---
id: changelog-2026-q4
title: Q4 2026 (October - December)
description: Product updates for the Organisation Wallet Suite and Data Wallet in Q4 2026.
hide_title: false
sidebar_label: Q4 2026 (Oct - Dec)
keywords: [changelog, release notes, Organisation Wallet Suite, Data Wallet, iGrant.io, Q4 2026, migration, issuance history, webhooks]
slug: /changelog/2026-q4/
---

> **Build this with an AI coding agent.** Install the iGrant.io Agent Skills, then ask your agent to build the integration:
>
> ```bash
> npx skills add L3-iGrant/skills
> ```


## November 2026 (2026.11.x)

This release includes breaking changes to the wallet API. Where an endpoint still has an old path in the iGrant.io cloud service, its endpoint page shows that path behind a switch.

### Organisation Wallet Suite
- One path scheme for the wallet API - all wallet routes now follow `/v4/{group}/ows/{role}`, without the `digital-wallet`, `openid` and `sdjwt` segments, and path parameters are named after their resources
- Issuance history - the issuance history replaces the credential history as the record of one credential configuration offered to one wallet (`credentialExchangeId`), with a typed issue body, a transaction code generated by the issuer and a list of its issued credentials
- Several credential configurations in one offer - one issue call creates an issuance history for each credential configuration of the definition, all in one credential offer with one QR code. Filter by `offerId` to find them
- Key attestation checks - the issuer rejects a self-attested key attestation: it must be signed by a wallet provider or, on Android, chain to the Google Hardware Attestation Root. Each check is recorded with a stable `KA_*` code and shown in the dashboard
- Display of the other party - records show the name, logo and cover image exactly as the other party provides them, or `null`, instead of placeholders such as "Unknown". New organisations no longer get a generated logo or a stock cover image
- Trust gates - the gates have one name each (credential signer, issuer, relying party, status issuer and wallet provider) with matching settings and checks. A check runs only when its Require switch is on, and only against its accepted list, and a trust source shows where it is used
- Final revocation - revoking an issuance history revokes all of its credentials. The issuer no longer suspends a credential or makes a revoked credential valid again
- Cursor pages - the issuer lists return pages of `{"items", "nextCursor"}`, with a total only on request (`includeTotal=true`)
- Issuance statistics - issuance histories are counted in five buckets (in progress, expired, denied, issued and revoked), for the organisation and for each credential definition
- Expiry of unused offers - an issuance history in progress expires at the end of its current grant
- Credential definition versions - every change creates a new version that the issuance histories refer to, and the revocation settings belong to each credential configuration
- Configuration with PATCH - the issuer, holder, verifier and wallet provider configurations are updated with `PATCH` and a JSON Merge Patch, and the issuer settings are grouped by protocol
- Webhook events - new event types `ows.<role>.<resource>.<event>` for the issuer, verifier and holder, with a small signed body, delivery in order and retries for up to 24 hours. See [Webhook Events](/docs/openid4vc-webhooks/)
- Protocol endpoints - the token, nonce, credential and other issuer endpoints are now under `/organisation/{organisationId}/service/{version}`, as given in the issuer metadata
- Signing key in each credential configuration - a request that creates or updates a credential definition sets `cryptographicKeyFormat` and `cryptographicKeyIdentifier` in each credential configuration, and a signing key at the top level is refused (`credential_definition.configuration_fields_at_top_level`). The old paths still accept it and use it for each credential configuration that has no signing key of its own
- Removed - `requiresWalletAttestation`, the top-level `allowsCredentialReissuance` of a credential definition, the trusted list check of the organisation's own keys, the route `POST /v4/config/ows/key-management/trust-lookup`, and holder support for registration certificates (it will come back later)

## October 2026 (2026.10.x)

### Organisation Wallet Suite
- More secure vaults for signing keys - organisations can now store signing keys in OpenBao, HashiCorp Vault, Google Cloud KMS, AWS KMS, Azure Key Vault or a QTSP via the CSC API, with PKCS#11 HSM support for on-premise deployments
- Fine-grained API key permissions - API key access control now supports 115 permissions across 29 resources, restricting each integration to authorised endpoints and storing only secure, keyed hashes
- Purpose-specific certificate templates - key management now supports purpose-specific certificate templates for PID, EAA, QEAA, WRPAC, mdoc and status list signing, with key usage and expiry details aligned with ETSI EN 319 412-2
- Standard OpenID4VCI 1.0 error codes - issuer, authorisation server and wallet provider errors now follow standard OpenID4VCI 1.0 OAuth error codes, with clearer descriptions for troubleshooting
- Certified security levels for wallet key attestation - wallet key attestation now supports certified security levels, including Android StrongBox, verified boot checks and attestation revocation validation, aligned with OpenID4VCI 1.0 and EUDI ARF TS3
- OpenID conformance checklists and sandbox signing keys - OpenID conformance testing now includes profile-specific configuration checklists and bulk report downloads, while sandboxes support full signing key management
- Stricter issuance and verification checks - credential issuance and verification now include single-use pre-authorised codes, full certificate-chain validation, stricter PID and age verification checks, standardised credential matching and encrypted request compression

### Data Wallet
- Verifier authentication and clearer request errors - OpenID4VP 1.0 verifier authentication now supports X.509 certificates, DID keys, and verifier attestations, alongside encrypted requests, advanced credential queries, localised error messages, and explanations of invalid requests in 16 languages
- Multiple transactions in one request - the SDK now supports multiple transactions in a single OpenID4VP request, with individual transaction hashes and EUDI ARF TS12 support for payments, login risk, account access and e-mandates
- OpenID4VCI 1.0 issuance improvements - OpenID4VCI 1.0 issuance now supports signed issuer metadata, deferred credential handling, clearer issuance states and DPoP-bound token refresh and notifications
- Clearer error feedback - standardised SDK error handling now preserves issuer and authorisation server error codes, enabling clearer user feedback, retry handling, and management of rejected credential reissuance
- Age verification with redirect URIs - age verification now supports redirect URI-based services, with controlled acceptance of unsigned requests through synchronised wallet metadata
- Accessibility, security and usability improvements - accessibility improvements include localised screen-reader labels, hardware-backed key handling, enhanced Android device attestation, automatic Wallet Unit Attestation renewal and clearer credential details