Changelog

2026-04-01

Collections API

• Collections are now a top-level /collections resource (breaking) — collection endpoints no longer live under the product namespace. POST /insurance/collection becomes POST /collections (shared across products), with insurance data read from GET /collections/{collectionId}/insurance/data. Status, supplemental information, policy documents and deletion move the same way. The request body also moves from the untyped input map (plus the consents and filter fields) to a typed parameters array, which changes how each Swedish login method (BankID, email) and the trade-union consent are supplied. See the migration guide for the endpoint mapping, parameter shapes, and per-login-method changes.

Changes made to CollectionStatusResponse

The following statuses have been added. No statuses have been removed.

• AUTHENTICATION_ERROR — returned when authentication fails for a reason other than incorrect credentials, for example a rejected consent or an error raised by the company during sign-in.
• LOGIN_METHOD_NOT_APPLICABLE — returned when the requested loginMethod cannot be used for the company.

Any exhaustive switch over the status enum needs a branch — or a default — for the new values. Every status, including those already returned by 2025-01-01, is described in the collection statuses table.

Changes made to CompanyAvailability

One status has been added to status. No statuses have been removed.

• DEGRADED_PERFORMANCE — returned when a company is experiencing intermittent issues, usually caused by errors at the data source. Collections can still be attempted, but they may fail or return incomplete data.

As with CollectionStatusResponse, an exhaustive switch over the availability status needs a branch — or a default — for the new value. Treating an unrecognised status as unavailable is the safer default.

User Management API

New endpoints for managing users and sessions. A collection started with a user session token is tied to that user, so you can verify that a caller owns a collection before returning its data.

• POST /users — Create a user with an externalId mapping to your system
• GET /users — Find a user by externalId
• GET /users/{userUuid} — Get user by UUID (supports both API key and JWT)
• DELETE /users/{userUuid} — Anonymize a user (soft delete)
• POST /users/{userUuid}/sessions — Create a JWT session token scoped to the user
• GET /users/{id}/collections — Get all collections for a user
• GET /collections — List the collections belonging to the session token's own user. Takes latest and statusIn query parameters, and requires a user session token

New schemas: UserResponse, CreateUserRequest, SessionResponse, CollectionSummary

Changes made to API responses

InsuranceFarm

• The type of the field insuredMovablesAmount has changed from integer to MonetaryAmount. This aligns it with every other insurance object carrying that field, which moved to MonetaryAmount in 2025-01-01.

Apart from that field, the insurance objects returned by 2026-04-01 are unchanged from 2025-01-01.