airwallex 0.8.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: be0adbfbafc982fa5c899a9df4230e9c65a68e46d2e7eb248b981e41ccc23bd4
-  data.tar.gz: 599bdc078288f934cc5f8b06fced1668605c8e2e6af4763d943a9f227a32e563
+  metadata.gz: '018417ed2b3091ca1c5eafdf99df79c1a81be1d13ddda2524a917d2bc9a2c3ff'
+  data.tar.gz: 0abdb483ebe91136353cc77efb5023cb1d0a05b3fd986c8c3ba59750dfeccfdd
 SHA512:
-  metadata.gz: 4cd20d177f642d64bdb07922f673483ab3d86499c0a938c8a7db7854f06fd5dff86b10326c09496dbf9a0bc8099a64834fc0ee4a56ff91d822dd721aff911e7a
-  data.tar.gz: 56b071c9ff52ccf48f6526c6f3a8264d55c1d8cfcc5794d869894535baf7685c7642bdebf498f5c4ed01e362631f62a9721d4151bc6f860cf91b574a2a2d54b7
+  metadata.gz: 1b48a815ca9ca948b4695cfa28b12e70c5dc21a7c6ff37781d20fe0b2f219b12daf205ec997eaaf51eca19bce49d3ffd0fbb890773cd99f5573c4733680e1ec6
+  data.tar.gz: ff66015473fee32cd8ec4bd7cdbb03072b340111d1c354db181c07e0722c936d7b14565210eabd6583f8cd223be9f4c96889b1e329a79b41709ed4626b474427

data/CHANGELOG.md

@@ -1,8 +1,88 @@
 ## [Unreleased]
 
+## [0.10.0] - 2026-09-29
+
+### Added
+
+- `RFI.retrieve` (`GET /api/v1/rfis/{id}`) and `RFI.list` (`GET /api/v1/rfis`, filterable by
+  `statuses`, `types`, `from_created_at`, `end_created_at`, `page_size`). Both take
+  `headers:` for `x-on-behalf-of`
+- `RFI.list` supports bookmark pagination: `has_more`/`next_cursor` come from `page_after`, and
+  `next_page`/`auto_paging_each` request `page: <page_after>`
+- `ListObject` accepts `cursor_param:` (defaults to `:next_cursor`) and `opts:`, and forwards
+  the original `opts` (e.g. `headers:`) to subsequent pages. Resources that don't pass these
+  behave exactly as before
+- `RFI.simulate_create`/`.simulate_close`/`.simulate_follow_up` and the instance
+  `#simulate_close`/`#simulate_follow_up` accept an optional trailing `opts` hash with `headers:`
+
+### Changed
+
+- `RFI.resource_path` is now `/api/v1/rfis`; the simulation path moved to `RFI::SIMULATION_PATH`
+  (`/api/v1/simulation/rfis`). Simulation methods hit the same URLs as before
+
+## [0.9.0] - 2026-09-09
+
+### Added
+
+- Sandbox Simulation API coverage (all sandbox-only, see
+  https://www.airwallex.com/docs/api/simulation/):
+  - Deposit resource (`.create`/`.retrieve`/`.list` for real Direct Debit deposits,
+    `.simulate_create` for a Global Account bank-transfer deposit, `.simulate_settle`,
+    `.simulate_reject`, `.simulate_reverse` — the latter three only operate on
+    Direct Debit deposits made via `.create`, confirmed against the live sandbox;
+    a bank-transfer deposit from `.simulate_create` auto-settles on its own)
+  - IssuingTransaction resource (`.simulate_create` with `single_phase`,
+    `.simulate_capture`, `.simulate_reverse`, `.simulate_refund`,
+    `.simulate_notify_three_ds`) — `.simulate_create`'s response key is
+    `transaction_id` (confirmed against the live sandbox; earlier docs research
+    suggested `card_transaction_lifecycle_id`, which the API doesn't return)
+  - Cardholder resource (`.simulate_pass_review`)
+  - LinkedAccount resource (`.simulate_accept_mandate`, `.simulate_reject_mandate`,
+    `.simulate_cancel_mandate`, `.simulate_fail_microdeposits`)
+  - AccountOffboarding nested resource (`.simulate_complete`, `.simulate_cancel`),
+    scoped to a parent ConnectedAccount
+  - RFI resource (`.simulate_create`, `.simulate_close`, `.simulate_follow_up`,
+    plus instance equivalents)
+  - POSTerminal resource (`.simulate_turn_on`, `.simulate_turn_off`,
+    `.simulate_generate_activation_code`, `.simulate_confirm_payment_intent`,
+    `.simulate_payment_scenarios`)
+  - Transfer gained `.simulate_transition`/`#simulate_transition`
+  - Dispute gained `.simulate_create`, `.simulate_escalate`/`#simulate_escalate`,
+    `.simulate_resolve`/`#simulate_resolve`
+  - ConnectedAccount gained `.simulate_update_status`/`#simulate_update_status`,
+    `#simulate_complete_offboarding`, `#simulate_cancel_offboarding`
+  - AccountAmendment gained `.simulate_approve`/`#simulate_approve`,
+    `.simulate_reject`/`#simulate_reject`
+  - PaymentIntent gained `#simulate_shopper_pay`, `#simulate_shopper_reject`
+  - PaymentConsent gained `#simulate_shopper_verify`
+- New tests covering all of the above (430 total)
+
+### Fixed
+
+- RFI question `answer.type` corrected to the real uppercase enum (`"TEXT"`,
+  not `"text"`) — confirmed against the live sandbox
+
+### Verified against the live sandbox
+
+- `Deposit.simulate_create`, `Transfer.simulate_transition`,
+  `Dispute.simulate_create`, `RFI.simulate_create`/`#simulate_close`,
+  `IssuingTransaction.simulate_create`/`.simulate_refund` all confirmed
+  working end-to-end
+- `IssuingTransaction.simulate_capture`/`.simulate_reverse` and
+  `AccountAmendment.simulate_approve` reach the correct endpoint (accepted,
+  not 404) but couldn't be fully exercised on this account — both require
+  Admin-level API key permissions this sandbox key doesn't have
+- Found and worked around (in the smoke test only) a pre-existing bug in
+  `Client`'s Faraday retry configuration: `retry_options[:exceptions]`
+  doesn't include `Faraday::RetriableResponse`, so any POST that gets back
+  a `retry_statuses` code (429/500/502/503/504) raises uncaught instead of
+  being returned as a normal `Airwallex::Error` — unrelated to the
+  Simulation resources, not fixed here
+
 ## [0.8.0] - 2026-09-02
 
 ### Fixed
+
 - `Util.deep_symbolize_keys` now recurses into `Array`s, matching `ActiveSupport#deep_transform_keys`'s
   behavior. Previously any `Array` value was copied through untouched, so hashes nested inside an array
   (e.g. `beneficiary_form_schemas`'s `fields` list) kept string keys even after "deep" symbolizing.
@@ -22,6 +102,7 @@
 ## [0.7.0] - 2026-08-28
 
 ### Added
+
 - GlobalAccount resource (create, retrieve, list, update, `#close`, `#generate_statement_letter`,
   `#transactions`)
   - GlobalAccountAlias nested resource (`#create_alias`, `#alias`, `#aliases`, `#initiate_port`,
@@ -42,6 +123,7 @@
 - New tests covering all of the above (378 total)
 
 ### Fixed
+
 - `APIOperations::Update` now sends `POST #{resource_path}/{id}/update` instead of `PUT #{resource_path}/{id}`
 - `APIOperations::Delete` now sends `POST #{resource_path}/{id}/delete` instead of `DELETE #{resource_path}/{id}`,
   and checks the response instead of always returning `true`
@@ -73,12 +155,14 @@
 - `Quote.create` requires `validity` (`MIN_1`, `MIN_15`, `MIN_30`, `HR_1`, `HR_4`, `HR_8`, or `HR_24`)
 
 ### Removed
+
 - `Rate.list` — the endpoint has no "list all rates" concept, only `.retrieve(sell_currency:, buy_currency:)`
 - `PaymentMethod.delete` and `PaymentMethod#detach` — replaced by `#disable`, the real lifecycle operation
 
 ## [0.6.0] - 2026-08-28
 
 ### Fixed
+
 - `Webhook::Event` now correctly exposes the event type. Airwallex sends this field as `"name"` in
   the webhook payload, not `"type"` — the previous `Event#type` reader was reading a key that doesn't
   exist and always returned `nil`. The accessor is renamed to `Event#name` to match Airwallex's actual
@@ -87,6 +171,7 @@
 ## [0.5.0] - 2026-08-28
 
 ### Fixed
+
 - Webhook signature verification no longer rejects valid webhooks when Airwallex sends
   millisecond-precision timestamps. `verify_timestamp` now detects millisecond values (anything at or
   above `MS_THRESHOLD = 10_000_000_000`, which safely distinguishes seconds from milliseconds until the
@@ -95,6 +180,7 @@
 ## [0.4.0] - 2026-08-27
 
 ### Fixed
+
 - `Idempotency` and `AuthRefresh` middleware are now actually registered on the Faraday connection.
   Previously both classes existed but were never wired in, so the "automatic `request_id` generation"
   and "retry once after a 401" behavior documented in the README did not happen at runtime.
@@ -103,12 +189,14 @@
 - CI now triggers on pushes to `main` (previously configured for `master`, so pushes never ran CI).
 
 ### Changed
+
 - `Client#request` no longer manually manages the `Authorization` header or calls
   `ensure_authenticated!` directly; this is now owned by the `AuthRefresh` middleware.
 
 ## [0.3.0] - 2025-11-25
 
 ### Added
+
 - BatchTransfer resource (create, retrieve, list) for bulk payout operations
 - Dispute resource (retrieve, list, accept, submit_evidence) for chargeback management
 - Foreign Exchange resources:
@@ -121,15 +209,18 @@
 - Comprehensive manual test suite for regression testing
 
 ### Changed
+
 - Refactored List operation for better code quality (reduced complexity from 12 to 7)
 - Balance.retrieve now performs client-side filtering for currency lookup
 
 ### Fixed
+
 - List operation now correctly handles Balance API's direct array response format
 
 ## [0.2.0] - 2025-11-25
 
 ### Added
+
 - Refund resource (create, retrieve, list)
 - PaymentMethod resource (create, retrieve, list, update, delete, detach)
 - Customer resource (create, retrieve, list, update, delete)
@@ -139,6 +230,7 @@
 ## [0.1.0] - 2025-11-25
 
 ### Added
+
 - Core infrastructure: Configuration, Client, Error handling
 - Authentication: Bearer token with automatic refresh
 - API Resources:
@@ -154,5 +246,6 @@
 - Ruby 3.1+ support
 
 ### Notes
+
 - This is an MVP release focusing on core payment acceptance and payout functionality
 - Additional resources (FX, cards, refunds) will be added in future versions

data/README.md

@@ -16,12 +16,14 @@ This gem provides a Ruby interface to Airwallex's payment infrastructure, design
 - **Billing**: Products, prices, billing customers, and subscriptions for recurring/instalment billing
 - **Recurring Payments**: Payment consents and payment sources for merchant-initiated (off-session) charges
 - **Scale**: Connected accounts, funds splits, and charges for platforms onboarding sub-merchants
+- **Compliance**: Retrieve and list Requests for Information (RFIs), including for connected accounts
+- **Sandbox Simulations**: Deposits, issuing transactions, disputes, transfer status, Direct Debit mandates, connected account/offboarding review outcomes, RFIs, and POS terminals — see [Sandbox Simulations](#sandbox-simulations)
 - **Idempotency**: Automatic request deduplication for safe retries
 - **Pagination**: Unified interface over cursor-based and offset-based pagination
 - **Webhook Security**: HMAC-SHA256 signature verification with replay protection
 - **Sandbox Support**: Full testing environment for development
 
-**Not yet implemented:** Card issuing.
+**Not yet implemented:** live Card issuing resources (Card, Cardholder create/retrieve/list) — only their sandbox Simulation actions are covered today.
 
 ## Installation
 
@@ -416,6 +418,258 @@ split.release
 charge = Airwallex::Charge.retrieve('charge_id')
 ```
 
+### Requests for Information (RFIs)
+
+RFIs are compliance questions Airwallex raises against an account. They use
+bookmark pagination (`page_after`/`page`), which `ListObject` handles for you,
+and connected accounts are addressed with `x-on-behalf-of`, which is kept
+across pages. The API key needs the **Risk → Request for Information (RFI):
+Read** permission, or Airwallex responds with 401 (`Airwallex::AuthenticationError`).
+
+```ruby
+headers = { 'x-on-behalf-of' => 'acct_123' }
+
+rfi = Airwallex::RFI.retrieve('rfi_123', headers: headers)
+rfi.status                           # => "ACTION_REQUIRED"
+rfi.active_request[:questions].first # => { id: ..., title: { en: ... }, answer: { type: "ATTACHMENT" }, ... }
+
+# statuses/types are comma-separated strings; page_size is 1-2000 (default 100)
+Airwallex::RFI.list({ statuses: 'ACTION_REQUIRED', types: 'KYC,KYC_ONGOING' }, headers: headers)
+              .auto_paging_each { |r| puts r.id }
+```
+
+### Sandbox Simulations
+
+Sandbox-only endpoints (`/api/v1/simulation/...`) that stand in for the bank,
+card network, issuing bank, or shopper — for driving async/manual lifecycles
+in tests without waiting on real-world events. See
+https://www.airwallex.com/docs/api/simulation/ for the full reference. All
+of these raise `Airwallex::Error` (same as any other endpoint) if called
+against a production API key.
+
+#### Deposits
+
+```ruby
+# Simulate an inbound bank transfer landing in a Global Account — auto-settles
+# on its own within a few seconds, same as a real bank transfer
+Airwallex::Deposit.simulate_create(amount: 100.00, global_account_id: 'gacc_123')
+
+# .simulate_settle/.simulate_reject/.simulate_reverse are for Direct Debit
+# deposits specifically, made via the real (non-simulation) .create — a real
+# direct debit pull takes days to clear, so the sandbox needs a way to force it
+pending = Airwallex::Deposit.create(funding_source_id: 'la_123', amount: 50.00, currency: 'AUD')
+pending.simulate_settle # -> SETTLED
+# or: pending.simulate_reject -> REJECTED
+
+# Reversing only works on an already-SETTLED Direct Debit deposit; it creates
+# an offsetting settled deposit and deactivates the LinkedAccount
+settled = Airwallex::Deposit.create(funding_source_id: 'la_123', amount: 50.00, currency: 'AUD')
+settled.simulate_settle
+settled.simulate_reverse
+
+# Class-level equivalents take a deposit_id directly instead of an instance
+Airwallex::Deposit.simulate_settle('dpt_123')
+Airwallex::Deposit.simulate_reject('dpt_123')
+Airwallex::Deposit.simulate_reverse('dpt_123')
+```
+
+#### Issuing Transactions
+
+```ruby
+# Authorize, then capture in full
+txn = Airwallex::IssuingTransaction.simulate_create(
+  card_id: 'card_123',
+  transaction_amount: 25.00,
+  transaction_currency: 'USD'
+)
+Airwallex::IssuingTransaction.simulate_capture(txn.transaction_id)
+
+# Authorize, then capture only part of the authorized amount
+txn = Airwallex::IssuingTransaction.simulate_create(
+  card_id: 'card_123', transaction_amount: 25.00, transaction_currency: 'USD'
+)
+Airwallex::IssuingTransaction.simulate_capture(txn.transaction_id, transaction_amount: 10.00)
+
+# Authorize and clear in a single step (no separate capture needed)
+Airwallex::IssuingTransaction.simulate_create(
+  card_id: 'card_123', transaction_amount: 25.00, transaction_currency: 'USD', single_phase: true
+)
+
+# Reverse a still-PENDING (uncaptured) authorization instead of capturing it
+txn = Airwallex::IssuingTransaction.simulate_create(
+  card_id: 'card_123', transaction_amount: 25.00, transaction_currency: 'USD'
+)
+Airwallex::IssuingTransaction.simulate_reverse(txn.transaction_id)
+
+# Refund a CAPTURED transaction back to the card
+Airwallex::IssuingTransaction.simulate_refund(
+  card_id: 'card_123', transaction_amount: 25.00, transaction_currency: 'USD'
+)
+
+# Simulate a 3DS delegation-mode notification for a card
+Airwallex::IssuingTransaction.simulate_notify_three_ds(card_number: '4111111111111111')
+```
+
+#### Disputes
+
+```ruby
+# Full lifecycle: raised, challenged, then resolved in the merchant's favor
+dispute = Airwallex::Dispute.simulate_create(
+  payment_intent_id: payment_intent.id,
+  reason_code: '4853',
+  stage: 'CHARGEBACK',
+  due_at: (Time.now + 86_400).iso8601
+)
+dispute.challenge(customer_communication: 'Proof of delivery')
+dispute.simulate_resolve(in_favor_of: 'MERCHANT')
+
+# Or accept without challenging, then resolve in the customer's favor
+dispute = Airwallex::Dispute.simulate_create(
+  payment_intent_id: payment_intent.id, reason_code: '4853', stage: 'CHARGEBACK',
+  due_at: (Time.now + 86_400).iso8601
+)
+dispute.accept
+dispute.simulate_resolve(in_favor_of: 'CUSTOMER')
+
+# Escalate — the issuing bank rejects the challenge evidence and advances the
+# dispute to the next stage (e.g. Chargeback -> Pre-arbitration)
+dispute.challenge(customer_communication: 'Proof of delivery')
+dispute.simulate_escalate(due_at: (Time.now + 86_400).iso8601)
+
+# Class-level equivalents take a dispute_id directly instead of an instance
+Airwallex::Dispute.simulate_escalate('dis_123', due_at: (Time.now + 86_400).iso8601)
+Airwallex::Dispute.simulate_resolve('dis_123', in_favor_of: 'MERCHANT')
+```
+
+#### Transfers
+
+```ruby
+# Advance a transfer's status one step at a time: SCHEDULED -> PROCESSING ->
+# SENT -> PAID
+transfer.simulate_transition(next_status: 'PROCESSING')
+transfer.simulate_transition(next_status: 'SENT')
+transfer.simulate_transition(next_status: 'PAID')
+
+# OVERDUE, FAILED, and CANCELLED can be jumped to directly
+transfer.simulate_transition(next_status: 'FAILED', failure_type: 'INSUFFICIENT_FUNDS')
+
+# Class-level equivalent takes a transfer_id directly instead of an instance
+Airwallex::Transfer.simulate_transition('tfr_123', next_status: 'CANCELLED')
+```
+
+#### Connected Accounts & Offboarding
+
+```ruby
+# Simulate a KYC/KYB review outcome (account must currently be SUBMITTED)
+connected_account.simulate_update_status(next_status: 'ACTIVE')
+# or: connected_account.simulate_update_status(next_status: 'SUSPENDED')
+# or: connected_account.simulate_update_status(next_status: 'ACTION_REQUIRED')
+
+# Class-level equivalent takes an account_id directly instead of an instance
+Airwallex::ConnectedAccount.simulate_update_status('acct_123', next_status: 'ACTIVE')
+
+# Simulate a pending offboarding completing or being cancelled — via the
+# parent ConnectedAccount instance...
+connected_account.simulate_complete_offboarding('obd_456')
+connected_account.simulate_cancel_offboarding('obd_456')
+
+# ...or directly against AccountOffboarding with both ids
+Airwallex::AccountOffboarding.simulate_complete('acct_123', 'obd_456')
+Airwallex::AccountOffboarding.simulate_cancel('acct_123', 'obd_456')
+```
+
+#### Account Amendments
+
+```ruby
+amendment = Airwallex::AccountAmendment.create(
+  target: 'account_details.store_details',
+  store_details: { store_name: 'New Store Name' }
+)
+amendment.simulate_approve
+# or: amendment.simulate_reject
+
+# Class-level equivalents take an amendment_id directly instead of an instance
+Airwallex::AccountAmendment.simulate_approve('amd_123')
+Airwallex::AccountAmendment.simulate_reject('amd_123')
+```
+
+#### Linked Accounts (Direct Debit Mandates)
+
+```ruby
+# Mandate lifecycle: PROCESSING -> ACTIVE, or PROCESSING -> INACTIVE. All
+# four actions return HTTP 200 with an empty body, so the gem returns `true`
+# rather than a resource instance.
+Airwallex::LinkedAccount.simulate_accept_mandate('la_123')  # PROCESSING -> ACTIVE
+Airwallex::LinkedAccount.simulate_reject_mandate('la_123')  # PROCESSING -> INACTIVE
+Airwallex::LinkedAccount.simulate_cancel_mandate('la_123')  # PROCESSING or ACTIVE -> INACTIVE
+
+# Simulate a failed micro-deposit verification: REQUIRES_ACTION -> FAILED
+Airwallex::LinkedAccount.simulate_fail_microdeposits('la_123')
+```
+
+#### Shopper Actions
+
+```ruby
+# Simulate the shopper completing (or abandoning) a redirect/3DS challenge
+# raised during PaymentIntent#confirm, using the url from its next_action
+payment_intent.simulate_shopper_pay(url: next_action_url)
+# or: payment_intent.simulate_shopper_reject(url: next_action_url)
+
+# Simulate the shopper completing a redirect/3DS challenge raised during
+# PaymentConsent#verify, using the url from its next_action
+payment_consent.simulate_shopper_verify(url: next_action_url)
+```
+
+#### Issuing Cardholders
+
+```ruby
+# Bypass a cardholder's pending RFI review stage
+Airwallex::Cardholder.simulate_pass_review('chd_123')
+```
+
+#### Requests for Information (RFIs)
+
+```ruby
+# Raise a KYC RFI, then close it
+rfi = Airwallex::RFI.simulate_create(type: 'KYC', questions: [{ answer: { type: 'TEXT' } }])
+rfi.simulate_close
+
+# Follow up on an RFI — reopen an existing answered question (by id) or
+# append a new one
+rfi = Airwallex::RFI.simulate_create(type: 'KYC', questions: [{ answer: { type: 'TEXT' } }])
+rfi.simulate_follow_up(questions: [{ answer: { type: 'TEXT' } }])
+
+# Class-level equivalents take an rfi_id directly instead of an instance
+Airwallex::RFI.simulate_close('rfi_123')
+Airwallex::RFI.simulate_follow_up('rfi_123', questions: [{ answer: { type: 'TEXT' } }])
+
+# Raise an RFI against a connected account — params need braces when
+# followed by opts. Fails with BadRequestError ("ongoing RFI case exists")
+# if the account already has an open RFI.
+Airwallex::RFI.simulate_create(
+  { type: 'KYC', questions: [{ answer: { type: 'TEXT' } }] },
+  headers: { 'x-on-behalf-of' => 'acct_123' }
+)
+```
+
+#### POS Terminals
+
+```ruby
+# Turn a terminal on, then have it confirm a PaymentIntent under a named test
+# scenario
+Airwallex::POSTerminal.simulate_turn_on(terminal_id: 'term_123')
+Airwallex::POSTerminal.simulate_confirm_payment_intent(
+  terminal_id: 'term_123', payment_scenario_name: 'approve'
+)
+Airwallex::POSTerminal.simulate_turn_off(terminal_id: 'term_123')
+
+# List the test scenario names available to simulate_confirm_payment_intent
+Airwallex::POSTerminal.simulate_payment_scenarios
+
+# Generate a terminal activation code
+Airwallex::POSTerminal.simulate_generate_activation_code(request_id: 'req_123')
+```
+
 ## Usage
 
 ### Authentication
@@ -454,7 +708,8 @@ transfer = Airwallex::Transfer.create(
 
 ### Pagination
 
-Unified interface across both cursor-based and offset-based endpoints:
+Unified interface across cursor-based, offset-based, and bookmark-based (RFI) endpoints.
+Any `headers:` passed to `.list` (e.g. `x-on-behalf-of`) are kept on every page:
 
 ```ruby
 # Auto-pagination with enumerable
@@ -588,13 +843,13 @@ end
 ### Currently Implemented Resources
 
 - **Payment Acceptance**:
-  - PaymentIntent (create, retrieve, list, update, confirm, cancel, capture)
+  - PaymentIntent (create, retrieve, list, update, confirm, cancel, capture, simulate_shopper_pay, simulate_shopper_reject)
   - Refund (create, retrieve, list)
   - PaymentMethod (create, retrieve, list, update, disable)
   - Customer (create, retrieve, list, update, delete)
-  - Dispute (retrieve, list, accept, challenge, related_payment_intents)
+  - Dispute (retrieve, list, accept, challenge, related_payment_intents, simulate_create, simulate_escalate, simulate_resolve)
 - **Payouts**:
-  - Transfer (create, retrieve, list, cancel)
+  - Transfer (create, retrieve, list, cancel, simulate_transition)
   - Beneficiary (create, retrieve, list, update, delete, validate, verify_account, api_schema, form_schema, supported_financial_institutions)
   - BatchTransfer (create, retrieve, list)
 - **Foreign Exchange & Multi-Currency**:
@@ -605,6 +860,8 @@ end
 - **Global Accounts**:
   - GlobalAccount (create, retrieve, list, update, close, generate_statement_letter, create_alias, aliases, mandate, mandates)
   - GlobalAccountTransaction, GlobalAccountAlias, GlobalAccountMandate (list/lifecycle actions scoped to a parent account)
+  - Deposit (create, retrieve, list — Direct Debit only; simulate_create for a Global Account bank-transfer deposit, simulate_settle/simulate_reject/simulate_reverse for Direct Debit deposits made via create)
+  - LinkedAccount — sandbox Simulation only (simulate_accept_mandate, simulate_reject_mandate, simulate_cancel_mandate, simulate_fail_microdeposits)
 - **Billing & Subscriptions**:
   - BillingCustomer (create, retrieve, list, update, bank_transfer_instructions)
   - BillingProduct (create, retrieve, list, update)
@@ -612,18 +869,26 @@ end
   - BillingSubscription (create, retrieve, list, update, items)
   - BillingSubscriptionItem (scoped to a parent subscription)
 - **Recurring Payments**:
-  - PaymentConsent (create, retrieve, list, update, verify, verify_continue, disable)
+  - PaymentConsent (create, retrieve, list, update, verify, verify_continue, disable, simulate_shopper_verify)
   - PaymentSource (create, retrieve, list)
 - **Scale**:
-  - ConnectedAccount (create, retrieve, list, update, current, wallet_info, submit, agree_to_terms_and_conditions, suspend, reactivate)
-  - AccountAmendment (create, retrieve) - requires Admin-level API key permissions
+  - ConnectedAccount (create, retrieve, list, update, current, wallet_info, submit, agree_to_terms_and_conditions, suspend, reactivate, simulate_update_status, simulate_complete_offboarding, simulate_cancel_offboarding)
+  - AccountAmendment (create, retrieve, simulate_approve, simulate_reject) - requires Admin-level API key permissions
+  - AccountOffboarding — sandbox Simulation only, scoped to a parent ConnectedAccount (simulate_complete, simulate_cancel)
   - FundsSplit (create, retrieve, list, release)
   - Charge (create, retrieve, list)
+- **Issuing** (sandbox Simulation only — no live Card/Cardholder resources yet):
+  - IssuingTransaction (simulate_create with single_phase, simulate_capture, simulate_reverse, simulate_refund, simulate_notify_three_ds)
+  - Cardholder (simulate_pass_review)
+- **In-Person Payments** (sandbox Simulation only):
+  - POSTerminal (simulate_turn_on, simulate_turn_off, simulate_generate_activation_code, simulate_confirm_payment_intent, simulate_payment_scenarios)
+- **Compliance**:
+  - RFI (retrieve, list, plus sandbox simulate_create, simulate_close, simulate_follow_up)
 - **Webhooks**: Event handling, HMAC-SHA256 signature verification
 
 ### Coming in Future Versions
 
-- Card issuing
+- Live Card issuing resources (Card, Cardholder create/retrieve/list) — only their sandbox Simulation actions are implemented today
 
 ## Environment Support
 

data/lib/airwallex/list_object.rb

@@ -6,12 +6,19 @@ module Airwallex
 
     attr_reader :data, :has_more, :next_cursor
 
-    def initialize(data:, has_more:, resource_class:, next_cursor: nil, params: {})
+    # @param cursor_param [Symbol] query param the next cursor is sent as
+    #   (e.g. :page for bookmark-paginated endpoints like RFI)
+    # @param opts [Hash] the original request opts (e.g. headers:), forwarded
+    #   to every subsequent page so x-on-behalf-of etc. are kept
+    def initialize(data:, has_more:, resource_class:, next_cursor: nil, params: {}, # rubocop:disable Metrics/ParameterLists
+                   cursor_param: :next_cursor, opts: {})
       @data = data.map { |item| resource_class.new(item) }
       @has_more = has_more
       @next_cursor = next_cursor
       @resource_class = resource_class
       @params = params
+      @cursor_param = cursor_param
+      @opts = opts
     end
 
     def each(&)
@@ -49,7 +56,7 @@ module Airwallex
 
       if @next_cursor
         # Cursor-based pagination
-        next_params[:next_cursor] = @next_cursor
+        next_params[@cursor_param] = @next_cursor
       else
         # Offset-based pagination
         page_size = @params[:page_size] || @params[:limit] || 20
@@ -57,7 +64,7 @@ module Airwallex
         next_params[:offset] = current_offset + page_size
       end
 
-      @resource_class.list(next_params)
+      @opts.empty? ? @resource_class.list(next_params) : @resource_class.list(next_params, @opts)
     end
 
     # Automatically iterate through all pages

data/lib/airwallex/resources/account_amendment.rb

@@ -21,9 +21,48 @@ module Airwallex
     extend APIOperations::Create
     extend APIOperations::Retrieve
 
+    # Sandbox-only — see https://www.airwallex.com/docs/api/simulation/account-amendments
+    SIMULATION_PATH = "/api/v1/simulation/account/amendments"
+
     # @return [String] API resource path for account amendments
     def self.resource_path
       "/api/v1/account/amendments"
     end
+
+    # Simulate approving a PENDING amendment
+    #
+    # @param amendment_id [String]
+    # @return [AccountAmendment]
+    def self.simulate_approve(amendment_id)
+      response = Airwallex.client.post("#{SIMULATION_PATH}/#{amendment_id}/approve", {})
+      new(response)
+    end
+
+    # Simulate rejecting a PENDING amendment
+    #
+    # @param amendment_id [String]
+    # @return [AccountAmendment]
+    def self.simulate_reject(amendment_id)
+      response = Airwallex.client.post("#{SIMULATION_PATH}/#{amendment_id}/reject", {})
+      new(response)
+    end
+
+    # Simulate approving this amendment
+    #
+    # @return [AccountAmendment] self
+    def simulate_approve
+      response = Airwallex.client.post("#{self.class::SIMULATION_PATH}/#{id}/approve", {})
+      refresh_from(response)
+      self
+    end
+
+    # Simulate rejecting this amendment
+    #
+    # @return [AccountAmendment] self
+    def simulate_reject
+      response = Airwallex.client.post("#{self.class::SIMULATION_PATH}/#{id}/reject", {})
+      refresh_from(response)
+      self
+    end
   end
 end

data/lib/airwallex/resources/account_offboarding.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Airwallex
+  # Represents an offboarding request for a Connected Account. Always
+  # accessed through its parent ConnectedAccount, since its API path is
+  # scoped by account_id.
+  #
+  # This gem currently only implements the sandbox Simulation endpoints for
+  # completing/cancelling an offboarding; it does not yet implement the live
+  # create/retrieve/list endpoints (`/api/v1/accounts/{account_id}/offboardings`).
+  # See https://www.airwallex.com/docs/api/simulation/connected-account-offboarding
+  #
+  # @example Simulate an offboarding finishing
+  #   Airwallex::AccountOffboarding.simulate_complete("acct_123", "obd_456")
+  class AccountOffboarding < APIResource
+    # @param account_id [String] the parent ConnectedAccount's id
+    # @return [String] API resource path for this account's simulated
+    #   offboarding actions
+    def self.resource_path(account_id)
+      "/api/v1/simulation/accounts/#{account_id}/offboardings"
+    end
+
+    # Simulate an offboarding completing
+    #
+    # @param account_id [String]
+    # @param offboarding_id [String]
+    # @return [AccountOffboarding]
+    def self.simulate_complete(account_id, offboarding_id)
+      response = Airwallex.client.post("#{resource_path(account_id)}/#{offboarding_id}/complete", {})
+      new(response)
+    end
+
+    # Simulate an offboarding being cancelled
+    #
+    # @param account_id [String]
+    # @param offboarding_id [String]
+    # @return [AccountOffboarding]
+    def self.simulate_cancel(account_id, offboarding_id)
+      response = Airwallex.client.post("#{resource_path(account_id)}/#{offboarding_id}/cancel", {})
+      new(response)
+    end
+  end
+end