Generated SDK #2768393570 (major)

[sdk-generation-automation]

Changelog

2026-08-18

Breaking Change

Fix Travel Rule legalPerson name schema for IVMS101 compliance

Products: Off exchanges, Transactions, Travel Rule

Scope: API + SDKs

• What's new
  Fixes the Travel Rule legal person name schema to use the IVMS101-compliant array structure with proper name type codes (LEGL, SHRT, TRAD) instead of the incorrect flat object format.

• Impact
  Customers must update Travel Rule integrations to use the new array-based name identifier structure.

Affected endpoints:

1. Validate Full Travel Rule Transaction
2. Create a new transaction
3. Estimate transaction fee
4. Add Collateral
5. Remove Collateral

Fix Travel Rule legalPerson name schema for IVMS101 compliance

Products: Travel Rule

Scope: API + SDKs

• What's new
  Fixes the Travel Rule legal person name schema to use the IVMS101-compliant array structure with proper name type codes (LEGL, SHRT, TRAD) instead of the incorrect flat object format.

• Impact
  Customers must update Travel Rule integrations to use the new array-based name identifier structure.

Affected endpoints:

1. Validate Full Travel Rule Transaction

Added

Add ETH staking consolidation and withdrawal ETA fields

Products: Staking

Scope: API + SDKs

• What's new
  Adds three new optional fields to EthereumBlockchainData: estimatedSourceExitTime, estimatedConsolidationTime, and estimatedWithdrawalTime to surface timing estimates for in-flight ETH validator consolidations and withdrawals.

• Impact
  Customers can now track estimated completion times for pending ETH staking consolidations and withdrawals via the API.

Affected endpoints:

1. Get position details
2. List staking positions
3. List staking positions (Paginated)

Add gaslessInfo to transaction responses

Products: Transactions

Scope: API + SDKs

• What's new
  Adds a new gaslessInfo object to transaction responses containing relay and meta-transaction details including tenant and vault account information.

• Impact
  Customers can identify meta-transactions and see which relay tenant sponsored the gas fees.

Affected endpoints:

1. Get a specific transaction by external transaction ID
2. Get a specific transaction by Fireblocks transaction ID
3. Get transaction history

Add new ReasonForPaymentEnum values

Products: Trading (Beta)

Scope: API + SDKs

• What's new
  Adds three new payment reason values: CORPORATE_INVESTMENT, INTER_COMPANY_TRANSFER, and OFFICE_OPERATING_EXPENSES to support additional corporate payment use cases.

• Impact
  Customers can now specify additional payment reasons when creating trading orders.

Affected endpoints:

1. Create an order

Add FSPM security findings endpoint

Products: Security Posture Management

Scope: API + SDKs

• What's new
  Adds an endpoint to retrieve paginated security posture findings for a workspace, with filtering by severity, category, and status.

• Impact
  Customers with Security Admin or Security Auditor roles can programmatically retrieve security posture findings.

Affected endpoints:

1. Get FSPM security findings

Fixed

Document Owner and Viewer roles for staking endpoints

Products: Staking

Scope: API + SDKs

• What's new
  Adds missing Owner and Viewer roles to endpoint permission documentation for staking list endpoints. These roles were already permitted at runtime but not documented.

• Impact
  Customers with Owner or Viewer roles now see accurate permission documentation for staking endpoints.

Affected endpoints:

1. List staking positions
2. List staking positions (Paginated)
3. List staking providers

---

[github-actions]

Acknowledged. We'll review and respond soon. (Note that this SDK code is auto generated)

[semgrep-code-fireblocks]

Semgrep identified an issue in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.398.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.

To resolve this comment:

✨ Commit fix suggestion

1. Update the project .npmrc so the default registry points to the approved internal JFrog/Artifactory URL, for example registry=https://example.com/..., and remove any registry= entries that still point to registry.npmjs.org or another public source.

2. If this project uses scoped packages, update those scope mappings in .npmrc too, for example @scope:registry=https://example.com/..., so every package resolves through the internal registry.

3. Delete the current lockfile and installed modules so npm can rebuild dependency metadata from the approved registry. Use package-lock.json and node_modules/ as the items to remove.

4. Regenerate the lockfile with npm after the registry change by running \$ npm install. This rebuilds each resolved entry so it points at the internal registry instead of public URLs.

5. Confirm the regenerated package-lock.json no longer contains public resolved, registry, or tarball URLs such as https://registry.npmjs.org/...; the entry for electron-to-chromium should now reference the approved internal registry instead.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-fireblocks]

Semgrep identified an issue in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/browserslist/-/browserslist-4.28.7.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.

To resolve this comment:

✨ Commit fix suggestion

Suggested change

	"resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.7.tgz",
	"resolved": "<VERIFIED_VALUE_REQUIRED>",

View step-by-step instructions

1. Update your project’s npm registry configuration to use the approved internal registry instead of the public npm registry.
   Add or update .npmrc with registry=https://example.com/artifactory/api/npm/npm/ or the exact internal URL your team requires.

2. Remove any lockfile entries that were generated from the public registry by deleting package-lock.json.
   The resolved URLs in that file are copied from the registry npm used when the lockfile was created.

3. Remove the installed dependency tree so npm does not reuse packages fetched from the public source.
   Delete node_modules.

4. Regenerate the lockfile using the internal registry by running npm install.
   If needed, use an explicit command such as $ npm install --registry=https://example.com/artifactory/api/npm/npm/.

5. Confirm the regenerated package-lock.json no longer contains public URLs like https://registry.npmjs.org/... and instead points to your approved internal registry.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-fireblocks]

Semgrep identified an issue in your code:
package-lock.json contains a reference to a public package registry or CDN (https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.6.tgz). Dependencies must be resolved through the approved internal JFrog/Artifactory registry. Update your .npmrc to point at the approved registry, delete node_modules and package-lock.json, then re-run npm install and commit the regenerated lockfile.

To resolve this comment:

✨ Commit fix suggestion

1. Update your project npm configuration to use the approved internal registry instead of the public npm registry.
   Add or change the registry setting in .npmrc to your internal Artifactory/JFrog URL, for example registry=https://example.com/artifactory/api/npm/npm/.

2. Remove the existing installed packages and lockfile so npm stops reusing public resolved URLs.
   Delete node_modules and package-lock.json.

3. Regenerate the lockfile using the internal registry.
   Run $ npm install after the .npmrc change so npm rewrites each resolved entry to the approved internal registry URL.

4. Confirm that the regenerated package-lock.json no longer contains public URLs such as https://registry.npmjs.org/... and that entries like resolved now point to your internal registry.
   The lockfile stores the exact download source for each package, so changing .npmrc alone does not fix existing resolved values.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by block-public-registry-refs-in-package-lock.

_{You can view more details about this finding in the Semgrep AppSec Platform.}