# Changelog ## 23-10-2026 ### Documentation - Corrected the PKCE challenges in the [PAR example](https://docs.stoe.no/id-check/api/par.md#complete-request-object-example) and [implementation guide](https://docs.stoe.no/id-check/getting-started/implementation.md) to match the documented token request verifier. - Updated the public and full OpenAPI specifications to describe EC signing keys and their certificate chain in the JWKS response. - Fixed the changelog link to the [document details fields](https://docs.stoe.no/id-check/api/par.md#document-details-fields). ## 22-10-2026 ### Documentation - The [OpenAPI specification](https://docs.stoe.no/id-check/api/openapi.md) is now embedded with Swagger UI at the existing `/api/openapi/` URL. ## 17-08-2026 ### ID Token - Added `jti` claim to the ID token, providing a unique identifier for each issued token ## 15-04-2026 ### Documentation - Added [Data Validation](https://docs.stoe.no/id-check/id-token.md#data-validation) guidance to ID Token documentation, clarifying RP responsibility for validating identity data against their own compliance requirements ## 10-03-2026 ### Documentation - Updated OpenAPI spec examples: all authorization callback and error redirect URIs now include the `iss` parameter per RFC 9207 - Updated [Implementation Guide](https://docs.stoe.no/id-check/getting-started/implementation.md) with `iss` parameter in callback example and validation guidance - Updated [Implementation Guide](https://docs.stoe.no/id-check/getting-started/implementation.md) token response example with `access_token` and `token_type` fields - Updated [Common Errors](https://docs.stoe.no/id-check/faq/common-errors.md) with `iss` parameter in error callback example and handling steps ## 09-03-2026 ### Changes - **Authorization response `iss` parameter**: The authorization callback now includes the `iss` parameter per [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207), enabling relying parties to verify the identity of the authorization server that issued the response. - **Token response `token_type` field**: The token response now includes `token_type: "Bearer"` per [RFC 6749 §5.1](https://www.rfc-editor.org/rfc/rfc6749#section-5.1). - **Token response `access_token` value**: The `access_token` field now returns `"not_applicable"` instead of an empty string. DIP is an identity verification service where the ID token is the primary artifact. - **Token endpoint cache headers**: The token endpoint now returns `Cache-Control: no-store` and `Pragma: no-cache` headers to prevent caching of token responses. - **Discovery metadata**: Added `authorization_response_iss_parameter_supported`, `code_challenge_methods_supported`, and `grant_types_supported` to the [OpenID Configuration](https://docs.stoe.no/id-check/api/openid-configuration.md) endpoint. ### Documentation - Updated [Token](https://docs.stoe.no/id-check/api/token.md) documentation with response headers and new fields - Updated [OpenID Configuration](https://docs.stoe.no/id-check/api/openid-configuration.md) documentation with FAPI 2.0 fields - Updated OpenAPI specs with new fields and response headers ## 12-02-2026 ### Breaking Changes - **`personal_number` in document details is now always a plain string**: For Norwegian documents, this is the fødselsnummer (NNIN). For non-Norwegian documents, this may contain a national identification number from the issuing country, or may be absent. ### Changes - **Document details** Changed how document issuer is requested - Requesting document issuer details is now done by setting `"issuer": null` in the `document_details` object of the PAR request. - No changes in how it is presented in the ID Token. ### Documentation - Updated [PAR documentation](https://docs.stoe.no/id-check/api/par.md#document-details-fields) to reflect new request format for document issuer details ## 11-02-2026 ### New Features - **Document Check Details**: Added OIDC4IA-compliant `check_details` array on document evidence, always included in the response - `vcrypt` entry for active authentication result (always present) - `data` entry for issuer registry verification (present when issuer check is available) ### Breaking Changes - **Removed `active_authentication_result` and `issuer_check` from `document_details`**: These legacy fields have been replaced by the `check_details` array on the document evidence object. Remove these fields from your PAR request `document_details` and read verification results from `check_details` instead. - **Discovery config `documents_check_methods_supported` changed**: Changed from `["bvr"]` to `["vcrypt", "data"]`. ### Documentation - Added [Document Check Details](https://docs.stoe.no/id-check/id-token.md#document-check-details) section to ID Token documentation - Updated [PAR documentation](https://docs.stoe.no/id-check/api/par.md) to remove deprecated fields ## 06-02-2026 ### New Features - **OIDC4IA trust_framework format**: `trust_framework` must be an object with a `value` field - Example: `{"trust_framework": {"value": "stoe"}}` - `trust_framework` is required when requesting verified claims ### Documentation