Changes deployed to the Trust Framework directory during 2026 — the Raidiam-operated directory, certificate authority, and role/scope reference data that underpins participant identity. Each entry records what was deployed, when it became effective, and its category.
Narrow by category or add a keyword to search titles and descriptions.
A new directory:software:organisation:application:management scope lets a software client programmatically create, update, suspend, and delete other clients within the same organisation, supporting automated onboarding workflows.
Directory API endpoints now support filtering, sorting, and partial-match search across organisations, contacts, authority claims, domain users, API resources, certifications, applications, and administrators.
The Documents page has been redesigned into a single scrollable view, replacing the previous two-tab layout. Pending signatures and signing history are combined into collapsible sections.
Audit table columns can now be sorted directly from the UI.
Resolved an error when using the sign button on deleted documents.
Fixed domain status validation when adding authority role claims.
Corrected the organisation search clear button and filter persistence.
Fixed the Terms & Conditions signers dropdown to reflect the actual signer count.
Improved page size validation on the clients endpoint.
Restored selectability of the type field in federation entity management.
Corrected the creation date displayed for Reference Data flags.
Fixed token endpoint 500 errors on account lookup and short credential values.
The audit log endpoint now fully implements the sort parameter, letting consumers retrieve audit records ordered by date and rely on deterministic ordering when querying audit history.
Organisations can now register and manage links to external documents. A new Regulatory Documents tab, with dedicated API endpoints, captures a document type, a validated HTTPS URI, and an optional description, while a Regulatory Document Types tab in Reference Data lets administrators manage the available types. Read-only users see the list without edit controls. The feature is disabled by default and can be enabled per request.
A new Certificate Authorities section in Reference Data provides full root CA lifecycle management: create, view, update, enable, and disable root CAs via PEM upload or paste. A unified wizard auto-detects the certificate type (root only, root with intermediate, or intermediate referencing an existing root) and visualises the trust chain as an interactive node graph. Administrators can edit a Root CA name or an Intermediate CA chain name directly, and the Intermediates tab supports View, Enable, and Disable with confirmation dialogs. The wizard resumes from the intermediates step on retry without re-creating the root CA, hierarchical mTLS trust constraints are enforced, and validation covers duplicate detection, invalid file formats, and required contact fields.
Organisation records now expose an audit trail, consistent with the audit functionality already available for applications. Users with appropriate permissions can review a chronological history of changes made to an organisation.
The /clients endpoint response now includes an organisation_name field, populated from the organisation record, allowing identity providers to display the organisation name associated with a client and supporting distributor and representative model use cases.
Audit history is now available for application certificates (navigable by application and by certificate, identified by key type and KID), organisation roles (navigable by role name), and organisation domains (navigable by domain name).
The /token endpoint response now includes a grant_id field for code exchange and refresh token flows, allowing TPPs to retrieve user consents even after tokens are revoked. It is included by default and can be disabled per environment via grant_id_in_token_response=false; existing token response structures and flows are unaffected.
A new generic grant revocation endpoint operates independently of specific consent flows. Grants are soft-deleted on revocation, preserving history and the revocation reason (for example TPP-initiated, refresh token reuse, or session end), with configurable TTL-based expiry — access tokens have a 1-hour lifetime while refresh tokens and grants have a 100-year lifetime. A migration is required to create or drop TTL indexes depending on the soft-deletion configuration.
The audit API now supports the authorisationServerCertification resource type alongside server roles and API resources, queryable with the standard actionType, organisationId, resourceId, performedBy, and date-range parameters. Requests using the server certification resource type previously returned a "resource type not implemented" error.
The Directory UI now uses HTTP DELETE when removing authorisation servers, API resources, and server certifications, replacing the previous behaviour of calling PUT with a status of Inactive. The change is internal to the UI and requires no action from API consumers or integrators.
Multi-step wizards now adapt to screen size: step numbers only on mobile, step numbers with hover tooltips on small laptops, and full step labels on larger screens.
When deactivating an Authority still bound to active authorisation domain mappings, the API error response now includes the IDs of all bound domains, allowing administrators to identify and remove the relevant mappings before retrying.
API auto-fill now fetches the registered endpoint regex format for the relevant API family rather than the API family version, so auto-populated values more accurately reflect the expected endpoint structure.
Path segments expected to be UUIDs — authorisation server ID, software statement ID, and domain user ID — now return a clean 400 Bad Request instead of an unhandled 500 Internal Server Error.
Setting an organisation administrator to Active via PUT no longer triggers a reactivation email when the user is already active; the API now suppresses the email when no state change has occurred.
When creating an authorisation server, optional fields that were edited and then cleared are now omitted from the request payload rather than submitted as empty strings, which previously caused an API error.
A race condition that could cause duplicate key violations when multiple requests initialised the same user simultaneously is now handled correctly, returning a 400 Bad Request instead of an unhandled server error.
Updates to API Resources now consistently produce audit entries retrievable via the audit API; previously no audit records were created, causing the audit endpoint to return empty results.
Flag values are now correctly returned for organisations, authorisation servers, and software statements in directory snapshot data replicated to Open Finance consumers, in line with the published API specification.
When creating an IDP configuration fails, the UI now displays the meaningful error returned by the API rather than a generic message, giving administrators clear guidance on what to correct.
Applications now include an audit history view that supports comparing versions side by side. When non-sequential versions are compared, the interface warns that intermediate changes may not be reflected in the diff. Tabs for certificates, flags, and roles are present and marked as coming soon.
The Authorisation Servers list page now includes a Show active servers only toggle, mirroring the equivalent filter already available on the Applications list.
The audit view now includes a primary switcher that lets users move between resources and their associated audit items.
Filter controls now collapse into a filter count icon on smaller screens, keeping filtering accessible on mobile without crowding the layout.
User registration now validates email format, with invalid formats rejected at the API level.
Search endpoints now accept both repeated query parameters and comma-separated values for the same parameter.
The Service Desk scope now retrieves contacts across all visibility levels.
Global search now supports organisation registration numbers and parent organisation IDs as search criteria.
Fixed an issue where success modals could appear before an Application wizard step had completed.
Fixed enable/disable role validation for Domain Users, with clearer error messaging.
Corrected low-contrast informational messages in the simulator consent flows.
Fixed evaluation of the Family complete flag for Open Data API families.
Repaired sorting on the authority list.
Eliminated duplicate network requests issued on certain pages.
Corrected certificate table alignment and column responsiveness.
Fixed visibility of the error shown when disabling a Domain Mapping that is still in use.
Resolved an issue with field toggle behaviour on the IDP Configuration screen.
The current directory version is now shown in the UI via the profile menu. Selecting Versions opens a modal displaying the active release version with direct links to the Release Notes and API documentation.
Authorisation Servers now include a dedicated Roles tab. The tab surfaces associated domains, roles, and authorities, and allows administrators to add and manage server roles directly from the server detail view.
The onboarding verification flow now separates email and phone OTP validation into distinct steps. Email validation runs first, followed by phone where applicable. Phone OTP is skipped when not configured in the environment.
A new directory:software:audit scope supports automated retrieval of audit logs via client credentials, without a human user account. Organisation Administrators can use an Application with this scope to query audit endpoints programmatically.
Action icons on Organisation, Server, and Application cards are now visually disabled when unavailable. A tooltip clarifies why the action is inactive or permission-restricted.
Toggle controls across the Directory have been updated to align with the design system.
The global search bar now scales responsively across screen sizes, adapting on mobile and dynamically adjusting on larger displays.
The Certification Type and Certification Type Variant dropdowns now support auto-complete and pagination, improving usability when working with a large number of certification types.
Forms within dialogs now scroll to the first invalid field when validation fails, while preserving error summary visibility.
Fixed an issue where typing in the global search bar briefly displayed "No results for…" before the search completed. The interface now correctly shows a "Searching…" state during queries.
Fixed an issue where configuring API resource metadata at the authorisation server level incorrectly applied the same schema to multiple distinct API Families. Each API Family now reflects its own configured metadata schema.
Fixed an issue preventing organisation users with appropriate type access from updating API resource metadata on an Authorisation Server.
The Application Details page has been redesigned for a clearer, more structured layout. Key information such as flags and core application details is shown prominently at the top, while detailed sections are collapsed by default.
A new guided wizard simplifies creating Identity Providers. The wizard provides clearer visual feedback during configuration and consolidates IDP and IDP version creation into a single flow.
Applications participating in a federation now display clear visual indicators. A Federated tag is shown on the application page, and a collapsible section provides visibility into the federation hierarchy — the current entity, the parent entity, and the trust anchor.
Additional helpers and contextual guidance have been added to the API Families configuration screens, helping users understand certification types and configuration requirements during creation.
The sidebar on mobile now opens as a partial overlay rather than a full-screen panel, allowing users to keep context with the underlying page.
Selected configuration forms now support prepopulated values, reducing manual input and improving consistency when creating new resources.
Endpoint generation in the API resource wizard now correctly produces patterns based on the actual API version and properly handles version numbers and dot notation.
The "Generating Assertion" confirmation dialog no longer appears when generating an assertion for an already-locked application.
Disabling a Domain Mapping that is still in use now surfaces the API error to the user.
The Add IDP Configuration button is now correctly disabled when the Authorisation Server is inactive.
Suspended applications can now be deleted directly from the Application Details page.
Updates to Domain User information are now reflected immediately, without requiring a page refresh.
Corrected wording in the Disable Flag confirmation dialog (previously said "certification" instead of "flag").
Resolved several issues including duplicate endpoint definitions, incorrect version handling for generated endpoints, and improved validation when defining endpoint patterns.
Fixed an issue preventing creation of Authorisation Domain Roles when the description exceeded the allowed character limit.
API Families can now be configured through Reference Data, allowing ecosystem operators to centrally manage which API families are available and giving participants a clear view of supported APIs.
Certificates now support a Description field to help identify their purpose. The description can be set during certificate creation and updated later, improving clarity for participants managing certificates across multiple environments.
A redesigned Authorisation Server details page introduces a clearer, more structured layout. Key information such as flags and core server details is easier to identify, with sections grouped and collapsed by default.
Federation details now display all relevant federation endpoints rather than only the Fetch endpoint, improving transparency when configuring, validating, and troubleshooting federation integrations.
Authorities now clearly indicate which Organisation they belong to when viewed under Reference Data. Where applicable, an Organisation tag links directly to the associated Organisation. Legacy Authorities include an explanation of their previous creation model.
The UI now clearly explains the difference between Federation roles and Directory roles, including how metadata behaves differently between them. This reduces confusion when role metadata does not propagate for Federation roles.
A unified layout with improved spacing, pagination, and visual consistency has been applied across Organisations, Authorisation Mapping, Domain Users, Terms & Conditions, and Audit History.
The legacy "New Organisation" button has been removed. The guided Organisation creation wizard is now the standard method for creating Organisations.
Action labels across the Directory have been standardised to Enable / Disable for clarity and consistency when managing resources.
Data Administrator users can now manage the Participant Terms & Conditions Signing required? setting when editing Organisations.
Logo uploads now display an image preview before saving. Drag-and-drop uploads are consistently supported across Organisations, Servers, and Applications.
Fixed missing actions for approved IDP versions.
Fixed Organisation ID regeneration issues during the Organisation creation flow.
Eliminated unnecessary duplicate backend requests on Reference Data pages.
Improved validation when configuring Authorisation Servers to prevent invalid configurations.
Resolved issues affecting flag management and configuration visibility across the UI.
Corrected icon visibility issues across the UI for improved visual consistency.
The Federations page is no longer reachable when Federations are disabled in the ecosystem.
Reduced unnecessary backend calls when editing Applications.
Resolved filtering issues when using the My Organisations filter.
Corrected placeholder text displayed in document signing dialogs.
Added missing required-field indicators in Application configuration screens.
General stability, consistency, and reliability improvements across the Directory UI.
For changes deployed to the API Hub platform rather than the directory, see API Hub Release Notes. For corrections to published documentation, see Erratas.
