> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.vlenseg.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.vlenseg.com/_mcp/server.

# October 26, 2026

## New features

### Change Phone Number Session

Users can now change their registered phone number through an invitation link or an embedded session.

* Admins with the new **Change Phone Number Invitation** permission can send an invitation from the **Users** page. The invitation is emailed, so the user's email must be confirmed. English and Arabic email templates are included. See [Users & invitations](/portal/users-and-invitations#change-phone-number-invitation).
* The user confirms the new number with an SMS code (OTP).
* Users with a verified digital identity must also pass a face match against their stored biometric data. For other users, phone ownership is checked and the number is updated right after the OTP is verified.
* The new number can't be the same as the current number.

New endpoints under `api/ChangePhoneNumberSession`: `CreateInvitation`, `CreateSession`, `GetUserSessionSettings`, `SendOtp`, `VerifyOtp` and `ValidateFaceMatch`.

See [Change Phone Number Session](/iframe-session#change-phone-number-session).

### Prevent new request on rejection (iframe)

A new session permission, **Prevent New Request On Rejection** (`sessionPermissions.preventNewRequestOnRejection`), can be set when creating an invitation and is shown in the invitation and session details. When it is enabled, inside the iframe:

* The user can't start a new request for a contract type that was already rejected for them.
* If every allowed contract type is already signed or rejected, the session is treated as fulfilled.

Rejected requests no longer count as signed contracts.

See [Prevent new request on rejection](/iframe-session#prevent-new-request-on-rejection) and, for the portal, [Users & invitations](/portal/users-and-invitations#prevent-new-request-on-rejection).

### Signing status in contract emails

Contract emails now show who has signed: **Customer Signed** or **Service Provider Signed**. Two new placeholders are available for the email subject and body: `{BUSINESS_REQUEST_TYPE}` and `{SIGNING_STATUS}`.

The new default subject is:

```
{TENANT_NAME} - {BUSINESS_REQUEST_TYPE} - {SIGNING_STATUS}
```

See [Contract emails](/e-contracting#contract-emails).

### Infobip base URL and sender name per tenant

The Infobip settings in the portal now include **Base URL** and **Sender Name**, and **Test Connection** uses them. The base URL can be entered without `https://`. Tenants that only saved an API key keep using the default base URL and sender. See [Settings](/portal/settings).

## Enhancements

### Faster, more stable contract PDFs

Contract PDF generation is faster and more stable under load.

### Clear 404 for unknown endpoints

Calls to an endpoint that doesn't exist now return **HTTP 404** `Endpoint not found` instead of an authentication error. See [HTTP error codes](/errors#http-error-codes).

## Bug fixes

* Email matching in user lookups is no longer case-sensitive
* Hidden or invisible characters and extra spaces are removed from the email or phone number before the user lookup