Crassula Release Week 37

core v.25.09.4-25.09.7
client v.25.09.7-25.09.8

Improvements

API

Updated validation rules for Bank transfers by the IFX provider:

recipientIban: This parameter is now a required field.
beneficiaryAddress: Maximum length is increased from 70 to 200 characters.
recipientName:
- Expression requirements are changed from ^[a-zA-Z.' ]+$ to ^[a-zA-Z0-9\/\-?:().,'+\s#=!"%&*<>;{@\r\n]*$
- Maximum length is increased from 35 to 140 characters.
details: A maximum length of 35 characters is enforced.
recipientAccount: The field is now required for SWIFT transfers.

If you're using IFX-related endpoints, make sure to update your requests to comply with the new validations. Otherwise, validation errors will be returned. See the upgrade note for details.

Fixes

API

Unified the cards[] response structure in both GET and POST /api/clients/{clientId}/vaults endpoints to match the format used across other Banking API endpoints. See the updated Banking API for details.

Authentication

Fixed an issue where attempting to delete 2FA with type sms returned a 403 error. Now, 2FA deletion for both sms and topt types functions correctly.
Addressed a problem where users with both 2FA and Auth-token login methods were unable to sign in after 2FA was deleted via API. This has now been resolved.

Card issuing

Fixed an issue where an incorrect document name was shown when submitting card documents via the Admin Panel. The system now correctly prompts for a Utility bill instead of Proof of address, which was misleading.

Web Interface

Adjusted the disclaimer link display for Equals Money provider to ensure it appears correctly and consistently across the interface.

Upcoming Updates

New Features

New service providers

A new BaaS integration with Zand Bank will be introduced. More details about this integration will be shared in the upcoming product updates.
We will be implementing CoP Inbound functionality for the ClearBank provider. This feature is part of the Confirmation of Payee service and helps prevent misdirected payments and fraud. Please contact your client manager for further information.

Fixes

API

We will be aligning and standardizing response codes across both Bearer token and API key authorization methods. This update ensures that the returned HTTP status codes consistently reflect the actual issue - such as missing resources or lack of permissions - regardless of the authentication method used. See the upgrade note for more details.