with a `phone_number` is now supported in the UI SDK. It is automatically available if the `SMS` option is activated. > See [`showAuth`](../../sdk-ui/showAuth.html) for more details about this improvement. * * * ## Security ### Audit log module We have improved our Audit log module to immediately detect `client_id` creation events. > For more information, check out our [Audit logs](../../docs/audit-logs.html) page. * * * ## Integration ### Job definition run The `job_id` is now present in the response payload after running a `job_definition` with the [run](https://docs.identity.purse.eu/openapi/management.html#operation/runJobDefinition) endpoint to facilitate jobs administration with the dedicated [Management API](https://docs.identity.purse.eu/openapi/management.html#tag/Jobs-and-job-definitions). * * * ## Fixes ##### You could not make the phone\_number signUp field for showAuth mandatory. ✓ ##### There was a performance issue when multiple users were suspended with the suspend endpoint. ✓ --- # 02 December 2021 (v2.63) URL: /release-notes/previous-years/263.html `Purse Identity v2.63` focuses primarily on improving our Consent management module and resolving a few bug fixes. ## User data ### Consents It’s now possible to define a `reporter` for each individual consent when updating a profile through the [Management API](https://docs.identity.purse.eu/openapi/management.html#tag/Consents). ## Integration ### Social login accessibility We have improved the accessibility of our social login buttons to comply with the [RGAA](https://www.numerique.gouv.fr/publications/rgaa-accessibilite/) standards and facilitate their usage. ### New `refreshTokens` method You can now refresh an `access_token` with a `refresh_token` with the Core JS SDK thanks to the [refreshTokens](../../sdk-core/refreshTokens.html) method. > For more information on refresh tokens in general, check out our [Refresh tokens](../../docs/refresh-tokens.html) guide. * * * ## Fixes ##### Consent titles weren’t present in the Get consent grant stats endpoint response. ✓ ##### There was a minor performance issue when searching for some specific fields with the Search user endpoint. ✓ ##### A suspended user was unsuspended after an update with the Management API. ✓ ##### Lite profiles using an identifier when created with the Lite registration endpoint resulted in an error. ✓ ##### The search for an external\_id containing an uppercase in the Purse Identity Console wasn’t responding correctly. ✓ ##### The consent date could be updated when sending a payload that didn’t change the grant status of a consent. ✓ ##### The consent date could be updated when importing a file that didn’t change the grant status of a consent. ✓ ##### An archived consent group could appear as accepted in the consent log when creating a user profile . ✓ --- # 21 December 2021 (v2.64) URL: /release-notes/previous-years/264.html `Purse Identity v2.64` focuses primarily on improving our **Azure AD integration**, enriching our **Audit log module**, and facilitating **Multi-factor Authentication** integration. ## Integration ### Azure AD connection We’ve modified the configuration of Azure AD organizations to let you define a default role for user signin in the Purse Identity Console. Previously, the default role was always CRM User. We’ve also added a new [role](../../docs/roles.html) with no rights in the Purse Identity Console if necessary for you. > For more information, check out our dedicated [Azure AD guide](../../docs/azure.html) . ### Internationalization We now support both Hungarian and Slovak languages accross the platform. Your end users will be able to see messages in these languages by using our SDKs or Hosted Pages. Currently supported languages Currently supported languages - `ar` - العربية _Arabic_ - `de` - Deutsch _German_ - `en` - English - `es` - Español _Spanish_ - `fr` - Français _French_ - `hu` - Magyar _Hungarian_ - `it` - Italiano _Italian_ - `jp` - 日本 _Japanese_ - `ko` - 한국인 _Korean_ - `nl` - Nederlands _Dutch_ - `pt` - Portuguese - `ru` - Ру́сский _Russian_ - `sk` - Slovenský _Slovak_ - `zh-CN` - _People’s Republic of China Simplified Chinese_ - `zh-Hans` - _Simplified Chinese_ - `zh-Hant` - _Traditional Chinese_ - `zh-HK` - _Hong Kong Traditional Chinese_ - `zh-MO` - _Macao Traditional Chinese_ - `zh-SG` - _Singapore Simplified Chinese_ - `zh-TW` - _Taiwan Traditional Chinese_ * * * ## Authentication ### Facilitate the initiation of the stepup flow You can now initiate a **Multi-factor Authentication (MFA)** stepup flow with an `access_token`. > We recommend that you only use this approach if you are unable to use the SSO session cookie or `tkn` approach. > For more details, check out our [MFA Guide](../../docs/mfa.html). * * * ## Security ### Audit log module We have improved our Audit log module to immediately detect job execution events. > For more information, check out our [Audit logs](../../docs/audit-logs.html) page. * * * ## Fixes ##### Vkontakte experienced a connection failure because of a modification in the API version. ✓ ##### A user\_updated event was generated at the end of a passwordless flow. ✓ ##### The creation of a user with a created\_at value in the past resulted in an error with the create user endpoint. ✓ ##### The merge of two profiles containing only an external\_id with the merge user endpoint resulted in an empty profile. ✓ ##### The consent date could be updated when sending a payload that didn’t change the grant status of a consent. ✓ --- # 18 January 2022 (v2.65) URL: /release-notes/previous-years/265.html `Purse Identity v2.65` focuses primarily on improving our [User import module](#user-import-module) and various [Security](#security) improvements such as with our Audit Logs which now automatically detect security-related updates. ## Integration ### User import module When a user is created via an import file, the `created_at` and `updated_at` fields are now automatically set to the profile creation date if they are not already present in the file. > For more details, check out [Import user profiles](../../docs/imports.html#create-a-user-via-import-file). * * * ## Security ### Audit logs We have improved our Audit log module to immediately detect an update in the security section ([rate limits](../../docs/rate-limiting.html), [SSO](../../docs/sso.html), [password policy](../../docs/password-management.html)). > For more information, check out our [Audit logs](../../docs/audit-logs.html) page. ### Hide profile existence In order to mitigate the impact of attacks, we have added a new `Hide profile existence` option that allows you to send a succesful response after a [password reset](https://docs.identity.purse.eu/openapi/identity.html#operation/requestPasswordReset) even if the profile isn’t present in our database. ![hide profile existence](../../docs/_images/security/hide-profile-existence.jpg) > For more information, check out our [Hide profile existence](../../docs/hide-profile-existence.html) page. ### Mask job credentials Credentials are now hidden in the [Get job executions from a job definition](https://docs.identity.purse.eu/openapi/management.html#operation/getJobExecutionsFromDefinitionIDs) endpoint response. ### Code and authentication token reuse All user tokens on the concerned `client_id` are now invalidated if there is an attempt to reuse an authentication token or a code that has been already consumed. * * * ## Authentication ### Force user login The `prompt` and `max_age` parameters can now be used on the [/oauth/authorize](https://docs.identity.purse.eu/openapi/identity.html#operation/authorizeUser) endpoint and all the session management methods to force a user to login even if he has a valid SSO session. > For more information, check out the [/authorize](https://docs.identity.purse.eu/openapi/identity.html#operation/authorizeUser) endpoint or one of the [SDK Core](../../sdk-core/index.html) methods parameters list. * * * ## Fixes ##### opt-out consents weren’t automatically accepted after a signup with a social provider. ✓ ##### It was possible to modify the suspension\_status field with an import. ✓ ##### The User updated at parameter filter equals (=) option didn’t respond correctly on export jobs. ✓ ##### The error\_message\_key has been added in the start MFA credential registration endpoint. ✓ --- # 02 February 2022 (v2.66) URL: /release-notes/previous-years/266.html `Purse Identity v2.66` focuses primarily on improving our [Audit logs](#audit-logs) and [Multi-factor Authentication (MFA)](#mfa-266) modules as well as various [Security](#security) and [Integration](#integration) improvements. ## Authentication ### Release highlight Email MFA credential (second factor) You can now use `email` as a second factor authentication for MFA flows. Users can choose to set their email identifier as an **MFA** credential and use it to complete the stepup flow. > For security reasons, only the email identifier can be set as a second factor. Other emails cannot be used as MFA credentials. **Management API new MFA endpoints:** - initiate MFA activation flows for [phone numbers](https://docs.identity.purse.eu/openapi/management.html#operation/startPhoneNumberRegistration) and [emails](https://docs.identity.purse.eu/openapi/management.html#operation/startEmailRegistration). - list and view [MFA credentials](https://docs.identity.purse.eu/openapi/management.html#operation/listMfaCredentials) > For more details on Multi-factor Authentication, check out our [MFA Guide](../../docs/mfa.html). * * * ## Security ### Audit logs We have improved our Audit log module to immediately detect any login in the Purse Identity Console. You now easily view your audit logs with the new [retrieve audit logs](https://docs.identity.purse.eu/openapi/Management.html#operation/searchAuditLogs) Management endpoint. > Make sure to add the new scope `read:audit-logs` if you want to use this endpoint. > For more information, check out our [Audit logs](../../docs/audit-logs.html) page. ### reCaptcha V3 We have adjusted the configuration of `reCaptcha V3` based on the bot activity we have observed on our platform. * * * ## Integration ### Export jobs filters We have added the `since` criteria for date fields used in filters configured in export jobs. You can now target users that haven’t been updated or haven’t logged in since a predefined ammount of time thanks to this criteria. > For more information, check out our [export user profiles](../../docs/export-user-profiles.html#filter-export-jobs) page. ### User update The [update user](https://docs.identity.purse.eu/openapi/Management.html#operation/updateUser) endpoint now supports the `redirect_url` parameter which overrides any `redirect_url` set in the Purse Identity Console. * * * ## Fixes ##### Two consecutive passwordless flows resulted in an expired code. ✓ ##### The update a LITE profile endpoint didn’t merge the Lite profile if the updated identifier matched an existing identifier. ✓ ##### It was possible to erase consent information when updating a lite profile using the update a LITE profile endpoint. ✓ ##### We have improved our second factor Management to be sure that the correct number is added as the second factor. ✓ ##### It was possible to grant an archived consent. ✓ ##### In some limited cases, it was not possible to log in to the Purse Identity Console. ✓ --- # 17 February 2022 (v2.67) URL: /release-notes/previous-years/267.html `Purse Identity v2.67` delivers important [Audit logs](#audit-logs) updates as well as offering [Oney](#new-social-provider) as an option for Social Login. ## Security ### Audit logs We have added the `created_at` field in all audit log events. This allows you to know the exact timestamp for an event. > For more information, check out our [Audit logs](../../docs/audit-logs.html) page. Audit log example ```none { "user_email": "user@gmail.com", (1) "entity_name": "jobs", (2) "user_name": "My user name", (3) "action_name": "create", (4) "account_name": "my-account", (5) "created_at" : "2021-09-09T09:21:22.107809Z", (6) "id": "a040230b-60...998", (7) "ip_address": "x.x.x.x", (8) "action_data": { (9) "jobId": "AXvK4s..UnUYyz", "jobType": "export" }, "client_id": "Console Purse Identity", (10) "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36" (11) } ``` - (1) The email of the Purse Identity Console user that produced the audit log. - (2) The name of the entity that produced the audit log. - (3) The user name of the Purse Identity Console user that produced the audit log. - (4) The Action name that triggered the Pub/Sub hook that produced the audit log. - (5) `account_name` specifies the name of the Purse Identity account. - (6) The creation date timestamp for the audit log. - (7) The ID of the audit log. - (8) The IP address of the Purse Identity Console user that produced the audit log. - (9) The Action data (more information about the trigger). In this case, an export event with the Id `AXvK4s..UnUYyz`. - (10) The client that produced the audit log. - (11) The `user_agent` that produced the audit log. * * * ## Integration ### New social provider You can now integrate [Oney](https://www.oney.fr) bank as a social provider with Purse Identity. This allow your users to authenticate easily and seamlessly on partner sites. > For more information, check out our [Oney](../../docs/oney.html) page. > Please contact the Purse Identity team if you want to implement this option. ### Lite registration The `lite_only` field is now present in the [push lite profile](https://docs.identity.purse.eu/openapi/management.html#operation/pushLiteProfile) endpoint response. > This enables you to directly identify whether the profile is still only a Lite profile. * * * ## Fixes ##### In some limited cases, a search performed in the Purse Identity Console did not retrieve all profile data. ✓ --- # 07 March 2022 (v2.68) URL: /release-notes/previous-years/268.html `Purse Identity v2.68` delivers important [Security](#security) updates as well as improves our [KakaoTalk login](#kakaotalk-login) integration. ## Security ### Captcha You can now deploy reCAPTCHA v3 protection on the following methods of the Core SDK: - [`signup`](../../sdk-core/signup.html) - [`requestPasswordReset`](../../sdk-core/requestPasswordReset.html) - [`startPasswordless`](../../sdk-core/startPasswordless.html) It can also be deployed the reCAPTCHA V3 protection on the following widgets of the UI SDK: - [`showAuth`](../../sdk-ui/showAuth.html) - [`showPasswordless`](../../sdk-ui/showPasswordless.html) > Please contact the Purse Identity team if you want to implement this feature. > Check out the [reCAPTCHA](../../docs/hosted-pages.html#recaptcha-v3) section on Hosted Pages to see how to rapidly integrate the feature. ### Password update with a fresh `access_token` We have added an option to deactivate password updates with a fresh `access_token` (issued since less than 5 minutes). If this option is disabled, the password can only be updated with the old password value or with a code (received on the user identifier after a [password reset](https://docs.identity.purse.eu/openapi/identity.html#operation/requestPasswordReset) request). > For more information, check out our [Password Management](../../docs/password-management.html) page. ### Session token invalidation The session token is now also invalidated after a user logout. This token is only present when the Single Sign-On feature is activated. > For more information, check out our [SSO](../../docs/sso.html) page. ### Signup endpoint protection Our signup endpoint and methods are now protected with the **Identity Fraud Protection** module to also block malicious IP addresses that try to attack it. > For more information, check out our [Identity Fraud Protection](../../docs/ifp.html) page. ### Audit logs API The [retrieve and search audit logs](https://docs.identity.purse.eu/openapi/management.html#operation/searchAuditLogs) endpoint has been modified to retrieve the logs in descending order (according to their `created_at` attribute). > Make sure to add the new `read:audit-logs` scope if you want to use this endpoint. > For more information, check out our [Audit logs](../../docs/audit-logs.html) page. * * * ## Authentication ### Dedicated stepup template with an email The email sent after a step up request with an email second factor can now be configured separately. The activation email template is still available and can be configured as a separate template as well to be able to offer the best overall experience to your users. > For more details on Multi-factor Authentication, check out our [MFA Guide](../../docs/mfa.html). * * * ## Integration ### KakaoTalk login We have improved our KakaoTalk login integration to be able to retrieve user information directly from KakaoTalk (`email`,`phone_number`,`gender` …​). We also support Kakaotalk sync integration and we are now able to retrieve `CI` (Connecting Information) directly in the user profile in a new field `provider_metadata`. This field can be retrieved thanks to the identity API and methods (For example the [get a user profile](https://docs.identity.purse.eu/openapi/identity.html#operation/getUserProfile)) and the management API with the [get a user](https://docs.identity.purse.eu/openapi/management.html#operation/getUser) endpoint. > For more information, check out our [Kakao Connect](../../docs/kakao-connect.html) page. * * * ## Fixes ##### In some cases, an edition of a job in the Purse Identity Console overloaded the username and password. ✓ --- # 23 March 2022 (v2.69) URL: /release-notes/previous-years/269.html `Purse Identity v2.69` continues to improve our [reCAPTCHA v3](#captcha) integration, enhances our [rate limiting](#rate-limiter) feature and provides a few [fixes](#fixes) as well. ## Security ### Captcha We are still actively developing our [reCAPTCHA v3](https://www.google.com/recaptcha/about/) integration. reCAPTCHA protection is now separated by endpoint, allowing you to activate it for specific endpoints that suit your needs. The possible endpoints for activation are: - [`passwordless`](https://docs.identity.purse.eu/openapi/identity.html#operation/startPasswordlessFlow) - [`login`](https://docs.identity.purse.eu/openapi/identity.html#operation/loginWithPassword) - [`forgotPassword`](https://docs.identity.purse.eu/openapi/identity.html#operation/requestPasswordReset) - [`signup`](https://docs.identity.purse.eu/openapi/identity.html#operation/signup) ### Rate limiter You can now configure rate limiting for the passwordless flow directly from the Purse Identity Console. ![269 rate limite passwordless console](../_images/269-rate-limite-passwordless-console.jpg) > For more, check out our [Rate limiting](../../docs/rate-limiting.html) guide. ### Audit logs We have improved our Audit log module to immediately detect any user update or deletion in the Purse Identity Console. > For more information, check out our [Audit logs](../../docs/audit-logs.html) page. * * * ## Authentication ### Email second factor deletion You can now delete user emails that are used as second factor MFA credentials through the Management API with the new [Delete email MFA credentials](https://docs.identity.purse.eu/openapi/management.html#operation/deleteMFAemail) endpoint. This can often help users recover their account. > For more details on Multi-factor Authentication, check out our [MFA Guide](../../docs/mfa.html). * * * ## Integration ### Consent logs export We have added a new Export Definition type: **User Consents**. It works the same way as other export jobs, using either CSV or JSON files with any desired filters, but in this case, the User Consents export definition exports only the data in the consent log. > This feature is only available to Purse Identity accounts that have both the [Consents](../../docs/consents.html) and [Export Jobs](../../docs/exports.html) enabled. You can find this new job type on your Purse Identity Console under **Settings**  **Export definitions** menu. ![269 export definition user consents console](../_images/269-export-definition-user-consents-console.jpg) > For details on exporting consent logs, check out the [Export user consent logs](../../docs/export-consent-logs.html) guide. * * * ## Fixes ##### There was an issue displaying the favicon configured in Hosted Pages. ✓ ##### There were some issues with consent logs when merging user profiles. ✓ ##### The grant page was (incidentally) always displayed during OaaS flows. ✓ ##### Some signup requests responded with a 500 http error. ✓ --- # 07 April 2022 (v2.70) URL: /release-notes/previous-years/270.html `Purse Identity v2.70` further enhances our [IFP module](#security), provides a [dedicated template](#dedicated-stepup-template-with-sms) for the SMS `stepup` flow, and offers a [new `has_password` `boolean`](#new-attribute-for-sms-custom-providers) for SMS custom providers. You can now also revoke [access tokens](#access-token-management) with the `revokeToken` endpoint. ## Security ### Improved Identity Fraud Protection module algorithm We have improved our [Identity Fraud Protection (IFP)](../../docs/ifp.html) module’s IP suspension algorithm to be able to respond according to the threat detected on the attacking IP address. ### Whitelist IPs for the IFP module You can now whitelist IP addresses specifically for the IFP module directly from your Purse Identity Console. > Whitelisted IP addresses will bypass the attack protection policy. > For more details on our identity fraud protection module, check out the [IFP page](../../docs/ifp.html). ![ip inspector whitelist](../../docs/_images/ip-inspector/ip-inspector-whitelist.jpg) * * * ## Authentication ### Access token management We provide a revocation endpoint that lets you revoke Refresh Tokens. It is now possible to use the same endpoint to revoke access tokens. > for more information, check out our [revokeToken](https://docs.identity.purse.eu/openapi/identity.html#operation/revokeToken) API endpoint. ### Dedicated stepup template with SMS The SMS sent after a step up request with a `phone_number` second factor can now be configured separately. The activation SMS template is still available and can be configured as a separate template as well to be able to offer the best overall experience to your users. > For more details on Multi-factor Authentication (MFA), check out our [MFA Guide](../../docs/mfa.html). * * * ## Integration ### New attribute for SMS custom providers We added a new `boolean` field called `has_password` in the [request payload](../../docs/setup-sms-provider.html#set-up-custom-sms-provider) for SMS custom providers. With this, you can easily adapt the SMS to users whom have no password associated with their account, allowing them to create a password. ```json { "sms": "string/sms", "template_id": "string", "personalizations": { "given_name": "string", "last_name": "string", "gender": "string", "has_password": boolean, (1) "redirect_url": "string/url" } } ``` - (1) The `has_password` boolean is only included in the payload for the `password_reset` template. > For more information, check out [Custom SMS providers](../../docs/setup-sms-provider.html#set-up-custom-sms-provider). ### New event type We have a new event type (`managed_user_created`) for those users created specifically through the [Management API](https://docs.identity.purse.eu/openapi/management.html). > For more, check out our dedicated [User Event Types](../../docs/models-user-events.html#user-event-types) documentation. * * * ## Fixes ##### We generalized some error messages for actions performed with the Management API. ✓ ##### It was possible to double consent log entries in some specific conditions. ✓ ##### The verification of an email modified from the Purse Identity Console wasn’t successful. ✓ ##### The Name attribute wasn’t present in the user profile after a login with PayPal. ✓ ##### Some compromised profiles weren’t automatically suspended by the Identity Fraud Protection module. ✓ ##### Imported Lite users weren’t merged correctly. ✓ --- # 28 April 2022 (v2.71) URL: /release-notes/previous-years/271.html `Purse Identity v2.71` improves our [MFA activation flow](#authentication) for users using their `phone_number` as a second factor. We have also made it possible to [filter consent logs](#integration) in an export job. ## Authentication ### Facilitate `phone_number` activation as a second factor We have improved our MFA activation flow to facilitate the addition of a verified `phone_number` as a second factor. Verified number Essentially, users with existing _verified_ phone numbers can use that phone number as a second factor without additional verification steps. Unverified number Users with existing _unverified_ phone numbers participating in the MFA flow, have their number verified as part of the MFA flow. > For more details on Multi-factor Authentication, check out our [MFA Guide](../../docs/mfa.html). * * * ## Integration ### Consents logs export We have made filtering consents logs in the export definition a bit easier by adding a new filter selector for existing consent keys. ![filter consent keys](../../docs/_images/consents/filter-consent-keys.gif) > For details on exporting consent logs, check out the [Export user consent logs](../../docs/export-consent-logs.html) guide. * * * ## Fixes ##### It was impossible to create a consent group with more than 10 standalone consents. ✓ ##### Custom fields were not correctly managed after a biometric authentication. ✓ ##### The updated\_at field wasn’t updated after a Lite profile merge on existing authenticated profiles. ✓ --- # 12 May 2022 (v2.72) URL: /release-notes/previous-years/272.html `Purse Identity v2.72` expands the [fields](#filters) by which you can filter export definitions, webhooks, and pub/sub hooks and restored [some analytics pages](#analytics). There’s a new [role](#authentication) on the Purse Identity Console and we have improved your ability to see [which](#security) of your user profiles are compromised. We also [fixed](#fixes) a few issues. ## Authentication ### New Purse Identity Console role You can now assign users a `Read only CRM User` role for those who only need read-access to [Analytics](../../docs/analytics.html) and profiles. > For more, check out our [roles](../../docs/roles.html) page. ## Security ### Compromised profile alerts We have added a new user event (`profile_compromised`) to better inform you about when a user’s profile has been compromised. The event is only available to extract with a [webhook](../../docs/webhooks.html) or [Pub/Sub hook](../../docs/pub-sub-hook.html) if the `compromised-profile` feature is enabled on your Purse Identity Console. > For more on user events and event types, see [User Events](../../docs/models-user-events.html). * * * ## Integration ### Filters You can now filter more attributes for [export definitions](../../docs/export-user-profiles.html), [User-event webhooks](../../docs/webhooks.html), and [Pub/Sub hooks](../../docs/pub-sub-hook.html). - All of the [address model attributes](../../docs/models-user-profile.html#addresses-object). - User `nickname`, `middlename`, `username` and `name` attributes from the [user profile model](../../docs/models-user-profile.html#user-profile-fields). - Verified and unverified emails from the [emails object](../../docs/models-user-profile.html#emails-object). - [Origins](../../docs/models-user-profile.html#origins) values that you can define in the SDKs or through the API See all the filterable fields You can filter the following [User Profile](../../docs/models-user-profile.html) fields for [export jobs](../../docs/exports.html), [User-event webhooks](../../docs/webhooks.html), and [Pub/Sub hooks](../../docs/pub-sub-hook.html). - `user email` - `user email verified` - `user verified emails` - `user unverified emails` - `user phone number` - `user phone number verified` - `user username` - `user first name` - `user last name` - `user name` - `user nickname` - `user gender` - `user age` - `user external id` - `user authentication types` - `user providers` - `user devices` - `user city` - `user country` - `user nb of logins` - `user nb of friends` - `user nb of local friends` - `user first login` - `user last login` - `user last login type` - `user created at` - `user updated at` - `user lite only` - `user suspension status` - `user title` - `user locality` - `user region` - `user country` - `user recipient` - `user company` - `user address_complement` - `user custom fields` - `user consents` - `user Kakao Age range` - `user Kakao Connecting Information` - `user third party grants client id` - `user third party grants date` - `user session devices` - `user session devices client id` - `user session devices created at` - `user session devices device class` - `user session devices device name` - `user session devices ip` - `user session devices city` - `user session devices country` - `user session devices last connection` - `user session devices operating system` - `user session devices token type` - `user session devices user agent name` - `identities` - `identities id` ![272 filter fields](../_images/272-filter-fields.gif) ### Analytics We’ve restored the browsers and operating systems usage analytics pages, under the Analytics menu of the Purse Identity Console. You will find those analytics pages using the following links: Operating systems ```curl https://console.reach5.co//technology/system ``` Browsers ```curl https://console.reach5.co//technology/browser ``` ### New webhook triggers It is now possible to use the following user event types to trigger a [User-event webhooks](../../docs/webhooks.html): - `authorization_deleted` - `authorization_granted` - `authorization_refused` > For more on user events and event types, see [User Events](../../docs/models-user-events.html). * * * ## Fixes ##### It was impossible to display more than 10 consents in the "What your users consent to?" page. ✓ ##### In some cases, custom email fields weren’t searchable in the Purse Identity Console. ✓ ##### When importing a lite profile and then a managed profile with the same external\_id, the updated\_at field was not updated. ✓ ##### The duration of the stepup verification\_code configured on the Purse Identity Console wasn’t applied. ✓ --- # 09 June 2022 (v2.73) URL: /release-notes/previous-years/273.html `Purse Identity v2.73` brings you the opportunity to use [Google One Tap](https://developers.google.com/identity/one-tap) as part of your site or application. We also [fixed](#fixes) a few minor issues. ## Authentication ### Google One Tap You can now offer your users the ability to authenticate with Google One Tap. Google One Tap is a new passwordless method that can improve conversions by allowing your users to signup or login with just a click. > For more, check out our [Google One Tap](../../docs/google-onetap.html) page. ![onetap example](../../docs/_images/social-providers/google/onetap-example.jpg) * * * ## Fixes ##### In some cases, it was not possible to delete a custom field with an email data type from the Purse Identity Console. ✓ ##### Previously, only the email field was checked before creating a profile. We now check both the verified and unverified email list. ✓ ##### Some managed profiles weren’t correctly keeping the phone\_number\_verified status after importing as a lite profile. ✓ ##### The updated\_at field was not updating after an updateLiteConsents API call. ✓ ##### In some cases when importing profiles, the new email did not replace the existing email, but rather was added as an unverified email. ✓ ##### Some attributes were inadvertently translated by Google translate when visiting a user’s profile page in the Purse Identity Console. ✓ --- # 30 June 2022 (v2.74) URL: /release-notes/previous-years/274.html `Purse Identity v2.74` primarily focuses on improving end user flows to optimise your user’s authentication and session experience. We also made a few small integration tweaks and some [Fixes](#fixes) to make your lives easier. ## Registration ### SMS Signup invitation You may already be familiar with our **Signup invitation feature** which uses email to contact end users and invite them to proceed with a full registration based on the information we gathered on their profile. Now, we have made this feature available via SMS as well. Regardless of how your end users want to be contacted, you’ll be able to gently nudge and encourage them to finish the registration process and manage a true omnichannel experience with them. > For more information, check out [Lite profiles](../../docs/lite-profiles.html). ![274 signup invitation sms](../_images/274-signup-invitation-sms.gif) * * * ## Authentication ### Multi-Factor Authentication We’re now offering a new `Settings` section in the MFA menu of the Purse Identity Console to let you configure exactly which second factor(s) will be available to your end users. Depending on your specific needs, you can choose `email`, `SMS` or **both**. > For more on this, check out our dedicated [MFA guide](../../docs/mfa.html#enable-second-factors-for-mfa). ![settings toggle second factor](../../docs/_images/mfa/settings_toggle-second-factor.gif) * * * ## Integration ### Email verification We have a new email template which allows you to communicate directly to users outside of the registration process. It may be useful when users have created an account in the past, but never went on to verify their email address. You now have this dedicated email template available to you just as you do with the [SMS templates](../../docs/sms-templates.html). > For more information on this topic, check out our dedicated guide [here](../../docs/email-templates.html#configure-email-templates), under the `Account verification` tab. ![274 scroll verification tab](../_images/274-scroll-verification-tab.gif) ### Webhooks We have brought back the `login` event type pre-event [webhooks](../../docs/webhooks.html) to let you sync with your ecosystem when end users are authenticated on your site. ReachFive API calls that trigger this event are: - [loginWithPassword](https://docs.identity.purse.eu/openapi/identity.html#operation/loginWithPassword) - [verifyPasswordless](https://docs.identity.purse.eu/openapi/identity.html#operation/verifyPasswordless) - [authorizeUser](https://docs.identity.purse.eu/openapi/identity.html#operation/authorizeUser) - [retrieveAccessToken](https://docs.identity.purse.eu/openapi/identity.html#operation/retrieveAccessToken) - [authenticateWithCredentials](https://docs.identity.purse.eu/openapi/identity.html#operation/authenticateWithCredentials) * * * ## Fixes ##### There was an issue displaying custom fields data in specific merge situations. ✓ --- # 21 July 2022 (v2.75) URL: /release-notes/previous-years/275.html `Purse Identity v2.75` provides several feature updates including the ability to now configure what [reCAPTCHA settings](#release-highlight) you want to offer users. We also remedied several [known issues](#fixes) as part of this release. Check out the sections below for more details. ## Release highlight reCAPTCHA configuration settings We made the reCAPTCHA configurations available directly from the Purse Identity Console so that you can define which public endpoints are protected on your existing Identity Clients. This new configuration is available for both v2 and v3 versions of reCAPTCHA. You do this directly from the Purse Identity Console by going to **Settings**  **Security**  **Recaptcha**. ![recaptcha nav](../../docs/_images/console/recaptcha-nav.jpg) > For more, check out the dedicated [Enable reCAPTCHA from the console](../../docs/captcha/recaptcha.html) page. * * * ## Integration ### New Webhook monitoring events There are two new event types that will allow you to monitor your webhooks. These event types can be triggered with [PubSub hooks](../../docs/pub-sub-hook.html): - `pre_event_failure` - `post_event_failure` > For more on user event types, see [User Events](../../docs/models-user-events.html). ### Tag attributes If there is no value assigned to the custom [`tags` field](../../docs/custom-fields.html#custom-field-data-types), tag attributes will no longer appear as empty tables when creating or updating a profile. > Typically, attributes that are not set do not appear as part of an API response. However, the `tags` custom field type did previously appear as an empty table (array) in the response. If your setup anticipated these empty tables for `tags`, please update accordingly. * * * ## Other improvements We improved the identifier behaviour so that a new profile can’t be created if its email identifier is already used or present in the following: - `email` - `emails.unverified` attribute - `emails.verified` attribute > This drastically reduces the chances of duplicate profiles. * * * ## Fixes ##### There was an issue with addresses deletion on managed profiles whom also have a Lite identity. ✓ ##### In some cases, the reporter field in the consent logs wasn’t accurately reported. ✓ ##### The updated\_at value wasn’t properly updated after changing consent values on a profile through the Import module. ✓ ##### It was impossible to update the consent of a lite\_only profile without providing the version\_id and language. ✓ --- # 04 August 2022 (v2.76) URL: /release-notes/previous-years/276.html `Purse Identity v2.76` introduces [orchestration tokens](#release-highlight) and provides several [security](#security) related updates. We also [fixed](#fixes) a few issues. ## Release highlight Orchestration token You can now ensure that the authentication flow is always completed by passing an orchestration token when using the **Login URL** option on your first-party identity client(s). You just need to enable **Attach orchestration token**. ![login url orchestration token enable](../../docs/_images/console/clients/login-url-orchestration-token-enable.jpg) > For more, see [Request Orchestration Tokens](../../docs/orchestration-token.html). * * * ## Security ### Compromised profiles detection The `profile_compromised` [event type](../../docs/models-user-events.html) is now no longer limited to those the [automatic suspension feature](../../docs/ifp.html) enabled. All customers can avail of this event type to trigger [Pub/Sub hooks](../../docs/pub-sub-hook.html) and [User-event webhooks](../../docs/webhooks.html). ### Multi-Factor credential deletion You now have to perform the [stepup operation](https://docs.identity.purse.eu/openapi/identity.html#operation/stepup) in order to [delete an email credential](https://docs.identity.purse.eu/openapi/identity.html#operation/deleteEmailCredential) through the Identity API. > For more on MFA as a whole, see the [Multi-factor Authentication](../../docs/mfa.html) guide. * * * ## Fixes ##### The login\_as user event was generated with the wrong date. ✓ ##### LITE profile updates weren’t correctly performed if the profile contained an archived consent. ✓ ##### The updated\_at value was updated even though no modifications were made on a profile after an import. ✓ ##### It was impossible to change the consents value when using the showProfileEditor UI widget. ✓ --- # 25 August 2022 (v2.77) URL: /release-notes/previous-years/277.html `Purse Identity v2.77` improves the [export module](#improvements), introduces a new [SMS template](#integration), further improves [security](#security) for updating email addresses, and now, you can use the `lang` attribute for [custom provider templates](#integration). We also [fixed](#fixes) a few issues. ## Improvements ### Export module improvements You can now export users in bulk directly from the Purse Identity Console by dropping in values that are separated by a semi-colon (`;`). > Check out our [Export user profiles](../../docs/export-user-profiles.html) page for more details. ![277 semicolon filter exports](../_images/277-semicolon-filter-exports.gif) ### Endpoint deprecation Deprecation Notice We have deprecated the [getUserByEmail](https://docs.identity.purse.eu/openapi/management.html#operation/getUserByEmail) endpoint. You should use the [searchUsers](https://docs.identity.purse.eu/openapi/management.html#operation/searchUsers) and [getUser](https://docs.identity.purse.eu/openapi/management.html#operation/getUser) endpoints instead. * * * ## Integration ### Verify phone number template (SMS) Using the [sendPhoneNumberVerification](https://docs.identity.purse.eu/openapi/identity.html#operation/sendPhoneNumberVerification) endpoint, you can now use the **Verify phone number** [SMS template](../../docs/sms-templates.html) to send to users who need to still verify their phone number. > See more here [SMS templates](../../docs/sms-templates.html) for more details. ### SMS & Email custom providers You can now specify the `lang` attribute in the payload for both email and SMS custom providers. This helps you to further personalize your user communications. > - For email custom providers, see [Email custom providers](../../docs/emails.html#custom-providers). > > - For SMS custom providers, see [SMS custom providers](../../docs/setup-sms-provider.html#set-up-custom-sms-provider). > ```json { "sms": "+33688888884", "template_id": "password_reset", "personalizations": { "id": "id", "external_id": "externalId", "given_name": "Max", "last_name": "Robertson", "gender": "M", "sms_code": "smsCode", "lang": "fr", (1) "has_password": true, } } ``` - (1) The `lang` attribute shown in the custom provider JSON payload. * * * ## Security ### Multi-Factor credential deletion You now have to perform the [stepup operation](https://docs.identity.purse.eu/openapi/identity.html#operation/stepup) in order to [update an email](https://docs.identity.purse.eu/openapi/identity.html#operation/updateEmailAddress) through the Identity API. > For more on MFA as a whole, see the [Multi-factor Authentication](../../docs/mfa.html) guide. * * * ## Fixes ##### The Password Reset email template was defaulting to en (English) for the user language even when the default language was different. ✓ ##### In some cases, it was impossible to add new MFA credentials. ✓ ##### Login user events displayed the wrong auth\_type. ✓ --- # 8 September 2022 (v2.78) URL: /release-notes/previous-years/278.html `Purse Identity v2.78` introduces our initial [SCIM feature](#release-highlight), enhances the [signup invitation flow](#enhanced-signup-invitation-flow) and improves retrieving user profile information. We also [fixed](#fixes) one issue. ## Release highlight ![beta icon](../../docs/_images/icons/beta-icon.svg "A beta release is the first offering of the feature and may not be fully available to all customers. Contact your Purse Identity representative for more details.") **Beta release** 2026-10-30 SCIM launch We have launched our initial SCIM feature. The **System for Cross-domain Identity Management**, better known as [SCIM](http://www.simplecloud.info/), is a specification that is specifically designed to simplify managing user identities in cloud-based settings. The primary purpose of SCIM is to automate (in a secure fashion) exchanging user identities between cloud applications and service providers. Read the docs - [SCIM on the Purse Identity Console](../../docs/scim.html) - [SCIM overview](../../docs/integration/scim.html) - [SCIM API routes](https://docs.identity.purse.eu/openapi/scim.html) * * * ## Registration ### Enhanced signup invitation flow You can now complete the signup invitation flow with a `verification_code` by using the new [getSignupDataPost](https://docs.identity.purse.eu/openapi/identity.html#operation/getSignupDataPost) endpoint. > With this POST operation, you can still pass the `token` as part of the request payload if so desired. > For more information, check out [Lite profiles](../../docs/lite-profiles.html). * * * ## Other improvements - Previously, if a `phone_number` was invalid, you could not retrieve the user profile information. Now, you can still receive the user profile information even if the `phone_number` itself is invalid. * * * ## Fixes ##### In some cases, exceptions in an export job were impacting the whole module. ✓ --- # 22 September 2022 (v2.79) URL: /release-notes/previous-years/279.html `Purse Identity v2.79` introduces the `custom_identifier` [password authentication](#release-highlight) option. We also [fixed](#fixes) a couple of issues. ## Release highlight Authenticate with a custom identifier With this release, we have made it so that your users can now authenticate with a `custom_identifier` and not just an email or phone number. This custom identifier is available with the [Core](../../sdk-core/index.html) and [UI](../../sdk-ui/index.html) SDKs. A typical use case would be to use the custom identifier as a username, a customer number or a loyalty number. We want to offer you all the flexibility you need for your use case. The impacted methods and API operations are: SDK Core - [loginWithPassword](../../sdk-core/loginWithPassword.html) - [signup](../../sdk-core/signup.html) SDK UI - [showAuth](../../sdk-ui/showAuth.html) Identity API - [loginWithPassword](https://docs.identity.purse.eu/openapi/identity.html#operation/loginWithPassword) - [signup](https://docs.identity.purse.eu/openapi/identity.html#operation/signup) For more on the `custom_identifier` approach, check out the [User Profile model](../../docs/models-user-profile.html#custom_identifier) page or the [Authenticate with password](../../docs/password-authentication/authenticate-with-password.html) page. * * * ## Security ### Multi-Factor credential addition You now have to perform the [stepup operation](https://docs.identity.purse.eu/openapi/identity.html#operation/stepup) in order to add a [phone number credential](https://docs.identity.purse.eu/openapi/identity.html#operation/startPhoneNumberRegistration) or an [email credential](https://docs.identity.purse.eu/openapi/identity.html#operation/startEmailRegistration) through the Identity API if there’s already a credential on the user profile. > For more on MFA as a whole, see the [Multi-factor Authentication](../../docs/mfa.html) guide. * * * ## Fixes ##### There were some minor issues with webhooks filtering IPs. ✓ ##### In some cases, the language for a consent was being taken from the browser language instead of the language of the consent. This was throwing an error. ✓ --- # 06 October 2022 (v2.80) URL: /release-notes/previous-years/280.html `Purse Identity v2.80` adds the `verification_code` option as part of the [password reset flow](#password-reset), makes it easy to disable the [ROPC flow](#security) from the console, and makes it possible to [keep lite profiles](#other-improvements) on file even after deleting provider identities through the API. We also [fixed](#fixes) a couple of issues. ## Password reset You can now send a `verification_code` in an email as part of the **forgot password** workflow. > For more on the forgot password email template, see [Password reset](../../docs/email-templates.html). * * * ## Security For additional protection, we have made it easy for you to disable the **Resource Owner Password Credential (ROPC)** flow. This means that API calls to the [`oauth/token` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/retrieveAccessToken) with `"grant_type": "password"` are blocked with the `403` error code. We offer this ability to disable the flow, because we do not recommend this flow especially for public clients. You can add this to your First-party Identity client directly from the Purse Identity Console as shown below: ![280 disable ropc flow](../_images/280-disable-ropc-flow.gif) > For more on First-party Identity clients, check out our [Clients](../../docs/clients.html) page. * * * ## Other improvements You can now pass the `keepInLiteProfile` boolean in the [removeUserIdentity](https://docs.identity.purse.eu/openapi/management.html#operation/removeUserIdentity) and [removeUserProvider](https://docs.identity.purse.eu/openapi/management.html#operation/removeUserProvider) Management API calls if you want to keep the user information in a lite profile even after performing the delete operation. > For more on lite profiles, see [Lite profiles](../../docs/lite-profiles.html). * * * ## Fixes ##### In some cases, the user profile to be merged (:uid2) with mergeUsers was still showing up in the search index. ✓ ##### In some cases, there were multiple profile\_compromised events attached to one compromised profile instead of just one. For more on this topic, see Identity Fraud Protection. For more on this topic, see [Identity Fraud Protection](../../docs/ifp.html). --- # 27 October 2022 (v2.81) URL: /release-notes/previous-years/281.html `Purse Identity v2.81` provides several exciting updates including the ability to configure the threshold and duration for [locking user accounts](#release-highlight). Now, you can perform MFA actions directly with the [UI SDK](#multi-factor-authentication), as well as sign up and login users with [custom identifiers](#custom-identifiers) via all SDKs. On top of it all, Purse Identity v2.81 lets you [embed magic links](#embed-magic-links-anywhere) anywhere you want. In addition to these improvements, we have added a new filter operator and new failure events which you can see [here](#other-improvements). And of course, we [fixed](#fixes) a couple of issues. ## Release highlight Configurable user account lockout It’s now possible to lock out user accounts based on your own desired configuration. Previously, this was set by Purse Identity, but now you can configure it to better match your setup and improve you users security. You can do this directly from your Purse Identity Console by going to **Settings**  **Security**  **User lockout**. ![user lockout console](../../docs/_images/security/user-lockout-console.jpg) > For more, check out [User lockouts](../../docs/user-account-lockout.html). ## Multi-factor Authentication With our latest updates, you can now use the [UI SDK](../../sdk-ui/index.html) leverage our [Multi-factor Authentication](../../docs/mfa.html) feature. Through the UI SDK, you can now: ##### showMfaCredentials List MFA credentials associated with a user. ##### showMfa Activate MFA credentials for a user. > There’s also an option to remove MFA credentials through this UI method. There’s also an option to remove MFA credentials through this UI method. ##### showStepUp Perform a step up directly with the UI SDK. * * * ## Custom identifiers You can now sign up and login using a **custom identifier** (_such as a username or loyalty card number_) with the: - [Android SDK](../../sdk-android/index.html) - [iOS SDK](../../sdk-ios/index.html) - [UI SDK](../../sdk-ui/index.html) > You are currently able to do this with the [Core SDK](../../sdk-core/index.html) . The updates here build on this improvement. * * * ## Embed magic links anywhere There’s a new endpoint in town that allows you to embed magic links anywhere they’re needed without compromising your users security. > Go on over to the [Management API](https://docs.identity.purse.eu/openapi/management.html#operation/createMagicLink) to put it to use. * * * ## Other improvements ### New events We have introduced **2** new user events that can be triggered via the [**/forgot-password**](https://docs.identity.purse.eu/openapi/identity.html#operation/requestPasswordReset) endpoint. - `email_failure` - `sms_failure` > See [User Events](../../docs/models-user-events.html) for more details. ### New filter operator We are introducing the `BEFORE` operator as part of this release. With this operator, you can retrieve information that happened **before** the specified value. For example, if you want to find users that last logged in or were created before the last 30 days, you could filter that via the Purse Identity Console or in the Management API. > For more, check out [the filter operators section](../../docs/export-user-profiles.html#filter-export-jobs) on the exports page. ![281 console before operator](../_images/281-console-before-operator.gif) * * * ## Fixes ##### In some limited instances, the logout redirect facility was allowing redirects outside the root domain. ✓ --- # 17 November 2022 (v2.82) URL: /release-notes/previous-years/282.html `Purse Identity v2.82` is primarily a bug-fixing release. You can see more on that under the [fixes section](#fixes). We also updated a few [MFA](#multi-factor-authentication) items and had some other minor [improvements](#other-improvements). ## Multi-factor Authentication We have improved a couple of items for MFA. - To better protect accounts, users must now perform a step-up operation in order to modify an existing `phone_number` if that phone number is being used as an MFA second factor. - Now, when a user updates the phone number on their profile, we automatically update the MFA credential `phone_number`. This is protected through the step-up requirement detailed above. > See the [`/update-phone-number` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePhoneNumber) for more on that operation. > > For more on MFA in general, see our dedicated [Multi-factor Authentication](../../docs/mfa.html) page. * * * ## Other improvements - The **User Origin** filter on the Purse Identity Console now displays all possibilities based on your user data. Previously when filtering on the Purse Identity Console, it only displayed 20 results. - We have improved [exports](../../docs/exports.html) so that profiles modified during incremental export job executions are fully exported in the next export job and available in the job report. What does this mean exactly? Previously with incremental exports, the cutoff time for exporting profiles was taken after the last successful job, meaning that it was possible that some profiles between jobs may have been missed. With this improvement, we ensure they’re not missed and are fully exported in the next job. * * * ## Fixes ##### In some cases, the Identity Fraud Protection logs weren’t as verbose as required. ✓ ##### Due to the unpkg failure, Hosted Pages were temporarily down. ✓ ##### In some cases, it was possible to manually add scopes and permissions that weren’t directly applicable to or expected for a client. ✓ ##### In limited circumstances, it was possible for an unauthorized user to access restricted console areas such as Advanced Settings. ✓ ##### Some users with unverified emails were unable to authenticate via Social Login as expected. ✓ ##### In some limited instances, social providers were not removed in the Purse Identity Console after a user deleted the configuration. ✓ ##### Some users were unable to refuse archived consents. ✓ ##### The magic-link/ endpoint wasn’t correctly using the fallback redirect uri. ✓ ##### The Force data update from file option on the Purse Identity Console for imports was overwriting existing lite profiles in some cases. ✓ ##### The lite-registration/consents endpoint was returning errors when filtering with the phone number as a query parameter. ✓ --- # 08 December 2022 (v2.83) URL: /release-notes/previous-years/283.html `Purse Identity v2.83` provides improvements to our [MFA feature](#multi-factor-authentication), introduces a new [social provider](#social-login), and adds a new field for [user account lockouts](#user-account-lockouts). We also [improved](#other-improvements) some small items, and of course, we [fixed](#fixes) a few issues. ## Multi-factor Authentication You can now implement Multi-factor Authentication as part of the login flow if desired by configuring your MFA settings in the Purse Identity Console. What does this mean? For users with a registered MFA credential, a stepup will be required for logging in. > For more on this topic, see our dedicated **MFA settings** section on the [Multi-factor Authentication](../../docs/mfa.html) page. ![mfa settings require MFA always](../../docs/_images/mfa/mfa-settings-require-MFA-always.jpg) * * * ## User account lockouts We are giving you even more information regarding user account lockouts. With this update, the `lockout_end_date` field has been added to the user profile object so that you can see exactly when the lockout will end for a user. > For more on this topic, see the [User lockouts](../../docs/user-account-lockout.html) page. * * * ## Social login ### New provider: B.connect You can now use **B.connect** as a social provider with Purse Identity. ![console select B.connect](../../docs/_images/console/social-providers/console-select-B.connect.jpg) > Check out the quick guide on the [B.connect](../../docs/bconnect.html) page. ### Google You can now retrieve the user `birthdate` after a Google sign in. > For more on this topic, see the [Google Connect](../../docs/google.html) page. * * * ## Other improvements - Previously, you couldn’t partially update consent groups. Now, you can do partial updates to consent groups. Why is this useful? If you need to update an associated consent, for example if a consent is archived, this is a handy improvement. > For more on consents, see our dedicated [Consents](../../docs/consents.html) page. - You can now use the `count` query parameter on the [GET /users/compromised](https://docs.identity.purse.eu/openapi/management.html#operation/compromisedUser) endpoint. * * * ## Fixes ##### In some cases, updating a lite profile with an external\_id would delete the lite profile data. ✓ ##### Temporarily, some users were unable to edit Purse Identity Console pages as expected. ✓ ##### The user’s suspension status was not viewable from the Purse Identity Console. This did not impact the actual suspension status of the user. This did not impact the actual suspension status of the user. ##### In some limited cases, it was impossible to delete a lite profile using the Remove a user identity endpoint. ✓ ##### From time to time, some user profiles were blocked inadvertently. ✓ ##### After merging two profiles with external\_id, the appropriate user event was not being generated. ✓ ##### There were some minor issues with filtering with the API. ✓ ##### When registering a phone number for MFA that was different than the phone number on the user’s profile, the added MFA phone number was unintentionally verified. ✓ --- # 22 December 2022 (v2.84) URL: /release-notes/previous-years/284.html `Purse Identity v2.84` brings improvements to [job execution logs](#job-execution-logs), delivers a new event type for when users are [locked out](#user-lockouts), and improves our [error messages](#other-improvements) for more specific messaging. And of course, we [fixed](#fixes) a couple of issues. ## Job execution logs We are introducing a new endpoint that allows you to export job logs with the **Management API**. It has two query parameters: - `include_all_log` which lets you decide if you want _all_ the logs or just errors. - `format` which specifies if you want the export file format in `JSON` or `CSV`. _Defaults to `CSV` if left unspecified_. > For more, see the [`/api/v3/jobs/{job_id}/logs/export` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/exportJobLogs). * * * ## User lockouts We have added a new [user event type](../../docs/models-user-events.html) called `profile_lockout` that is triggered each time a user profile is locked. In addition to this new event type, we have ensured the counter for blocked accounts is reset to `0` after the appropriate amount of time, which makes sure the user is allowed to make the configured amount of attempts as expected. > For more on user account lockouts, see [User lockouts](../../docs/user-account-lockout.html). * * * ## Other improvements We have improved the error messages for object storage transfer errors. Instead of a general messages, you’ll get more detailed responses like: - `Invalid SFTP credentials` - `The SFTP server closed the connection` - `The SFTP server is unreachable` > For more details on error messages, see [SDK and API errors](../../docs/errors.html). * * * ## Fixes ##### In some limited cases, you could assign a true value to an archived consent when it should only be possible to assign the value to false. ✓ ##### We had a minor compatibility issue with our birthdate object from a third party API response. ✓ --- # 16 January 2023 (v2.85) URL: /release-notes/previous-years/285.html `Purse Identity v2.85` is primarily a bug-fixing and security release. See the [improvements](#general-improvements) and [fixes](#fixes) below. ## General improvements - We have improved the stability of jobs that involve exporting [consents](../../docs/consents.html). * * * ## Fixes ##### During a routine security audit, a few minor issues were identified. ✓ ##### Any custom\_field for a profile wasn’t appearing on deleted profiles using the user\_deleted pre-event webhook. ✓ ##### There was a small UI issue on the logs console page (admin only). ✓ ##### In some cases, you were unable to delete an address added from a social provider from a profile. ✓ ##### It was temporarily impossible to add a user email under Roles. ✓ --- # 06 February 2023 (v2.86) URL: /release-notes/previous-years/286.html `Purse Identity v2.86` brings improvements to [export jobs](#export-path-variables), [audit logs](#audit-logs), and [lite profiles](#lite-profiles) as well as bringing additional functionality to our [Login as](#login-as) feature. We also worked on a few [other improvements](#other-improvements). And of course, we [fixed](#fixes) a few issues. ## Export path variables You can now add variables to your export path for exporting profiles, consents, or events. This improvement aims to give you more control on file naming for your exports and helps better organize these for analysis. > For more on these new export path variables, see the [Export job definitions](../../docs/exports.html) page. * * * ## Audit logs We added a new action (`settings:update`) for audit logs so that whenever a setting is altered or a feature is enabled or disabled, an audit log is produced. > For more on audit logs, see [Audit logs](../../docs/audit-logs.html). * * * ## Lite profiles We have improved the logic for when you update unified profile identifiers so that updates to the managed profile propogates to the lite profile. > For more on lite profiles, see [Lite profiles](../../docs/lite-profiles.html). * * * ## Login as We bring additional functionality to the **Login as** feature. Now, you have more control over the configuration for particular users with a _dynamic mode_. You are, of course, still able to configure a global setting for logging in as a user, but this improvement gives you more options. > For more on the **Login as** feature, see our [Login as](../../docs/login-as.html) guide. * * * ## Other improvements - We have enhanced the validation process for emails in the [UI SDK](../../sdk-ui/index.html) to make sure all legitimate values are accepted. - We have improved the loading time for job definition and job reports list pages. - For [consent logs](../../docs/consents-use.html), we tweaked the query to make sure they are displayed in descending order from the newest to oldest. - Our Filtering function has improved to ensure you see all relevant results directly in the Purse Identity Console. * * * ## Fixes ##### In some limited cases, it was not possible to connect when display was set to popup mode during a social login flow. ✓ ##### In some instances, you could not use a custom\_identifier with Hosted Pages. ✓ ##### Hosted Pages were not updating the origin field as expected. ✓ ##### It was briefly possible to choose consent groups when setting up an export where only standalone consents should be selectable. ✓ ##### Sometimes, Azure accounts were inadvertently deleted when there were two user accounts associated with different Azure Active Directory organizations on the Purse Identity Console. ✓ --- # 16 February 2023 (v2.87) URL: /release-notes/previous-years/287.html `Purse Identity v2.87` mainly focuses on improving a few items related to the [Purse Identity Console](#purse-identity-console). We also [fixed](#fixes) a few issues. ## Purse Identity Console ### Session timeouts We have improved the Purse Identity Console session logic so that the session lifetime for users is `4` hours. For more, see our dedicated [Purse Identity Console](../../docs/console.html) introduction page. ### Authentication You can now disable the `username/password` login option on your Purse Identity Console to enhance security. Contact your [Purse Identity representative](mailto:support@reach.co) if you would like to make use of this option. * * * ## Fixes ##### For a short time, users with certain Roles were unable to access the Login as feature. ✓ ##### There was briefly an issue with the origin not being allowed for Admin users on the Purse Identity Console. ✓ ##### Temporarily, users trying to finish creating their account through social providers on the Purse Identity Console were unable to connect. ✓ ##### Users were briefly unable to reset their password in the Purse Identity Console. ✓ ##### CRM users were unable to view user profiles in the Purse Identity Console. ✓ ##### The login-as operation was sending incorrect responses. ✓ --- # 02 March 2023 (v2.88) URL: /release-notes/previous-years/288.html `Purse Identity v2.88` introduces our [Double opt-in consent feature](#release-highlight). It also brings you a new [social provider](#social-providers) by which to connect as well as additional [language support](#language-support). We also [fixed](#fixes) a few issues. ## Release highlight Double opt-in The Double opt-in (DOI) feature provides additional security and peace of mind for compliance for yourself and your users. It’s simple like single opt-in, but requires an additional step for the user to confirm his or her email or mobile (via SMS). With Purse Identity, you can even define the preferred communication channel for these DOI consent types directly in the Purse Identity Console. For more that, see [Consents](../../docs/consents.html). You can create templates for the double opt-in feature directly in your Purse Identity Console as well as send DOI requests with the [Management API](https://docs.identity.purse.eu/openapi/management.html). * * * To help you better understand double opt-in consents, check out our dedicated guide [**here**](../../docs/doi.html). ## Social providers We are happy to announce that you can now connect Naver as a social provider authentication option in your Purse Identity Console. > For more on that, check out our dedicated [Naver page](../../docs/naver.html). * * * ## Language support We now support even more languages here at Purse Identity. We have added the following languages: - `ar` **العربية** _Arabic_ - `jp` **日本** _Japanese_ - `ko` **한국인** _Korean_ - `zh-hk` **廣東話** _Hong Kong Traditional Chinese_ > For more on the languages we support, see [Supported languages](../../docs/global-consumers/languages.html). * * * ## Fixes ##### In some cases, the consent history for users was out of sync between actions on lite and/or managed profiles. ✓ ##### When a user was registered to the Purse Identity Console with a password that did not meet the requirements, a 5xx response code was thrown intead of the expected 4xx with provided error detail page, letting them know their password had not met the expected requirements. ✓ ##### In some limited cases, admin users were unable to add a user to different accounts. ✓ --- # 16 March 2023 (v2.89) URL: /release-notes/previous-years/289.html `Purse Identity v2.89` further strengthens our [attack protection policy](#identity-fraud-protection), introduces two [new scopes](#mfa-scopes) for our MFA endpoints, and improves the [audit logs](#audit-logs). We [deprecated](#deprecations) one feature, and we also [fixed](#fixes) a few issues. ## Identity fraud protection We have further improved our attack protection policy by automatically flagging and blocking suspicious signup requests. All user profiles created by suspicious signup requests will now be flagged with the `signup_compromised` [event type](../../docs/models-user-events.html). > For more on the Identity Fraud Protection module, see our [dedicated IFP page](../../docs/ifp.html). * * * ## MFA scopes We have added two new scopes related to [Multi-factor Authentication](../../docs/mfa.html). ##### manage:mfa Allows you to manage (start the flow, update, verify, delete) MFA credentials. - Post [mfa/credentials/phone-numbers](https://docs.identity.purse.eu/openapi/management.html#operation/startPhoneNumberRegistration) - Post [mfa/credentials/phone-numbers/verify](https://docs.identity.purse.eu/openapi/management.html#operation/verifyPhoneNumberRegistration) - Post [mfa/credentials/emails](https://docs.identity.purse.eu/openapi/management.html#operation/startEmailRegistration) - Post [mfa/credentials/emails/verify](https://docs.identity.purse.eu/openapi/management.html#operation/verifyEmailRegistration) - Delete [mfa/credentials/emails](https://docs.identity.purse.eu/openapi/management.html#operation/deleteMFAemail) - Delete [mfa/credentials/sms](https://docs.identity.purse.eu/openapi/management.html#operation/deleteCredentials) ##### read:mfa Allows you to read MFA endpoints. - Get [mfa/credentials](https://docs.identity.purse.eu/openapi/management.html#operation/listMfaCredentials) * * * ## Audit logs We added a new action (`settings:update`) for audit logs so that whenever a setting is altered on the [user lockouts](../../docs/user-account-lockout.html) configuration page, an audit log is produced. > For more on audit logs, see [Audit logs](../../docs/audit-logs.html). * * * ## Deprecations We have deprecated the use of the `fields` query parameter on the following endpoints: - [Search user events](https://docs.identity.purse.eu/openapi/management.html#operation/searchUserEvents) - [Search user events by ID](https://docs.identity.purse.eu/openapi/management.html#operation/searchUserEventsByUserID) * * * ## Fixes ##### It was impossible to remove the external\_id or the custom\_identifier of a user from the Purse Identity Console. ✓ ##### You were briefly unable to use query parameters in whitelisted redirect URLs. ✓ ##### It was impossible to accept a consent group that contained an archived standalone consent. ✓ ##### In some cases, you would receive an unexpected error when changing the consent grant via the Purse Identity Console. ✓ ##### There was a small issue with pagination on the Purse Identity Console. ✓ --- # 4 April 2023 (v2.90) URL: /release-notes/previous-years/290.html `Purse Identity v2.90` further improves our [user suspension](#user-suspension) feature and better enables user management with [SCIM](#scim) mappings. We also [fixed](#fixes) a few issues. ## User suspension To help you better differentiate between suspended users, we have added a `suspension_information` object to the [user profile](../../docs/models-user-profile.html) as well as an optional `suspension_reason` parameter to the [suspend users operation](https://docs.identity.purse.eu/openapi/management.html#operation/suspendUser). This way you can more easily view the reason why users are suspended and make more informed decisions on what actions to take. Want to know more? - The suspension reason variable is available to both [email](../../docs/email-templates.html) and [sms templates](../../docs/sms-templates.html) . - For more on user suspension in general, check out our dedicated page [here](../../docs/suspend-user.html). * * * ## SCIM We have improved the security of our SCIM feature by allowing you to determine whether you want only users mapped from your user management tool to be able to authenticate into the Purse Identity Console. You can also allow users created within your Purse Identity Console organization or both. It’s up to you. We did this by adding an additional **authentication means** field when mapping users. For console instructions on how to determine authentication means, see [SCIM on the console](../../docs/scim.html). For more on SCIM w/Purse Identity in general, please see the [SCIM overview](../../docs/integration/scim.html). * * * ## Fixes ##### Whitelisted URLs containing query parameters weren’t working as logout redirect URLs in some cases. ✓ ##### The user city filter operator wasn’t working as expected with the following filter operators from within the Purse Identity Console: IS ANY OF and IS NONE OF. ✓ ##### The job report for consent logs was reporting incorrect information. ✓ ##### In some cases, exporting the company field via csv using the /users/export operation was not working. ✓ ##### The waiting\_double\_accept field wasn’t properly valued in CSV exports. ✓ --- # 20 April 2023 (v2.91) URL: /release-notes/previous-years/291.html `Purse Identity v2.91` introduces some updates to our [email templates](#email-template-updates), improves filtering abilities on [suspended users](#security), adds some control around [Double opt-in consents](#double-opt-in-consents), and overall provides some general [improvements](#other-improvements). We also [fixed](#fixes) a few issues. ## Email template updates With this release, we have added a new email template that you can use to communicate with your users. In addition, there is a new variable available to you for usage with SMTP servers and custom providers. For more on email templates in general, check out our dedicated page [here](../../docs/email-templates.html). ### User lockout template Template overview - **Template name**: User lockout - **Where can I find it?**: On your Purse Identity Console at **Settings**  **Emails**  **Templates** - **What does it do?**: Automatically sends an email notification to any user who is locked out from their account. ### `client_id` variable A new variable is available to you to use in your email templates when using SMTP or custom providers. This variable is the client ID used to perform the API call. This can be either an Identity or Management client. The variable appears as `{{user.client_id}}` for SMTP providers on the Purse Identity Console template and as `client_id` for custom providers and custom provider payloads. * * * ## Security You can now filter users by `suspension_reason` in order to get a clearer picture of why your users are suspended. This is currently represented as `suspension_reason` as a query parameter with the Management API and as `reason` as part of the `suspension_information` object in the [User Profile object](../../docs/models-user-profile.html). This is shown as the **User Suspension reason** filter option in the Purse Identity Console. For more on this topic, see [User suspension](../../docs/suspend-user.html). ![console filter suspendedUsers reason](../../docs/_images/console/filtering/console-filter-suspendedUsers-reason.gif) * * * ## Double opt-in consents The Double opt-in (DOI) feature provides additional security and peace of mind for compliance for yourself and your users. It’s simple like single opt-in, but requires an additional step for the user to confirm his or her email or mobile (via SMS). With Purse Identity, you can even define the preferred communication channel for these DOI consent types directly in the Purse Identity Console. For more that, see [Consents](../../docs/consents.html). In some integration cases, it’s likely some users have already gone through the DOI process and therefore, after integrating with Purse Identity, you’ll need to be able to update the consent status yourself. You can update the `granted` status to `true` or `false` for a user with one of the following approaches: - The Management API’s [update user profile](https://docs.identity.purse.eu/openapi/management.html#operation/updateUser) endpoint. - The Identity API’s [update user profile](https://docs.identity.purse.eu/openapi/identity.html#operation/updateUserProfile) endpoint. - The Import Module by importing [user profiles](../../docs/import-profiles-from-the-console.html). For more on Double opt-in consents, check out our dedicated page [here](../../docs/doi.html). * * * ## Other improvements - We have added the `address_complement` field to the address object, meaning that even more address types are able to be used within the Purse Identity ecosystem. For more on this topic, see the [addresses object section](../../docs/models-user-profile.html#addresses-object) on the User Profile model page. - With this release, you can now search for your users within the Purse Identity Console by Purse Identity `ID`. The search is case-sensitive. ![291 console searchUserById](../_images/291-console-searchUserById.gif) - We have improved the error messaging around expired redirect URLs for Double opt-in [consent templates](../../docs/consent-templates.html). Now, when the link is expired and a user clicks on it, they’ll be redirected to the **Redirect to** URL defined in the template with the query parameters explaining the link is invalid. Example expired redirect URL ```none https://www.example.com/confirmation-of-signup?error=invalid_grant&error_description=Code+de+vérification+invalide&error_message_key=error.invalidVerificationCode ``` * * * ## Fixes ##### Users for a select few customers were temporarily experiencing issues with signing up to their site. ✓ ##### There was a brief issue with the suspension status of some accounts while merging. ✓ ##### It was temporarily impossible to filter by the user ID upon inital profile creation. ✓ ##### Some customers were unable to update the phone\_number field to a null value. ✓ --- # 11 May 2023 (v2.92) URL: /release-notes/previous-years/292.html `Purse Identity v2.92` welcomes the usage of [passkeys for iOS signup flows](#release-highlight). We have [deprecated](#deprecations) a feature, and we made some [general improvements](#other-improvements) with this release. We also [fixed](#fixes) a few issues. ## Release highlight iOS authentication with passkeys We now support signup flows with FIDO2 passkeys for iOS. This means that users are able to authenticate with any synchronised iOS device with a passkey onto your Purse Identity-integrated site. Several methods are available to make use of this featuer with our iOS SDK. The table below gives a high level overview. For more in-depth information, check out the method pages in our [iOS docs](../../sdk-ios/index.html). ##### signup(withRequest) Signs up a user using a passkey. ##### beginAutoFillAssistedPasskeyLogin This starts the autofill-assisted passkey login request. ##### login(withRequest) Logs the user in using credentials stored in the keychain. The system displays all available credentials in the dialog (modal). ##### login(withNonDiscoverableUserName) Logs the user in using credentials that are undiscoverable. ##### registerNewPasskey Adds a new passkey to an existing account. ## Deprecations We have deprecated the Recommender and Login popup features as per the [attention announcement](../../attention/2022/july/deprecation_recommender-login-popup.html). * * * ## Other improvements - We have further strengthened our security around social login providers. - We upgraded to [Liquibase 4](https://www.liquibase.org/). - We have added the `address_complement` field to the iOS address object. For more on this topic, see our [iOS documentation](../../sdk-ios/index.html). * * * ## Fixes ##### For those using Adobe as an email provider, user lockout email notifications were not being sent properly. ✓ ##### For a brief time, you couldn’t filter profiles by custom fields in the Purse Identity Console. ✓ ##### In some limited cases, when updating a lite profile that contained an existing phone\_number, the update would not behave as expected if the SMS feature was disabled. ✓ ##### There was temporarily a minor issue with the Identity Fraud Protection module. ✓ ##### Sometimes, when deleting user profiles in bulk, the Purse Identity Console would display that 0 profiles were deleted when in fact the profiles had actually been deleted. ✓ --- # 25 May 2023 (v2.93) URL: /release-notes/previous-years/293.html `Purse Identity v2.93` brings in several updates including setting a [preferred channel](#double-opt-in-consents) for communicating Double opt-in consents. We have added a new [email provider](#oracle-responsys) to our repertoire, made it possible to [subscribe to consent events](#subscribe-to-consent-events), along with some [general improvements](#other-improvements), and as always, we [fixed](#fixes) a few issues. ## Double opt-in consents With this release, you can now decide your **preferred** channel of communication when sending Double opt-in consents. This means that in the case where a profile has both identifiers (`phone_number` and `email`) set and you choose `email` as the preferred channel, then of course, it will be sent via email. If the user only has one identifier, of course, the DOI consent will be sent to their only existing identifier. For more on consents in Purse Identity, check out our dedicated [documentation](../../docs/consents.html). ![293 doi preferredChannel](../_images/293-doi-preferredChannel.jpg) * * * ## Oracle Responsys You can now integrate your [Oracle Responsys](https://www.oracle.com/cx/marketing/campaign-management/) account with Purse Identity directly in the Purse Identity Console allowing you to leverage the digital marketing campaigns and personalized messages already established with Oracle Responsys Campaign Management. For more on email providers in Purse Identity, check out our dedicated [documentation](../../docs/emails.html). * * * ## Subscribe to consent events Our webhooks and Pub/Sub hooks now allow you to subscribe to consent events such as: - `consent.denied` - `consent.granted` - `consent.waiting` Want to know more? - For more on consent statuses (event), check out [Field value matrix for consent status](../../docs/doi.html#field-value-matrix-for-consent-status). - For more on user event types, see the field in the user event model [here](../../docs/models-user-events.html#user-event-types). - For more on webhooks, see [here](../../docs/webhooks.html). - For more on Pub/Sub hooks, see [here](../../docs/pub-sub-hook.html). ## Other improvements - You can now see the [`address_complement` field](../../docs/models-user-profile.html#addresses-object) on your user profiles in the Purse Identity Console. * * * ## Fixes ##### Customers using custom email providers were briefly unable to send User Lockout emails. ✓ ##### Lite and authenticated profiles were being merged as one unexpectedly when updating (via /lite-update) phone numbers when the SMS feature was disabled. ✓ ##### It was temporarily impossible to SEARCH the suspension\_information.reason for a user via the Management API’s Search users endpoint. ✓ ##### In some limited instances, updating a consent group affected the child (standalone) consent in unexpected ways. ✓ --- # 8 June 2023 (v2.94) URL: /release-notes/previous-years/294.html `Purse Identity v2.94` introduces the [Attack protection bypass header](#attack-protection-bypass-header), improves your control with [managing compromised profiles](#compromised-profile-management), and adds some [general improvements](#other-improvements). We also [fixed](#fixes) a few issues. ## Attack protection bypass header If you use a pool of IPs that are dynamically updated to call our platform, it can sometimes be difficult to maintain the whitelisted IPs list directly in the Purse Identity Console. For this reason, we’ve added the ability to send requests with a secure header. This is called the **Attack-Protection-Bypass header** and it can only be generated and maintained directly from the Purse Identity Console ensuring maximum protection but adding more flexibility for your setup. The header should only be used from the backend for security purposes. For more on this topic, check out the [Attack protection bypass header](../../docs/ifp.html#attack-protection-bypass-header) section on the Identity Fraud Protection page. ![294 attackBypass](../_images/294-attackBypass.gif) * * * ## Compromised profile management It’s now possible to uncompromise\[[1](#_footnotedef_1 "View footnote.")\] a user directly from the Purse Identity Console, giving you even more control over managing user profiles. For more on this topic, check out the [Uncompromise a profile](../../docs/ifp.html#uncompromise-a-profile) section on the Identity Fraud Protection page. * * * ## Other improvements - [Social provider](../../docs/social-login-overview.html) secrets are not viewable from the Purse Identity Console. You can update the secret if needed from the console, but it will not be viewable again after saving the information. This is a security-related improvement. - You can now filter pre-filled optional fields by `is empty` (exists) and `is not empty` (missing). * * * ## Fixes ##### In limited circumstances, some scheduled DELETE operations for jobs were running even though the job was already previously deleted or did not exist. ✓ ##### If several Pub/Sub hooks were triggered by the same event and one of the hooks crashed, the remaining hooks were not called. ✓ ##### Pub/Sub hooks and webhooks were unexpectedly failing when the consent feature was disabled. ✓ * * * [1](#_footnoteref_1). To uncompromise means to remove a user from the compromised profiles list. --- # 22 June 2023 (v2.95) URL: /release-notes/previous-years/295.html `Purse Identity v2.95` welcomes our [Risk-based Authentication](#release-highlight) feature along with other important [security](#security) updates, further improves [lite profiles](#lite-profiles), and we made some [general improvements](#other-improvements). As always, we [fixed](#fixes) a few issues. ## Release highlight Risk-based Authentication Risk-based Authentication, also known as RBA, offers a holistic approach to user authentication that provides a more frictionless experience for users while ensuring security and peace-of-mind from a site perspective. RBA uses a risk calculation to develop a device profile, sometimes referred to as a fingerprint, so that future login attempts are compared against this fingerprint in order to determine the path to authentication, whether that means immediate authentication or perhaps a [stepup](../../docs/mfa.html) may be required if it’s determined that the login attempt deviates too far from the device profile. ![rba flow](../../docs/_images/rba/rba-flow.jpg) For a complete look at the RBA within Purse Identity, check out [Risk-based Authentication](../../docs/rba.html). * * * ## Security In addition to the [RBA](#release-highlight) feature release, there are other security updates: - [Attack protection policy](#attack-protection-policy) - [Suspending users from console](#suspending-users-from-console) ### Attack protection policy To further strengthen our security measures and give you more verbose information for analysis related to attacks, we have added the **attacking IP** information to Get [`users/compromised` endpoint](https://docs.identity.purse.eu/openapi/management.html#operation/compromisedUser) as well as in the Purse Identity Console for compromised profiles. See our [Identity Fraud Protection](../../docs/ifp.html) page for more information about compromised profiles and attack protection policies with Purse Identity. ### Suspending users from console You can now manually suspend users directly from the Purse Identity Console in a temporary fashion. Previously, you could only permanently suspend users from the Purse Identity Console. See [User suspension](../../docs/suspend-user.html) for more information on managing user suspension. To temporarily suspend a user from the console: 1. Log in with your credentials to the Purse Identity Console. 2. From the sidebar, go to **Profiles**. 3. Select the user you want to manage. 4. From the Actions dropdown button, select **Suspend**. 1. In the dialog, choose to suspend the user temporarily or permanently and give a reason (`camelCase` only). The suspension type determines which authentication methods are blocked. See [Authentication methods by suspension type](../../docs/suspend-user.html#authentication-methods-by-suspension-type). ![console temp suspend user](../../docs/_images/security/console-temp-suspend-user.jpg) * * * ## Lite profiles We have improved throttling for lite registration requests, ensuring all requests are handled quickly and efficiently. In addition to this, you can now distinguish between `lite` and `local` profiles in the Purse Identity Console. To do this: 1. Go to **Analytics**  **Profiles**. 2. Click the Filter icon. 3. Apply the desired filter. _In this case for example purposes, filter by **Use Providers**._ ![295 filterLiteLocal](../_images/295-filterLiteLocal.jpg) * * * ## Other improvements - You can now filter action data for audit logs via the [`/audit-logs` endpoint](https://docs.identity.purse.eu/openapi/Management.html#operation/searchAuditLogs). See our [dedicated Audit logs page](../../docs/audit-logs.html) for information on Audit Logs in general with Purse Identity. - We have further strengthened our security around HTML-rendered fields. - [CRM Users](../../docs/roles.html) can now export profile segments. ![295 exportSegments](../_images/295-exportSegments.jpg) - We have improved the Purse Identity Console so that the session lifetime for users authenticating through Azure AD is now `4` hours. For more, see our dedicated [Purse Identity Console](../../docs/console.html) introduction page. * * * ## Fixes ##### Some users were unable to access their own credential (Security & Password) information in the Purse Identity Console. ✓ ##### Some operations were expecting filter operator STARTS\_WITH instead STARTS WITH. You can now use both options. ✓ ##### The between filter operator was not functioning properly in the Purse Identity Console. ✓ ##### There were some minor issue syncing Azure AD users inside the Purse Identity Console. ✓ --- # 6 July 2023 (v2.96) URL: /release-notes/previous-years/296.html `Purse Identity v2.96` brings the ability to add and view MFA second factors directly on the [console](#mfa-on-the-purse-identity-console) and updates the [passwordless flows](#login-event-for-passwordless-flows) to emit the `login` event. We also made some [other improvements](#other-improvements), and as always, we [fixed](#fixes) a few issues. ## MFA on the Purse Identity Console To further strengthen security, account administrators can enable the **Require multi factor authentication on the console** option. If enabled, any users authenticating with a username/password combination must have a second factor to be able to access the console. You must have the MFA feature enabled at the root level for this option to work. This can be done by contacting a [Purse Identity representative](mailto:support@reach5.co). Check out [MFA for console users](../../docs/mfa-on-console.html) for more details. To enable the MFA second factor requirement: 1. Go to **Settings**  **Security**  **Console login**. 2. Enable the **Require multi factor authentication on the console** option. 3. Don’t forget to **Save** your input. ![mfa console login](../../docs/_images/security/mfa-console-login.jpg) * * * ## login event for passwordless flows The `login` user event is now emitted for passwordless signup flows where you can also see both the `authType` and `device` information in the user event. For more details, see [User Events](../../docs/models-user-events.html). * * * ## Other improvements - We have improved error messages around merging lite profiles. ```none error.lite.accounts.alreadyExist (1) ``` - (1) See [SDK and API errors](../../docs/errors.html) for more details. - We have added warnings logs for when the deprecated `user_id` property is used in the [`/update-password` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePassword). - [DOI consents](../../docs/doi.html) are now included properly in analytics. * * * ## Fixes ##### Some suspended users weren’t receiving the account suspension email when their account was suspended. ✓ ##### Only administrators should be able to see Purse Identity Console login settings. ✓ ##### In some cases, you could not add MFA credentials after registering a user in the Purse Identity Console. ✓ ##### Some roles weren’t functioning as expected within the Purse Identity Console. ✓ --- # 27 July 2023 (v2.97) URL: /release-notes/previous-years/297.html `Purse Identity v2.97` provides further improvements to our [Risk-based Authentication](#release-highlight) feature, allows you to [verify phone numbers](#verify-phone-numbers) of unauthenticated users, and makes [End Job Notification webhooks](#end-job-notification-webhooks) available to export jobs. There are also several [other general improvements](#other-improvements). As always, we [fixed](#fixes) a few issues. ## Release highlight Risk-based Authentication We have further improved our Risk-based Authentication feature. Now, when a login attempt meets the "risky" threshold, a notification is sent to the user (via email or SMS) if there is no second factor (MFA) associated with the account. If the user does have a second factor enabled, they’ll be asked to perform a stepup operation to ensure it is indeed them trying to log in. The notifications are sent via two new templates: - Risky Login Notification email template found in the Purse Identity Console at **Settings**  **Emails**  **Templates** - Risky Login Notification SMS template found in the Purse Identity Console at **Settings**  **SMS**  **Templates** For a complete look at the RBA within Purse Identity including the new templates, check out [Risk-based Authentication](../../docs/rba.html). ## Verify phone numbers With this release, we have introduced a way to verify phone numbers of users who haven’t yet authenticated via your app or site. To do so, you’ll need to use the following new endpoints: [`/send-phone-number-verification`](https://docs.identity.purse.eu/openapi/management.html#operation/sendVerificationSMS) Sends an SMS with a verification code so the user can verify the supplied phone number. [`/verify-phone-number`](https://docs.identity.purse.eu/openapi/management.html#operation/verifyPhoneNumberViaSms) Sends the `verification_code` received from the verification request to confirm the user’s phone number. * * * ## End Job Notification webhooks End Job Notification webhooks were previously only available to import jobs. Now, they are also available to export jobs. For more details, check out [Export job webhook](../../docs/export-webhook.html). ![end job notification webhook flow](../../docs/_images/webhooks/end-job-notification-webhook-flow.png) * * * ## Other improvements - You can now update user profiles without providing an ID such as an email or phone number. - We have improved the error messaging for when MFA is not enabled in the Purse Identity Console to give more specific help. - From this release, you’re now able to update the `email_verified` and `phone_number_verified` fields with import jobs. For more details, check out our [Imports documentation](../../docs/imports.html). * * * ## Fixes ##### There was a moderate security vulnerability identified that was remedied. ✓ ##### In some limited cases, you were unable to view newly-created users on the Purse Identity Console. ✓ ##### In some cases, jobs got stuck in the WAITING status causing timeouts. ✓ ##### In limited instances, the error key wasn’t matching the OAuth response for suspended users, causing an HTTP 500 error. ✓ ##### Sometimes, when getting the auth\_type for a user, we were only receiving the latest connection information instead of all the ways the user had authenticated. ✓ --- # 10 August 2023 (v2.98) URL: /release-notes/previous-years/298.html `Purse Identity v2.98` introduces our [configurable risk score threshold](#release-highlight), allows tighter integration with [social providers](#social-logins), and we improved the [user experience with console fields](#improved-ux-for-console-fields). There are also some [other general improvements](#other-improvements), and as always, we [fixed](#fixes) a few issues. ## Release highlight Risk score configuration We’re further improving our RBA feature. With that, you can now configure the **Risk score threshold** which is the threshold at which a login attempt is deemed risky. You can configure this threshold directly in the Purse Identity Console at **Settings**  **MFA**  **Settings**. For more on RBA with Purse Identity, check out [Risk-based Authentication](../../docs/rba.html). ![298 riskScore](../_images/298-riskScore.jpg) ## Social logins To make integration as seamless as possible, you can now retrieve Kakao user consents and bring them straight into Purse Identity. For other social providers, it’s possible to send the `providerName` and `providerAccessToken` fields available in the authentication result object obtained with `return_provider_token` boolean in the Identity API’s [`/oauth/token` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/retrieveAccessToken) or alternatively, via either the [loginWithSocialProvider](../../sdk-core/loginWithSocialProvider.html) or [showSocialLogin](../../sdk-ui/showSocialLogin.html) methods with the `returnProviderToken` auth option. For more details, see [Kakao Connect](../../docs/kakao-connect.html). * * * ## Improved UX for Console fields With this release, we have greatly improved the user experience when selecting fields to create webhooks, pub/sub hooks, and jobs. They are now more easily selectable from a dropdown menu. ![298 uxFieldsDropdown](../_images/298-uxFieldsDropdown.gif) * * * ## Other improvements - We have improved the speed for logging in for users with multiple console accounts. * * * ## Fixes ##### There was a slight discrepancy in the email verification process between our SDKs, APIs, and import jobs. ✓ ##### Emails with a full stop (foo@bar.example.com) in the domain were unexpectedly throwing validation errors. These emails are now once again fully accepted as valid. ✓ ##### For a brief period on the Purse Identity Console, the default profile photo used for when there is no photo associated with a profile was unavailable. This is now self-hosted to ensure it’s always available when needed. ✓ --- # 31 August 2023 (v2.99) URL: /release-notes/previous-years/299.html `Purse Identity v2.99` brings some improved security features including new configurable endpoints for [rate limiting](#rate-limiting), [reCAPTCHA](#recaptcha) improvements, and the ability to import the [suspension status](#imports) for users. There are also some [other general improvements](#other-improvements), and as always, we [fixed](#fixes) a few issues. ## Rate limiting We have added more endpoints for which you can configure specific rate limits. These endpoints are: - [`/update-phone-number` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/updatePhoneNumber) - [`/update-email` endpoint](https://docs.identity.purse.eu/openapi/identity.html#operation/updateEmailAddress) For more details, see [Rate limiting](../../docs/rate-limiting.html). ## reCAPTCHA In order to further protect your user accounts, we have included updating an email as an option for you to add to enforce reCAPTCHA security checks. You can select `update_email` directly from the **Endpoints** dropdown menu at **Settings**  **Security**  **Recaptcha**. For more details, see [Enable reCAPTCHA from the console](../../docs/captcha/recaptcha.html). ![299 rateLimitUpdateEmail](../_images/299-rateLimitUpdateEmail.jpg) * * * ## Imports You can now suspend users using the **Import feature** from within the Purse Identity Console by leveraging the `suspension_information` object in the user profile model. ```json ... "suspension_information": { "reason": "suspiciousUserNoGood", "status": "temporary" }, ... ``` ```csv id,suspension_information.status,suspension_information.reason AYl4...FUis7y,temporary,importCheckCheck ``` Want to know more? 🤔 - For more on importing users, see [Import job definition](../../docs/imports.html). - For more on the user profile model, see [User Profile](../../docs/models-user-profile.html). - For more on suspending users, see [User suspension](../../docs/suspend-user.html). * * * ## Other improvements - Jobs now continue even if writing to the job logs themselves fails. This keeps entire jobs from failing unexpectedly. * * * ## Fixes ##### In some cases, customers using public clients with the Core SDK were having users automatically disconnected without any action. This was due to conflicting authorization flows. ✓ ##### Error messages were inadvertently being returned in English no matter the configured language. ✓ ---