Changelog

New features

ID card verification from a single PDF

The national ID can now be uploaded as one PDF that contains both the front and the back, instead of two separate images.

POST /api/FRAServices/PersonallyIdentifiableInformationPdf
Content-Type: multipart/form-data
file=@national-id.pdf
phoneNumber=01000000000

New features

Change Phone Number Session

Users can now change their registered phone number through an invitation link or an embedded session.

• Admins with the new Change Phone Number Invitation permission can send an invitation from the Users page. The invitation is emailed, so the user’s email must be confirmed. English and Arabic email templates are included. See Users & invitations.
• The user confirms the new number with an SMS code (OTP).
• Users with a verified digital identity must also pass a face match against their stored biometric data. For other users, phone ownership is checked and the number is updated right after the OTP is verified.
• The new number can’t be the same as the current number.

New features

SMS provider option on the PII consent OTP

POST /api/FRAServices/RequestOtpForPii now accepts an optional smsProviders field, matching the rest of the API. Omit it — or send 0 — and the tenant’s default provider is used, so existing callers are unaffected.

API

Commercial Register PDF processing — background processing

CR PDF processing now runs in the background since it can take a long time. Added:

• POST /v1/ocr/process_pdf — submit a PDF, returns immediately with a processing status
• GET /v1/ocr/get_process_pdf_result/{transaction_id} — poll for the result

Documentation

Expanded API reference

The OpenAPI spec now documents 84 endpoints across Digital Identity, Business Request, Transactions, and Identity User Session — including flows that were previously guide-only or missing from the reference.

Authentication & account

New features

OAuth login — Google and Microsoft

Users can now register and authenticate using an existing Google or Microsoft account, eliminating the need for a separate email verification OTP.

New endpoints:

Enhancements

Bulk countersigning

Service providers can now select multiple contracts in the “Manage request traffic” view and countersign them in a single action using Bulk Customer Sign — reducing manual signing overhead for high-volume tenants.

Auto-signer tool improvements

Enhancements

Location-based liveness re-validation

The contract activation flow now enforces a 80 km radius check. When a user requests an OTP from a location more than 80 km from their last active device, the system requires liveness re-validation before proceeding. This prevents account takeover from geographically distant devices.

New features

Invitation sessions with pre-filled data

The POST /api/IdentityUserSession/CreateInvitation endpoint is now available. Admins can create iframe sessions with form fields pre-populated, so users only need to confirm and sign rather than fill in the full form.

Enhancements

SMS provider selection

The StepVerifyPhone endpoint now accepts a smsProviders field so tenants can choose which SMS gateway to use for OTP delivery on a per-request basis:

New features

Webhooks — App.BusinessRequestStatusChange

Tenants can now subscribe to contract lifecycle events via the Vlens portal. When a business request changes status (e.g. PendingApproval → Approved, Approved → CustomerSigned), Vlens sends an HTTP POST to your configured endpoint.