Release 5.4.0 - Add verification attempt-assets endpoints and card scheduled_activation_date

[david-ruiz-cko]

Note: small version number bump to align all other SDKs functionality minor version

⚠️ Breaking changes (see at the bottom)

This release adds support for pagination and asset retrieval in various identity verification APIs, and improves card update functionality with optional encrypted credential headers. The most significant changes are the introduction of paginated query parameters for listing attempts, new endpoints for retrieving attempt assets, and the ability to request encrypted card credentials via custom headers.

Identity Verification APIs

• Added optional pagination parameters (skip, limit) to all listAttempts methods for identity, ID document, address document, and face authentication verifications, and updated the Identities wrapper to support these parameters. [1] [2] [3] [4] [5] [6] [7] [8]
• Introduced new methods getAttemptAssets for ID document and address document verifications, allowing retrieval of uploaded document images for a specific attempt, with pagination support. These are also exposed in the Identities wrapper. [1] [2] [3] [4]
• Refactored query parameter handling by introducing a buildQueryParams utility to properly append query strings only when needed, avoiding unnecessary trailing question marks.

Issuing/Card APIs

• Enhanced the updateCard method to accept optional HTTP headers, enabling clients to request encrypted CVV values by setting return-encrypted-cvv and Encryption-Key headers. Updated documentation accordingly and propagated the change to the Issuing wrapper. [1] [2]

Other Improvements

• Changed the return value of getPDFReport in identity verifications to return a JSON object with a pre-signed PDF URL, instead of a raw CSV buffer, aligning with the updated API response.

⚠️ Breaking changes

Kind	Change
return type	identityVerifications.getPDFReport and identities.getIdentityVerificationPDFReport now resolve to the parsed JSON body carrying pdf_report, instead of a Buffer. The method previously requested text/csv and Buffer-wrapped a response the API sends as application/json, so pdf_report was unreachable
types	Promise -> Promise on the three getPDFReport declarations and the three aggregate delegates. For the address document and ID document variants the implementation always returned JSON, so those two are declaration corrections with no runtime change

Note: nothing else is breaking. The new params and headers arguments are trailing and optional in both the JavaScript and the type declarations.

[agent-wall-e]

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

• 2.2.7_dependency_upgrade

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 1

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
2.2.7_dependency_upgrade	classifying	§2.2.7	All files are manifest + lockfile, and no security-sensitive package was touched.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[agent-wall-e]

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

• 2.2.7_dependency_upgrade

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}