didit-sdk 1.0.0

data/lib/didit/resources/sessions.rb

@@ -0,0 +1,2820 @@
+# Code generated by codegen from openapi/*.json. DO NOT EDIT.
+# frozen_string_literal: true
+
+module Didit
+  module Resources
+    # The +sessions+ resource.
+    class Sessions < Didit::Resource
+      # @return [Didit::Resources::Sessions::Imports]
+      def imports
+        @imports ||= Imports.new(@client)
+      end
+
+      # @return [Didit::Resources::Sessions::Reviews]
+      def reviews
+        @reviews ||= Reviews.new(@client)
+      end
+
+      # @return [Didit::Resources::Sessions::Signatures]
+      def signatures
+        @signatures ||= Signatures.new(@client)
+      end
+
+      # @return [Didit::Resources::Sessions::Webhooks]
+      def webhooks
+        @webhooks ||= Webhooks.new(@client)
+      end
+
+      # Add an image to a session
+      #
+      # Attach one extra image or PDF to the ID verification (`model_type=kyc`) or Proof of Address (`model_type=poa`)
+      # result of a finished User Verification (KYC) session, for example evidence collected outside the flow. The
+      # session must be `Approved`, `Declined`, `In Review` or `Kyc Expired` and carry the result named by
+      # `model_type`; Business Verification (KYB) sessions are not supported. Each call appends one file (to the most
+      # recent result when the step ran more than once), keeps the existing files and records a `FILE_ADDED` entry in
+      # the session activity log; the upload sends no webhook and does not change the session status. The file is
+      # compressed on upload and is returned in `extra_files` of the session decision. This endpoint is limited to 10
+      # requests per minute per API key. A scoped API key needs `sessions: write`, and without `media: read` it
+      # receives the `extra_files` links as `null`.
+      #
+      # +PATCH /v3/session/{sessionId}/add-images/+
+      #
+      # @param session_id [String] UUID of the User Verification (KYC) session to add the file to (the `session_id`
+      #   returned by `POST /v3/session/`). A Business Verification (KYB) session ID returns `404`.
+      # @param file [Pathname, IO, String, Didit::FilePart] The image or PDF. Allowed extensions: `jpg`, `jpeg`,
+      #   `png`, `webp`, `tiff`, `pdf`. At most 15 MB as uploaded; the file is then compressed and rejected with `400`
+      #   if it is still larger than 2 MB (2,097,152 bytes). Empty files are rejected.
+      # @param model_type [String] `kyc` adds the file to the ID verification result, `poa` to the Proof of Address
+      #   result.
+      # @param file_password [String] Password of an encrypted PDF. Without it, or with a wrong one, an encrypted PDF
+      #   returns `400`.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsAddImagesResponse]
+      def add_images(session_id, file:, model_type:, file_password: OMIT, request_options: nil)
+        @client.request(
+          :patch,
+          "/v3/session/{sessionId}/add-images/",
+          path_params: { "sessionId" => session_id },
+          body: {
+            "file" => file,
+            "model_type" => model_type,
+            "file_password" => file_password
+          },
+          encoding: :multipart,
+          file_fields: %w[file],
+          response: Types::SessionsAddImagesResponse,
+          request_options: request_options
+        )
+      end
+
+      # Bulk delete KYC sessions by session_number
+      #
+      # Bulk delete User Verification (KYC) sessions by their numeric `session_number`, or every KYC session in your
+      # application with `delete_all: true`.
+      #
+      # `session_number` is the human-friendly incrementing counter shown in the Console session list and returned as
+      # `session_number` by the create-session and decision endpoints; it is **not** the `session_id` UUID. To delete
+      # a session by UUID, or to delete a Business Verification (KYB) session, which this endpoint never touches, use
+      # `DELETE /v3/session/{sessionId}/delete/` instead.
+      #
+      # **Up to 20 sessions are deleted in the request, more run as a job.** The number of matching sessions decides,
+      # whether they are selected by `session_numbers` or with `delete_all`:
+      # - Up to 20 matching sessions: they are deleted before the response, which is `200` with one entry per session
+      #   in `results[]`.
+      # - More than 20: the response is `202` with a deletion job, and the sessions are deleted in the background.
+      #   Poll `GET /v3/sessions/delete/{job_id}/` until `status` is `COMPLETED` or `FAILED`. A job reports counts per
+      #   outcome, never which sessions it deleted. A `delete_all` job deletes only the sessions created before the
+      #   request; sessions started while it runs are not deleted.
+      #
+      # Each deleted session gets exactly the same treatment as the single-session delete endpoint: the session, every
+      # verification attempt it holds, its decision and extracted data, its related feature records (ID verification,
+      # face, liveness, face match, and so on) and all of its stored files are deleted, it disappears from every read
+      # endpoint, and previously issued media URLs stop resolving. Webhook deliveries still queued for a deleted
+      # session, and their retries, are dropped; webhooks already delivered are not affected. Blocklist entries are
+      # **not** removed, credits already consumed are **not** refunded, and the parent User entities are **not**
+      # deleted (use `POST /v3/users/delete/` for those); no webhook is emitted for the deletion. Deletion is
+      # permanent and irreversible.
+      #
+      # **Selection semantics:**
+      # - With `delete_all: true` you can narrow the selection with the filters of `GET /v3/sessions/`, each prefixed
+      #   with `filter_` (for example `filter_status`, `filter_workflow_id`, `filter_date_from`). Filters that take
+      #   several values in List Sessions (`status`, `workflow_id`, `country`, `region`, `document_type`,
+      #   `document_name`, `session_type`, `warning`, `organization_name`) accept a comma-separated string or an
+      #   array; the others take one value. An empty value is ignored. Filters apply only together with `delete_all`,
+      #   and a deletion job applies the same filters.
+      # - An unknown `filter_*` key, or a filter value that cannot be read, rejects the whole request with `400`
+      #   before anything is deleted, so a mistyped filter never widens the deletion to every session.
+      # - Entries in `session_numbers` that do not match a live KYC session in your application (unknown numbers,
+      #   already-deleted sessions, or sessions owned by another application) are **silently skipped**: they do not
+      #   appear in `results` and are not counted in a job's `total`.
+      # - Validation failures (a non-numeric entry, an empty list, neither `session_numbers` nor `delete_all`
+      #   provided, or a template retention the application cannot honour) reject the **whole request** with `400` and
+      #   delete nothing.
+      # - Sessions are deleted in groups. If a group cannot be deleted (for example because a storage service is
+      #   unavailable), every session in that group is reported as `face_retention_outcome: failed_retryable` and
+      #   stays in place; the other groups are unaffected. Repeat the request for those sessions. A job retries such a
+      #   group by itself.
+      # - There is no documented cap on the list length; the shared write rate limit (below) is the practical bound.
+      #
+      # **Face biometric data:** the optional `retain_face_embeddings`, `face_retention_days`,
+      # `face_retention_deadline`, `deletion_instruction`, and `instruction_id` fields have the same meaning as on
+      # `DELETE /v3/session/{sessionId}/delete/` and apply to every matched session. Each result reports its own
+      # `face_retention_outcome`.
+      #
+      # **Response:** `200 OK` with `results[]` for up to 20 matching sessions, or `202 Accepted` with a deletion job
+      # for more. Every result confirms deletion except `face_retention_outcome: failed_retryable`, which reports a
+      # session that was NOT deleted and should be retried. Earlier versions of this endpoint returned `204 No
+      # Content`; update clients that assert on `204`.
+      #
+      # **Idempotency:** repeating the same request deletes nothing more: numbers that no longer match a session are
+      # skipped.
+      #
+      # **`delete_all: true` (destructive):** deletes **every** remaining KYC session in the application;
+      # `session_numbers` is ignored when set. There is no confirmation step and no undo.
+      #
+      # **Authentication:** API key in the `x-api-key` header. Missing or invalid credentials return `403`
+      # (`{"detail": "You do not have permission to perform this action."}`); this API never returns `401`.
+      #
+      # **Rate limit:** shared write budget of 300 requests/min per API key across all POST/PATCH/DELETE endpoints;
+      # exceeding it returns `429`.
+      #
+      # This endpoint accepts API keys only. Business Console user Bearer tokens are rejected with `403` (unlike the
+      # single-session delete, which accepts both).
+      #
+      # **Filed regulatory reports:** if the selected data is in a finalized regulatory report, the whole request is
+      # refused with `409` and nothing is deleted. The body uses `code: in_filed_report` and names each report with
+      # `uuid`, `report_number`, `report_type` and `case_uuid`. Delete the reports, then repeat the request.
+      #
+      # +POST /v3/sessions/delete/+
+      #
+      # @param session_numbers [Array<String>] Numeric `session_number` values of the KYC sessions to delete, as
+      #   digit-only strings (JSON numbers are also accepted and coerced). Required unless `delete_all` is `true`; an
+      #   empty list returns `400`. Any non-digit entry rejects the whole request with `400` (unless `delete_all` is
+      #   `true`, in which case validation is skipped and the entries are ignored). Numbers that do not match a live
+      #   session in...
+      # @param delete_all [Boolean] When `true`, every remaining KYC session in the calling application is deleted and
+      #   `session_numbers` is ignored, unless you narrow the selection with `filter_*` keys. More than 20 matching
+      #   sessions run as a deletion job (`202`) that covers only the sessions created before the request. Defaults to
+      #   `false`. Irreversible; there is no confirmation step.
+      # @param retain_face_embeddings [Boolean, nil] Override the application's `face_retention_policy` for this
+      #   deletion. `true` keeps one image-free face biometric template anchored to the session's User after the session
+      #   is deleted; `false` deletes the face embedding with the session; omit or `null` to follow the application
+      #   policy. Ignored for KYB sessions and for sessions without a face embedding.
+      # @param face_retention_days [Integer] Finite retention duration, in days, for a retained template. Required
+      #   when a template is retained unless the application already sets `face_retention_days`. The template's
+      #   `expires_at` is the earliest of this duration, the application's general data-retention window, and
+      #   `face_retention_deadline`.
+      # @param face_retention_deadline [Time, String] Optional hard expiry for a retained template. Must be in the
+      #   future.
+      # @param deletion_instruction [String] The class of instruction you are giving. `operational_session_delete`
+      #   deletes the session and retains a template only when the policy or `retain_face_embeddings` says so.
+      #   `privacy_erasure` purges every retained biometric template anchored to the session's User before deleting the
+      #   session, cannot be overridden by the application policy, and cannot be combined with `retain_face_embeddings:
+      #   true` (`...
+      # @param instruction_id [String] Your durable reference for this deletion instruction (for example an
+      #   erasure-ticket id). Recorded on the audit trail and on any retained template. Generated by Didit when omitted.
+      # @param filter_status [String, Array<String>] Narrows a `delete_all` to the sessions that match the `status`
+      #   filter of [List Sessions](/sessions-api/list-sessions), with the same values. A comma-separated string or an
+      #   array. Ignored without `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_vendor_data [String] Narrows a `delete_all` to the sessions that match the `vendor_data` filter
+      #   of [List Sessions](/sessions-api/list-sessions), with the same value. One value, not a list: an array is
+      #   joined into one comma-separated text, so several values are not matched as alternatives. Ignored without
+      #   `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_search [String] Narrows a `delete_all` to the sessions that match the `search` filter of [List
+      #   Sessions](/sessions-api/list-sessions), with the same value. One value, not a list: an array is joined into
+      #   one comma-separated text, so several values are not matched as alternatives. Ignored without `delete_all`. An
+      #   empty value is ignored and does not narrow the selection.
+      # @param filter_workflow_id [String, Array<String>] Narrows a `delete_all` to the sessions that match the
+      #   `workflow_id` filter of [List Sessions](/sessions-api/list-sessions), with the same values. A comma-separated
+      #   string or an array. Ignored without `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_date_from [Date, String] Narrows a `delete_all` to the sessions that match the `date_from`
+      #   filter of [List Sessions](/sessions-api/list-sessions), with the same value. One value, not a list: an array
+      #   is joined into one comma-separated value, so several values are refused with `400`. Ignored without
+      #   `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_date_to [Date, String] Narrows a `delete_all` to the sessions that match the `date_to` filter of
+      #   [List Sessions](/sessions-api/list-sessions), with the same value. One value, not a list: an array is joined
+      #   into one comma-separated value, so several values are refused with `400`. Ignored without `delete_all`. An
+      #   empty value is ignored and does not narrow the selection.
+      # @param filter_country [String, Array<String>] Narrows a `delete_all` to the sessions that match the `country`
+      #   filter of [List Sessions](/sessions-api/list-sessions), with the same values. A comma-separated string or an
+      #   array. Ignored without `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_document_type [String, Array<String>] Narrows a `delete_all` to the sessions that match the
+      #   `document_type` filter of [List Sessions](/sessions-api/list-sessions), with the same values. A
+      #   comma-separated string or an array. Ignored without `delete_all`. An empty value is ignored and does not
+      #   narrow the selection.
+      # @param filter_document_name [String, Array<String>] Narrows a `delete_all` to the sessions that match the
+      #   `document_name` filter of [List Sessions](/sessions-api/list-sessions), with the same values. A
+      #   comma-separated string or an array. Ignored without `delete_all`. An empty value is ignored and does not
+      #   narrow the selection.
+      # @param filter_region [String, Array<String>] Narrows a `delete_all` to the sessions that match the `region`
+      #   filter of [List Sessions](/sessions-api/list-sessions), with the same values. A comma-separated string or an
+      #   array. Ignored without `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_didit_internal_id [String] Narrows a `delete_all` to the sessions that match the
+      #   `didit_internal_id` filter of [List Sessions](/sessions-api/list-sessions), with the same value. One value,
+      #   not a list: an array is joined into one comma-separated value, so several values are refused with `400`.
+      #   Ignored without `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_session_type [String, Array<String>] Narrows a `delete_all` to the sessions that match the
+      #   `session_type` filter of [List Sessions](/sessions-api/list-sessions), with the same values. A comma-separated
+      #   string or an array. Ignored without `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_api_service [String] Narrows a `delete_all` to the sessions that match the `api_service` filter
+      #   of [List Sessions](/sessions-api/list-sessions), with the same value. One value, not a list: an array is
+      #   joined into one comma-separated value, so several values are refused with `400`. Ignored without `delete_all`.
+      #   An empty value is ignored and does not narrow the selection.
+      # @param filter_screened_full_name [String] Narrows a `delete_all` to the sessions that match the
+      #   `screened_full_name` filter of [List Sessions](/sessions-api/list-sessions), with the same value. One value,
+      #   not a list: an array is joined into one comma-separated text, so several values are not matched as
+      #   alternatives. Ignored without `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_warning [String, Array<String>] Narrows a `delete_all` to the sessions that match the `warning`
+      #   filter of [List Sessions](/sessions-api/list-sessions), with the same values. A comma-separated string or an
+      #   array. Ignored without `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_status_initialized_as_in_review [Boolean] Narrows a `delete_all` to the sessions that match the
+      #   `status_initialized_as_in_review` filter of [List Sessions](/sessions-api/list-sessions), with the same
+      #   values. Ignored without `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_is_kyc_to_be_reviewed [Boolean] Narrows a `delete_all` to the sessions that match the
+      #   `is_kyc_to_be_reviewed` filter of [List Sessions](/sessions-api/list-sessions), with the same values. Ignored
+      #   without `delete_all`. An empty value is ignored and does not narrow the selection.
+      # @param filter_euuid [String] Narrows a `delete_all` to the sessions that match the `euuid` filter of [List
+      #   Sessions](/sessions-api/list-sessions), with the same value. One value, not a list: an array is joined into
+      #   one comma-separated value, so several values are refused with `400`. Ignored without `delete_all`. An empty
+      #   value is ignored and does not narrow the selection.
+      # @param filter_organization_name [String, Array<String>] Narrows a `delete_all` to the sessions that match the
+      #   `organization_name` filter of [List Sessions](/sessions-api/list-sessions), with the same values. A
+      #   comma-separated string or an array. With an API key it can only match your own organization's name, so it
+      #   selects all of your sessions or none. Ignored without `delete_all`. An empty value is ignored and does not
+      #   narrow the selection.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsBatchDeleteResponse, Didit::Types::SessionDeletionJob]
+      def batch_delete(
+        session_numbers: OMIT,
+        delete_all: OMIT,
+        retain_face_embeddings: OMIT,
+        face_retention_days: OMIT,
+        face_retention_deadline: OMIT,
+        deletion_instruction: OMIT,
+        instruction_id: OMIT,
+        filter_status: OMIT,
+        filter_vendor_data: OMIT,
+        filter_search: OMIT,
+        filter_workflow_id: OMIT,
+        filter_date_from: OMIT,
+        filter_date_to: OMIT,
+        filter_country: OMIT,
+        filter_document_type: OMIT,
+        filter_document_name: OMIT,
+        filter_region: OMIT,
+        filter_didit_internal_id: OMIT,
+        filter_session_type: OMIT,
+        filter_api_service: OMIT,
+        filter_screened_full_name: OMIT,
+        filter_warning: OMIT,
+        filter_status_initialized_as_in_review: OMIT,
+        filter_is_kyc_to_be_reviewed: OMIT,
+        filter_euuid: OMIT,
+        filter_organization_name: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :post,
+          "/v3/sessions/delete/",
+          body: {
+            "session_numbers" => session_numbers,
+            "delete_all" => delete_all,
+            "retain_face_embeddings" => retain_face_embeddings,
+            "face_retention_days" => face_retention_days,
+            "face_retention_deadline" => face_retention_deadline,
+            "deletion_instruction" => deletion_instruction,
+            "instruction_id" => instruction_id,
+            "filter_status" => filter_status,
+            "filter_vendor_data" => filter_vendor_data,
+            "filter_search" => filter_search,
+            "filter_workflow_id" => filter_workflow_id,
+            "filter_date_from" => filter_date_from,
+            "filter_date_to" => filter_date_to,
+            "filter_country" => filter_country,
+            "filter_document_type" => filter_document_type,
+            "filter_document_name" => filter_document_name,
+            "filter_region" => filter_region,
+            "filter_didit_internal_id" => filter_didit_internal_id,
+            "filter_session_type" => filter_session_type,
+            "filter_api_service" => filter_api_service,
+            "filter_screened_full_name" => filter_screened_full_name,
+            "filter_warning" => filter_warning,
+            "filter_status_initialized_as_in_review" => filter_status_initialized_as_in_review,
+            "filter_is_kyc_to_be_reviewed" => filter_is_kyc_to_be_reviewed,
+            "filter_euuid" => filter_euuid,
+            "filter_organization_name" => filter_organization_name
+          },
+          response: { 200 => Types::SessionsBatchDeleteResponse, 202 => Types::SessionDeletionJob },
+          request_options: request_options
+        )
+      end
+
+      # Bulk update AML hit review statuses
+      #
+      # Update the review status of **multiple AML hits** in one call. Provide `hit_updates`, a list of `{ hit_id,
+      # review_status }` pairs. `review_status` is one of `Unreviewed`, `Confirmed Match`, `False Positive`, or
+      # `Inconclusive`.
+      #
+      # The update is all-or-nothing: if any `hit_id` is not found in the AML check, the request returns `404` and no
+      # hit is changed. A successful call fires a single `data.updated` webhook and records one activity entry
+      # covering all changes. For graph workflows with multiple AML checks, pass `node_id` to target a specific check.
+      #
+      # Authenticate with your API key (`x-api-key`) or a user authorization header - either must carry the
+      # `write:sessions` privilege.
+      #
+      # +PATCH /v3/session/{sessionId}/bulk-update-aml-hit-status/+
+      #
+      # @param session_id [String] UUID of the verification session. Accepts both user (KYC) and business (KYB)
+      #   session IDs - the service resolves the ID across both session types.
+      # @param hit_updates [Array<Hash>] Non-empty list of hit updates.
+      # @param node_id [String] Optional graph node ID. Use it (here or as a query parameter) when the session has
+      #   multiple AML checks.
+      # @param node_id_query [String] Workflow graph node ID. Required only when the session has multiple AML checks
+      #   (one per node); omit it for single-AML sessions.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsBulkUpdateAmlHitStatusResponse]
+      def bulk_update_aml_hit_status(session_id, hit_updates:, node_id: OMIT, node_id_query: OMIT, request_options: nil)
+        @client.request(
+          :patch,
+          "/v3/session/{sessionId}/bulk-update-aml-hit-status/",
+          path_params: { "sessionId" => session_id },
+          query: {
+            "node_id" => node_id_query
+          },
+          body: {
+            "hit_updates" => hit_updates,
+            "node_id" => node_id
+          },
+          response: Types::SessionsBulkUpdateAmlHitStatusResponse,
+          request_options: request_options
+        )
+      end
+
+      # Cancel a check override that waits for the flow to finish
+      #
+      # Cancel an override of a feature (step) status that is still `pending_until_flow_finishes`, so it never
+      # applies. The check keeps its status, the cancellation is recorded in the session's activity as
+      # `FEATURE_OVERRIDE_CANCELLED`, and no webhook is sent. The response is the override with `state: cancelled` and
+      # `cancel_reason: cancelled_by_reviewer`.
+      #
+      # An override that already applied or was cancelled returns `409` with the code `feature_override_not_pending`.
+      # Find override IDs with `GET /v3/session/{sessionId}/features/overrides/` or in the `override` returned by the
+      # feature status update.
+      #
+      # Requires the `write:sessions` privilege; a scoped API key needs write access to decisions.
+      #
+      # +POST /v3/session/{sessionId}/features/overrides/{overrideId}/cancel/+
+      #
+      # @param session_id [String] UUID of the verification session. Accepts both user (KYC) and business (KYB)
+      #   session IDs.
+      # @param override_id [String] The `id` of the override to cancel.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::FeatureStatusOverride]
+      def cancel_feature_override(session_id, override_id, request_options: nil)
+        @client.request(
+          :post,
+          "/v3/session/{sessionId}/features/overrides/{overrideId}/cancel/",
+          path_params: { "sessionId" => session_id, "overrideId" => override_id },
+          response: Types::FeatureStatusOverride,
+          request_options: request_options
+        )
+      end
+
+      # Create a verification session
+      #
+      # Create a User Verification (KYC) or Business Verification (KYB) session and receive a hosted verification
+      # `url` plus a `session_token` to redirect or embed for your end user. The `workflow_id` selects which
+      # verification steps run and whether the session is KYC or KYB.
+      #
+      # Call this from your backend (never the browser - the API key is a secret) whenever a user or business needs to
+      # be verified: at signup, before a sensitive action, or when re-verification is required. Prerequisites: a
+      # published workflow (created in the Console [Workflows](https://docs.didit.me/console/workflows) page) and an
+      # application API key with available credits. Sandbox applications bypass the credit check.
+      #
+      # **Idempotency:** when `vendor_data` is provided and an unfinished session (`Not Started`, `In Progress`,
+      # `Resubmitted`, or `Awaiting User`) with the same `vendor_data` already exists on the workflow's **current
+      # latest published version** (and that session already has a hosted verification URL), the existing session is
+      # returned (still `201`) instead of creating a duplicate - with its `callback` and `metadata` updated to the
+      # newly provided values. An unfinished session created on an older version of the workflow (one that has since
+      # been republished) is **not** reused; a new session pinned to the latest published version is created instead.
+      # Sessions in `Approved`, `Declined`, `In Review`, `Expired`, `Abandoned`, or `Kyc Expired` are never reused.
+      #
+      # **Side effects:** the hosted verification URL is generated and stored; if
+      # `contact_details.send_notification_emails` is `true` and an email is provided, a verification invite email is
+      # sent. The session expires after the workflow's configured session expiration time. For KYB workflows,
+      # `contact_details.phone` and `expected_details` are ignored.
+      #
+      # +POST /v3/session/+
+      #
+      # @param workflow_id [String] Stable identifier of the workflow that defines which verification steps the
+      #   session will run. Workflows are created and managed in the [Workflows](/console/workflows) page of the
+      #   Console. The `workflow_id` also implicitly selects whether the session is KYC or KYB.
+      # @param vendor_data [String] A unique identifier for the user being verified, such as a UUID, email, or
+      #   internal user ID. This field is used for: (1) **User grouping** - sessions with the same vendor_data are
+      #   linked to the same user profile in the Users tab. (2) **Cross-session duplicate detection** - when checking
+      #   for duplicated faces, documents, phone numbers, emails, IP addresses, or device fingerprints, sessions with
+      #   the...
+      # @param callback [String] URL to redirect the user to after verification completes. Didit automatically appends
+      #   `verificationSessionId` and `status` (Approved, Declined, In Review) as query parameters. Custom URL schemes
+      #   (e.g. `myapp://`) are supported for mobile callbacks. If omitted, the workflow's default `callback_url` is
+      #   used. When the application has allowed domains (`allowed_domains` on `PATCH /v3/webhook/`), an `h...
+      # @param callback_method [String] Determines which device should handle the redirect to the provided callback
+      #   URL. Use `initiator` to redirect only the device that started the flow, `completer` for the device that
+      #   finishes it, or `both` to allow either device to trigger the callback. If you ever notice the callback not
+      #   triggering reliably, we recommend setting this value to `both`.
+      # @param metadata [Object] Arbitrary JSON stored with the session and echoed back in the response and webhooks.
+      #   Any JSON value is accepted (object, string, number, array), but a JSON object of key/value pairs is
+      #   recommended. Not shown to the end user. Use it to pass your own correlation ids, A/B variants, or business
+      #   context.
+      # @param tags [Array<String>] Tags added to the session when it is created, by name. Up to 10, each up to 50
+      #   characters. Names are case-insensitive and stored in upper case. A name that does not exist yet in the
+      #   application is created as a new tag. The tags show on the session in the console, where you can filter by
+      #   them.
+      # @param language [String] Language code (ISO 639-1) for the verification process interface. Controls the
+      #   language displayed to the end user during verification. If not provided, the browser's language will be
+      #   automatically detected and used. Check all the supported languages [here](/integration/supported-languages).
+      # @param contact_details [Hash] User contact information that can be used for notifications, prefilling
+      #   verification forms, and phone verification. This includes email address, preferred language for
+      #   communications, and phone number.
+      # @param expected_details [Hash] Expected user details used to cross-validate against the data extracted from
+      #   the user's ID document, Proof of Address, and other verification steps. Mismatches are surfaced as warnings on
+      #   the decision; some fields (e.g. `id_country`, `expected_document_types`) also alter the user-facing flow. For
+      #   Business Verification (KYB) workflows only the business fields (`company_name`, `registry_country`, `...
+      # @param portrait_image [String] Base64-encoded portrait image of the end user's face (max 2MB; JPEG, PNG, WebP,
+      #   or TIFF). Used as the reference image to match against the liveness capture when the workflow is a `Biometric
+      #   Authentication` workflow with Face Match enabled, or any graph workflow where Face Match runs before ID
+      #   Verification (OCR). Optional when the `vendor_data` user already has a stored face image: Didit reuses it...
+      # @param sandbox_scenario [String] Sandbox-only scenario slug. Only accepted when the API key belongs to a
+      #   sandbox-mode application; rejected on live applications. When set, the create flow expands the scenario's
+      #   bundled magic values onto the session's input fields (contact_details, expected_details) so the mocked
+      #   providers reproduce the scenario's outcome through the real workflow pipeline. See the scenario catalog at GET
+      #   /v1/san...
+      # @param sign [Hash] Electronic Signature input for this session. `documents` are the documents to sign, for a
+      #   workflow whose Electronic Signature step takes documents from the session (`signature_documents_source`
+      #   `session` or `both`): up to 20 documents and 50 MB in total. `field_values` fills the fields whose `prefill`
+      #   is `api.<key>`, on workflow and session documents alike. Creating a session again for the same `...
+      # @param user_state [String] Where the person lives, when you know it: an ISO 3166-2 subdivision code (`US-IL`,
+      #   `ES-M`) or a US state code or name (`IL`, `Illinois`). A state whose law requires explicit biometric consent
+      #   (Illinois, Texas, Colorado) makes the verification flow ask for it before capturing a face, with trigger
+      #   `declared_state`. An unrecognized value returns `400`. See [Biometric consent](/getting-started/biomet...
+      # @param biometric_consent [Hash] Explicit biometric consent you already collected from the person. It satisfies
+      #   the requirement, so the verification flow does not ask again, and the decision records it as `status: "given"`
+      #   with trigger `customer_collected`. An answer the person already gave in the flow is never replaced. See
+      #   [Biometric consent](/getting-started/biometric-consent).
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsCreateResponse]
+      def create(
+        workflow_id:,
+        vendor_data: OMIT,
+        callback: OMIT,
+        callback_method: OMIT,
+        metadata: OMIT,
+        tags: OMIT,
+        language: OMIT,
+        contact_details: OMIT,
+        expected_details: OMIT,
+        portrait_image: OMIT,
+        sandbox_scenario: OMIT,
+        sign: OMIT,
+        user_state: OMIT,
+        biometric_consent: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :post,
+          "/v3/session/",
+          body: {
+            "workflow_id" => workflow_id,
+            "vendor_data" => vendor_data,
+            "callback" => callback,
+            "callback_method" => callback_method,
+            "metadata" => metadata,
+            "tags" => tags,
+            "language" => language,
+            "contact_details" => contact_details,
+            "expected_details" => expected_details,
+            "portrait_image" => portrait_image,
+            "sandbox_scenario" => sandbox_scenario,
+            "sign" => sign,
+            "user_state" => user_state,
+            "biometric_consent" => biometric_consent
+          },
+          response: Types::SessionsCreateResponse,
+          request_options: request_options
+        )
+      end
+
+      # Delete a verification session (KYC or KYB)
+      #
+      # Delete a single verification session, User Verification (KYC) or Business Verification (KYB), by its
+      # `session_id`. The id is resolved against KYC sessions first, then KYB sessions, so both kinds are deleted
+      # through this one URL.
+      #
+      # **What is deleted:**
+      # - The session and every verification attempt it holds, including results that a resubmission replaced: the
+      #   decision, extracted data, all related feature records (ID verification, face, liveness, face match, AML,
+      #   registry checks, IP analysis, and so on), its reviews and its activity log.
+      # - All stored files owned by the session: document front/back photos (full, cropped, and privacy-blurred
+      #   variants), document-capture videos, portrait crops, NFC chip portrait and signature images, face reference
+      #   images, liveness videos, face-match source/target images, Proof of Address documents, and any extra uploaded
+      #   files (KYC); uploaded company documents and extra files (KYB). Electronic Signature documents, signed PDFs,
+      #   evidence PDFs and signature images (KYC and KYB): their download paths stop working. Previously issued media
+      #   URLs (`https://<media-host>/...`) stop resolving.
+      # - The session's face data. Its face embedding is deleted too, unless you choose to keep an image-free template
+      #   (see **Face biometric data**).
+      # - Webhook deliveries still queued for the session, and their retries. Webhooks already delivered are not
+      #   affected.
+      # - For a Business Verification (KYB) session: the verifications it created for its key people (KYC) and its
+      #   corporate owners (KYB), recursively, reported as `deleted_child_verifications`. A verification it only links
+      #   to, such as an existing approved KYC it reused, is not deleted.
+      #
+      # The session disappears from every read endpoint immediately: `GET /v3/session/{sessionId}/decision/` returns
+      # `404` and `GET /v3/sessions/` stops listing it. Ongoing AML monitoring and KYB registry monitoring started by
+      # the deleted verifications stop.
+      #
+      # **What is not affected:** blocklist entries created from this session (face or document) are **not** removed;
+      # manage those with the blocklist endpoints. Share tokens issued for the session are not revoked, but there is
+      # nothing left for them to import: an import with one returns `400` with `{"share_token": ["Original session
+      # does not exist."]}`. Credits already consumed are **not** refunded. The parent User or Business entity is
+      # **not** deleted; use `POST /v3/users/delete/` or `POST /v3/businesses/delete/` for those. If the User's
+      # profile portrait came from this session, the portrait is removed with it.
+      #
+      # **Face biometric data:** by default the session's face embedding is deleted with the session
+      # (`face_retention_outcome: deleted`). An application that opted in to biometric-template retention
+      # (`face_retention_policy: retain_until_user_deleted` on `PATCH /v3/webhook/`), or a request with
+      # `retain_face_embeddings: true`, keeps one separately managed, image-free face biometric template anchored to
+      # the session's User (`retained_with_user`) so that duplicate detection, Face Search, and biometric
+      # authentication keep working. The template never contains the face image, media, identity fields, the decision,
+      # or the deleted session's id; it is biometric data deleted at `biometric_template_expires_at`, or earlier on
+      # User deletion, privacy erasure, or an explicit purge through `/v3/biometric-templates/`. A session without a
+      # linked User cannot retain a template (`ineligible_no_vendor_user`). Send `deletion_instruction:
+      # privacy_erasure` for data-subject requests: it purges every retained template for that User and never retains
+      # a new one.
+      #
+      # **Irreversible:** deletion is permanent and there is no restore endpoint. Export anything you need (for
+      # example a decision PDF) before you call it.
+      #
+      # **Side effects:** no webhook is emitted for deletions.
+      #
+      # **Response:** `200 OK` once the deletion has completed, with a JSON body reporting the
+      # `face_retention_outcome`, the retained template's expiry and, for a KYB session,
+      # `deleted_child_verifications`. Earlier versions of this endpoint returned `204 No Content`; update clients
+      # that assert on `204`. Keep your `instruction_id` in your own erasure log.
+      #
+      # **Idempotency:** not idempotent at the HTTP level: the first call returns `200`; repeating it returns `404`
+      # because the session no longer resolves. After a `503` the session is still in place; repeat the same request
+      # to finish deleting it.
+      #
+      # **Authentication:** send your application's API key in the `x-api-key` header; the session must belong to that
+      # application. Console user access tokens (`Authorization: Bearer ...`) may also call this endpoint when they
+      # carry the `delete:sessions` permission. Authentication and permission failures both return `403`; this API
+      # never returns `401`.
+      #
+      # **Rate limit:** shared write budget of 300 requests/min per API key across all POST/PATCH/DELETE endpoints;
+      # exceeding it returns `429`.
+      #
+      # To bulk-delete KYC sessions by their numeric `session_number`, use `POST /v3/sessions/delete/` instead.
+      #
+      # **Filed regulatory reports:** if the selected data is in a finalized regulatory report, the whole request is
+      # refused with `409` and nothing is deleted. The body uses `code: in_filed_report` and names each report with
+      # `uuid`, `report_number`, `report_type` and `case_uuid`. Delete the reports, then repeat the request.
+      #
+      # +DELETE /v3/session/{sessionId}/delete/+
+      #
+      # @param session_id [String] UUID (`session_id`) of the User Verification (KYC) or Business Verification (KYB)
+      #   session to delete, as returned when the session was created. Must be a canonical hyphenated UUID - a non-UUID
+      #   value does not match the route and returns `404`.
+      # @param retain_face_embeddings [Boolean, nil] Override the application's `face_retention_policy` for this
+      #   deletion. `true` keeps one image-free face biometric template anchored to the session's User after the session
+      #   is deleted; `false` deletes the face embedding with the session; omit or `null` to follow the application
+      #   policy. Ignored for KYB sessions and for sessions without a face embedding.
+      # @param face_retention_days [Integer] Finite retention duration, in days, for a retained template. Required
+      #   when a template is retained unless the application already sets `face_retention_days`. The template's
+      #   `expires_at` is the earliest of this duration, the application's general data-retention window, and
+      #   `face_retention_deadline`.
+      # @param face_retention_deadline [Time, String] Optional hard expiry for a retained template. Must be in the
+      #   future.
+      # @param deletion_instruction [String] The class of instruction you are giving. `operational_session_delete`
+      #   deletes the session and retains a template only when the policy or `retain_face_embeddings` says so.
+      #   `privacy_erasure` purges every retained biometric template anchored to the session's User before deleting the
+      #   session, cannot be overridden by the application policy, and cannot be combined with `retain_face_embeddings:
+      #   true` (`...
+      # @param instruction_id [String] Your durable reference for this deletion instruction (for example an
+      #   erasure-ticket id). Recorded on the audit trail and on any retained template. Generated by Didit when omitted.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsDeleteResponse]
+      def delete(
+        session_id,
+        retain_face_embeddings: OMIT,
+        face_retention_days: OMIT,
+        face_retention_deadline: OMIT,
+        deletion_instruction: OMIT,
+        instruction_id: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :delete,
+          "/v3/session/{sessionId}/delete/",
+          path_params: { "sessionId" => session_id },
+          body: {
+            "retain_face_embeddings" => retain_face_embeddings,
+            "face_retention_days" => face_retention_days,
+            "face_retention_deadline" => face_retention_deadline,
+            "deletion_instruction" => deletion_instruction,
+            "instruction_id" => instruction_id
+          },
+          response: Types::SessionsDeleteResponse,
+          request_options: request_options
+        )
+      end
+
+      # Export AML screening history as CSV
+      #
+      # Download the same ongoing-monitoring history as `GET /v3/session/{sessionId}/aml-screening-history/` as a CSV
+      # file, one line per completed re-screen, newest first, ready to hand to an auditor. The file is streamed whole
+      # (no pagination) and starts with a header line; an empty cell means unknown, dataset dates are never estimated,
+      # and a value that would start a spreadsheet formula is prefixed with an apostrophe. Works for KYC and KYB
+      # session IDs; pass `node_id` when the session ran more than one AML step. Errors are returned as JSON, not CSV.
+      # A scoped API key needs `decisions: read` and `media: read`: the response is a file, so a key without `media:
+      # read` gets `403`.
+      #
+      # +GET /v3/session/{sessionId}/aml-screening-history/export/+
+      #
+      # @param session_id [String] UUID of the verification session (the `session_id` returned by `POST
+      #   /v3/session/`). Accepts both User Verification (KYC) and Business Verification (KYB) session IDs: the server
+      #   resolves the ID across both session types. Must be a well-formed UUID; a malformed value does not match the
+      #   route and returns an HTML `404`.
+      # @param node_id [String] Workflow graph node ID of the AML check. Needed only when the session ran more than
+      #   one AML step; without it the most recent AML check is used. An unknown node returns `404`.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [String, nil] the body bytes, or nil when a block receives the chunks
+      def export_aml_screening_history(session_id, node_id: OMIT, request_options: nil, &block)
+        @client.request(
+          :get,
+          "/v3/session/{sessionId}/aml-screening-history/export/",
+          path_params: { "sessionId" => session_id },
+          query: {
+            "node_id" => node_id
+          },
+          response: :binary,
+          accept: "text/csv, application/json",
+          request_options: request_options, &block
+        )
+      end
+
+      # Download a PDF report for a verification session
+      #
+      # Render and download a compliance-ready PDF report for a finished verification session. The same path serves
+      # both User Verification (KYC) and Business Verification (KYB) sessions - the server resolves the `sessionId`
+      # against both session types and picks the matching report template.
+      #
+      # **Eligible statuses.** The session must already carry a final or reviewable status:
+      #
+      # - KYC sessions: `Approved`, `Declined`, `In Review`, or `Kyc Expired`.
+      # - KYB sessions: `Approved`, `Declined`, or `In Review`.
+      #
+      # Any other status (`Not Started`, `In Progress`, `Expired`, `Abandoned`, …) returns `403` with an explanatory
+      # `detail` string - see the `403` response below.
+      #
+      # **What the report contains.** The PDF mirrors the console session view at the moment of the request:
+      #
+      # - **KYC** - rolled-up session status, the warnings list, and one section per executed feature: ID Verification
+      #   (document images plus extracted fields), NFC, Liveness, Face Match, Email Verification, Phone Verification,
+      #   Proof of Address, Questionnaire answers, Database Validation, AML Screening, and IP Analysis - followed by
+      #   session tags, console review activity (comments and status changes), and the session event timeline.
+      # - **KYB** - registry checks (company data), AML screenings, business document verifications, key-people
+      #   checks, questionnaire responses, phone/email verifications, IP analyses, and the session event timeline,
+      #   followed by tags and review activity.
+      #
+      # **Branding.** If your application has white-label customization, the report is rendered with your logo and
+      # links to your privacy-policy URL; otherwise it carries Didit branding. Reports are rendered in English - there
+      # is no language parameter.
+      #
+      # **No caching.** Every call re-renders the PDF from the current session data, so a report generated after a
+      # manual review reflects the reviewer’s decision. Two calls for the same session can produce byte-different
+      # files - archive the downloaded file if you need an immutable copy.
+      #
+      # **Latency.** Rendering downloads every stored image (document sides, selfies, extra files) before composing
+      # the PDF, so media-heavy sessions can take several seconds. Use a generous client read timeout (60 s
+      # recommended) and stream the body to disk.
+      #
+      # **Trailing slash.** The canonical route ends with a trailing slash (`…/generate-pdf/`). A request without it
+      # is served directly with the same response - there is no `301` redirect, so no client has to follow redirects
+      # and `curl` does not need `-L`. Use the slashed URL as in the samples.
+      #
+      # If you need the underlying data as JSON instead of a rendered report, use `GET
+      # /v3/session/{sessionId}/decision/`. For every reportable session of one user in a single document, use `GET
+      # /v3/users/{vendor_data}/generate-pdf/`.
+      #
+      # +GET /v3/session/{sessionId}/generate-pdf/+
+      #
+      # @param session_id [String] UUID of the User Verification (KYC) or Business Verification (KYB) session to
+      #   render - the `session_id` returned by `POST /v3/session/`. The same path works for both session kinds; use the
+      #   `Content-Disposition` filename on the response to tell which report type you received. **Must be a
+      #   well-formed, lowercase UUID.** The route only matches valid UUIDs, so a malformed value is rejected by the
+      #   URL...
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [String, nil] the body bytes, or nil when a block receives the chunks
+      def generate_pdf(session_id, request_options: nil, &block)
+        @client.request(
+          :get,
+          "/v3/session/{sessionId}/generate-pdf/",
+          path_params: { "sessionId" => session_id },
+          response: :binary,
+          accept: "application/pdf, application/json",
+          request_options: request_options, &block
+        )
+      end
+
+      # Redeem a share token to clone a verification session into your application
+      #
+      # Redeem a share token to clone a KYC or KYB session into the calling application with a fresh `session_id`. Not
+      # idempotent - a token redeems once per receiver.
+      #
+      # +POST /v3/session/import-shared/+
+      #
+      # @param share_token [String] JWT share token issued by [`POST
+      #   /v3/session/{sessionId}/share/`](/sessions-api/share-session).
+      # @param trust_review [Boolean] If `true`, the cloned session keeps the source's final `status`. If `false`, it
+      #   is forced into `In Review`.
+      # @param workflow_id [String] UUID of a workflow in the calling application. Cross-application IDs are rejected
+      #   with `404`.
+      # @param vendor_data [String, nil] Optional override for the cloned session's `vendor_data`.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionDecision]
+      def import_shared(share_token:, trust_review:, workflow_id:, vendor_data: OMIT, request_options: nil)
+        @client.request(
+          :post,
+          "/v3/session/import-shared/",
+          body: {
+            "share_token" => share_token,
+            "trust_review" => trust_review,
+            "workflow_id" => workflow_id,
+            "vendor_data" => vendor_data
+          },
+          response: Types::SessionDecision,
+          request_options: request_options
+        )
+      end
+
+      # List verification sessions (KYC and/or KYB) with filters and pagination
+      #
+      # Returns a paginated list of verification sessions for the application identified by your API key, newest first
+      # (descending `session_number`).
+      #
+      # **Canonical URL:** the route is `/v3/sessions/` (trailing slash). Requests to `/v3/sessions` without the slash
+      # receive a `301` redirect to the slashed URL with the query string preserved; most HTTP clients follow it
+      # transparently on GET.
+      #
+      # **When to use this endpoint vs webhooks.** Use this endpoint for dashboards, back-office search,
+      # reconciliation, and batch exports. Do not poll it to track the progress of individual verifications -
+      # configure [webhooks](/integration/webhooks) instead, which push `status.updated` events the moment a session
+      # changes. For one session's full result, call `GET /v3/session/{sessionId}/decision/`.
+      #
+      # **KYC and KYB sessions.** `session_kind` selects which kinds are listed:
+      # - `user` (default) - User Verification (KYC) sessions only. Backward-compatible behavior.
+      # - `business` - Business Verification (KYB) sessions only. Rows have a different, smaller shape (see the
+      #   response schema).
+      # - `all` - both kinds in one response: the KYC page and the KYB page for the same `limit`/`offset` are
+      #   concatenated in `results` (KYC rows first), so a page can contain up to `2 x limit` rows. `count` is the sum
+      #   of both kinds and `next`/`previous` reflect the KYC-side pagination. For strict pagination of mixed data,
+      #   call `user` and `business` separately.
+      #
+      # Every row carries a `session_kind` discriminator (`"user"` or `"business"`).
+      #
+      # **Pagination.** Standard limit/offset: `limit` (default 50) and `offset` (default 0), with `next`/`previous`
+      # ready-made page URLs. For KYC rows `count` is exact. For KYB rows `count` is computed with a bounded scan and
+      # is capped at 100 - when there are more than 100 matches it stays at 100, so iterate using `next` (or by
+      # checking whether a full page came back) rather than computing total pages from `count`.
+      #
+      # **Filter semantics.** All filters combine with AND and apply to KYC rows. When `session_kind` is `business` or
+      # `all`, the KYB side honors the shared parameters `vendor_data`, `status`, `workflow_id`, `country`
+      # (registry-company country code), `date_from`, `date_to`, `search` (company name, registration number - type
+      # registration numbers without separators, e.g. `DPC001` not `DPC-001` - vendor_data, session number, or session
+      # UUID), `warning`, and `organization_name`; the remaining KYC-only filters are ignored for KYB rows.
+      # Comma-separated parameters (`status`, `country`, `document_type`, `region`, `workflow_id`, `document_name`,
+      # `warning`, `organization_name`, `session_type`) match any of the listed values (OR within the parameter).
+      # `vendor_data` is an exact match - use `search` for partial matching. Unknown values in list filters simply
+      # return no rows (no error); malformed typed values (`date_from`, `date_to`, `didit_internal_id`, `api_service`,
+      # `session_kind`) return `400` with a per-field error object.
+      #
+      # **Search.** `search` adapts to the input: a full UUID looks up `session_id`; digits (with optional `+ - .
+      # space`) match session-number prefix, document/personal numbers, phone-number prefix, or `vendor_data`; values
+      # containing `@` match email prefixes; any other text matches names (accent-insensitive) and `vendor_data`.
+      #
+      # No fixed per-endpoint rate limit is enforced, but keep list polling infrequent and rely on webhooks for
+      # real-time updates.
+      #
+      # +GET /v3/sessions/+
+      #
+      # @param session_kind [String] Which kind of sessions to list: `user` (KYC only, default), `business` (KYB
+      #   only), or `all` (both, concatenated - see the description for merged-pagination semantics). Matching is
+      #   case-insensitive (`BUSINESS` works); any value other than a case variant of `user`/`business`/`all` returns
+      #   `400`.
+      # @param limit [Integer] Maximum number of rows per page (per kind when `session_kind=all`). Defaults to 50.
+      # @param offset [Integer] Number of rows to skip before the first returned row. Defaults to 0. Prefer following
+      #   the `next`/`previous` URLs from the response.
+      # @param status [String] Comma-separated list of session statuses to include, e.g. `Approved,In Review`. Values
+      #   are case-sensitive; see [Verification Statuses](/integration/verification-statuses). Unknown values match
+      #   nothing.
+      # @param vendor_data [String] Exact-match filter on the `vendor_data` you sent at session creation (your own
+      #   user/business identifier). For partial matches use `search` instead.
+      # @param search [String] A complete displayed reference such as `S-0001` (user) or `B-0001` (business) matches
+      #   only that session number and kind; leading zeros and letter case do not affect matching. Smart free-text
+      #   search. A full UUID matches `session_id`; numeric input matches session-number prefix, document/personal
+      #   numbers, phone prefix, or `vendor_data`; input containing `@` matches email prefixes; other text matche...
+      # @param workflow_id [String] Comma-separated workflow UUIDs (find them on the Workflows page in the Console).
+      #   Malformed UUIDs in the list are ignored; if none are valid the result is empty.
+      # @param date_from [Date, String] Only sessions created on or after this date (UTC), format `YYYY-MM-DD`.
+      #   Malformed dates return `400`.
+      # @param date_to [Date, String] Only sessions created up to this date (UTC), format `YYYY-MM-DD`. For KYC rows
+      #   the entire day is included; for KYB rows the comparison is `created_at <= date_to` (midnight), so use the next
+      #   day's date to include a full day of KYB sessions.
+      # @param country [String] Comma-separated country filter. For KYC rows: ISO 3166-1 alpha-3 codes of the ID
+      #   document's issuing state (e.g. `ESP,USA`), which may differ from nationality. For KYB rows: the registry
+      #   company's country code.
+      # @param document_type [String] Comma-separated ID-document type codes verified in the session (KYC rows only):
+      #   `P` (Passport), `ID` (Identity Card), `DL` (Driver's License), `RP` (Residence Permit), `SSC` (Social Security
+      #   Card), `HIC` (Health Insurance Card), `WP` (Work Permit), `TC` (Tax Card), `VISA`, `PSC` (Public Service
+      #   Card), `BC` (Birth Certificate), `OTHER`. Note the response field `document_type` contains the display...
+      # @param document_name [String] Exact document names; multiple names can be passed comma-separated, but the
+      #   value is only split on commas when it contains more than one ` - ` separator (a lone name with an embedded
+      #   comma is matched whole). Names are as recognized by document verification (front or back side), e.g. `Spain -
+      #   Id Card (2021)`. KYC rows only.
+      # @param region [String] Comma-separated document region/state values (for documents issued per region, such as
+      #   US driver's licenses). KYC rows only.
+      # @param didit_internal_id [String] Filter by Didit's internal user identifier (the `didit_internal_id` response
+      #   field) to list all sessions of one verified user. Must be a valid UUID; malformed values return `400`. KYC
+      #   rows only.
+      # @param session_type [String] Comma-separated session creation channels: `API`, `HOSTED`, `MIGRATED`. The
+      #   special value `ALL` (or omitting the parameter) disables the filter. KYC rows only.
+      # @param api_service [String] Filter standalone API sessions by service. Invalid values return `400`. KYC rows
+      #   only.
+      # @param screened_full_name [String] Accent-insensitive name search inside AML and database-validation screened
+      #   data. When combined with `api_service=AML` or `api_service=DATABASE_VALIDATION`, the search is restricted to
+      #   that feature's screened data. KYC rows only.
+      # @param warning [String] Comma-separated warning risk codes; returns sessions that raised any of them (e.g.
+      #   `POSSIBLE_FRAUD`). Risk codes are listed per feature in the [warnings documentation](/integration/webhooks).
+      #   Applies to KYC rows and, with business warning codes, to KYB rows.
+      # @param status_initialized_as_in_review [Boolean] When `true`, only sessions whose decision initially landed in
+      #   `In Review` (useful to audit manual-review volume). KYC rows only.
+      # @param is_kyc_to_be_reviewed [Boolean] `true` returns sessions whose document verification is flagged for
+      #   manual review; `false` returns sessions with document verification explicitly not flagged. Omit to disable.
+      #   KYC rows only.
+      # @param euuid [String] Filter by the end user's euuid (UUID assigned to the verifying user, used by Console
+      #   deep links). Must be a valid UUID; malformed values return a 400 field error. KYC rows only.
+      # @param organization_name [String] Comma-separated organization names. Console-oriented; with an API key
+      #   (already scoped to one application) it only matches your own organization's name.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Page<Didit::Types::SessionsListResponseResults>]
+      def list(
+        session_kind: OMIT,
+        limit: OMIT,
+        offset: OMIT,
+        status: OMIT,
+        vendor_data: OMIT,
+        search: OMIT,
+        workflow_id: OMIT,
+        date_from: OMIT,
+        date_to: OMIT,
+        country: OMIT,
+        document_type: OMIT,
+        document_name: OMIT,
+        region: OMIT,
+        didit_internal_id: OMIT,
+        session_type: OMIT,
+        api_service: OMIT,
+        screened_full_name: OMIT,
+        warning: OMIT,
+        status_initialized_as_in_review: OMIT,
+        is_kyc_to_be_reviewed: OMIT,
+        euuid: OMIT,
+        organization_name: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :get,
+          "/v3/sessions/",
+          query: {
+            "session_kind" => session_kind,
+            "limit" => limit,
+            "offset" => offset,
+            "status" => status,
+            "vendor_data" => vendor_data,
+            "search" => search,
+            "workflow_id" => workflow_id,
+            "date_from" => date_from,
+            "date_to" => date_to,
+            "country" => country,
+            "document_type" => document_type,
+            "document_name" => document_name,
+            "region" => region,
+            "didit_internal_id" => didit_internal_id,
+            "session_type" => session_type,
+            "api_service" => api_service,
+            "screened_full_name" => screened_full_name,
+            "warning" => warning,
+            "status_initialized_as_in_review" => status_initialized_as_in_review,
+            "is_kyc_to_be_reviewed" => is_kyc_to_be_reviewed,
+            "euuid" => euuid,
+            "organization_name" => organization_name
+          },
+          page: Types::SessionsListResponseResults,
+          request_options: request_options
+        )
+      end
+
+      # List AML screening history
+      #
+      # List every completed ongoing-monitoring re-screen of a session's AML check, newest first by `completed_at`,
+      # including the runs where nothing changed: alerts, activity entries and webhooks fire only when a result moves,
+      # so this history is the evidence that a clean subject was still being screened. Works for KYC and KYB session
+      # IDs; pass `node_id` when the session ran more than one AML step. Only ongoing-monitoring re-screens are listed
+      # (the first screening is part of the session decision) and runs from before this history existed are not
+      # reconstructed, so a session without ongoing monitoring returns an empty list. `count` is exact up to 100 and
+      # capped at 100 above that, so follow `next` until it is `null`. A scoped API key needs `decisions: read`; see
+      # [Continuous AML
+      # monitoring](https://docs.didit.me/core-technology/aml-screening/continuous-monitoring-aml-screening).
+      #
+      # +GET /v3/session/{sessionId}/aml-screening-history/+
+      #
+      # @param session_id [String] UUID of the verification session (the `session_id` returned by `POST
+      #   /v3/session/`). Accepts both User Verification (KYC) and Business Verification (KYB) session IDs: the server
+      #   resolves the ID across both session types. Must be a well-formed UUID; a malformed value does not match the
+      #   route and returns an HTML `404`.
+      # @param node_id [String] Workflow graph node ID of the AML check. Needed only when the session ran more than
+      #   one AML step; without it the most recent AML check is used. An unknown node returns `404`.
+      # @param limit [Integer] Maximum number of screening runs per page. Defaults to 50. A value below 1 or a
+      #   non-numeric value falls back to 50; a value above 1,000,000 returns `400`.
+      # @param offset [Integer] Number of results to skip before the first returned one. Defaults to 0; a negative or
+      #   non-numeric value falls back to 0, a value above 1,000,000 returns `400`. Prefer following the `next` and
+      #   `previous` URLs.
+      # @param ordering [String] Optional sort override. The default order is `-completed_at`. Pass a result field
+      #   name (for example `completed_at`, `started_at`, `outcome` or `score`) to sort ascending, prefix it with `-` to
+      #   sort descending, and separate several fields with commas. Unknown fields are ignored.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Page<Didit::Types::AMLScreeningRun>]
+      def list_aml_screening_history(
+        session_id,
+        node_id: OMIT,
+        limit: OMIT,
+        offset: OMIT,
+        ordering: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :get,
+          "/v3/session/{sessionId}/aml-screening-history/",
+          path_params: { "sessionId" => session_id },
+          query: {
+            "node_id" => node_id,
+            "limit" => limit,
+            "offset" => offset,
+            "ordering" => ordering
+          },
+          page: Types::AMLScreeningRun,
+          request_options: request_options
+        )
+      end
+
+      # List session events
+      #
+      # Read the event timeline of one verification session, newest first by `sent_at`: the screens the user saw,
+      # buttons and uploads, failed attempts, status and feature-step changes, and the workflow routing trace. Works
+      # for User Verification (KYC) and Business Verification (KYB) session IDs. Events are stored asynchronously, so
+      # a new event can take a few seconds to appear. Results are paginated with `limit` and `offset`; follow `next`
+      # until it is `null`. A scoped API key needs `sessions: read` and `decisions: read`, and without `media: read`
+      # it receives `file_url` as `null`. The routing events are described in [Retrieve
+      # session](https://docs.didit.me/sessions-api/retrieve-session).
+      #
+      # +GET /v3/session/{sessionId}/events/+
+      #
+      # @param session_id [String] UUID of the verification session (the `session_id` returned by `POST
+      #   /v3/session/`). Accepts both User Verification (KYC) and Business Verification (KYB) session IDs: the server
+      #   resolves the ID across both session types. Must be a well-formed UUID; a malformed value does not match the
+      #   route and returns an HTML `404`.
+      # @param limit [Integer] Maximum number of events per page. Defaults to 50. A value below 1 or a non-numeric
+      #   value falls back to 50; a value above 1,000,000 returns `400`.
+      # @param offset [Integer] Number of results to skip before the first returned one. Defaults to 0; a negative or
+      #   non-numeric value falls back to 0, a value above 1,000,000 returns `400`. Prefer following the `next` and
+      #   `previous` URLs.
+      # @param ordering [String] Optional sort override. The default order is `-sent_at`. Pass a result field name
+      #   (for example `sent_at`, `created_at`, `event_type`, `feature_step` or `step`) to sort ascending, prefix it
+      #   with `-` to sort descending, and separate several fields with commas. Unknown fields are ignored.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Page<Didit::Types::SessionEvent>]
+      def list_events(session_id, limit: OMIT, offset: OMIT, ordering: OMIT, request_options: nil)
+        @client.request(
+          :get,
+          "/v3/session/{sessionId}/events/",
+          path_params: { "sessionId" => session_id },
+          query: {
+            "limit" => limit,
+            "offset" => offset,
+            "ordering" => ordering
+          },
+          page: Types::SessionEvent,
+          request_options: request_options
+        )
+      end
+
+      # List a session's check overrides
+      #
+      # Every override of an individual feature (step) status on a User Verification (KYC) or Business Verification
+      # (KYB) session, newest first and not paginated: applied ones, ones waiting for the person to finish the flow
+      # (`pending_until_flow_finishes`) and cancelled ones, each with who asked, their reason, and whether it applied
+      # while the person was still in the flow (`forced`).
+      #
+      # `person_in_flow` tells you whether a new override with `defer_until_flow_finishes: true` would wait.
+      # `flow_finished_at` is when the person last finished the flow; it is `null` while they are still in it (a
+      # resubmission included) and when the session closed before they finished.
+      #
+      # Requires the `read:sessions` privilege; a scoped API key needs read access to decisions.
+      #
+      # +GET /v3/session/{sessionId}/features/overrides/+
+      #
+      # @param session_id [String] UUID of the verification session. Accepts both user (KYC) and business (KYB)
+      #   session IDs.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsListFeatureOverridesResponse]
+      def list_feature_overrides(session_id, request_options: nil)
+        @client.request(
+          :get,
+          "/v3/session/{sessionId}/features/overrides/",
+          path_params: { "sessionId" => session_id },
+          response: Types::SessionsListFeatureOverridesResponse,
+          request_options: request_options
+        )
+      end
+
+      # List networks for a session
+      #
+      # List the networks the session's vendor user belongs to. Resolves through the session's vendor_data-linked
+      # user.
+      #
+      # +GET /v3/organization/{organization_id}/application/{application_id}/sessions/{session_id}/networks/+
+      #
+      # @param session_id [String] Session UUID.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::EntityNetworkMembershipList]
+      def list_networks(session_id, request_options: nil)
+        @client.request(
+          :get,
+          "/v3/organization/{organization_id}/application/{application_id}/sessions/{session_id}/networks/",
+          path_params: { "session_id" => session_id },
+          scope: :application,
+          response: Types::EntityNetworkMembershipList,
+          request_options: request_options
+        )
+      end
+
+      # Preview a session's decision email
+      #
+      # Render the email the person receives when you set a session to `Approved` or `Declined` with `send_email:
+      # true`, without changing the session or sending anything. The response shows the subject and HTML exactly as
+      # they are sent, the recipient, the sender, the language, and whether confirming the change sends the email at
+      # all (`will_be_sent`, `not_sent_reason`).
+      #
+      # The recipient is the person's own address: the one they verified in an email verification step of the flow,
+      # else the one given in `contact_details` when the session was created. The sender is your application's
+      # verified sender domain when white label applies (`sender_kind: customer`), else Didit's sender (`sender_kind:
+      # didit`).
+      #
+      # To send exactly what you previewed, call [Update Session Status](/sessions-api/update-status) with the same
+      # `new_status`, `send_email: true`, `email_address` set to `recipient`, `email_language` set to `language` and
+      # `email_preview_token` set to `preview_token`. The receipt expires after 15 minutes. When the recipient,
+      # language, session status, sender or email changed since the preview, the update returns `409` before anything
+      # changes; preview again and confirm with the new receipt.
+      #
+      # Works for User Verification (KYC) and Business Verification (KYB) sessions in `Approved`, `Declined`, `In
+      # Review`, `Kyc Expired`, `Abandoned` or `Resubmitted` status. The status check runs before body validation.
+      # Requires the `write:sessions` privilege; a scoped API key needs write access to decisions. Responses use
+      # `Cache-Control: no-store`: treat them as sensitive verification content.
+      #
+      # +POST /v3/session/{sessionId}/decision-email-preview/+
+      #
+      # @param session_id [String] UUID of the verification session. Accepts both user (KYC) and business (KYB)
+      #   session IDs.
+      # @param new_status [String] The decision whose email you want to preview.
+      # @param email_language [String] Language of the email, the same default as Update Session Status. A language
+      #   that is not offered falls back to English; `language` in the response says which one is used.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsPreviewDecisionEmailResponse]
+      def preview_decision_email(session_id, new_status:, email_language: OMIT, request_options: nil)
+        @client.request(
+          :post,
+          "/v3/session/{sessionId}/decision-email-preview/",
+          path_params: { "sessionId" => session_id },
+          body: {
+            "new_status" => new_status,
+            "email_language" => email_language
+          },
+          response: Types::SessionsPreviewDecisionEmailResponse,
+          request_options: request_options
+        )
+      end
+
+      # Preview a resubmission email
+      #
+      # Render the email that would accompany a KYC or KYB resubmission without changing the session, resetting
+      # checks, extending its expiry, running checks or sending mail. Requires the `write:sessions` privilege (a
+      # scoped API key needs write access to decisions) and a session in `Approved`, `Declined`, `In Review`, `Kyc
+      # Expired` or `Abandoned` status. The server validates the selected workflow steps and renders its fixed
+      # translated template with the applicable verified white-label sender and branding. The request cannot set a
+      # subject, message body or action URL.
+      #
+      # `email_address` is optional. Without it, the email goes to the person's own address: the one they verified in
+      # an email verification step of the flow, else the one given in `contact_details` when the session was created.
+      # An address you pass wins (`recipient_source: request`). When no address is known and you pass none,
+      # `recipient` and `preview_token` are empty strings and no email can be sent.
+      #
+      # The response includes the recipient and where it comes from, the sender, subject, HTML, language, resolved
+      # steps, whether confirming sends the email (`will_be_sent`, `not_sent_reason`) and a signed `preview_token`.
+      # `requires_user_action` is `false` when every selected step runs without the person: the resubmission then
+      # finishes on its own and no email goes out (`not_sent_reason: no_user_action`).
+      #
+      # This preview does not reserve session state or authorize delivery. After reviewing it, call [Update Session
+      # Status](/sessions-api/update-status) with `new_status: Resubmitted`, the same `nodes_to_resubmit` and
+      # `email_language` you previewed, `send_email: true`, `email_address` set to `recipient` and
+      # `email_preview_token` set to `preview_token`. The receipt expires after 15 minutes. When a receipt is
+      # supplied, changed inputs, message content, sender or session state return `409` before any mutation or send.
+      # Existing integrations may omit the receipt. Regenerate the preview after a conflict. Treat the response as
+      # sensitive verification content; responses use `Cache-Control: no-store`. Render HTML in a sandboxed frame,
+      # never directly in your application DOM.
+      #
+      # +POST /v3/session/{sessionId}/resubmission-preview/+
+      #
+      # @param session_id [String] UUID of the verification session to update. Accepts both user (KYC) and business
+      #   (KYB) session IDs - the service resolves the ID across both session types.
+      # @param nodes_to_resubmit [Array<Hash>] Steps to preview, using the same validation, selection and workflow
+      #   ordering as a resubmission. Omit to auto-select recorded attempts needing resubmission.
+      # @param email_address [String] Optional. Send the email to this address instead of the person's own. Without
+      #   it, the recipient is the address the person verified in the flow, else the one given in `contact_details`. No
+      #   email is sent by this call.
+      # @param email_language [String] Language for the notification email. Accepts any string at schema level;
+      #   unsupported codes silently fall back to English (`en`).
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsPreviewResubmissionResponse]
+      def preview_resubmission(
+        session_id,
+        nodes_to_resubmit: OMIT,
+        email_address: OMIT,
+        email_language: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :post,
+          "/v3/session/{sessionId}/resubmission-preview/",
+          path_params: { "sessionId" => session_id },
+          body: {
+            "nodes_to_resubmit" => nodes_to_resubmit,
+            "email_address" => email_address,
+            "email_language" => email_language
+          },
+          response: Types::SessionsPreviewResubmissionResponse,
+          request_options: request_options
+        )
+      end
+
+      # Regenerate a Key People party's KYC session
+      #
+      # Give a Key People party of a Business Verification (KYB) session a new individual KYC session after its
+      # previous one was deleted or expired before the person started it, so the Key People check can finish again;
+      # send no request body. It works when the party's KYC session was deleted (`kyc_session_deleted: true`) or
+      # expired before the person started it (`Expired`, never started). A session still in progress or one that ended
+      # in any other status (`Approved`, `Declined`, `In Review`, `Abandoned`, ...) returns `409` unless it was
+      # deleted. A party that never had one or a company party always returns `409`. Didit creates a new hosted KYC
+      # session with the workflow the party was verified with (its latest published version) or, when that is no
+      # longer known, the workflow your Key People settings assign to the party's role, so its link lasts that KYC
+      # workflow's session expiration time; it emails the link to the party when an email is on file, clears
+      # `is_skipped`, and recomputes the Key People check and the business session status. It then sends a
+      # `data.updated` [webhook](https://docs.didit.me/integration/webhooks) for the business session with trigger
+      # `console_key_people_regenerate`; to exempt the party instead, use `PATCH
+      # /v3/session/{sessionId}/kyb/parties/{partyUuid}/`. A scoped API key needs `decisions: write`, and without
+      # `sessions: write` it receives `kyc_session_url` as `null`. Deleted sessions qualify even if the person had
+      # already started or finished verification. Imported sessions do not qualify through expiry; they must have been
+      # deleted.
+      #
+      # +POST /v3/session/{sessionId}/kyb/parties/{partyUuid}/regenerate/+
+      #
+      # @param session_id [String] UUID of the parent Business Verification (KYB) session.
+      # @param party_uuid [String] UUID of the Key People party (`key_people_checks[].submitted.parties[].uuid` on the
+      #   business session decision). Must belong to the session referenced by `sessionId`.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::KYBKeyPeopleParty]
+      def regenerate_kyb_party(session_id, party_uuid, request_options: nil)
+        @client.request(
+          :post,
+          "/v3/session/{sessionId}/kyb/parties/{partyUuid}/regenerate/",
+          path_params: { "sessionId" => session_id, "partyUuid" => party_uuid },
+          response: Types::KYBKeyPeopleParty,
+          request_options: request_options
+        )
+      end
+
+      # Retrieve the full decision for a verification session
+      #
+      # Retrieve the complete decision report for a verification session - the rolled-up session `status` plus one
+      # report per verification feature the workflow executed. This is the canonical read endpoint for both User
+      # Verification (KYC) and Business Verification (KYB) sessions: the same path serves both, and the top-level
+      # `session_kind` discriminator tells you which shape you received (`"user"` or `"business"`).
+      #
+      # **Every feature report is a plural array.** V3 workflows are graphs that can run the same feature more than
+      # once, so each block (`id_verifications`, `nfc_verifications`, `liveness_checks`, `face_matches`,
+      # `poa_verifications`, `document_ai_documents`, `phone_verifications`, `email_verifications`, `aml_screenings`,
+      # `ip_analyses`, `database_validations`, `questionnaire_responses`) is a JSON array whose items each carry a
+      # `node_id` identifying the workflow graph node that produced them. Read NFC as `response.nfc_verifications[0]`
+      # - never as a singular `nfc` field. A block is `null` until the workflow has run that feature at least once;
+      # features the workflow does not include never appear with data. Electronic Signature results are in
+      # `signatures`, which is present only when the workflow has an Electronic Signature step.
+      #
+      # **When to call.** The recommended pattern is event-driven: wait for the `status.updated` webhook that fires
+      # when the session reaches a decision (`Approved`, `Declined`, `In Review`), then call this endpoint once to
+      # fetch the full report. Polling also works - the endpoint can be called at any point in the session lifecycle
+      # and returns the data produced so far - but webhook-then-fetch is cheaper and faster. Media URLs in the
+      # response (document images, videos, PDFs) are short-lived presigned links: fetch them promptly or re-request
+      # the decision to get fresh ones, and do not persist them as long-term references.
+      #
+      # **Statuses.** The top-level `status` is the session lifecycle status (`Not Started`, `In Progress`, `Awaiting
+      # User`, `In Review`, `Approved`, `Declined`, `Resubmitted`, `Expired`, `Kyc Expired`, `Abandoned`). Each
+      # feature item additionally carries its own feature-level `status` (`Not Finished`, `Approved`, `Declined`, `In
+      # Review`, ...). A session can be `Approved` overall while an individual feature is `In Review`, depending on
+      # the workflow's decision rules.
+      #
+      # **Authentication and visibility.** Authenticate with the application API key in the `x-api-key` header (a
+      # console user Bearer token with the `read:sessions` permission also works). Only sessions owned by the
+      # authenticated application are visible. If your workflow restricts response attributes, non-allowed fields
+      # inside feature items are returned as `null` while `status`, `warnings`, and `node_id` are always preserved.
+      #
+      # **Rate limits.** GET requests are limited to 600 per minute per API key. Exceeding the limit returns `429`
+      # with `Retry-After` and `X-RateLimit-*` headers.
+      #
+      # +GET /v3/session/{sessionId}/decision/+
+      #
+      # @param session_id [String] UUID of the verification session whose decision you want to retrieve. This is the
+      #   `session_id` returned by `POST /v3/session/`. The same path works for both User Verification (KYC) and
+      #   Business Verification (KYB) sessions - the server resolves the id against both session types. **Must be a
+      #   valid UUID.** The route only matches well-formed UUIDs, so a malformed value is rejected by the URL router
+      #   b...
+      # @param include [String] Comma-separated list of extra payload sections. Supported values: `events` and
+      #   `resubmissions`, alone or together (`events,resubmissions`). When `include=events` is passed, the response
+      #   additionally contains the session event timeline (`events`, including the `WORKFLOW_BRANCH_EVALUATED` /
+      #   `WORKFLOW_STATUS_NODE_REACHED` routing events described on the Retrieve Session page), the full activity
+      #   log...
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionDecision]
+      def retrieve_decision(session_id, include: OMIT, request_options: nil)
+        @client.request(
+          :get,
+          "/v3/session/{sessionId}/decision/",
+          path_params: { "sessionId" => session_id },
+          query: {
+            "include" => include
+          },
+          response: Types::SessionDecision,
+          request_options: request_options
+        )
+      end
+
+      # Get a bulk session deletion job
+      #
+      # Progress of a bulk session deletion that `POST /v3/sessions/delete/` answered with `202` (more than 20
+      # matching sessions, selected by `session_numbers` or with `delete_all`). Poll every few seconds while `status`
+      # is `PENDING` or `PROCESSING`; stop when it is `COMPLETED` or `FAILED`.
+      #
+      # The job reports how many sessions ended in each outcome and how many it has processed, never which sessions it
+      # deleted. A `FAILED` job carries the reason in `error`; the sessions it had not reached are still in place, so
+      # repeat the deletion request to delete them.
+      #
+      # **Authentication:** API key in the `x-api-key` header. A job is only visible to the application that created
+      # it; any other `job_id` returns `404`. Missing or invalid credentials return `403`; this API never returns
+      # `401`.
+      #
+      # +GET /v3/sessions/delete/{job_id}/+
+      #
+      # @param job_id [String] The `job_id` returned with the `202` from `POST /v3/sessions/delete/`.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionDeletionJob]
+      def retrieve_deletion_job(job_id, request_options: nil)
+        @client.request(
+          :get,
+          "/v3/sessions/delete/{job_id}/",
+          path_params: { "job_id" => job_id },
+          response: Types::SessionDeletionJob,
+          request_options: request_options
+        )
+      end
+
+      # Mint a share token for a finished verification session
+      #
+      # Mint a short-lived JWT that lets a specific Didit application import this finished session. Pair with `POST
+      # /v3/session/import-shared/`.
+      #
+      # +POST /v3/session/{sessionId}/share/+
+      #
+      # @param session_id [String] UUID of the source verification session to mint a token for.
+      # @param for_application_id [String] UUID of the Didit application that will redeem the token. Must exist, must
+      #   not be deleted, and must differ from the calling application. Find it in the Business Console under **Settings
+      #   → Application**.
+      # @param ttl_in_seconds [Integer] Token lifetime, in seconds. Minimum `60`, maximum `86400` (24 h). Defaults to
+      #   `3600` (1 h).
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsShareResponse]
+      def share(session_id, for_application_id:, ttl_in_seconds: OMIT, request_options: nil)
+        @client.request(
+          :post,
+          "/v3/session/{sessionId}/share/",
+          path_params: { "sessionId" => session_id },
+          body: {
+            "for_application_id" => for_application_id,
+            "ttl_in_seconds" => ttl_in_seconds
+          },
+          response: Types::SessionsShareResponse,
+          request_options: request_options
+        )
+      end
+
+      # Simulate a sandbox session's status
+      #
+      # Force a terminal status on a sandbox session after the fact, from your backend, without running the flow.
+      # Sandbox applications only: a live session returns `404`. Works for User Verification (KYC) and Business
+      # Verification (KYB) sessions.
+      #
+      # Set `new_status`, or let `scenario` or `risk` supply it. `risk` (or the first risk the scenario's magic values
+      # carry) adds that warning to the session. The change is recorded in the session's activity.
+      #
+      # `send_webhooks` (default `true`) sends exactly the webhooks a real status change sends. With `false` the
+      # status still changes and the console still updates live, but no webhook is logged or sent, the missed-webhook
+      # recovery never re-sends that decision, and the next status change sends webhooks as usual. The response echoes
+      # the value applied.
+      #
+      # Requires the `write:sessions` privilege; a scoped API key needs write access to sessions. An unknown
+      # `session_id` returns `404` and another application's session returns `403`, both before the body is read; a
+      # live session returns `404` only after the body is validated. To simulate from the hosted flow with the
+      # session's own token, use `POST /v3/session/{sessionId}/sandbox/simulate/`. See [Sandbox & Test
+      # Data](/integration/sandbox-testing) for the scenario catalog.
+      #
+      # +POST /v3/session/{sessionId}/simulate/+
+      #
+      # @param session_id [String] UUID of the sandbox verification session. Accepts both user (KYC) and business
+      #   (KYB) session IDs.
+      # @param new_status [String] The status to set. When you leave it out, it defaults to the default status of the
+      #   risk case (`risk`, or the first risk the scenario's magic values carry), else to the scenario's default
+      #   status.
+      # @param comment [String] Note added to the activity entry the status change records.
+      # @param scenario [String] A scenario slug from the catalog (`GET /v1/sandbox/scenarios/`). It supplies the
+      #   default status and, without `risk`, the warning its magic values carry. An unknown slug returns `400`.
+      # @param risk [String] A risk case from the catalog. Its warning is added to the session, with a log type that
+      #   follows `new_status`. An unknown value returns `400`.
+      # @param node_id [String] Workflow node the risk warning is attached to. Defaults to the session's current node.
+      # @param send_webhooks [Boolean] `true` sends exactly the webhooks a real status change sends to the sandbox
+      #   application's destinations: `status.updated`, plus the `user.status.updated` / `user.data.updated` (or
+      #   `business.status.updated` / `business.data.updated`) events the change causes, for destinations subscribed to
+      #   them. `false` changes the status without logging or sending any webhook: the missed-webhook recovery never
+      #   re-...
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SandboxSimulateResponse]
+      def simulate(
+        session_id,
+        new_status: OMIT,
+        comment: OMIT,
+        scenario: OMIT,
+        risk: OMIT,
+        node_id: OMIT,
+        send_webhooks: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :post,
+          "/v3/session/{sessionId}/simulate/",
+          path_params: { "sessionId" => session_id },
+          body: {
+            "new_status" => new_status,
+            "comment" => comment,
+            "scenario" => scenario,
+            "risk" => risk,
+            "node_id" => node_id,
+            "send_webhooks" => send_webhooks
+          },
+          response: Types::SandboxSimulateResponse,
+          request_options: request_options
+        )
+      end
+
+      # Update an AML hit review status
+      #
+      # Set the review status of a **single AML hit** (a potential sanction / PEP / watchlist / adverse-media match)
+      # returned by AML screening, without changing the overall session decision. Identify the hit by its `hit_id`
+      # (the `id` of an entry in the AML check's `hits` array - see the session decision).
+      #
+      # `review_status` is one of `Unreviewed`, `Confirmed Match`, `False Positive`, or `Inconclusive`. Reviewer
+      # decisions are preserved across ongoing-monitoring updates, so a hit you mark `False Positive` stays that way
+      # when the provider re-screens.
+      #
+      # A successful call fires a `data.updated` webhook and appends an activity entry (with actor attribution) to the
+      # session's review trail. For graph workflows with multiple AML checks, pass `node_id` to target a specific
+      # check.
+      #
+      # Authenticate with your API key (`x-api-key`) or a user authorization header - either must carry the
+      # `write:sessions` privilege.
+      #
+      # +PATCH /v3/session/{sessionId}/update-aml-hit-status/+
+      #
+      # @param session_id [String] UUID of the verification session. Accepts both user (KYC) and business (KYB)
+      #   session IDs - the service resolves the ID across both session types.
+      # @param hit_id [String] The `id` of the hit in the AML check's `hits` array.
+      # @param review_status [String] The new review status for the hit.
+      # @param node_id [String] Optional graph node ID. Use it (here or as a query parameter) when the session has
+      #   multiple AML checks.
+      # @param node_id_query [String] Workflow graph node ID. Required only when the session has multiple AML checks
+      #   (one per node); omit it for single-AML sessions.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsUpdateAmlHitStatusResponse]
+      def update_aml_hit_status(
+        session_id,
+        hit_id:,
+        review_status:,
+        node_id: OMIT,
+        node_id_query: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :patch,
+          "/v3/session/{sessionId}/update-aml-hit-status/",
+          path_params: { "sessionId" => session_id },
+          query: {
+            "node_id" => node_id_query
+          },
+          body: {
+            "hit_id" => hit_id,
+            "review_status" => review_status,
+            "node_id" => node_id
+          },
+          response: Types::SessionsUpdateAmlHitStatusResponse,
+          request_options: request_options
+        )
+      end
+
+      # Update an AML check status
+      #
+      # Set the status of a session's AML screening check as a whole (the `status` of an `aml_screenings[]` entry in
+      # the session decision), for example `Approved` after your team cleared every hit. Works for KYC and KYB session
+      # IDs; pass `node_id` (query parameter or body field) when the session ran more than one AML step, otherwise the
+      # most recent AML check is updated. When the status actually changes, an `AML_STATUS_UPDATED` activity entry is
+      # recorded and a `data.updated` [webhook](https://docs.didit.me/integration/webhooks) is sent; sending the
+      # current status returns `200` and changes nothing. The session status is not recomputed: use `PATCH
+      # /v3/session/{sessionId}/update-status/` for the session decision and `PATCH
+      # /v3/session/{sessionId}/update-aml-hit-status/` for single hits. A scoped API key needs `decisions: write`.
+      #
+      # +PATCH /v3/session/{sessionId}/update-aml-status/+
+      #
+      # @param session_id [String] UUID of the verification session (the `session_id` returned by `POST
+      #   /v3/session/`). Accepts both User Verification (KYC) and Business Verification (KYB) session IDs: the server
+      #   resolves the ID across both session types. Must be a well-formed UUID; a malformed value does not match the
+      #   route and returns an HTML `404`.
+      # @param status [String] New status of the AML check.
+      # @param node_id [String] Workflow graph node ID of the AML check, as an alternative to the query parameter.
+      # @param node_id_query [String] Workflow graph node ID of the AML check to update. Needed only when the session
+      #   ran more than one AML step. Takes precedence over `node_id` in the body.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsUpdateAmlStatusResponse]
+      def update_aml_status(session_id, status:, node_id: OMIT, node_id_query: OMIT, request_options: nil)
+        @client.request(
+          :patch,
+          "/v3/session/{sessionId}/update-aml-status/",
+          path_params: { "sessionId" => session_id },
+          query: {
+            "node_id" => node_id_query
+          },
+          body: {
+            "status" => status,
+            "node_id" => node_id
+          },
+          response: Types::SessionsUpdateAmlStatusResponse,
+          request_options: request_options
+        )
+      end
+
+      # Update KYC data extracted from the ID document on a verification session
+      #
+      # Correct the identity fields that were extracted (OCR / NFC) from the user's ID document - misread names,
+      # dates, document numbers, and so on - after the verification has finished. Typical callers are a compliance
+      # analyst working from your own back office, or an automated reconciliation job. Every field in the body is
+      # optional: only the keys you send are written, everything else is left untouched (`PATCH` semantics).
+      #
+      # The session must belong to your application and be in `Approved`, `Declined`, `In Review`, or `Kyc Expired`
+      # status. Sessions in any other state (e.g. still `In Progress`) return `404` with `"No Session matches the
+      # given query."` - distinct from the `"Not found."` returned for an unknown or deleted `sessionId`. The session
+      # must also carry an ID-verification (KYC) record: sessions whose workflow never ran an ID-verification step
+      # return `404` (`"The session does not have a KYC."`). For graph workflows with multiple ID-verification steps,
+      # target a specific step with `node_id` (query parameter or body field); when omitted, the most recent KYC
+      # record is patched.
+      #
+      # Two derived fields are recomputed on every call: `full_name` (from `first_name` + `last_name`) and
+      # `issuing_state_name` (from `issuing_state`). If the free-text `address` changes, the server may also
+      # re-geocode it and refresh `parsed_address` (skipped for sandbox sessions). `extra_fields` and `parsed_address`
+      # are merged key-by-key rather than replaced - see the per-field descriptions for the `null`-to-delete
+      # semantics.
+      #
+      # Submitting at least one valid field fires the `data.updated` [webhook](/integration/webhooks) (trigger
+      # `manual_review`) - even when the submitted values equal the stored ones. When values actually change, a
+      # `KYC_DATA_UPDATED` activity entry recording the changed fields with previous and new values is appended to the
+      # session's `reviews`, visible in [Get Decision](#get-/v3/session/-sessionId-/decision/) and the console
+      # activity timeline. The session's status and decision are **not** re-evaluated - use [Update
+      # Status](#patch-/v3/session/-sessionId-/update-status/) to change the outcome. An empty JSON body (`{}`) is
+      # accepted and simply returns the current KYC data without firing the webhook.
+      #
+      # Accepts an API key or a console user token; either way the credential needs the `write:sessions` permission.
+      # Authentication and permission failures both return `403` - this API never responds `401`. Note that the
+      # session lookup runs before credential checks, so an unknown `sessionId` returns `404` even with missing
+      # credentials. This endpoint has a dedicated rate limit of 10 requests per minute per API key (invalid requests
+      # count too); the shared write budget of 300 requests per minute also applies.
+      #
+      # +PATCH /v3/session/{sessionId}/update-data/+
+      #
+      # @param session_id [String] UUID of the User Verification (KYC) session whose extracted document data you are
+      #   correcting. Business (KYB) session IDs are not valid here - for company data use [Update KYB Company
+      #   Data](#patch-/v3/session/-sessionId-/kyb/-companyUuid-/update-data/).
+      # @param document_type [String, nil] Document type code. Accepts the short codes listed in the enum, plus six
+      #   long-form aliases normalized server-side before validation: `Passport` → `P`, `Identity Card` → `ID`,
+      #   `Driver's License` → `DL`, `Residence Permit` → `RP`, `Health Insurance Card` → `HIC`, `Tax Card` → `TC`. Any
+      #   other value (including `PASSPORT` in caps) returns `400`.
+      # @param document_subtype [String, nil] Document subtype from the document registry, including the region prefix
+      #   when the registry distinguishes regional variants.
+      # @param document_number [String, nil] Document number as printed on the ID.
+      # @param personal_number [String, nil] Personal / national identification number where the document carries one
+      #   (e.g. Spanish DNI on a passport).
+      # @param date_of_birth [Date, String, nil] Date of birth in `YYYY-MM-DD`. Any other format returns `400`.
+      # @param date_of_issue [Date, String, nil] Issue date of the document in `YYYY-MM-DD`.
+      # @param expiration_date [Date, String, nil] Expiration date of the document in `YYYY-MM-DD`.
+      # @param issuing_state [String, nil] Issuing country as an ISO 3166-1 alpha-3 code. Case-insensitive (`esp` is
+      #   stored as `ESP`); the human-readable `issuing_state_name` shown in [Get
+      #   Decision](#get-/v3/session/-sessionId-/decision/) is recomputed from this value. Invalid codes return `400`.
+      # @param first_name [String, nil] Given name(s). The stored `full_name` is recomputed as `first_name + ' ' +
+      #   last_name` on every call to this endpoint.
+      # @param last_name [String, nil] Family name(s). Also feeds the recomputed `full_name`.
+      # @param gender [String, nil] Sex as printed on the document: `M` (male), `F` (female), or `U` (unknown). Any
+      #   other value - including `X` - returns `400`.
+      # @param address [String, nil] Free-text address as printed on the document. When this value changes
+      #   (non-sandbox sessions only) and the structured address is still missing or incomplete, the server re-geocodes
+      #   it synchronously before responding - the 200 body already reflects the refreshed `parsed_address`. The
+      #   re-geocode also requires `issuing_state` to be present on the KYC record.
+      # @param place_of_birth [String, nil] Place of birth as printed on the document.
+      # @param nationality [String, nil] Nationality as printed on the document. Free text up to 32 characters -
+      #   typically an ISO 3166-1 alpha-3 code (e.g. `ESP`), but not validated as one.
+      # @param marital_status [String] Marital status where the document carries it. Any other value returns `400`.
+      # @param extra_fields [Hash, nil] Per-key overrides for document-specific extra fields (e.g. `blood_group`,
+      #   `dl_categories`, `mrz_string`). Keys are merged into the existing override map: send a key with a value to set
+      #   it, or with `null` / `""` to remove that key from the merged view. Send the whole field as `null` to clear all
+      #   previously applied overrides. Must be a JSON object, otherwise `400`. The response always returns the m...
+      # @param parsed_address [Hash, nil] Structured address. Only these nested keys are accepted: `address_type`,
+      #   `city`, `region`, `street_1`, `street_2`, `postal_code`, `country` - any other key returns `400`. Per-key
+      #   semantics: a value sets the key, `null` removes it. `formatted_address` is recomputed server-side by joining
+      #   `street_1`, `street_2`, `city`, `region`, `postal_code`, and `country` and is returned in the response - you
+      #   ca...
+      # @param node_id [String] Workflow graph node whose KYC record to patch, for graph workflows with multiple
+      #   ID-verification steps (also accepted as a `node_id` body field). When omitted, the most recent KYC record on
+      #   the session is patched. If no KYC exists for the given node, the call returns `404` (`"The session does not
+      #   have a KYC for node '<node_id>'."`).
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsUpdateDataResponse]
+      def update_data(
+        session_id,
+        document_type: OMIT,
+        document_subtype: OMIT,
+        document_number: OMIT,
+        personal_number: OMIT,
+        date_of_birth: OMIT,
+        date_of_issue: OMIT,
+        expiration_date: OMIT,
+        issuing_state: OMIT,
+        first_name: OMIT,
+        last_name: OMIT,
+        gender: OMIT,
+        address: OMIT,
+        place_of_birth: OMIT,
+        nationality: OMIT,
+        marital_status: OMIT,
+        extra_fields: OMIT,
+        parsed_address: OMIT,
+        node_id: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :patch,
+          "/v3/session/{sessionId}/update-data/",
+          path_params: { "sessionId" => session_id },
+          query: {
+            "node_id" => node_id
+          },
+          body: {
+            "document_type" => document_type,
+            "document_subtype" => document_subtype,
+            "document_number" => document_number,
+            "personal_number" => personal_number,
+            "date_of_birth" => date_of_birth,
+            "date_of_issue" => date_of_issue,
+            "expiration_date" => expiration_date,
+            "issuing_state" => issuing_state,
+            "first_name" => first_name,
+            "last_name" => last_name,
+            "gender" => gender,
+            "address" => address,
+            "place_of_birth" => place_of_birth,
+            "nationality" => nationality,
+            "marital_status" => marital_status,
+            "extra_fields" => extra_fields,
+            "parsed_address" => parsed_address
+          },
+          response: Types::SessionsUpdateDataResponse,
+          request_options: request_options
+        )
+      end
+
+      # Update a Document AI document
+      #
+      # Correct the fields Document AI extracted from one uploaded document, set its review status, or both, on a KYC
+      # or KYB session. `extracted_data` must be a JSON object and is merged key by key: a key you send replaces the
+      # stored value (a key sent as `null` is stored as `null`) and keys you leave out keep their values. The document
+      # status feeds the Document AI result of its workflow node in the session decision; the session status itself is
+      # not recomputed. Every successful call, including one that changes nothing, sends a `data.updated`
+      # [webhook](https://docs.didit.me/integration/webhooks) with trigger `manual_review`. A scoped API key needs
+      # `decisions: write`; see [Document AI](https://docs.didit.me/core-technology/document-ai/overview).
+      #
+      # +PATCH /v3/document-ai/{sessionId}/documents/{documentUuid}/+
+      #
+      # @param session_id [String] UUID of the verification session (the `session_id` returned by `POST
+      #   /v3/session/`). Accepts both User Verification (KYC) and Business Verification (KYB) session IDs: the server
+      #   resolves the ID across both session types. Must be a well-formed UUID; a malformed value does not match the
+      #   route and returns an HTML `404`.
+      # @param document_uuid [String] UUID of the Document AI document (`document_ai_documents[].items[].uuid` in `GET
+      #   /v3/session/{sessionId}/decision/`). It must belong to the session in the path.
+      # @param extracted_data [Hash] Field keys (the keys you configured for the document) and their corrected values.
+      #   Must be a JSON object; merged key by key into the stored data. Leave it out rather than sending `null`, which
+      #   returns `400`.
+      # @param status [String] New review status of the document.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsUpdateDocumentAiDataResponse]
+      def update_document_ai_data(session_id, document_uuid, extracted_data: OMIT, status: OMIT, request_options: nil)
+        @client.request(
+          :patch,
+          "/v3/document-ai/{sessionId}/documents/{documentUuid}/",
+          path_params: { "sessionId" => session_id, "documentUuid" => document_uuid },
+          body: {
+            "extracted_data" => extracted_data,
+            "status" => status
+          },
+          response: Types::SessionsUpdateDocumentAiDataResponse,
+          request_options: request_options
+        )
+      end
+
+      # Update an individual feature (step) status
+      #
+      # Set the status of a single verification feature (step) within a session. Target the feature by its workflow
+      # graph `nodeId`. On non-graph workflows, whose steps have no node, use `default` and also pass `feature_type`
+      # to say which step you mean.
+      #
+      # Works for both User Verification (KYC) and Business Verification (KYB) sessions and every step type: ID/OCR,
+      # Liveness, Face Match, NFC, AML, Proof of Address, Phone, Email, Database Validation, Questionnaire, and the
+      # KYB registry / documents / key-people checks. This endpoint is **not** available for standalone API sessions
+      # (`session_type = API`).
+      #
+      # `new_status` must be one of `Approved`, `Declined`, or `In Review`, and must differ from the feature's current
+      # status.
+      #
+      # **When the override applies.** Without `defer_until_flow_finishes` (or with `false`) the override applies at
+      # once, as it always did; when the person is still in the flow it is recorded as `forced`. With
+      # `defer_until_flow_finishes: true` while the person is still in the flow (the session is `Not Started`, `In
+      # Progress` or `Resubmitted` and has not finished), the override is stored as `pending_until_flow_finishes` and
+      # applies when the flow finishes, after the flow reaches its own decision. On a session whose flow already ended
+      # it applies at once either way. A waiting override is cancelled instead when the person redoes its step before
+      # finishing, when a newer override on the same check replaces it, when the session leaves the flow unfinished
+      # (abandoned, expired, or decided mid-flow), or when you cancel it with `POST
+      # /v3/session/{sessionId}/features/overrides/{overrideId}/cancel/`. List a session's overrides with `GET
+      # /v3/session/{sessionId}/features/overrides/`.
+      #
+      # **Effect on the session.** A session that already has a decision keeps it: only the check changes. When the
+      # session has no decision yet and its workflow is waiting on exactly this step, applying the override completes
+      # the step: the workflow moves on, later steps run, and a status node can set the session decision and fire
+      # `status.updated`.
+      #
+      # **Webhooks and activity.** A `data.updated` webhook fires when the override applies (at once, or when the flow
+      # finishes), never while it waits or when it is cancelled. Every override is recorded in the session's activity
+      # as `FEATURE_OVERRIDE_PENDING`, `FEATURE_OVERRIDE_APPLIED` or `FEATURE_OVERRIDE_CANCELLED`, with who made it;
+      # the request's entry carries your `comment`.
+      #
+      # Authenticate with your API key (`x-api-key`) or a user authorization header carrying the `write:sessions`
+      # privilege; a scoped API key needs write access to decisions.
+      #
+      # +PATCH /v3/session/{sessionId}/features/{nodeId}/update-status/+
+      #
+      # @param session_id [String] UUID of the verification session. Accepts both user (KYC) and business (KYB)
+      #   session IDs - the service resolves the ID across both session types.
+      # @param node_id [String] Workflow graph node ID of the feature to update (for example `feature_ocr_1`). Use the
+      #   literal value `default` for non-graph (single-step) workflows where the feature has no node ID.
+      # @param new_status [String] Target status for this feature. Must differ from the current value.
+      # @param comment [String] Optional free-text note recorded on the session's review trail for this feature
+      #   change.
+      # @param feature_type [String] Which kind of step to target. Needed on non-graph workflows (`nodeId` =
+      #   `default`), where every step shares no node; optional otherwise. An unknown value returns `400`.
+      # @param defer_until_flow_finishes [Boolean] While the person is still in the flow, store the override as
+      #   `pending_until_flow_finishes` and apply it when the flow finishes, instead of at once. Omitted or `false`, the
+      #   override applies at once. On a session whose flow already ended it applies at once either way.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsUpdateFeatureStatusResponse]
+      def update_feature_status(
+        session_id,
+        node_id,
+        new_status:,
+        comment: OMIT,
+        feature_type: OMIT,
+        defer_until_flow_finishes: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :patch,
+          "/v3/session/{sessionId}/features/{nodeId}/update-status/",
+          path_params: { "sessionId" => session_id, "nodeId" => node_id },
+          body: {
+            "new_status" => new_status,
+            "comment" => comment,
+            "feature_type" => feature_type,
+            "defer_until_flow_finishes" => defer_until_flow_finishes
+          },
+          response: Types::SessionsUpdateFeatureStatusResponse,
+          request_options: request_options
+        )
+      end
+
+      # Update registry-extracted company data on a Business Verification (KYB) session
+      #
+      # Correct the registry-extracted company data on a Business Verification (KYB) session - company name,
+      # registration number, addresses, status, contact details - identified by `companyUuid`. Typical callers are a
+      # compliance analyst fixing a registry misread, or your back office syncing corrected company data. Every field
+      # in the body is optional (`PATCH` semantics); an empty JSON body (`{}`) is a no-op that simply echoes the
+      # current company record.
+      #
+      # Edits are written in two places at once: fields with a canonical company column (name, registration number,
+      # country, incorporation date, tax number, type, statuses, capital fields (`registered_capital`,
+      # `registered_capital_amount`, `registered_capital_currency`), alternative names, nature of business, website,
+      # email, phone, LEI, location, and `legal_address` → `registered_address`) update that column, and **every**
+      # submitted key is also merged into the `registry_data` snapshot (dates as ISO strings) so the "extracted from
+      # registry" view reflects the correction. Fields without a column - `region`, `registration_date`,
+      # `dissolution_date`, `control_scheme` - land in `registry_data` only. `user_provided_data` (what the end user
+      # confirmed in the hosted flow) is never touched, and `last_console_edit_at` is stamped on every non-empty
+      # PATCH.
+      #
+      # Unlike the KYC/POA update endpoints, there is **no session-status gate**: the company can be edited at any
+      # point in the business session's lifecycle. The company must belong to the session in the path (`404` with
+      # `"KYB company does not belong to the given session."` otherwise) and to your application. Every non-empty
+      # PATCH fires the `data.updated` [webhook](/integration/webhooks) on the business session (trigger
+      # `console_registry_edit`) - even when the submitted values equal the stored ones. The session's status and
+      # decision are **not** re-evaluated, and no review/audit entry is recorded.
+      #
+      # Accepts an API key or a console user token; either way the credential needs the `write:businesses` permission.
+      # Authentication and permission failures both return `403` - this API never responds `401`. Note that the
+      # session lookup runs before credential checks, so an unknown `sessionId` returns `404` even with missing
+      # credentials. The shared write budget of 300 requests per minute per API key applies.
+      #
+      # For User Verification sessions, the KYC counterpart is `PATCH /v3/session/{sessionId}/update-data/`; to change
+      # the session decision itself use `PATCH /v3/session/{sessionId}/update-status/`.
+      #
+      # +PATCH /v3/session/{sessionId}/kyb/{companyUuid}/update-data/+
+      #
+      # @param session_id [String] UUID of the parent Business Verification (KYB) session.
+      # @param company_uuid [String] UUID of the company record to update (`registry_checks[].company.uuid` on the
+      #   business session decision). Must belong to the session referenced by `sessionId`.
+      # @param company_name [String] Legal name of the company. Written to the canonical column and the registry
+      #   snapshot.
+      # @param registration_number [String] Official registration number with the company registry.
+      # @param country_code [String] Country of incorporation, ISO 3166-1 alpha-2. Case-insensitive (`us` is stored as
+      #   `US`). Alpha-3 codes fail the 2-character limit with `400`.
+      # @param region [String, nil] Subdivision / region tag where the registry has one (e.g. US state). Stored in the
+      #   registry snapshot only - it has no canonical column.
+      # @param incorporation_date [Date, String] Incorporation date in `YYYY-MM-DD`. Optional like every other field -
+      #   the `PATCH` is partial. Any other date format returns `400`.
+      # @param registration_date [Date, String, nil] Registration date where the registry distinguishes it from
+      #   incorporation. Stored in the registry snapshot only.
+      # @param dissolution_date [Date, String, nil] Dissolution date for companies that are no longer active. Stored
+      #   in the registry snapshot only.
+      # @param tax_number [String] Tax identification number.
+      # @param legal_address [String] Legal / registered address. Aliased server-side to the canonical
+      #   `registered_address` column - the response returns it under `registered_address`, while the registry snapshot
+      #   keeps the `legal_address` key you sent.
+      # @param company_type [String] Legal entity type (e.g. `Limited Liability Company`, `PLC`, `GmbH`).
+      # @param registry_status [String, nil] Registry-reported company status. Lowercase, some values contain spaces
+      #   (e.g. `struck off`, `no longer authorised`). Any other value returns `400`.
+      # @param verification_status [String, nil] Outcome of the registry verification. Any other value returns `400`.
+      # @param alternative_names [String] Trade names, former legal names, DBA names (free text).
+      # @param nature_of_business [String] Short description of the company's activity.
+      # @param registered_capital [String] Human-readable registered capital (e.g. `USD 50000`). Use
+      #   `registered_capital_amount` + `registered_capital_currency` for structured values, or this field for free-form
+      #   text.
+      # @param registered_capital_amount [Numeric, nil] Numeric registered-capital amount (up to 20 digits, 2 decimal
+      #   places). Sets the `registered_capital_amount` column and is mirrored into `registry_data` as a decimal string;
+      #   the response echoes it as a decimal string (e.g. `"1500000.50"`).
+      # @param registered_capital_currency [String, nil] ISO 4217 currency code for `registered_capital_amount`.
+      #   Case-insensitive (`usd` is stored as `USD`); values that are not exactly 3 letters return `400` with the ISO
+      #   4217 message. Sets the canonical `registered_capital_currency` column and is mirrored into `registry_data`.
+      # @param website [String] Company website. Bare domains are accepted and normalized with an `https://` prefix
+      #   (`docsprobe.example.com` is stored as `https://docsprobe.example.com`); values that still fail URL validation
+      #   return `400`.
+      # @param email [String] Contact email on file with the registry.
+      # @param phone [String] Contact phone. Must match `+`, digits, spaces, dashes, dots, or parentheses, with 7-15
+      #   digits total - otherwise `400`.
+      # @param legal_entity_identifier [String] LEI, where the company has one.
+      # @param location_of_registration [String] City / subdivision of the registry of record.
+      # @param vat_number [String] EU VAT number. Merged into the `registry_data` snapshot only - editing it here does
+      #   not re-run VAT and tax ID validation, so `vat_validation_status` and the other `vat_*` result fields are
+      #   unchanged.
+      # @param control_scheme [String] Control / governance scheme when the registry exposes it. Stored in the
+      #   registry snapshot only.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsUpdateKybCompanyDataResponse]
+      def update_kyb_company_data(
+        session_id,
+        company_uuid,
+        company_name: OMIT,
+        registration_number: OMIT,
+        country_code: OMIT,
+        region: OMIT,
+        incorporation_date: OMIT,
+        registration_date: OMIT,
+        dissolution_date: OMIT,
+        tax_number: OMIT,
+        legal_address: OMIT,
+        company_type: OMIT,
+        registry_status: OMIT,
+        verification_status: OMIT,
+        alternative_names: OMIT,
+        nature_of_business: OMIT,
+        registered_capital: OMIT,
+        registered_capital_amount: OMIT,
+        registered_capital_currency: OMIT,
+        website: OMIT,
+        email: OMIT,
+        phone: OMIT,
+        legal_entity_identifier: OMIT,
+        location_of_registration: OMIT,
+        vat_number: OMIT,
+        control_scheme: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :patch,
+          "/v3/session/{sessionId}/kyb/{companyUuid}/update-data/",
+          path_params: { "sessionId" => session_id, "companyUuid" => company_uuid },
+          body: {
+            "company_name" => company_name,
+            "registration_number" => registration_number,
+            "country_code" => country_code,
+            "region" => region,
+            "incorporation_date" => incorporation_date,
+            "registration_date" => registration_date,
+            "dissolution_date" => dissolution_date,
+            "tax_number" => tax_number,
+            "legal_address" => legal_address,
+            "company_type" => company_type,
+            "registry_status" => registry_status,
+            "verification_status" => verification_status,
+            "alternative_names" => alternative_names,
+            "nature_of_business" => nature_of_business,
+            "registered_capital" => registered_capital,
+            "registered_capital_amount" => registered_capital_amount,
+            "registered_capital_currency" => registered_capital_currency,
+            "website" => website,
+            "email" => email,
+            "phone" => phone,
+            "legal_entity_identifier" => legal_entity_identifier,
+            "location_of_registration" => location_of_registration,
+            "vat_number" => vat_number,
+            "control_scheme" => control_scheme
+          },
+          response: Types::SessionsUpdateKybCompanyDataResponse,
+          request_options: request_options
+        )
+      end
+
+      # Skip (or re-require) a Key People party on a Business Verification (KYB) session
+      #
+      # Exempt a Key People party from verification, or put it back in scope. This is the operator escape hatch for a
+      # party that can never finish its own check - most often because the individual KYC session handed to a UBO or
+      # director was deleted, which freezes that child's status and leaves the KYB parked in `Awaiting User` with
+      # nothing left that could move it.
+      #
+      # Setting `is_skipped: true` drops the party out of the Key People aggregation and immediately recomputes the
+      # `KYBKeyPeopleCheck` and the parent session status, so the business session can settle and then be approved or
+      # declined. Sending `is_skipped: false` puts the party back in scope and the check goes back to waiting on it.
+      #
+      # Unlike the applicant-facing skip in the hosted Key People screen, this endpoint is **not** gated by the role's
+      # `allow_skip` setting - that flag limits what the applicant may decide, not what your analyst may override.
+      # `requires_verification` is deliberately left untouched, so an overridden party reads as
+      # `requires_verification: true` **and** `is_skipped: true` and the record still shows what the rules asked for.
+      #
+      # The party must belong to the session in the path (`404` with `"Party does not belong to the given session."`
+      # otherwise) and to your application. A PATCH that actually changes the flag fires the `data.updated`
+      # [webhook](/integration/webhooks) on the business session with trigger `console_key_people_skip`; a PATCH that
+      # sets the flag to its current value is a no-op that echoes the party back.
+      #
+      # Accepts an API key or a console user token; either way the credential needs the `write:businesses` permission.
+      #
+      # +PATCH /v3/session/{sessionId}/kyb/parties/{partyUuid}/+
+      #
+      # @param session_id [String] UUID of the parent Business Verification (KYB) session.
+      # @param party_uuid [String] UUID of the Key People party to update
+      #   (`key_people_checks[].submitted.parties[].uuid` on the business session decision). Must belong to the session
+      #   referenced by `sessionId`.
+      # @param is_skipped [Boolean] `true` exempts the party from verification so the Key People check can settle
+      #   without it; `false` puts it back in scope.
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsUpdateKybPartyResponse]
+      def update_kyb_party(session_id, party_uuid, is_skipped:, request_options: nil)
+        @client.request(
+          :patch,
+          "/v3/session/{sessionId}/kyb/parties/{partyUuid}/",
+          path_params: { "sessionId" => session_id, "partyUuid" => party_uuid },
+          body: {
+            "is_skipped" => is_skipped
+          },
+          response: Types::SessionsUpdateKybPartyResponse,
+          request_options: request_options
+        )
+      end
+
+      # Update Proof of Address data extracted from the POA document on a verification session
+      #
+      # Correct the fields extracted from the user's Proof of Address document - utility bill, bank statement, or
+      # other address evidence - after the verification has finished: issuer, dates, the printed name, the address
+      # itself, and banking details. Every field in the body is optional: only the keys you send are written,
+      # everything else is left untouched (`PATCH` semantics).
+      #
+      # The session must belong to your application and be in `Approved`, `Declined`, `In Review`, or `Kyc Expired`
+      # status. Sessions in any other state (e.g. still `In Progress`) return `404` with `"No Session matches the
+      # given query."` - distinct from the `"Not found."` returned for an unknown or deleted `sessionId`. The session
+      # must also carry a POA record: sessions whose workflow never ran a Proof of Address step return `404` (`"The
+      # session does not have a POA."`). For graph workflows with multiple POA steps, target a specific step with
+      # `node_id` (query parameter or body field); when omitted, the most recent POA record is patched.
+      #
+      # `extra_fields` is merged key-by-key: nine known keys (`bank_iban`, `additional_names`, …) write through to
+      # dedicated POA columns, any other key is kept as a custom extra, and `null` / `""` deletes a key.
+      # `poa_parsed_address` accepts only the seven documented keys and recomputes `formatted_address` /
+      # `poa_formatted_address` after every edit. If the free-text `poa_address` changes, the server may also
+      # re-geocode it and refresh the structured address (skipped for sandbox sessions).
+      #
+      # Unlike the KYC variant of this endpoint, the `data.updated` [webhook](/integration/webhooks) (trigger
+      # `manual_review`) fires only when at least one stored value **actually changed** - re-sending identical values
+      # is a silent no-op. When values change, a `POA_DATA_UPDATED` activity entry recording the changed fields with
+      # previous and new values is appended to the session's `reviews`, visible in [Get
+      # Decision](#get-/v3/session/-sessionId-/decision/) and the console activity timeline. The session's status and
+      # decision are **not** re-evaluated - use [Update Status](#patch-/v3/session/-sessionId-/update-status/) to
+      # change the outcome.
+      #
+      # Accepts an API key or a console user token; either way the credential needs the `write:sessions` permission.
+      # Authentication and permission failures both return `403` - this API never responds `401`. Note that the
+      # session lookup runs before credential checks, so an unknown `sessionId` returns `404` even with missing
+      # credentials. This endpoint has a dedicated rate limit of 10 requests per minute per API key (invalid requests
+      # count too); the shared write budget of 300 requests per minute also applies.
+      #
+      # An empty JSON body `{}` is a no-op: it returns `200` echoing the current POA record without firing the webhook
+      # (`has_changes` stays false).
+      #
+      # +PATCH /v3/session/{sessionId}/update-poa-data/+
+      #
+      # @param session_id [String] UUID of the User Verification (KYC) session whose attached POA record you are
+      #   correcting.
+      # @param issuing_state [String, nil] Country that issued the POA document, ISO 3166-1 alpha-3. Case-insensitive
+      #   (normalized to uppercase); invalid codes return `400`.
+      # @param document_type [String] POA document category. Values are uppercase - lowercase variants like
+      #   `utility_bill` return `400`.
+      # @param document_language [String, nil] Language of the document, typically an ISO 639-1 code (e.g. `es`). Free
+      #   text - not validated as a language code.
+      # @param issuer [String, nil] Organization that issued the document (utility company, bank, government agency).
+      # @param issue_date [Date, String, nil] Issue date of the POA document in `YYYY-MM-DD`. Any other format returns
+      #   `400`.
+      # @param poa_address [String, nil] Free-text address as printed on the document. When this value changes
+      #   (non-sandbox sessions only) and the structured address is still missing or incomplete, the server re-geocodes
+      #   it in the background of the same request and may overwrite `poa_parsed_address` / `poa_formatted_address` with
+      #   the geocoder result. The re-geocode also requires `issuing_state` to be present on the POA record.
+      # @param name_on_document [String, nil] Recipient name as printed on the document.
+      # @param extra_fields [Hash, nil] Document-specific extras, merged key-by-key. Nine keys map to dedicated POA
+      #   columns: `bank_account_number`, `bank_iban`, `bank_sort_code`, `bank_routing_number`, `bank_swift_bic`,
+      #   `bank_branch_name`, `bank_branch_address`, `document_phone_number`, and `additional_names` (must be a list of
+      #   strings or `null`, otherwise `400`). Any other key is stored as a custom extra field. Per-key semantics: a
+      #   va...
+      # @param poa_parsed_address [Hash, nil] Structured address. Only these nested keys are accepted: `address_type`,
+      #   `city`, `region`, `street_1`, `street_2`, `postal_code`, `country` - any other key returns `400`. Per-key
+      #   semantics: a value sets the key, `null` removes it. `formatted_address` (and the top-level
+      #   `poa_formatted_address`) is recomputed server-side by joining `street_1`, `street_2`, `city`, `region`,
+      #   `postal_code`, and `count...
+      # @param node_id [String] Workflow graph node whose POA record to patch, for graph workflows with multiple Proof
+      #   of Address steps (also accepted as a `node_id` body field). When omitted, the most recent POA record on the
+      #   session is patched. If no POA exists for the given node, the call returns `404` (`"The session does not have a
+      #   POA for node '<node_id>'."`).
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsUpdatePoaDataResponse]
+      def update_poa_data(
+        session_id,
+        issuing_state: OMIT,
+        document_type: OMIT,
+        document_language: OMIT,
+        issuer: OMIT,
+        issue_date: OMIT,
+        poa_address: OMIT,
+        name_on_document: OMIT,
+        extra_fields: OMIT,
+        poa_parsed_address: OMIT,
+        node_id: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :patch,
+          "/v3/session/{sessionId}/update-poa-data/",
+          path_params: { "sessionId" => session_id },
+          query: {
+            "node_id" => node_id
+          },
+          body: {
+            "issuing_state" => issuing_state,
+            "document_type" => document_type,
+            "document_language" => document_language,
+            "issuer" => issuer,
+            "issue_date" => issue_date,
+            "poa_address" => poa_address,
+            "name_on_document" => name_on_document,
+            "extra_fields" => extra_fields,
+            "poa_parsed_address" => poa_parsed_address
+          },
+          response: Types::SessionsUpdatePoaDataResponse,
+          request_options: request_options
+        )
+      end
+
+      # Approve, decline, or request resubmission for a verification session
+      #
+      # Manually override the final decision of a KYC or KYB verification session. Set `new_status` to `Approved` or
+      # `Declined` to record a manual decision, or to `Resubmitted` to clear specific verification steps and let the
+      # user redo them through the same verification URL. The endpoint accepts both user (KYC) and business (KYB)
+      # session IDs.
+      #
+      # Call it once a session has reached a reviewable state: the current status must be `Approved`, `Declined`, `In
+      # Review`, `Kyc Expired`, `Abandoned`, or `Resubmitted`. Sessions that are still `Not Started`, `In Progress`,
+      # or `Awaiting User`, or that ended as `Expired`, return `400`. Your API key needs the `write:sessions`
+      # permission (a scoped API key needs write access to decisions). The eligible-state check runs before body
+      # validation, so an ineligible session returns the `Wrong Current Status` error even when the payload is also
+      # invalid.
+      #
+      # For `Resubmitted`, pass `nodes_to_resubmit` to choose which workflow steps the user must redo, or omit it to
+      # auto-select existing feature attempts in a resubmittable state (`Declined`, `In Review`, `Not Finished`,
+      # `Expired`). Never-attempted features are not auto-selected: list them explicitly in `nodes_to_resubmit`, or
+      # the request returns `400` when no recorded attempt needs resubmission. The selected steps' previous results
+      # move to the resubmission's history (returned by Get Decision with `include=resubmissions`), the steps are
+      # reordered to match the workflow graph, the session's expiration window restarts, and the original verification
+      # URL becomes usable again. Backend-only steps (`AML`, `DATABASE_VALIDATION`, `IP_ANALYSIS`) at the head of the
+      # list run immediately without user interaction; if every resubmitted step is backend-only, the session
+      # re-finalizes within the same request. `KYB_REGISTRY` and `KYB_KEY_PEOPLE` cannot be resubmitted directly:
+      # resubmit the relevant child KYC sessions instead and the parent business session recomputes automatically.
+      #
+      # Every call that changes the status fires the `status.updated` [webhook](/integration/webhooks) once the change
+      # commits and appends an activity entry (with actor attribution and your `comment`) to the session's `reviews`,
+      # visible in [Get Decision](#get-/v3/session/-sessionId-/decision/) and in the console activity timeline. The
+      # user-profile aggregates linked to the session's `vendor_data` update as well. Declining disables ongoing AML
+      # monitoring for the session; re-approving re-enables it (from `Resubmitted`, `Declined`, or `Kyc Expired`) when
+      # the workflow has monitoring turned on. Approving or declining a child KYC that belongs to a KYB key-people
+      # check recomputes the parent business session's status. Set `send_email: true` (with `email_address`) to notify
+      # the user: a status notice for `Approved`/`Declined`, or a resubmission email containing the verification link
+      # and per-step reasons for `Resubmitted`. To check the email first, preview it with [Preview Decision
+      # Email](/sessions-api/preview-decision-email) (`Approved`, `Declined`) or [Preview Resubmission
+      # Email](/sessions-api/preview-resubmission) (`Resubmitted`) and pass its `preview_token` as
+      # `email_preview_token`: the update then sends exactly the previewed email, or returns `409` before changing
+      # anything when the email or the session changed since the preview or the receipt is older than 15 minutes.
+      #
+      # Repeating `Approved` or `Declined` on a session that already has that status changes nothing and returns
+      # `200`: no webhook, no activity entry and no email. Repeating `Resubmitted` returns `400` (`The new status is
+      # the same as the current status.`). Missing or invalid credentials and missing permissions return `403`; an
+      # expired scoped API key returns `401`.
+      #
+      # +PATCH /v3/session/{sessionId}/update-status/+
+      #
+      # @param session_id [String] UUID of the verification session to update. Accepts both user (KYC) and business
+      #   (KYB) session IDs - the service resolves the ID across both session types.
+      # @param new_status [String] Target status. `Approved` and `Declined` record a final manual decision (each can
+      #   also overturn the other). `Resubmitted` clears the selected steps and sends the session back to the user. Any
+      #   other value returns `400`.
+      # @param comment [String] Free-text reason for the change, stored on the session's review trail and returned in
+      #   the `reviews` array of [Get Decision](#get-/v3/session/-sessionId-/decision/). For example `Duplicated user`.
+      # @param nodes_to_resubmit [Array<Hash>] Workflow steps the user must redo. Only acted on when `new_status` is
+      #   `Resubmitted`. For `Approved`/`Declined` the entries are still schema-validated (an invalid `feature` value
+      #   returns `400`) but schema-valid entries are semantically ignored. If omitted, the server auto-selects existing
+      #   OCR, Liveness, Face Match, POA, Phone, Email, AML, Database Validation, and Questionnaire attempts whose
+      #   statu...
+      # @param send_email [Boolean] Whether to email the user about the change. Requires `email_address`. For
+      #   `Approved`/`Declined` the user receives a status notice; for `Resubmitted` the email includes the verification
+      #   link and the per-step resubmission reasons.
+      # @param email_address [String] Recipient for the notification email. **Required when `send_email` is `true`** -
+      #   omitting it returns `400`.
+      # @param email_language [String] Language for the notification email. Accepts any string at schema level;
+      #   unsupported codes silently fall back to English (`en`).
+      # @param email_preview_token [String] Optional receipt from [Preview Decision
+      #   Email](/sessions-api/preview-decision-email) (for `Approved` and `Declined`) or [Preview Resubmission
+      #   Email](/sessions-api/preview-resubmission) (for `Resubmitted`): its `preview_token`. Valid only with
+      #   `send_email: true`; without it the request returns `400`. The recipient, language, session status, sender and
+      #   email (and, for a resubmission, the selected s...
+      # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+      # @return [Didit::Types::SessionsUpdateStatusResponse]
+      def update_status(
+        session_id,
+        new_status:,
+        comment: OMIT,
+        nodes_to_resubmit: OMIT,
+        send_email: OMIT,
+        email_address: OMIT,
+        email_language: OMIT,
+        email_preview_token: OMIT,
+        request_options: nil
+      )
+        @client.request(
+          :patch,
+          "/v3/session/{sessionId}/update-status/",
+          path_params: { "sessionId" => session_id },
+          body: {
+            "new_status" => new_status,
+            "comment" => comment,
+            "nodes_to_resubmit" => nodes_to_resubmit,
+            "send_email" => send_email,
+            "email_address" => email_address,
+            "email_language" => email_language,
+            "email_preview_token" => email_preview_token
+          },
+          response: Types::SessionsUpdateStatusResponse,
+          request_options: request_options
+        )
+      end
+
+      # The +sessions.imports+ resource.
+      class Imports < Didit::Resource
+        # Cancel an import job
+        #
+        # Cancel an import. What was imported stays; the uploaded file and the key are erased.
+        #
+        # +POST /v3/session/imports/{importId}/cancel/+
+        #
+        # @param import_id [String]
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionImportJob]
+        def cancel(import_id, request_options: nil)
+          @client.request(
+            :post,
+            "/v3/session/imports/{importId}/cancel/",
+            path_params: { "importId" => import_id },
+            response: Types::SessionImportJob,
+            request_options: request_options
+          )
+        end
+
+        # Check a provider key
+        #
+        # Read the provider with your key before creating a migration. Nothing is stored.
+        #
+        # +POST /v3/session/imports/providers/check/+
+        #
+        # @param provider [String] Migration source, from `GET /v3/session/imports/providers/`. Required when `source`
+        #   is `provider`.
+        # @param credentials [Hash{String => String}] The provider's read-only key, with the field names
+        #   `credential_fields` lists. Encrypted at rest, never returned, and erased when the import ends. Send it as a
+        #   JSON string in multipart.
+        # @param options [Hash]
+        # @param record_ids [Array<String>] For `api_ids` providers: the first record ID of your export.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionsImportsCheckProviderResponse]
+        def check_provider(provider:, credentials:, options: OMIT, record_ids: OMIT, request_options: nil)
+          @client.request(
+            :post,
+            "/v3/session/imports/providers/check/",
+            body: {
+              "provider" => provider,
+              "credentials" => credentials,
+              "options" => options,
+              "record_ids" => record_ids
+            },
+            response: Types::SessionsImportsCheckProviderResponse,
+            request_options: request_options
+          )
+        end
+
+        # Create a verification import job
+        #
+        # Create an asynchronous import job for historical User Verification sessions, Business Verification sessions,
+        # transaction monitoring records, or workflow custom status rules. Set `source=provider` to migrate from
+        # another provider: Didit reads Sumsub, Onfido, Persona and ComplyCube with your read-only key, reads Veriff,
+        # iDenfy and MetaMap records by the IDs you upload in `file`, and imports an export file in Didit's format for
+        # the other providers. Record IDs are namespaced by provider (`sumsub:<id>`) so a re-run skips everything
+        # already in Didit. Imports are disabled by default and must be enabled per organization by Didit.
+        #
+        # +POST /v3/session/imports/+
+        #
+        # @param import_type [String] What to import: historical User Verification sessions, historical Business
+        #   Verification sessions, workflow custom status rules, or historical transaction monitoring records.
+        # @param workflow_id [String] Workflow UUID that imported sessions or status rules should be attached to.
+        #   Required for user_verification, business_verification, and status_rules. Omit for transactions.
+        # @param source_format [String] Optional. Inferred from the URL's file extension when omitted.
+        # @param source_file_url [String] Alternative to file upload. Must be an HTTPS URL resolving to a public
+        #   address (private/loopback networks are rejected). Mutually exclusive with `file`.
+        # @param source [String] `provider` makes this a migration from another identity verification provider. Omit
+        #   for a file import.
+        # @param provider [String] Migration source, from `GET /v3/session/imports/providers/`. Required when `source`
+        #   is `provider`.
+        # @param credentials [Hash{String => String}] The provider's read-only key, with the field names
+        #   `credential_fields` lists. Encrypted at rest, never returned, and erased when the import ends. Send it as a
+        #   JSON string in multipart.
+        # @param options [Hash]
+        # @param status_mapping [Hash{String => String}] Edits to the provider's default status mapping: source status
+        #   to Didit status. `Not Finished` and `Abandoned` are skipped and counted, never imported.
+        # @param dry_run [Boolean] Count what the migration would import (by status, already in Didit, same person,
+        #   not finished) and write nothing. The job ends `READY`; start it with `POST
+        #   /v3/session/imports/{importId}/start/`.
+        # @param face_templates [Boolean] Build face templates from the imported selfies and search them against the
+        #   application's faces and blocklist. Matches are flagged for review only. Requires `lawful_basis_confirmed`.
+        # @param lawful_basis_confirmed [Boolean] Confirms you have a lawful basis to share these selfies with Didit
+        #   as processor.
+        # @param file [Pathname, IO, String, Didit::FilePart] Canonical CSV or NDJSON file. Use NDJSON for large
+        #   imports. Maximum upload size 25 MB (use `source_file_url` for bigger files). Mutually exclusive with
+        #   `source_file_url`.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionImportJob]
+        def create(
+          import_type: OMIT,
+          workflow_id: OMIT,
+          source_format: OMIT,
+          source_file_url: OMIT,
+          source: OMIT,
+          provider: OMIT,
+          credentials: OMIT,
+          options: OMIT,
+          status_mapping: OMIT,
+          dry_run: OMIT,
+          face_templates: OMIT,
+          lawful_basis_confirmed: OMIT,
+          file: OMIT,
+          request_options: nil
+        )
+          @client.request(
+            :post,
+            "/v3/session/imports/",
+            body: {
+              "import_type" => import_type,
+              "workflow_id" => workflow_id,
+              "source_format" => source_format,
+              "source_file_url" => source_file_url,
+              "source" => source,
+              "provider" => provider,
+              "credentials" => credentials,
+              "options" => options,
+              "status_mapping" => status_mapping,
+              "dry_run" => dry_run,
+              "face_templates" => face_templates,
+              "lawful_basis_confirmed" => lawful_basis_confirmed,
+              "file" => file
+            },
+            encoding: :auto,
+            file_fields: %w[file],
+            response: Types::SessionImportJob,
+            request_options: request_options
+          )
+        end
+
+        # List active import jobs
+        #
+        # What is running or waiting, plus what just ended, for a progress indicator.
+        #
+        # +GET /v3/import-jobs/active/+
+        #
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionsImportsListActiveJobsResponse]
+        def list_active_jobs(request_options: nil)
+          @client.request(
+            :get,
+            "/v3/import-jobs/active/",
+            response: Types::SessionsImportsListActiveJobsResponse,
+            request_options: request_options
+          )
+        end
+
+        # List verification import row errors
+        #
+        # List row-level errors for a verification import job, ordered by `row_number`. Use this endpoint to produce a
+        # corrected retry file containing only failed rows.
+        #
+        # +GET /v3/session/imports/{importId}/errors/+
+        #
+        # @param import_id [String]
+        # @param limit [Integer] Page size. Defaults to 50 when omitted.
+        # @param offset [Integer] Zero-based offset of the first record to return.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Page<Didit::Types::SessionImportError>]
+        def list_errors(import_id, limit: OMIT, offset: OMIT, request_options: nil)
+          @client.request(
+            :get,
+            "/v3/session/imports/{importId}/errors/",
+            path_params: { "importId" => import_id },
+            query: {
+              "limit" => limit,
+              "offset" => offset
+            },
+            page: Types::SessionImportError,
+            request_options: request_options
+          )
+        end
+
+        # List import jobs
+        #
+        # Every import of the application in one shape: verification imports and migrations, people and businesses.
+        #
+        # +GET /v3/import-jobs/+
+        #
+        # @param scope [String]
+        # @param limit [Integer]
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionsImportsListJobsResponse]
+        def list_jobs(scope: OMIT, limit: OMIT, request_options: nil)
+          @client.request(
+            :get,
+            "/v3/import-jobs/",
+            query: {
+              "scope" => scope,
+              "limit" => limit
+            },
+            response: Types::SessionsImportsListJobsResponse,
+            request_options: request_options
+          )
+        end
+
+        # List migration providers
+        #
+        # The 15 providers you can migrate verifications from: what each needs to connect, whether its API can list
+        # records, the permissions its key needs and its default status mapping.
+        #
+        # +GET /v3/session/imports/providers/+
+        #
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionsImportsListProvidersResponse]
+        def list_providers(request_options: nil)
+          @client.request(
+            :get,
+            "/v3/session/imports/providers/",
+            response: Types::SessionsImportsListProvidersResponse,
+            request_options: request_options
+          )
+        end
+
+        # Pause an import job
+        #
+        # Pause a queued or running import.
+        #
+        # +POST /v3/session/imports/{importId}/pause/+
+        #
+        # @param import_id [String]
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionImportJob]
+        def pause(import_id, request_options: nil)
+          @client.request(
+            :post,
+            "/v3/session/imports/{importId}/pause/",
+            path_params: { "importId" => import_id },
+            response: Types::SessionImportJob,
+            request_options: request_options
+          )
+        end
+
+        # Resume an import job
+        #
+        # Resume an import you paused. A job paused by the provider's rate limit resumes by itself.
+        #
+        # +POST /v3/session/imports/{importId}/resume/+
+        #
+        # @param import_id [String]
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionImportJob]
+        def resume(import_id, request_options: nil)
+          @client.request(
+            :post,
+            "/v3/session/imports/{importId}/resume/",
+            path_params: { "importId" => import_id },
+            response: Types::SessionImportJob,
+            request_options: request_options
+          )
+        end
+
+        # Retrieve a verification import job
+        #
+        # Retrieve import progress counters and terminal status for one job. Poll until `status` is `COMPLETED` or
+        # `FAILED`; `failed_count` > 0 means some rows were rejected - list them via the errors endpoint.
+        #
+        # +GET /v3/session/imports/{importId}/+
+        #
+        # @param import_id [String]
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionImportJob]
+        def retrieve(import_id, request_options: nil)
+          @client.request(
+            :get,
+            "/v3/session/imports/{importId}/",
+            path_params: { "importId" => import_id },
+            response: Types::SessionImportJob,
+            request_options: request_options
+          )
+        end
+
+        # Download verification import template
+        #
+        # Download the canonical CSV header for verification imports. The column set is determined by `import_type`.
+        # The first column of session templates is the idempotency key `external_id`.
+        #
+        # +GET /v3/session/imports/template/+
+        #
+        # @param import_type [String]
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [String, nil] the body bytes, or nil when a block receives the chunks
+        def retrieve_template(import_type: OMIT, request_options: nil, &block)
+          @client.request(
+            :get,
+            "/v3/session/imports/template/",
+            query: {
+              "import_type" => import_type
+            },
+            response: :binary,
+            accept: "text/csv, application/json",
+            request_options: request_options, &block
+          )
+        end
+
+        # Retry a migration
+        #
+        # Run a migration that ended again as a new job, with a new key (the old one was erased). It keeps the
+        # provider, workflow, region, status mapping and face templates choice; everything already in Didit is
+        # skipped.
+        #
+        # +POST /v3/session/imports/{importId}/retry/+
+        #
+        # @param import_id [String]
+        # @param credentials [Hash{String => String}] The provider's read-only key, with the field names
+        #   `credential_fields` lists. Encrypted at rest, never returned, and erased when the import ends. Send it as a
+        #   JSON string in multipart.
+        # @param file [Pathname, IO, String, Didit::FilePart] The record IDs or export file again, for `api_ids` and
+        #   `export_file` providers.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionImportJob]
+        def retry(import_id, credentials: OMIT, file: OMIT, request_options: nil)
+          @client.request(
+            :post,
+            "/v3/session/imports/{importId}/retry/",
+            path_params: { "importId" => import_id },
+            body: {
+              "credentials" => credentials,
+              "file" => file
+            },
+            encoding: :multipart,
+            file_fields: %w[file],
+            response: Types::SessionImportJob,
+            request_options: request_options
+          )
+        end
+
+        # Start a dry run
+        #
+        # Start a migration whose dry run finished (`READY`): the same job imports for real, with the status mapping
+        # and face templates choice as sent now.
+        #
+        # +POST /v3/session/imports/{importId}/start/+
+        #
+        # @param import_id [String]
+        # @param status_mapping [Hash{String => String}] Edits to the provider's default status mapping: source status
+        #   to Didit status. `Not Finished` and `Abandoned` are skipped and counted, never imported.
+        # @param face_templates [Boolean] Build face templates from the imported selfies and search them against the
+        #   application's faces and blocklist. Matches are flagged for review only. Requires `lawful_basis_confirmed`.
+        # @param lawful_basis_confirmed [Boolean] Confirms you have a lawful basis to share these selfies with Didit
+        #   as processor.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionImportJob]
+        def start(
+          import_id,
+          status_mapping: OMIT,
+          face_templates: OMIT,
+          lawful_basis_confirmed: OMIT,
+          request_options: nil
+        )
+          @client.request(
+            :post,
+            "/v3/session/imports/{importId}/start/",
+            path_params: { "importId" => import_id },
+            body: {
+              "status_mapping" => status_mapping,
+              "face_templates" => face_templates,
+              "lawful_basis_confirmed" => lawful_basis_confirmed
+            },
+            response: Types::SessionImportJob,
+            request_options: request_options
+          )
+        end
+      end
+
+      # The +sessions.reviews+ resource.
+      class Reviews < Didit::Resource
+        # Add a review note to a session's audit trail
+        #
+        # Append a note to a User Verification (KYC) session's review / activity feed. **This endpoint only records an
+        # entry - it never changes the session.** The session's `status` is left untouched, no status-transition
+        # validation runs, and no webhook fires. To actually approve, decline, or re-open a session (which also writes
+        # a fully-attributed `STATUS_UPDATED` entry to this feed), use `PATCH /v3/session/{session_id}/update-status/`
+        # instead.
+        #
+        # Both body fields are optional and an empty JSON object is accepted. `new_status` is stored purely as a label
+        # on the entry and accepts any of the ten session status values (case-sensitive). `@email` mentions inside
+        # `comment` are stored as plain text only - they trigger no notifications on this endpoint, and the entry's
+        # `mentioned_emails` stays empty.
+        #
+        # Note on attribution: entries created here carry no actor information. In the feed they show `actor_display:
+        # "Unknown"`, `actor_type: "CONSOLE_USER"`, and `activity_type: "STATUS_UPDATED"` (storage defaults), and the
+        # `201` body's `user` field is `"Unknown"`.
+        #
+        # +POST /v3/sessions/{session_id}/reviews/+
+        #
+        # @param session_id [String] UUID of the User Verification (KYC) session. Must belong to the same application
+        #   as the API key - cross-application UUIDs, deleted sessions, and Business Verification (KYB) session IDs all
+        #   return `404`.
+        # @param new_status [String, nil] Optional status label to record on the entry. Accepts any session status
+        #   value, case-sensitive (`"approved"` is rejected with `400`). Recording a status here does **not** change the
+        #   session's actual status - use the update-status endpoint for that.
+        # @param comment [String, nil] Optional free-text note (no enforced length limit). Stored verbatim; `@email`
+        #   mentions are not processed on this endpoint.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionsReviewsCreateResponse]
+        def create(session_id, new_status: OMIT, comment: OMIT, request_options: nil)
+          @client.request(
+            :post,
+            "/v3/sessions/{session_id}/reviews/",
+            path_params: { "session_id" => session_id },
+            body: {
+              "new_status" => new_status,
+              "comment" => comment
+            },
+            response: Types::SessionsReviewsCreateResponse,
+            request_options: request_options
+          )
+        end
+
+        # List session reviews and activity log
+        #
+        # Return the audit trail / activity feed for a User Verification (KYC) session, newest first, in a paginated
+        # envelope (`count` / `next` / `previous` / `results`, 50 entries per page by default).
+        #
+        # Feed entries are written by every actor that touches the session: manual decisions made through `PATCH
+        # /v3/session/{session_id}/update-status/` (which records `previous_status` → `new_status`), Console reviewer
+        # activity (comments with `@email` mentions, KYC/POA data edits, file uploads/removals, tag changes,
+        # detail-page views), AML ongoing-monitoring matches, and notes appended via `POST` on this same path. Reading
+        # this feed is the API-side equivalent of the **Activity** panel in the Didit Console session view.
+        #
+        # Only User Verification (KYC) sessions are addressable here; Business Verification (KYB) session IDs return
+        # `404`.
+        #
+        # +GET /v3/sessions/{session_id}/reviews/+
+        #
+        # @param session_id [String] UUID of the User Verification (KYC) session. Must belong to the same application
+        #   as the API key - cross-application UUIDs, deleted sessions, and Business Verification (KYB) session IDs all
+        #   return `404`.
+        # @param limit [Integer] Page size. Defaults to `50`.
+        # @param offset [Integer] Number of entries to skip from the start of the (ordered) feed. Defaults to `0`. The
+        #   `next` / `previous` URLs in the response carry the right values for walking the feed.
+        # @param ordering [String] Sort order. The feed defaults to newest first (`-created_at`); pass `created_at` to
+        #   read it oldest first. Unknown values are silently ignored (default order is used); other serializer field
+        #   names are also accepted.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Page<Didit::Types::ReviewItem>]
+        def list(session_id, limit: OMIT, offset: OMIT, ordering: OMIT, request_options: nil)
+          @client.request(
+            :get,
+            "/v3/sessions/{session_id}/reviews/",
+            path_params: { "session_id" => session_id },
+            query: {
+              "limit" => limit,
+              "offset" => offset,
+              "ordering" => ordering
+            },
+            page: Types::ReviewItem,
+            request_options: request_options
+          )
+        end
+      end
+
+      # The +sessions.signatures+ resource.
+      class Signatures < Didit::Resource
+        # Download a signed document
+        #
+        # Download the signed PDF of one document of an Electronic Signature step. Use the `signed_file` path of
+        # `signatures[].documents[]` in the decision. The PDF holds the document the signer was shown with their field
+        # values stamped, the evidence page (unless `signature_evidence_page` is off) and the PAdES signature with its
+        # timestamp. Didit checks the file against `sha256_signed` before returning it.
+        #
+        # Works for User Verification (KYC) and Business Verification (KYB) sessions. Needs `read:sessions`; your API
+        # key works. See the [Electronic Signature
+        # report](/core-technology/electronic-signature/report-electronic-signature#download-the-signed-documents).
+        #
+        # +GET /v3/session/{sessionId}/signatures/{nodeId}/documents/{documentId}/file/+
+        #
+        # @param session_id [String] The User Verification (KYC) or Business Verification (KYB) session.
+        # @param node_id [String] The Electronic Signature step: `node_id` of the item in `signatures[]`.
+        # @param document_id [String] `id` of the document in `signatures[].documents[]`.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [String, nil] the body bytes, or nil when a block receives the chunks
+        def download_document(session_id, node_id, document_id, request_options: nil, &block)
+          @client.request(
+            :get,
+            "/v3/session/{sessionId}/signatures/{nodeId}/documents/{documentId}/file/",
+            path_params: { "sessionId" => session_id, "nodeId" => node_id, "documentId" => document_id },
+            response: :binary,
+            accept: "application/pdf, application/json",
+            request_options: request_options, &block
+          )
+        end
+
+        # Download the signature evidence
+        #
+        # Download a signer's evidence PDF: the level and format, the signer and their verified identity session, the
+        # code confirmation, the IP address, each document with its original SHA-256 and field values, the
+        # certificate, the timestamp and the SHA-256 of every signed file. Use the `evidence_file` path of the
+        # signer's item in `signatures[]`.
+        #
+        # Always pass `signature_id` when a Business Verification step has several signers: without it, the route
+        # picks one of the step's signers. Needs `read:sessions`; your API key works.
+        #
+        # +GET /v3/session/{sessionId}/signatures/{nodeId}/evidence/+
+        #
+        # @param session_id [String] The User Verification (KYC) or Business Verification (KYB) session.
+        # @param node_id [String] The Electronic Signature step: `node_id` of the item in `signatures[]`.
+        # @param signature_id [String] `id` of the signer's item in `signatures[]`.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [String, nil] the body bytes, or nil when a block receives the chunks
+        def download_evidence(session_id, node_id, signature_id: OMIT, request_options: nil, &block)
+          @client.request(
+            :get,
+            "/v3/session/{sessionId}/signatures/{nodeId}/evidence/",
+            path_params: { "sessionId" => session_id, "nodeId" => node_id },
+            query: {
+              "signature_id" => signature_id
+            },
+            response: :binary,
+            accept: "application/pdf, application/json",
+            request_options: request_options, &block
+          )
+        end
+
+        # Download a signature image
+        #
+        # Download the signature or initials a signer applied to a field, as PNG. Use the `image_url` of the field in
+        # `signatures[].documents[].fields[]`. Needs `read:sessions`; your API key works.
+        #
+        # +GET /v3/session/{sessionId}/signatures/{nodeId}/fields/{fieldId}/image/+
+        #
+        # @param session_id [String] The User Verification (KYC) or Business Verification (KYB) session.
+        # @param node_id [String] The Electronic Signature step: `node_id` of the item in `signatures[]`.
+        # @param field_id [String] The field on this signer's copy, as in the field's `image_url`.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [String, nil] the body bytes, or nil when a block receives the chunks
+        def download_field_image(session_id, node_id, field_id, request_options: nil, &block)
+          @client.request(
+            :get,
+            "/v3/session/{sessionId}/signatures/{nodeId}/fields/{fieldId}/image/",
+            path_params: { "sessionId" => session_id, "nodeId" => node_id, "fieldId" => field_id },
+            response: :binary,
+            accept: "image/png, application/json",
+            request_options: request_options, &block
+          )
+        end
+
+        # Validate signatures again
+        #
+        # Re-check the signed documents of an Electronic Signature step. Didit re-reads every signed PDF, checks its
+        # SHA-256 and validates the PAdES signature, the certificate, the revocation data and the timestamp, then
+        # saves the result in each signer's `validation` and returns the updated items. Nothing is signed again. Send
+        # `signature_id` to check one signer; without it, every signer of the step is checked, and the call fails if
+        # any of them hasn't signed.
+        #
+        # Needs `write:sessions`; your API key works. In the console it's the **Validate again** button.
+        #
+        # +POST /v3/session/{sessionId}/signatures/{nodeId}/validate/+
+        #
+        # @param session_id [String] The User Verification (KYC) or Business Verification (KYB) session.
+        # @param node_id [String] The Electronic Signature step: `node_id` of the item in `signatures[]`.
+        # @param signature_id [String] `id` of one signer's item in `signatures[]`.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionsSignaturesValidateResponse]
+        def validate(session_id, node_id, signature_id: OMIT, request_options: nil)
+          @client.request(
+            :post,
+            "/v3/session/{sessionId}/signatures/{nodeId}/validate/",
+            path_params: { "sessionId" => session_id, "nodeId" => node_id },
+            body: {
+              "signature_id" => signature_id
+            },
+            response: Types::SessionsSignaturesValidateResponse,
+            request_options: request_options
+          )
+        end
+      end
+
+      # The +sessions.webhooks+ resource.
+      class Webhooks < Didit::Resource
+        # List session webhook deliveries
+        #
+        # List every webhook delivery Didit recorded for one verification session, user (KYC) or business (KYB),
+        # newest first, as a plain JSON array (not paginated). Each entry is one attempt to one destination: the first
+        # send, each automatic [retry](https://docs.didit.me/integration/webhooks#retry-policy) and each resend are
+        # separate entries with their own `uuid`, and retries and resends keep the payload's `event_id`.
+        # `request_header` and `request_body` are JSON text; parse them to read the signatures and the payload.
+        # Delivery records are available for about 30 days, so an empty array means no webhook has been sent for the
+        # session yet or every delivery is older than that. A scoped API key needs `sessions: read` and `decisions:
+        # read`.
+        #
+        # +GET /v3/session/{sessionId}/webhooks/+
+        #
+        # @param session_id [String] UUID of the verification session, user (KYC) or business (KYB): the `session_id`
+        #   returned by `POST /v3/session/`. The server resolves it against both session types. **Must be a valid
+        #   UUID.** The route only matches well-formed UUIDs, so a malformed value is rejected by the URL router before
+        #   any application code runs and the response is a `404` **HTML** page rather than the JSON `{"detail": ...}`
+        #   e...
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Array<Didit::Types::SessionWebhookDelivery>]
+        def list(session_id, request_options: nil)
+          @client.request(
+            :get,
+            "/v3/session/{sessionId}/webhooks/",
+            path_params: { "sessionId" => session_id },
+            response: [:array, Types::SessionWebhookDelivery],
+            request_options: request_options
+          )
+        end
+
+        # Resend session webhook delivery
+        #
+        # Send a recorded session webhook again to the URL it first went to, with the same payload and `event_id` and
+        # a fresh `timestamp`, `X-Timestamp` header and signatures. Didit signs it with the current secret of the
+        # destination the delivery belongs to (or the application-level secret for a delivery to the legacy webhook
+        # URL), waits up to 5 seconds for your endpoint, records the attempt as a new delivery and returns it with
+        # `200` whatever your endpoint answered: read `response_status`. A resend is not retried automatically, and
+        # every call sends again, so make your endpoint idempotent on `event_id`. The path has no trailing slash and
+        # the request has no body. A scoped API key needs `webhooks: write` and `decisions: read`.
+        #
+        # +POST /v3/session/{sessionId}/webhook/{webhook_uuid}/resend+
+        #
+        # @param session_id [String] UUID of the verification session, user (KYC) or business (KYB): the `session_id`
+        #   returned by `POST /v3/session/`. The server resolves it against both session types. **Must be a valid
+        #   UUID.** The route only matches well-formed UUIDs, so a malformed value is rejected by the URL router before
+        #   any application code runs and the response is a `404` **HTML** page rather than the JSON `{"detail": ...}`
+        #   e...
+        # @param webhook_uuid [String] UUID of the delivery to resend: the `uuid` of an entry returned by `GET
+        #   /v3/session/{sessionId}/webhooks/`. It must belong to the session in the path.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionWebhookDelivery]
+        def resend(session_id, webhook_uuid, request_options: nil)
+          @client.request(
+            :post,
+            "/v3/session/{sessionId}/webhook/{webhook_uuid}/resend",
+            path_params: { "sessionId" => session_id, "webhook_uuid" => webhook_uuid },
+            response: Types::SessionWebhookDelivery,
+            request_options: request_options
+          )
+        end
+
+        # Get session webhook delivery
+        #
+        # Retrieve one webhook delivery of a verification session: the URL it went to, the HTTP status your endpoint
+        # returned, and the exact headers and JSON body Didit sent. `request_header` and `request_body` are JSON text;
+        # to check your [signature verification](https://docs.didit.me/integration/webhooks#signature-verification),
+        # recompute `X-Signature-V2` from the parsed body with the secret of the destination it was sent to (or the
+        # application-level secret for a delivery to the legacy webhook URL). The path has no trailing slash: with one
+        # it returns `404`. A scoped API key needs `sessions: read` and `decisions: read`.
+        #
+        # +GET /v3/session/{sessionId}/webhook/{webhook_uuid}+
+        #
+        # @param session_id [String] UUID of the verification session, user (KYC) or business (KYB): the `session_id`
+        #   returned by `POST /v3/session/`. The server resolves it against both session types. **Must be a valid
+        #   UUID.** The route only matches well-formed UUIDs, so a malformed value is rejected by the URL router before
+        #   any application code runs and the response is a `404` **HTML** page rather than the JSON `{"detail": ...}`
+        #   e...
+        # @param webhook_uuid [String] UUID of the delivery: the `uuid` of an entry returned by `GET
+        #   /v3/session/{sessionId}/webhooks/`. It must belong to the session in the path.
+        # @param request_options [Hash, nil] :timeout, :max_retries, :extra_headers, :extra_query, :extra_body
+        # @return [Didit::Types::SessionWebhookDelivery]
+        def retrieve(session_id, webhook_uuid, request_options: nil)
+          @client.request(
+            :get,
+            "/v3/session/{sessionId}/webhook/{webhook_uuid}",
+            path_params: { "sessionId" => session_id, "webhook_uuid" => webhook_uuid },
+            response: Types::SessionWebhookDelivery,
+            request_options: request_options
+          )
+        end
+      end
+    end
+  end
+end