squarefi-bff-api-module 1.36.51 → 1.36.53

package/dist/api/frontend.d.ts

@@ -10,7 +10,7 @@ export declare const frontend: {
     };
     issuing: {
         cards: {
-            list: ({ status, ...params }?: API.Frontend.Issuing.Cards.List.Request) => Promise<API.Frontend.Issuing.Cards.List.Response>;
+            list: ({ status, ...params }: API.Frontend.Issuing.Cards.List.Request) => Promise<API.Frontend.Issuing.Cards.List.Response>;
             deposit: ({ card_id, ...data }: API.Frontend.Issuing.Cards.Deposit.Request) => Promise<API.Frontend.Issuing.Cards.Deposit.Response>;
             withdraw: ({ card_id, ...data }: API.Frontend.Issuing.Cards.Withdraw.Request) => Promise<API.Frontend.Issuing.Cards.Withdraw.Response>;
             getById: ({ card_id, }: API.Frontend.Issuing.Cards.Get.Request) => Promise<API.Frontend.Issuing.Cards.Get.Response>;
@@ -34,7 +34,7 @@ export declare const frontend: {
             create: (data: API.Frontend.Issuing.Cards.Create.Request) => Promise<API.Frontend.Issuing.Cards.Create.Response>;
         };
         cardholders: {
-            list: (params?: API.Frontend.Issuing.Cardholders.List.Request) => Promise<API.Frontend.Issuing.Cardholders.List.Response>;
+            list: (params: API.Frontend.Issuing.Cardholders.List.Request) => Promise<API.Frontend.Issuing.Cardholders.List.Response>;
             create: (data: API.Frontend.Issuing.Cardholders.Create.Request) => Promise<API.Frontend.Issuing.Cardholders.Create.Response>;
             getById: ({ cardholder_id, ...params }: API.Frontend.Issuing.Cardholders.Get.Request) => Promise<API.Frontend.Issuing.Cardholders.Get.Response>;
             delete: ({ cardholder_id, ...params }: API.Frontend.Issuing.Cardholders.Delete.Request) => Promise<API.Frontend.Issuing.Cardholders.Delete.Response>;
@@ -48,7 +48,7 @@ export declare const frontend: {
             };
         };
         subAccounts: {
-            getAll: (params?: API.Frontend.Issuing.SubAccounts.List.Request) => Promise<API.Frontend.Issuing.SubAccounts.List.Response>;
+            getAll: (params: API.Frontend.Issuing.SubAccounts.List.Request) => Promise<API.Frontend.Issuing.SubAccounts.List.Response>;
             getById: ({ sub_account_id, }: API.Frontend.Issuing.SubAccounts.Get.Request) => Promise<API.Frontend.Issuing.SubAccounts.Get.Response>;
             create: (data: API.Frontend.Issuing.SubAccounts.Create.Request) => Promise<API.Frontend.Issuing.SubAccounts.Create.Response>;
             transactions: ({ sub_account_id, ...params }: API.Frontend.Issuing.SubAccounts.Transactions.Request) => Promise<API.Frontend.Issuing.SubAccounts.Transactions.Response>;

package/dist/api/frontend.js

@@ -18,7 +18,7 @@ export const frontend = {
             // `status` is a comma-separated list on the wire (`status=ACTIVE,FROZEN`). The spec types it as
             // an array, which axios would default-serialize to `status[]=ACTIVE&status[]=FROZEN` — a form
             // the endpoint does not parse — so join it here and keep the array in the public type.
-            list: ({ status, ...params } = {}) => apiClientV1Frontend.getRequest('/frontend/issuing/cards', {
+            list: ({ status, ...params }) => apiClientV1Frontend.getRequest('/frontend/issuing/cards', {
                 params: status?.length ? { ...params, status: status.join(',') } : params,
             }),
             deposit: ({ card_id, ...data }) => apiClientV1Frontend.postRequest(`/frontend/issuing/cards/${card_id}/deposit`, { data }),
@@ -70,7 +70,7 @@ export const frontend = {
         // All write endpoints require the ADMIN role on the wallet; `wallet_id` travels as a query
         // parameter for access validation.
         cardholders: {
-            list: (params = {}) => apiClientV1Frontend.getRequest('/frontend/issuing/cardholders', { params }),
+            list: (params) => apiClientV1Frontend.getRequest('/frontend/issuing/cardholders', { params }),
             create: (data) => apiClientV1Frontend.postRequest('/frontend/issuing/cardholders', { data }),
             getById: ({ cardholder_id, ...params }) => apiClientV1Frontend.getRequest(`/frontend/issuing/cardholders/${cardholder_id}`, { params }),
             delete: ({ cardholder_id, ...params }) => apiClientV1Frontend.deleteRequest(`/frontend/issuing/cardholders/${cardholder_id}`, { params }),
@@ -111,7 +111,7 @@ export const frontend = {
             // Local-first list (`fiat_accounts` + computed balances + the program embed with its
             // cardholder KYC bar). `ids` (comma-separated) makes it a targeted read of specific
             // sub-accounts — prefer that over `getById`, whose shape varies with the vendor.
-            getAll: (params = {}) => apiClientV1Frontend.getRequest('/frontend/issuing/sub-accounts', { params }),
+            getAll: (params) => apiClientV1Frontend.getRequest('/frontend/issuing/sub-accounts', { params }),
             getById: ({ sub_account_id, }) => apiClientV1Frontend.getRequest(`/frontend/issuing/sub-accounts/${sub_account_id}`),
             create: (data) => apiClientV1Frontend.postRequest('/frontend/issuing/sub-accounts', { data }),
             transactions: ({ sub_account_id, ...params }) => apiClientV1Frontend.getRequest(`/frontend/issuing/sub-accounts/${sub_account_id}/transactions`, { params }),

package/dist/api/index.d.ts

@@ -7,6 +7,7 @@ import { frontend } from './frontend';
 import { issuing } from './issuing';
 import { kyc } from './kyc';
 import { list } from './list';
+import { massPayouts } from './mass-payouts';
 import { orders } from './orders';
 import { referrals } from './referrals';
 import { statements } from './statements';
@@ -26,6 +27,7 @@ type Api = {
     issuing: typeof issuing;
     kyc: typeof kyc;
     list: typeof list;
+    massPayouts: typeof massPayouts;
     orders: typeof orders;
     referrals: typeof referrals;
     statements: typeof statements;

package/dist/api/index.js

@@ -7,6 +7,7 @@ import { frontend } from './frontend';
 import { issuing } from './issuing';
 import { kyc } from './kyc';
 import { list } from './list';
+import { massPayouts } from './mass-payouts';
 import { orders } from './orders';
 import { referrals } from './referrals';
 import { statements } from './statements';
@@ -26,6 +27,7 @@ export const squarefi_bff_api_client = {
     issuing,
     kyc,
     list,
+    massPayouts,
     orders,
     referrals,
     statements,

package/dist/api/mass-payouts.d.ts

@@ -0,0 +1,29 @@
+import { API } from './types/types';
+/**
+ * Mass payouts (SFI-1528). Every endpoint is scoped by the source `wallet_id` and requires an
+ * administrative role on that wallet. The lifecycle is DRAFT -> (edit/preview) -> submit ->
+ * approve; nothing moves until approval, and `templates.*` are reusable recipient lists a draft
+ * can be seeded from.
+ *
+ * `list` / `items` filter by a single status value (not an array), so they need none of the
+ * comma-joining the issuing list endpoints do.
+ */
+export declare const massPayouts: {
+    list: ({ wallet_id, ...params }: API.MassPayouts.List.Request) => Promise<API.MassPayouts.List.Response>;
+    create: ({ wallet_id, ...data }: API.MassPayouts.Create.Request) => Promise<API.MassPayouts.Create.Response>;
+    getById: ({ wallet_id, id }: API.MassPayouts.GetById.Request) => Promise<API.MassPayouts.GetById.Response>;
+    update: ({ wallet_id, id, ...data }: API.MassPayouts.Update.Request) => Promise<API.MassPayouts.Update.Response>;
+    items: ({ wallet_id, id, ...params }: API.MassPayouts.Items.Request) => Promise<API.MassPayouts.Items.Response>;
+    preview: ({ wallet_id, id }: API.MassPayouts.Preview.Request) => Promise<API.MassPayouts.Preview.Response>;
+    submit: ({ wallet_id, id }: API.MassPayouts.Submit.Request) => Promise<API.MassPayouts.Submit.Response>;
+    approve: ({ wallet_id, id }: API.MassPayouts.Approve.Request) => Promise<API.MassPayouts.Approve.Response>;
+    cancel: ({ wallet_id, id }: API.MassPayouts.Cancel.Request) => Promise<API.MassPayouts.Cancel.Response>;
+    reportCsv: ({ wallet_id, id }: API.MassPayouts.ReportCsv.Request) => Promise<API.MassPayouts.ReportCsv.Response>;
+    templates: {
+        list: ({ wallet_id, ...params }: API.MassPayouts.Templates.List.Request) => Promise<API.MassPayouts.Templates.List.Response>;
+        create: ({ wallet_id, ...data }: API.MassPayouts.Templates.Create.Request) => Promise<API.MassPayouts.Templates.Create.Response>;
+        getById: ({ wallet_id, template_id, }: API.MassPayouts.Templates.GetById.Request) => Promise<API.MassPayouts.Templates.GetById.Response>;
+        update: ({ wallet_id, template_id, ...data }: API.MassPayouts.Templates.Update.Request) => Promise<API.MassPayouts.Templates.Update.Response>;
+        delete: ({ wallet_id, template_id, }: API.MassPayouts.Templates.Delete.Request) => Promise<API.MassPayouts.Templates.Delete.Response>;
+    };
+};

package/dist/api/mass-payouts.js

@@ -0,0 +1,40 @@
+import { apiClientV1Frontend } from '../utils/apiClientFactory';
+/**
+ * Mass payouts (SFI-1528). Every endpoint is scoped by the source `wallet_id` and requires an
+ * administrative role on that wallet. The lifecycle is DRAFT -> (edit/preview) -> submit ->
+ * approve; nothing moves until approval, and `templates.*` are reusable recipient lists a draft
+ * can be seeded from.
+ *
+ * `list` / `items` filter by a single status value (not an array), so they need none of the
+ * comma-joining the issuing list endpoints do.
+ */
+export const massPayouts = {
+    list: ({ wallet_id, ...params }) => apiClientV1Frontend.getRequest(`/frontend/mass-payouts/${wallet_id}`, { params }),
+    create: ({ wallet_id, ...data }) => apiClientV1Frontend.postRequest(`/frontend/mass-payouts/${wallet_id}`, { data }),
+    getById: ({ wallet_id, id }) => apiClientV1Frontend.getRequest(`/frontend/mass-payouts/${wallet_id}/${id}`),
+    // Draft-only. `items` fully replaces the recipient list; `virtual_account_id: null` clears the
+    // source virtual account and `scheduled_at: null` drops the schedule.
+    update: ({ wallet_id, id, ...data }) => apiClientV1Frontend.putRequest(`/frontend/mass-payouts/${wallet_id}/${id}`, {
+        data,
+    }),
+    items: ({ wallet_id, id, ...params }) => apiClientV1Frontend.getRequest(`/frontend/mass-payouts/${wallet_id}/${id}/items`, {
+        params,
+    }),
+    preview: ({ wallet_id, id }) => apiClientV1Frontend.getRequest(`/frontend/mass-payouts/${wallet_id}/${id}/preview`),
+    submit: ({ wallet_id, id }) => apiClientV1Frontend.postRequest(`/frontend/mass-payouts/${wallet_id}/${id}/submit`),
+    approve: ({ wallet_id, id }) => apiClientV1Frontend.postRequest(`/frontend/mass-payouts/${wallet_id}/${id}/approve`),
+    cancel: ({ wallet_id, id }) => apiClientV1Frontend.postRequest(`/frontend/mass-payouts/${wallet_id}/${id}/cancel`),
+    // `text/csv`, not the JSON envelope — the raw CSV body is resolved as a string. `responseType`
+    // is the repo's mechanism for non-JSON answers (see `statements.pdfByWalletUuid`); this one
+    // stays on the axios frontend client rather than the native fetch one because the fetch client
+    // has no Bearer variant and no 401-refresh, which every other `/frontend/*` call relies on.
+    reportCsv: ({ wallet_id, id }) => apiClientV1Frontend.getRequest(`/frontend/mass-payouts/${wallet_id}/${id}/report.csv`, { responseType: 'text' }),
+    templates: {
+        list: ({ wallet_id, ...params }) => apiClientV1Frontend.getRequest(`/frontend/mass-payouts/${wallet_id}/templates`, { params }),
+        create: ({ wallet_id, ...data }) => apiClientV1Frontend.postRequest(`/frontend/mass-payouts/${wallet_id}/templates`, { data }),
+        getById: ({ wallet_id, template_id, }) => apiClientV1Frontend.getRequest(`/frontend/mass-payouts/${wallet_id}/templates/${template_id}`),
+        // `items` fully replaces the row list; `virtual_account_id: null` clears the source account.
+        update: ({ wallet_id, template_id, ...data }) => apiClientV1Frontend.putRequest(`/frontend/mass-payouts/${wallet_id}/templates/${template_id}`, { data }),
+        delete: ({ wallet_id, template_id, }) => apiClientV1Frontend.deleteRequest(`/frontend/mass-payouts/${wallet_id}/templates/${template_id}`),
+    },
+};

package/dist/api/types/autogen/apiV1External.types.d.ts

@@ -1963,7 +1963,8 @@ export interface paths {
                         };
                     };
                 };
-                /** @description Bad Request - Missing required fields */
+                /** @description Bad Request — missing/invalid fields, or a `user_data_id` precondition not met (user not verified, no KYC applicant, or the applicant is unknown to the KYC provider). Code `INVALID_REQUEST`; the message names the failed precondition.
+                 *      */
                 400: {
                     headers: {
                         [name: string]: unknown;
@@ -2009,6 +2010,16 @@ export interface paths {
                         "application/json": components["schemas"]["ApiErrorResponse"];
                     };
                 };
+                /** @description The KYC provider failed while the dossier was being pulled for `user_data_id` (code `EXTERNAL_SERVICE_ERROR`). Retry later; the draft was not created.
+                 *      */
+                502: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ApiErrorResponse"];
+                    };
+                };
             };
         };
         delete?: never;
@@ -2155,7 +2166,120 @@ export interface paths {
         };
         options?: never;
         head?: never;
-        patch?: never;
+        /**
+         * Update cardholder
+         * @description Updates cardholder information (local row + vendor propagation of personal fields).
+         *     Same contract as `PATCH /frontend/issuing/cardholders/{cardholder_id}`.
+         *
+         *     **Authentication**: x-api-key header required
+         *
+         *     **Access Control**: Cardholder must belong to the authenticated wallet
+         *
+         */
+        patch: {
+            parameters: {
+                query?: {
+                    /** @description Wallet ID (required for non-wallet-bound API keys) */
+                    wallet_id?: string;
+                };
+                header?: never;
+                path: {
+                    /** @description The ID of the cardholder to update */
+                    cardholder_id: string;
+                };
+                cookie?: never;
+            };
+            requestBody: {
+                content: {
+                    "application/json": {
+                        /** @description Cardholder's first name */
+                        first_name?: string;
+                        /** @description Cardholder's last name */
+                        last_name?: string;
+                        /**
+                         * Format: email
+                         * @description Cardholder's email address
+                         */
+                        email?: string;
+                        /** @description Cardholder's phone number */
+                        phone?: string;
+                        /**
+                         * @description Cardholder's nationality as ISO 3166-1 alpha-3 country code
+                         * @example USA
+                         */
+                        nationality?: string;
+                        /** @enum {string} */
+                        gender?: "M" | "F";
+                        /** @enum {string} */
+                        cardholder_relationship?: "EMPLOYEE" | "CONTRACTOR";
+                        /** @enum {string} */
+                        gov_id_type?: "passport" | "id_card" | "driving_license" | "residence_permit_eu" | "residence_permit_ae" | "id_card_cn" | "id_card_hk";
+                        /** @description Identity document number (passport / driving licence / national ID). */
+                        gov_id_number?: string;
+                        /** @description 2-3 letter uppercase country code */
+                        gov_id_country?: string;
+                        /** Format: date */
+                        gov_id_issuance_date?: string;
+                        /** Format: date */
+                        gov_id_expiration_date?: string;
+                        /** @description Tax identifier (USA + Interlace CONSUMER: SSN, 9 digits or XXX-XX-XXXX) */
+                        tax_identification_number?: string;
+                        address?: {
+                            line1?: string;
+                            line2?: string;
+                            city?: string;
+                            state?: string;
+                            postal_code?: string;
+                            country?: string;
+                        };
+                    };
+                };
+            };
+            responses: {
+                /** @description Cardholder updated successfully */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /** @example true */
+                            success?: boolean;
+                            data?: components["schemas"]["Cardholder"];
+                            /** @example Cardholder updated successfully */
+                            message?: string;
+                        };
+                    };
+                };
+                /** @description Invalid request parameters */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ApiErrorResponse"];
+                    };
+                };
+                /** @description Access denied to this cardholder */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ApiErrorResponse"];
+                    };
+                };
+                /** @description Cardholder not found */
+                404: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": components["schemas"]["ApiErrorResponse"];
+                    };
+                };
+            };
+        };
         trace?: never;
     };
     "/api/issuing/cardholders/{cardholder_id}/documents": {
@@ -4112,6 +4236,8 @@ export interface paths {
                  *     - Missing required fields
                  *     - Invalid reference_id format
                  *     - Invalid amount (must be positive number)
+                 *     - `TOPUP_BELOW_MINIMUM` — credited amount is below the program's
+                 *       `min_topup` threshold (`error.details.min_topup`, program currency)
                  *      */
                 400: {
                     headers: {
@@ -4518,7 +4644,7 @@ export interface paths {
                         };
                     };
                 };
-                /** @description Validation error (insufficient balance, virtual account missing, etc.) */
+                /** @description Validation error — invalid body, pair disabled by the exchange config, or calculated amount too small. Balance is checked only at approve. */
                 400: {
                     headers: {
                         [name: string]: unknown;
@@ -4774,7 +4900,7 @@ export interface paths {
         };
         /**
          * Get order
-         * @description Retrieves a specific order by its numeric ID.
+         * @description Retrieves a specific order by its `id` (UUID; equal to `order_uuid` for orders created by the current flow).
          *
          *     **Authentication**: x-api-key header required
          *
@@ -4784,7 +4910,7 @@ export interface paths {
                 query?: never;
                 header?: never;
                 path: {
-                    order_id: number;
+                    order_id: string;
                 };
                 cookie?: never;
             };
@@ -4835,8 +4961,10 @@ export interface paths {
          *     debits the funds (transaction written as `complete`) and triggers the
          *     order execution pipeline. Exchange orders (EXCHANGE_OMNI) and internal
          *     transfers (TRANSFER_INTERNAL / OMNIBUS_INTERNAL_TRANSFER) settle
-         *     synchronously and land in COMPLETE. An insufficient balance fails the
-         *     order (FAILED). Only orders with status NEW can be approved. Orders
+         *     synchronously and land in COMPLETE. An insufficient balance answers
+         *     400 `INSUFFICIENT_FUNDS` and releases the order back to NEW; FAILED is
+         *     reached only when a step after the debit fails. Only orders with
+         *     status NEW can be approved. Orders
          *     created with `scheduled_at` move to EXPECTED instead — no funds are
          *     debited until execution at the requested time.
          *
@@ -4853,7 +4981,7 @@ export interface paths {
             };
             requestBody?: never;
             responses: {
-                /** @description Order approved and processing started */
+                /** @description Order approved — PROCESSING for workflow rails, COMPLETE for exchange / internal transfers, EXPECTED for scheduled orders */
                 200: {
                     headers: {
                         [name: string]: unknown;
@@ -4863,11 +4991,23 @@ export interface paths {
                             /** @example true */
                             success?: boolean;
                             data?: components["schemas"]["Order"];
-                            /** @example Order approved and processing started */
-                            message?: string;
                         };
                     };
                 };
+                /** @description Insufficient funds (`INSUFFICIENT_FUNDS` — the order is released back to NEW) or validation error */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
+                /** @description Order does not belong to the API key's wallet */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
                 /** @description Order not found */
                 404: {
                     headers: {
@@ -4875,7 +5015,7 @@ export interface paths {
                     };
                     content?: never;
                 };
-                /** @description Invalid status transition (order is not in NEW status) */
+                /** @description Order is not in an approvable state (`INVALID_STATE`), or another lifecycle call holds the order lock (`OPERATION_IN_PROGRESS`) */
                 409: {
                     headers: {
                         [name: string]: unknown;
@@ -4885,7 +5025,7 @@ export interface paths {
                             /** @example false */
                             success?: boolean;
                             error?: {
-                                /** @example INVALID_STATUS_TRANSITION */
+                                /** @example INVALID_STATE */
                                 code?: string;
                                 message?: string;
                             };
@@ -4952,11 +5092,16 @@ export interface paths {
                             /** @example true */
                             success?: boolean;
                             data?: components["schemas"]["Order"];
-                            /** @example Order canceled successfully */
-                            message?: string;
                         };
                     };
                 };
+                /** @description Order does not belong to the API key's wallet */
+                403: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content?: never;
+                };
                 /** @description Order not found */
                 404: {
                     headers: {
@@ -4964,7 +5109,7 @@ export interface paths {
                     };
                     content?: never;
                 };
-                /** @description Invalid status transition */
+                /** @description Order is not in a cancelable state (`INVALID_STATE`), or another lifecycle call holds the order lock (`OPERATION_IN_PROGRESS`) */
                 409: {
                     headers: {
                         [name: string]: unknown;
@@ -5110,7 +5255,7 @@ export interface paths {
         /**
          * Crypto
          * @description Sends crypto from the wallet's omnibus balance to an external blockchain
-         *     address (or another internal wallet) via a previously-created counterparty
+         *     address via a previously-created counterparty
          *     destination.
          *
          *     Two-phase: the order is created in `NEW` status without touching the
@@ -5121,7 +5266,7 @@ export interface paths {
          *     only through the internal transfer endpoint.
          *
          *     **Prerequisites:**
-         *     - A counterparty destination of type `CRYPTO_EXTERNAL` or `CRYPTO_INTERNAL`
+         *     - A counterparty destination of type `CRYPTO_EXTERNAL`
          *       created via `POST /api/counterparty/destinations`.
          *     - Sufficient balance in `from_currency_id` at approve time on the wallet
          *       bound to the API key.
@@ -5214,8 +5359,8 @@ export interface paths {
          * @description USD domestic Wire offramp. Funds are debited from the wallet's virtual account
          *     and sent to the bank counterparty destination.
          *
-         *     `wallet_id` is resolved from the API key. `virtual_account_id` may be
-         *     auto-resolved when omitted.
+         *     `wallet_id` is resolved from the API key. `virtual_account_id` is
+         *     required (there is no auto-resolution).
          *
          */
         post: {
@@ -5301,8 +5446,8 @@ export interface paths {
          * ACH
          * @description USD ACH offramp. Cheaper than Wire but slower (T+1..T+2 business days).
          *
-         *     `wallet_id` is resolved from the API key. `virtual_account_id` may be
-         *     auto-resolved when omitted.
+         *     `wallet_id` is resolved from the API key. `virtual_account_id` is
+         *     required (there is no auto-resolution).
          *
          */
         post: {
@@ -5387,7 +5532,7 @@ export interface paths {
         /**
          * SEPA
          * @description EUR SEPA offramp (SEPA / SEPA Instant depending on counterparty support).
-         *     The counterparty destination must be of type `BANK_SEPA`.
+         *     The counterparty destination must be of type `SEPA`.
          *
          */
         post: {
@@ -6942,7 +7087,7 @@ export type webhooks = Record<string, never>;
 export interface components {
     schemas: {
         /**
-         * @description Order type identifier. Must be one of the active values from the `order_types` table. Examples: `EXCHANGE_OMNI` (omnibus exchange), `L2F_SWIFT_OFFRAMP` (SWIFT offramp), `OMNIBUS_CRYPTO_TRANSFER` (crypto withdrawal). Legacy `DEPOSIT_*`, `WITHDRAWAL_*` and `AUTO_CONVERT_CRYPTO` are intentionally excluded.
+         * @description Order type identifier. Must be one of the active values from the `order_types` table. Examples: `EXCHANGE_OMNI` (omnibus exchange), `BRL_WIRE_OFFRAMP` (wire offramp), `OMNIBUS_CRYPTO_TRANSFER` (crypto withdrawal). `L2F_*` ids are historical (rail retired) and cannot be used to create orders. Legacy `DEPOSIT_*`, `WITHDRAWAL_*` and `AUTO_CONVERT_CRYPTO` are intentionally excluded.
          * @example EXCHANGE_OMNI
          * @enum {string}
          */
@@ -7084,18 +7229,28 @@ export interface components {
             /** @description Per transaction amount spent */
             per_transaction_spent?: number;
         };
-        /** @description Sensitive card data */
+        /** @description Sensitive card data, live-fetched from the vendor on every call and never persisted. */
         CardSensitiveData: {
-            /** @description Full card number */
-            card_number?: string;
-            /** @description Card security code */
-            cvv?: string;
-            /** @description Card expiration month (MM) */
-            expiry_month?: string;
-            /** @description Card expiration year (YYYY) */
-            expiry_year?: string;
-            /** @description Card PIN (if applicable) */
-            pin?: string;
+            /**
+             * @description Full card number
+             * @example 4111111111111111
+             */
+            card_number: string;
+            /**
+             * @description Card expiration date, `MM/YY`
+             * @example 07/29
+             */
+            expiry_date: string;
+            /**
+             * @description Card security code
+             * @example 123
+             */
+            cvv: string;
+            /**
+             * @description 3-D Secure password where the vendor exposes one (Wallester); `null` otherwise.
+             * @example null
+             */
+            security_code: string | null;
         };
         /** @description Card transaction */
         IssuingTransaction: {
@@ -7902,7 +8057,7 @@ export interface components {
             meta?: Record<string, never> | null;
             currency?: components["schemas"]["CurrencyRef"];
         };
-        /** @description Filtered order metadata (only public fields) */
+        /** @description Order metadata. List and single-read responses reduce it to the public allowlist; create/approve/cancel responses return the stored meta minus scheduler-internal keys */
         OrderMeta: {
             /** Format: uuid */
             request_id?: string | null;
@@ -8021,7 +8176,7 @@ export interface components {
             to_currency_id?: string;
             /**
              * Format: uuid
-             * @description UUID of a `CRYPTO_EXTERNAL` or `CRYPTO_INTERNAL` counterparty destination previously created via `POST /api/counterparty/destinations`.
+             * @description UUID of a `CRYPTO_EXTERNAL` counterparty destination previously created via `POST /api/counterparty/destinations`.
              * @example b2f3d8c1-4a7e-4d22-9c5f-1e6a8d0b2a44
              */
             counterparty_destination_id: string;
@@ -8072,13 +8227,13 @@ export interface components {
             to_currency_id?: string;
             /**
              * Format: uuid
-             * @description Virtual account UUID used as the funding source for the off-ramp. May be auto-resolved by the platform if omitted, but providing it explicitly is recommended.
+             * @description Virtual account UUID used as the funding source for the off-ramp (required; the order type is resolved from its program).
              * @example 11111111-2222-3333-4444-555555555555
              */
             virtual_account_id: string;
             /**
              * Format: uuid
-             * @description Bank counterparty destination UUID created via `POST /api/counterparty/destinations`. The destination type must match the rail (WIRE/ACH/SEPA/SWIFT/CHAPS/FPS).
+             * @description Bank counterparty destination UUID created via `POST /api/counterparty/destinations`. The destination type must match the rail (FEDWIRE for wire, ACH, SEPA, SWIFT, CHAPS, FPS).
              * @example b2f3d8c1-4a7e-4d22-9c5f-1e6a8d0b2a44
              */
             counterparty_destination_id: string;