Skip to navigation
Changelog

Changelog

New features, enhancements, and fixes to the Vlens API and documentation

October 13, 2026

October 13, 2026

New features

POST /api/FRAServices/RequestOtpForPii now accepts an optional smsProviders field, matching the rest of the API. Omit it — or send 0 — and the tenant’s default provider is used, so existing callers are unaffected.

POST /api/FRAServices/RequestOtpForPii
{
  "phoneNumber": "+201234567890",
  "smsProviders": 2
}

See PII inquiry with OTP for the full flow.

Users with AML matches

A new portal page (Users With AML) lists users whose ID front scan matched an AML record, showing user ID, name, phone number, transaction ID and scan date. Results are paged, searchable by name, surname, phone, email, ID number or transaction ID, and filterable by date range. Available to tenants and to the host while impersonating a tenant.

Access is controlled by the new Pages.AmlUsers permission — grant it to the roles that should see the page.

Custom confirmation content on business request types

Request types can now carry their own confirmation text, set on the request type screen and saved with each request. It is rendered in the KYC confirmation section of the generated contract, after the standard declaration and before the request fields, for both standard and promissory-note types, in English and Arabic.

It is not shown when the type is single-section or when KYC confirmation is hidden.

Enhancements

Scan step retries are driven by one setting

Scan step retries are now controlled solely by the Scan Step Max Tries Count feature. The default remains 6; setting it to 0 means unlimited tries, with every request counted as a new request. The old Enable Scan Step Retry checkbox has been removed from the Create/Edit Tenant screens.

Tenants that relied on the old Enable Scan Step Retry flag fall back to the 6-try limit after this release. Set Scan Step Max Tries Count to 0 for those tenants to keep unlimited retries.

Hide KYC Confirmation requires Custom Contract Template

Hide KYC Confirmation now takes effect only when the Custom Contract Template feature is enabled. Without it, the KYC confirmation is always shown in contracts.

Explicit error codes on the FRA PII inquiry

Both PII inquiry endpoints — POST /api/FRAServices/PersonallyIdentifiableInformation and POST /api/FRAServices/CheckIdAndFRAByTransaction — now return HTTP 400 with a specific error_code instead of a generic failure:

OTP not verified

  • 6106 — wrong OTP code. Re-enter it and retry with the same otpRequestId (up to 5 tries per OTP)
  • 6105 — OTP expired. Request a new OTP and retry
  • 6101 — OTP request not valid (unknown, already used, or no tries left). Request a new OTP and retry

ID image validation failed (PersonallyIdentifiableInformation and CheckIdAndFRAByTransaction), with the failing fields in data.validation_errors:

  • 6125 — ID front image failed validation
  • 6126 — ID back image failed validation

See PII inquiry with OTP and Error codes.

Bug fixes

  • Deleting a portal user who has signed contracts now returns a clear message instead of an HTTP 500 error. Self-deletion through the Gateway is unchanged
  • The Unlock action now appears for business request users in the Users list, and unlocking them is allowed by the backend
  • After login, users are returned to the link they originally opened — including /account/... links such as email verification — instead of the home page