APIs / Plaid

Plaid API changes

Breaking changes, deprecations and new fields in the Plaid API, as they ship.

Plaid2026-10-15 · 496cde4213 breaking1 deprecation25 additive

Breaking
scope is now required
Partial payloads are rejected.
2 places: LinkTokenCreateRequestCraReportParameter.scope, CraReportCreateRequest.scope
Code that breaks
```
await client.post("/…", {
  // …
  scope: /* now required */,
});
```
Breakingdirection flip: their tools call this safe
value can now return "CRA_PARTNER_INSIGHTS_ERROR", "CRA_REPORT_ERROR"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
PlaidErrorType · reachable from 294 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "CRA_PARTNER_INSIGHTS_ERROR"
  // no branch for "CRA_REPORT_ERROR"
  default:
    throw new Error("unexpected value");
}
```
Breaking
Response field vested_quantity removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
AssetReportInvestmentTransaction.vested_quantity · reachable from 3 operations
Code that breaks
```
// response.vested_quantity is now undefined
const vested_quantity = response.vested_quantity;
```
Breaking
Response field cost_basis removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
AssetReportInvestmentHolding.cost_basis · reachable from 3 operations
Code that breaks
```
// response.cost_basis is now undefined
const cost_basis = response.cost_basis;
```
Breaking
Response field vested_value removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
AssetReportInvestmentTransaction.vested_value · reachable from 3 operations
Code that breaks
```
// response.vested_value is now undefined
const vested_value = response.vested_value;
```
Breakingdirection flip: their tools call this safe
Response field maximum_payment_amount is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
PaymentInitiationMetadata.maximum_payment_amount · reachable from 3 operations
Code that breaks
```
// response.maximum_payment_amount may now be absent or null
const maximum_payment_amount = response.maximum_payment_amount ?? fallback;
```
Breakingdirection flip: their tools call this safe
Response field valid_standing_order_intervals is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
PaymentInitiationStandingOrderMetadata.valid_standing_order_intervals · reachable from 3 operations
Code that breaks
```
// response.valid_standing_order_intervals may now be absent or null
const valid_standing_order_intervals = response.valid_standing_order_intervals ?? fallback;
```
Breakingdirection flip: their tools call this safe
value can now return "BLOCKED"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
WalletStatus · reachable from 3 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "BLOCKED"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
options is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
CraReportCreateHomeLendingProductConfig.options · reachable from 2 operations
Code that breaks
```
await client.post("/…", {
  // options is now ignored, not rejected
  options: value,
});
```
Breaking
decision_stage is now required
Partial payloads are rejected.
LinkTokenCreateRequestCraReportParameter.decision_stage · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // …
  decision_stage: /* now required */,
});
```
Breakingdirection flip: their tools call this safe
Response field account_id is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
IdentityMatchListAttemptScore.account_id · reachable from 1 operation
Code that breaks
```
// response.account_id may now be absent or null
const account_id = response.account_id ?? fallback;
```
Breaking
value no longer accepts "PRODUCT_GENERATION_ERROR"
A value you may have hardcoded is now rejected.
SandboxCraServicingSimulateErrorWebhookCode · reachable from 1 operation
Code that breaks
```
// sending "PRODUCT_GENERATION_ERROR" for undefined is now rejected
```
Breaking
verification_status no longer accepts "VERIFICATION_STATUS_PENDING_APPROVAL"
A value you may have hardcoded is now rejected.
SandboxIncomeFireWebhookRequest.verification_status · reachable from 1 operation
Code that breaks
```
// sending "VERIFICATION_STATUS_PENDING_APPROVAL" for verification_status is now rejected
```
Deprecation
POST /credit/bank_income/webhook/update deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /credit/bank_income/webhook/update
Additive
/beta/cash_advance/income_insights/v1/get added
No action needed.
/beta/cash_advance/income_insights/v1/get

19 new response fields

AccountBase.paired_account_id
InvestmentAccount.paired_account_id
KYCCheckIDNumberSummary.ssa_verification
AssetReportInvestmentHolding.vested_quantity
AssetReportInvestmentHolding.vested_value
BusinessAccount.paired_account_id
LinkTokenCreateInstitutionData.institution_id
AccountIdentity.paired_account_id
AccountIdentityMatchScore.paired_account_id
AccountIdentityDocumentUpload.paired_account_id
CraReportGetIncomeInsightsMetadata.investment_account_type_count
AccountBaseNullable.paired_account_id
CraReportGetHomeLendingResponseProduct.items
CraCreditProfileReportMetadata.investment_account_type_count
CraReportGetIncomeInsightsResponseProduct.items
CraReportGetIncomeInsightsStream.description
CraReportGetIncomeInsightsStream.transactions
CraReportGetReport.client_report_id
CraReportGetReport.report_id

5 new request properties

CraReportCreateLendScoreProductConfig.options
LinkTokenCreateInstitutionData.institution_id
LinkTokenCreateRequestCraReportParameter.include_identity_match
CraLendScoreProduct.options
CraReportCreateRequest.include_identity_match

Plaid2026-10-02 · 6c2f0ff96 breaking18 additive

Breakingdirection flip: their tools call this safe
Response field street is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
can now be null
2 places: AddressData.street, AddressDataNullable.street
Code that breaks
```
// response.street may now be absent or null
const street = response.street ?? fallback;
```
Breaking
value no longer accepts "charge card"
A value you may have hardcoded is now rejected.
CreditAccountSubtype · reachable from 2 operations
Code that breaks
```
// sending "charge card" for undefined is now rejected
```
Breaking
value no longer accepts "installment"
A value you may have hardcoded is now rejected.
LoanAccountSubtype · reachable from 2 operations
Code that breaks
```
// sending "installment" for undefined is now rejected
```
Breakingdirection flip: their tools call this safe
value can now return "adjustment"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
TransferEventType · reachable from 2 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "adjustment"
  default:
    throw new Error("unexpected value");
}
```
Breaking
/link_delivery/create removed
Requests to this path now 404.
/link_delivery/create
Code that breaks
```
// Was:
await client.request("GET", "/link_delivery/create");
// Now: 404
```
Breaking
/link_delivery/get removed
Requests to this path now 404.
/link_delivery/get
Code that breaks
```
// Was:
await client.request("GET", "/link_delivery/get");
// Now: 404
```
Additive
/cra/report/create added
No action needed.
/cra/report/create
Additive
/protect/cash_advance/feedback/upload added
No action needed.
/protect/cash_advance/feedback/upload

8 new response fields

Item.paired_item_id
Institution.connection_availability
PaymentInitiationMetadata.supports_commercial_payment_consents
CreditCardLiability.cash_advance_limit
UserAccountSessionGetResponse.link_session_id
ProtectEventGetResponse.event_type
ItemWithConsentFields.paired_item_id
UserAccountSessionGetResponse.idv_session_status

5 new request properties

TransferAuthorizationCreateRequest.user_attributes
LinkTokenCreateRequest.cra_report_parameter
SandboxItemFireWebhookRequest.options
CustomSandboxTransaction.account_id
IdentityVerificationCreateRequest.language

3 request fields now accept null

AddressData.street
AddressDataNotRequired.street
AddressDataNullableNoRequiredFields.street

Plaid2026-09-01 · 7d1446fa4 breaking3 deprecation14 additive

Breakingdirection flip: their tools call this safe
protect_session_id is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
2 places: ProtectEvent.protect_session_id, ProtectEventSendRequest.protect_session_id
Code that breaks
```
await client.post("/…", {
  // protect_session_id is now ignored, not rejected
  protect_session_id: value,
});
```
Breaking
value no longer accepts "DELIVERED"
A value you may have hardcoded is now rejected.
CashAdvanceRepaymentStatus · reachable from 1 operation
Code that breaks
```
// sending "DELIVERED" for undefined is now rejected
```
Breakingdirection flip: their tools call this safe
sdk is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
ProtectModelInputs.sdk · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // sdk is now ignored, not rejected
  sdk: value,
});
```
Breaking
processor no longer accepts "paynote"
A value you may have hardcoded is now rejected.
ProcessorTokenCreateRequest.processor · reachable from 1 operation
Code that breaks
```
// sending "paynote" for processor is now rejected
```
Deprecation
POST /cra/monitoring_insights/get deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /cra/monitoring_insights/get
Deprecation
POST /cra/monitoring_insights/subscribe deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /cra/monitoring_insights/subscribe
Deprecation
POST /cra/monitoring_insights/unsubscribe deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /cra/monitoring_insights/unsubscribe
Additive
Request field now accepts null
A relaxation. Existing payloads are unaffected.
CashAdvanceRepayment.amount_paid · reachable from 1 operation

4 new response fields

Transaction.running_balance
WalletTransactionCounterparty.holder_category
WalletTransactionCounterparty.is_verified
CraReportGetResponse.client_user_id

9 new request properties

WalletTransactionCounterparty.holder_category
WalletTransactionCounterparty.is_verified
ProtectCashAdvanceDecisionCreateRequest.advance_type
ProtectCashAdvanceDecisionCreateRequest.is_taken
SandboxCraServicingSimulateRequest.user_id
ProtectCashAdvanceDecisionCreateRequest.previous_advance_count
ProtectEvent.device_session_id
ProtectEventSendRequest.device_session_id
ProtectModelInputs.device

Plaid2026-08-17 · 82f90e9611 breaking39 additive

Breaking
Response field product removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
5 places: CraReportGetResponseProduct.product, CraReportGetResponseProduct.version, CraReportGetResponseProduct.attributes, CraReportGetResponseProduct.errors, CraReportGetResponseProduct.metadata
Code that breaks
```
// response.product is now undefined
const product = response.product;
```
Breakingdirection flip: their tools call this safe
type can now return "TRANSFER_OUT"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
can now return "TRANSFER_OUT"
2 places: WalletTransaction.type, WalletTransactionGetResponse.type
Code that breaks
```
switch (response.type) {
  // existing branches …
  // no branch for "TRANSFER_OUT"
  default:
    throw new Error("unexpected type");
}
```
Breakingdirection flip: their tools call this safe
value can now return "charge card", "commercial line of credit", "home equity loan", "installment", "prediction market"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
AccountSubtype · reachable from 35 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "charge card"
  // no branch for "commercial line of credit"
  // no branch for "home equity loan"
  // no branch for "installment"
  // no branch for "prediction market"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "cra_home_lending"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
Products · reachable from 33 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "cra_home_lending"
  default:
    throw new Error("unexpected value");
}
```
Breaking
New scope required on /cra/check_report/base_report/get
Existing tokens 403. This needs user re-consent, not a code change, so it cannot be fixed by deploying.
POST /cra/check_report/base_report/get · 5 call sites
Breakingdirection flip: their tools call this safe
apr_type can now return "penalty_apr"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
APR.apr_type · reachable from 2 operations
Code that breaks
```
switch (response.apr_type) {
  // existing branches …
  // no branch for "penalty_apr"
  default:
    throw new Error("unexpected apr_type");
}
```
Breakingdirection flip: their tools call this safe
value can now return "charge card"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
CreditAccountSubtype · reachable from 2 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "charge card"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "commercial line of credit", "home equity loan", "installment"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
LoanAccountSubtype · reachable from 2 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "commercial line of credit"
  // no branch for "home equity loan"
  // no branch for "installment"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "prediction market"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
InvestmentAccountSubtype · reachable from 2 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "prediction market"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
product is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
CraReportGetRequestProduct.product · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // product is now ignored, not rejected
  product: value,
});
```
Breakingdirection flip: their tools call this safe
version is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
CraReportGetRequestProduct.version · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // version is now ignored, not rejected
  version: value,
});
```
Additive
Response type narrowed
A tighter guarantee, not a break. Every value you can receive now was already possible, so existing handling still covers it; a null check here may now be dead code.
AddressMatchScore · reachable from 3 operations
Additive
Response type narrowed
A tighter guarantee, not a break. Every value you can receive now was already possible, so existing handling still covers it; a null check here may now be dead code.
EmailAddressMatchScore · reachable from 3 operations
Additive
Response type narrowed
A tighter guarantee, not a break. Every value you can receive now was already possible, so existing handling still covers it; a null check here may now be dead code.
NameMatchScore · reachable from 3 operations
Additive
Response type narrowed
A tighter guarantee, not a break. Every value you can receive now was already possible, so existing handling still covers it; a null check here may now be dead code.
PhoneNumberMatchScore · reachable from 3 operations
Additive
/beta/issues/v1/unsubscribe added
No action needed.
/beta/issues/v1/unsubscribe
Additive
/beta/webhook_events/list added
No action needed.
/beta/webhook_events/list
Additive
/cra/servicing/subscription/list added
No action needed.
/cra/servicing/subscription/list
Additive
/cra/servicing/subscription/update added
No action needed.
/cra/servicing/subscription/update
Additive
/identity/match/list added
No action needed.
/identity/match/list
Additive
/protect/cash_advance/decision/create added
No action needed.
/protect/cash_advance/decision/create
Additive
/protect/cash_advance/repayment/create added
No action needed.
/protect/cash_advance/repayment/create
Additive
/sandbox/cra/servicing/simulate added
No action needed.
/sandbox/cra/servicing/simulate
Additive
/sandbox/user/fire_webhook added
No action needed.
/sandbox/user/fire_webhook
Additive
/cra/servicing/subscription/get added
No action needed.
/cra/servicing/subscription/get
Additive
/beta/issues/v1/list added
No action needed.
/beta/issues/v1/list
Additive
/beta/issues/v1/match added
No action needed.
/beta/issues/v1/match
Additive
/cra/servicing/subscription/delete added
No action needed.
/cra/servicing/subscription/delete
Additive
/beta/issues/v1/get added
No action needed.
/beta/issues/v1/get
Additive
/beta/issues/v1/subscribe added
No action needed.
/beta/issues/v1/subscribe
Additive
/cra/servicing/subscription/create added
No action needed.
/cra/servicing/subscription/create

14 new response fields

AccountBase.apy
InvestmentAccount.apy
Transaction.merchant_category_code
AssetReportInvestmentHolding.tax_lots
BusinessAccount.apy
AccountIdentityMatchScore.apy
AccountIdentity.apy
LiabilitiesObject.line_of_credit
LiabilitiesObject.loan
AccountBaseNullable.apy
AccountIdentityDocumentUpload.apy
BaseReportInvestmentHolding.tax_lots
ItemApplicationListResponse.disconnected_applications
LinkSessionSuccessMetadata.session_group_id

5 new request properties

CraReportGetRequest.report_id
CreditEmploymentGetRequest.user_id
PaymentInitiationConsentCreateRequest.user_id
PaymentInitiationPaymentCreateRequest.user_id
WalletTransactionExecuteRequest.user_id

Plaid2026-07-24 · bae08e211 breaking2 additive

Breakingdirection flip: their tools call this safe
value can now return "ADMIN", "FRAUD"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
TransferAuthorizationDecisionRationaleCode · reachable from 3 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "ADMIN"
  // no branch for "FRAUD"
  default:
    throw new Error("unexpected value");
}
```

2 new request properties

CreditBankStatementsUploadsGetRequest.user_id
CreditSessionsGetRequest.user_id

Plaid2026-07-22 · e3d940a97 breaking27 deprecation2 additive

Breakingdirection flip: their tools call this safe
AssetEmployerSponsoredIndicator can now return "No", "Yes"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
can now return "No", "Yes"
3 places: AssetDetail.AssetEmployerSponsoredIndicator, AssetDetail.AssetRetirementIndicator, AssetHolding.AssetHoldingRestrictedIndicator
Code that breaks
```
switch (response.AssetEmployerSponsoredIndicator) {
  // existing branches …
  // no branch for "No"
  // no branch for "Yes"
  default:
    throw new Error("unexpected AssetEmployerSponsoredIndicator");
}
```
Breaking
value withdrew accepted values
A value you may have hardcoded is now rejected.
no longer accepts 3, 4, 4.1
2 places: PrismCashScoreVersion, PrismInsightsVersion
Breaking
value withdrew accepted values
A value you may have hardcoded is now rejected.
no longer accepts 4, 4.1
2 places: PrismDetectVersion, PrismExtendVersion
Breaking
value withdrew accepted values
A value you may have hardcoded is now rejected.
PrismFirstDetectVersion · reachable from 3 operations
Breakingdirection flip: their tools call this safe
value can now return "client_return_recovered", "guarantee_reimbursed", "plaid_return_recovered"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
TransferEventType · reachable from 2 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "client_return_recovered"
  // no branch for "guarantee_reimbursed"
  // no branch for "plaid_return_recovered"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
Response field value is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
CraReportGetProductAttributes · reachable from 1 operation
Code that breaks
```
// response may now be absent or null
const value = response ?? fallback;
```
Breakingdirection flip: their tools call this safe
Response field value is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
CraReportGetProductMetadata · reachable from 1 operation
Code that breaks
```
// response may now be absent or null
const value = response ?? fallback;
```
Deprecation
POST /beacon/account_risk/v1/evaluate deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/account_risk/v1/evaluate
Deprecation
POST /link_delivery/get deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /link_delivery/get
Deprecation
POST /bank_transfer/get deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /bank_transfer/get
Deprecation
POST /bank_transfer/sweep/get deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /bank_transfer/sweep/get
Deprecation
POST /beacon/duplicate/get deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/duplicate/get
Deprecation
POST /beacon/report_syndication/get deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/report_syndication/get
Deprecation
POST /link_delivery/create deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /link_delivery/create
Deprecation
POST /bank_transfer/list deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /bank_transfer/list
Deprecation
POST /sandbox/bank_transfer/simulate deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /sandbox/bank_transfer/simulate
Deprecation
POST /bank_transfer/migrate_account deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /bank_transfer/migrate_account
Deprecation
POST /bank_transfer/sweep/list deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /bank_transfer/sweep/list
Deprecation
POST /beacon/report/list deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/report/list
Deprecation
POST /beacon/report_syndication/list deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/report_syndication/list
Deprecation
POST /beacon/user/account_insights/get deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/user/account_insights/get
Deprecation
POST /beacon/user/create deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/user/create
Deprecation
POST /beacon/user/get deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/user/get
Deprecation
POST /beacon/user/history/list deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/user/history/list
Deprecation
POST /beacon/user/review deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/user/review
Deprecation
POST /beacon/user/update deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/user/update
Deprecation
POST /employers/search deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /employers/search
Deprecation
POST /beacon/report/create deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/report/create
Deprecation
POST /beacon/report/get deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /beacon/report/get
Deprecation
POST /processor/bank_transfer/create deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /processor/bank_transfer/create
Deprecation
POST /sandbox/bank_transfer/fire_webhook deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /sandbox/bank_transfer/fire_webhook
Deprecation
POST /bank_transfer/balance/get deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /bank_transfer/balance/get
Deprecation
POST /bank_transfer/cancel deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /bank_transfer/cancel
Deprecation
POST /bank_transfer/create deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /bank_transfer/create
Additive
/transfer/return/recover added
No action needed.
/transfer/return/recover
Additive
Response field event_amount added
No action needed unless you validate responses against a closed schema.
TransferEvent.event_amount · reachable from 2 operations

Plaid2026-07-22 · 8a493a5a8 breaking2 deprecation15 additive

Breakingdirection flip: their tools call this safe

value can now return "ASSETS_ERROR", "CRA_MONITORING_ERROR", "CREDIT_PROFILE_REPORT_ERROR", "ENCOMPASS_ERROR", "ENRICH_ERROR", "FRAUD_INSIGHTS_ERROR", "FREDDIE_MAC_ERROR", "LINK_DELIVERY_ERROR", "PROFILE_ERROR", "RECURRING_TRANSACTIONS_ERROR", "STATEMENTS_ERROR", "TRANSFER_RECURRING_ERROR", "TRANSFER_REFUND_ERROR"

Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.

PlaidErrorType · reachable from 285 operations

Code that breaks

switch (response) {
  // existing branches …
  // no branch for "ASSETS_ERROR"
  // no branch for "CRA_MONITORING_ERROR"
  // no branch for "CREDIT_PROFILE_REPORT_ERROR"
  // no branch for "ENCOMPASS_ERROR"
  // no branch for "ENRICH_ERROR"
  // no branch for "FRAUD_INSIGHTS_ERROR"
  // no branch for "FREDDIE_MAC_ERROR"
  // no branch for "LINK_DELIVERY_ERROR"
  // no branch for "PROFILE_ERROR"
  // no branch for "RECURRING_TRANSACTIONS_ERROR"
  // no branch for "STATEMENTS_ERROR"
  // no branch for "TRANSFER_RECURRING_ERROR"
  // no branch for "TRANSFER_REFUND_ERROR"
  default:
    throw new Error("unexpected value");
}

Breakingdirection flip: their tools call this safe
value can now return "retro"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
Source · reachable from 18 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "retro"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "cash advance", "late fee", "membership fee", "returned item fee"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
TransactionCode · reachable from 6 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "cash advance"
  // no branch for "late fee"
  // no branch for "membership fee"
  // no branch for "returned item fee"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "rfp"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
TransferNetwork · reachable from 5 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "rfp"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
warning_code can now return "BANK_INCOME_INSIGHTS_INCOMPLETE", "BANK_INCOME_INSIGHTS_INSUFFICIENT_DATA", "BANK_INCOME_INSIGHTS_INTERNAL_ERROR", "BANK_INCOME_INSIGHTS_MISMATCHED_DAYS_REQUESTED", "BANK_INCOME_INSIGHTS_STATUS_IN_PROGRESS"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
Warning.warning_code · reachable from 3 operations
Code that breaks
```
switch (response.warning_code) {
  // existing branches …
  // no branch for "BANK_INCOME_INSIGHTS_INCOMPLETE"
  // no branch for "BANK_INCOME_INSIGHTS_INSUFFICIENT_DATA"
  // no branch for "BANK_INCOME_INSIGHTS_INTERNAL_ERROR"
  // no branch for "BANK_INCOME_INSIGHTS_MISMATCHED_DAYS_REQUESTED"
  // no branch for "BANK_INCOME_INSIGHTS_STATUS_IN_PROGRESS"
  default:
    throw new Error("unexpected warning_code");
}
```
Breakingdirection flip: their tools call this safe
type can now return "interest only"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
StudentRepaymentPlan.type · reachable from 2 operations
Code that breaks
```
switch (response.type) {
  // existing branches …
  // no branch for "interest only"
  default:
    throw new Error("unexpected type");
}
```
Breakingdirection flip: their tools call this safe
value can now return "guaranteed"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
TransferEventType · reachable from 2 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "guaranteed"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "DOCUMENT_TYPE_US_STUDENT_I20"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
DocType · reachable from 2 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "DOCUMENT_TYPE_US_STUDENT_I20"
  default:
    throw new Error("unexpected value");
}
```
Deprecation
POST /item/public_token/create deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /item/public_token/create
Deprecation
POST /sandbox/bank_income/fire_webhook deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /sandbox/bank_income/fire_webhook
Additive
/cra/report/get added
No action needed.
/cra/report/get
Additive
/fdx/consents added
No action needed.
/fdx/consents
Additive
/sandbox/fdx/consent/seed added
No action needed.
/sandbox/fdx/consent/seed

6 new response fields

Security.figi
BankTransferEvent.receiver_details
CraPartnerInsightsUltraFicoScoreResult.exclusion_code
CreditSessionDocumentIncomeResult.num_i20s_uploaded
PayrollIncomeObject.i20s
ProtectComputeResponse.timestamp

6 new request properties

CraCheckReportBaseReportGetRequest.consumer_report_permissible_purpose
CraCheckReportBaseReportGetRequest.report_id
CraCheckReportIncomeInsightsGetRequest.consumer_report_permissible_purpose
CraCheckReportIncomeInsightsGetRequest.report_id
CraCheckReportVerificationPdfGetRequest.hide_gse_details
IdentityVerificationCreateRequestUser.ip_address

Plaid2026-06-25 · 050cfa0f3 breaking7 additive

Breakingdirection flip: their tools call this safe
value can now return "IDEMPOTENCY_ERROR"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
PlaidErrorType · reachable from 282 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "IDEMPOTENCY_ERROR"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "cra_qualify"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
Products · reachable from 30 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "cra_qualify"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "in_epic"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
IDNumberType · reachable from 15 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "in_epic"
  default:
    throw new Error("unexpected value");
}
```
Additive
/fdx/consents/{consentId}/revocation added
No action needed.
/fdx/consents/{consentId}/revocation
Additive
Request property item_id added
No action needed unless it is required.
ProtectIncidentEvent.item_id · reachable from 1 operation

5 new response fields

RiskCheckEmail.name
SelfieAnalysis.age_check
Transfer.guarantee_details
TransferAuthorization.guarantee_details
TransferAuthorizationProposedTransfer.requested_amount

Plaid2026-06-10 · 5c2920e910 breaking17 additive

Breakingdirection flip: their tools call this safe
type can now return "ACCOUNT_FUNDING", "AUTO_REFUND"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
can now return "ACCOUNT_FUNDING", "AUTO_REFUND"
2 places: WalletTransaction.type, WalletTransactionGetResponse.type
Code that breaks
```
switch (response.type) {
  // existing branches …
  // no branch for "ACCOUNT_FUNDING"
  // no branch for "AUTO_REFUND"
  default:
    throw new Error("unexpected type");
}
```
Breakingdirection flip: their tools call this safe
value can now return "INTERNAL_ERROR", "STARTED"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
can now return "INTERNAL_ERROR", "STARTED"
2 places: CreditSessionBankEmploymentStatus, CreditSessionBankIncomeStatus
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "INTERNAL_ERROR"
  // no branch for "STARTED"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "BASE_REPORT_ERROR"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
PlaidErrorType · reachable from 280 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "BASE_REPORT_ERROR"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "payment", "refund"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
TransactionCode · reachable from 6 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "payment"
  // no branch for "refund"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "ACCOUNT_INVALID", "AUTHENTICATION_FAILED"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
WalletTransactionFailureReason · reachable from 2 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "ACCOUNT_INVALID"
  // no branch for "AUTHENTICATION_FAILED"
  default:
    throw new Error("unexpected value");
}
```
Breaking
reason_code is now required
Partial payloads are rejected.
UserProductsTerminateRequest.reason_code · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // …
  reason_code: /* now required */,
});
```
Breakingdirection flip: their tools call this safe
products is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
UserProductsTerminateRequest.products · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // products is now ignored, not rejected
  products: value,
});
```
Breaking
/item/handle_fraud_report removed
Requests to this path now 404.
/item/handle_fraud_report
Code that breaks
```
// Was:
await client.request("GET", "/item/handle_fraud_report");
// Now: 404
```
Breaking
/network_insights/report/get removed
Requests to this path now 404.
/network_insights/report/get
Code that breaks
```
// Was:
await client.request("GET", "/network_insights/report/get");
// Now: 404
```
Breaking
Response field protect_results removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
LinkSessionResults.protect_results · reachable from 1 operation
Code that breaks
```
// response.protect_results is now undefined
const protect_results = response.protect_results;
```
Additive
/fdx/consents/{consentId} added
No action needed.
/fdx/consents/{consentId}

11 new response fields

RiskCheckEmail.is_edu
Holding.tax_lots
RiskCheckEmail.includes_date_of_birth
CraPartnerInsightsUltraFicoScore.negative_reason_codes
PrismInsights.model_version
CraPartnerInsightsUltraFicoScore.positive_reason_codes
CraVerificationReport.income
ProtectComputeResponse.subscores
WatchlistScreeningHit.sub_programs
CraCreditProfileReportGetResponse.user_id
EntityWatchlistScreeningHit.sub_programs

5 new request properties

CraPartnerInsightsBaseFicoScore.reason_codes
TransferAuthorizationCreateRequest.custom_attributes
UserProductsTerminateRequest.reason_code
UserProductsTerminateRequest.reason_note
CraCheckReportVerificationPdfGetRequest.reports_requested

Plaid2026-04-27 · 22052fbb3 deprecation2 additive

Deprecation
POST /protect/event/get deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /protect/event/get
Deprecation
POST /credit/bank_income/refresh deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /credit/bank_income/refresh
Deprecation
POST /protect/event/send deprecated
Still works today. This is the earliest warning you will get before it is removed.
POST /protect/event/send
Additive
/sandbox/item/application/seed added
No action needed.
/sandbox/item/application/seed
Additive
/cra/credit_profile/report/get added
No action needed.
/cra/credit_profile/report/get

Plaid2026-04-17 · cb78341f2 breaking19 additive

Breakingdirection flip: their tools call this safe
value can now return "limited purpose checking"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
can now return "limited purpose checking"
2 places: AccountSubtype, DepositoryAccountSubtype
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "limited purpose checking"
  default:
    throw new Error("unexpected value");
}
```
Breaking
Response field name removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
BusinessKYBMatchDetails.name · reachable from 2 operations
Code that breaks
```
// response.name is now undefined
const name = response.name;
```

12 new response fields

CraPartnerInsightsUltraFicoScore.positive_reason_code_3
DepositoryFilter.limited_purpose_types
BusinessKYBMatchDetails.names
BusinessSearchTerms.alternative_names
CraPartnerInsightsFicoResults.report_characteristics
CraPartnerInsightsUltraFicoScore.positive_reason_code_4
CraPartnerInsightsUltraFicoScore.positive_reason_code_1
CraPartnerInsightsUltraFicoScore.positive_reason_code_2
BetaEwaReportV1GetResponse.ewa_attributes
CraBankIncomeItem.accounts
CraIncomeInsights.income_streams
CraIncomeInsights.user_summary

7 new request properties

DepositoryFilter.limited_purpose_types
LinkTokenCreateRequestCraOptions.income_insights
LinkTokenCreateRequestCraOptionsBaseReport.home_lending_report_options
BusinessVerificationCreateRequestBusiness.alternative_name
CraCheckReportCreateBaseReportOptions.home_lending_report_options
CraCheckReportCreateRequest.income_insights
CraCheckReportIncomeInsightsGetRequest.options

Plaid2026-04-02 · 0f27b2f78 breaking19 additive

Breakingdirection flip: their tools call this safe
prism_products is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
4 places: CraCheckReportCreatePartnerInsightsOptions.prism_products, CraCheckReportPartnerInsightsGetOptions.prism_products, LinkTokenCreateRequestCraOptionsPartnerInsights.prism_products, LinkTokenCreateRequestCreditPartnerInsights.prism_products
Code that breaks
```
await client.post("/…", {
  // prism_products is now ignored, not rejected
  prism_products: value,
});
```
Breakingdirection flip: their tools call this safe
plaid_check_score_version is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
2 places: CraCheckReportCashflowInsightsGetOptions.plaid_check_score_version, LinkTokenCreateRequestCraOptionsCashflowInsights.plaid_check_score_version
Code that breaks
```
await client.post("/…", {
  // plaid_check_score_version is now ignored, not rejected
  plaid_check_score_version: value,
});
```
Breakingdirection flip: their tools call this safe
value can now return "fhsa", "qshr", "roth 403B", "roth 457b", "roth pension", "roth profit sharing plan", "roth thrift savings plan"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
AccountSubtype · reachable from 35 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "fhsa"
  // no branch for "qshr"
  // no branch for "roth 403B"
  // no branch for "roth 457b"
  // no branch for "roth pension"
  // no branch for "roth profit sharing plan"
  // no branch for "roth thrift savings plan"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
value can now return "protect_transactions"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
Products · reachable from 30 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "protect_transactions"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
Response field value is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
CraPartnerInsightsPrism · reachable from 2 operations
Code that breaks
```
// response may now be absent or null
const value = response ?? fallback;
```
Breakingdirection flip: their tools call this safe
value can now return "fhsa", "line of credit", "roth 403B", "roth 457b", "roth pension", "roth profit sharing plan", "roth thrift savings plan", "thrift savings plan"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
InvestmentAccountSubtype · reachable from 2 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "fhsa"
  // no branch for "line of credit"
  // no branch for "roth 403B"
  // no branch for "roth 457b"
  // no branch for "roth pension"
  // no branch for "roth profit sharing plan"
  // no branch for "roth thrift savings plan"
  // no branch for "thrift savings plan"
  default:
    throw new Error("unexpected value");
}
```
Breaking
Response field recurrence removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
Enrichments.recurrence · reachable from 1 operation
Code that breaks
```
// response.recurrence is now undefined
const recurrence = response.recurrence;
```
Breaking
Response field plaid_check_score removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
CraCashflowInsightsReport.plaid_check_score · reachable from 1 operation
Code that breaks
```
// response.plaid_check_score is now undefined
const plaid_check_score = response.plaid_check_score;
```
Additive
/processor/investments/auth/get added
No action needed.
/processor/investments/auth/get
Additive
Response type narrowed
A tighter guarantee, not a break. Every value you can receive now was already possible, so existing handling still covers it; a null check here may now be dead code.
ItemStatusLastWebhook.code_sent · reachable from 1 operation
Additive
/item/handle_fraud_report added
No action needed.
/item/handle_fraud_report
Additive
/item/products/terminate added
No action needed.
/item/products/terminate

2 new response fields

Security.cfi_code
CraVerificationReport.gse_reference_id

13 new request properties

CraCheckReportBaseReportGetRequest.user_tier
CraCheckReportPartnerInsightsGetRequest.user_tier
CraPartnerInsightsGetRequest.user_tier
CreditBankIncomeGetRequest.user_id
CreditBankIncomePDFGetRequest.user_id
CreditBankIncomeRefreshRequest.user_id
CreditBankIncomeWebhookUpdateRequest.user_id
CreditPayrollIncomeGetRequest.user_id
CreditPayrollIncomeParsingConfigUpdateRequest.user_id
CreditPayrollIncomePrecheckRequest.user_id
CreditPayrollIncomeRefreshRequest.user_id
FDXNotification.subtype
CreditPayrollIncomeRiskSignalsGetRequest.user_id

Plaid2026-03-04 · 92814f5611 breaking21 additive

Breakingdirection flip: their tools call this safe
access_token is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
3 places: TransactionsRulesRemoveRequest.access_token, TransactionsRulesCreateRequest.access_token, TransactionsRulesListRequest.access_token
Code that breaks
```
await client.post("/…", {
  // access_token is now ignored, not rejected
  access_token: value,
});
```
Breaking
client_user_id is now required
Partial payloads are rejected.
3 places: TransactionsRulesCreateRequest.client_user_id, TransactionsRulesListRequest.client_user_id, TransactionsRulesRemoveRequest.client_user_id
Code that breaks
```
await client.post("/…", {
  // …
  client_user_id: /* now required */,
});
```
Breakingdirection flip: their tools call this safe
value can now return "MERCHANT_NAME"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
TransactionsRuleField · reachable from 2 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "MERCHANT_NAME"
  default:
    throw new Error("unexpected value");
}
```
Breaking
Response field item_id removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
TransactionsCategoryRule.item_id · reachable from 2 operations
Code that breaks
```
// response.item_id is now undefined
const item_id = response.item_id;
```
Breaking
Response field personal_finance_category removed
TransactionsCategoryRule.personal_finance_category · reachable from 2 operations
Code that breaks
```
// response.personal_finance_category is now undefined
const personal_finance_category = response.personal_finance_category;
```
Breaking
value no longer accepts "NAME"
A value you may have hardcoded is now rejected.
TransactionsRuleField · reachable from 2 operations
Code that breaks
```
// sending "NAME" for undefined is now rejected
```
Breaking
Response field trust_index removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
ProtectComputeResponse.trust_index · reachable from 1 operation
Code that breaks
```
// response.trust_index is now undefined
const trust_index = response.trust_index;
```
Breaking
pfc_detailed_category is now required
Partial payloads are rejected.
TransactionsRulesCreateRequest.pfc_detailed_category · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // …
  pfc_detailed_category: /* now required */,
});
```
Breaking
Response field fraud_attributes removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
ProtectComputeResponse.fraud_attributes · reachable from 1 operation
Code that breaks
```
// response.fraud_attributes is now undefined
const fraud_attributes = response.fraud_attributes;
```
Breaking
pfc_primary_category is now required
Partial payloads are rejected.
TransactionsRulesCreateRequest.pfc_primary_category · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // …
  pfc_primary_category: /* now required */,
});
```
Breakingdirection flip: their tools call this safe
personal_finance_category is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
TransactionsRulesCreateRequest.personal_finance_category · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // personal_finance_category is now ignored, not rejected
  personal_finance_category: value,
});
```

12 new response fields

BaseReportTransaction.personal_finance_category
TransactionsCategoryRule.pfc_primary_category
BusinessRiskCheck.industry_prediction
CraPartnerInsights.fico
TransactionsCategoryRule.pfc_detailed_category
TransactionsCategoryRule.updated_at
TransactionsCategoryRule.user_id
BusinessVerificationGetResponse.digital_presence_check
ProtectComputeResponse.attributes
ProtectComputeResponse.score
BusinessVerificationCreateResponse.digital_presence_check
ProtectComputeResponse.model

9 new request properties

ProtectModelInputs.sdk
CraCheckReportCreatePartnerInsightsOptions.fico
TransactionsRulesCreateRequest.pfc_detailed_category
TransactionsRulesCreateRequest.pfc_primary_category
TransactionsRulesListRequest.client_user_id
CraCheckReportPartnerInsightsGetPartnerInsights.fico
LinkTokenCreateRequestCraOptionsPartnerInsights.fico
TransactionsRulesCreateRequest.client_user_id
TransactionsRulesRemoveRequest.client_user_id

Plaid2026-02-18 · f8beb3f43 additive

Additive
Request field now accepts null
A relaxation. Existing payloads are unaffected.
BusinessVerificationCreateRequestBusiness · reachable from 1 operation

2 new response fields

BusinessVerificationCreateResponse.shareable_url
BusinessVerificationGetResponse.shareable_url

Plaid2026-02-17 · efcee8bb5 additive

Additive
/protect/compute added
No action needed.
/protect/compute

4 new response fields

RiskCheckDetails.trust_index_score
WalletTransaction.payee_verification_status
UserAccountSessionGetResponse.identity_edit_history
WalletTransactionGetResponse.payee_verification_status

Plaid2026-01-26 · 3dd26e286 breaking1 behavioral5 additive

Breakingdirection flip: their tools call this safe
value can now return "cra_plaid_credit_score"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
Products · reachable from 30 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "cra_plaid_credit_score"
  default:
    throw new Error("unexpected value");
}
```
Breaking
report_requested is now required
Partial payloads are rejected.
CraCheckReportVerificationPdfGetRequest.report_requested · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // …
  report_requested: /* now required */,
});
```
Breakingdirection flip: their tools call this safe
report_type is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
CraCheckReportVerificationPdfGetRequest.report_type · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // report_type is now ignored, not rejected
  report_type: value,
});
```
Breakingdirection flip: their tools call this safe
Response field is_investments_fallback_item is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
ProcessorInvestmentsHoldingsGetResponse.is_investments_fallback_item · reachable from 1 operation
Code that breaks
```
// response.is_investments_fallback_item may now be absent or null
const is_investments_fallback_item = response.is_investments_fallback_item ?? fallback;
```
Breakingdirection flip: their tools call this safe
email is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
BusinessVerificationCreateRequestBusiness.email · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // email is now ignored, not rejected
  email: value,
});
```
Breakingdirection flip: their tools call this safe
customFields is no longer accepted
Usually ignored rather than rejected, so the call succeeds and does something subtly different.
FDXNotificationPayload.customFields · reachable from 1 operation
Code that breaks
```
await client.post("/…", {
  // customFields is now ignored, not rejected
  customFields: value,
});
```
Behavioral
201 is now documented on /user/create
An unhandled branch in your error handling.
POST /user/create
Additive
/user/identity/remove added
No action needed.
/user/identity/remove
Additive
/user/items/remove added
No action needed.
/user/items/remove
Additive
/user_account/session/event/send added
No action needed.
/user_account/session/event/send

2 new request properties

BusinessVerificationCreateRequestBusiness.email_address
CraCheckReportVerificationPdfGetRequest.report_requested

Plaid2025-12-11 · 7a4402ba6 breaking10 additive

Breakingdirection flip: their tools call this safe
Response field email_address is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
BusinessEmailAddress.email_address · reachable from 2 operations
Code that breaks
```
// response.email_address may now be absent or null
const email_address = response.email_address ?? fallback;
```
Breakingdirection flip: their tools call this safe
Response field value is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
BusinessEntityType · reachable from 2 operations
Code that breaks
```
// response may now be absent or null
const value = response ?? fallback;
```
Breakingdirection flip: their tools call this safe
Response field name is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
BusinessKYBMatchDetails.name · reachable from 2 operations
Code that breaks
```
// response.name may now be absent or null
const name = response.name ?? fallback;
```
Breakingdirection flip: their tools call this safe
Response field number is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
BusinessPhoneNumber.number · reachable from 2 operations
Code that breaks
```
// response.number may now be absent or null
const number = response.number ?? fallback;
```
Breakingdirection flip: their tools call this safe
Response field url is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
BusinessWebsite.url · reachable from 2 operations
Code that breaks
```
// response.url may now be absent or null
const url = response.url ?? fallback;
```
Breaking
/user/items/list removed
Requests to this path now 404.
/user/items/list
Code that breaks
```
// Was:
await client.request("GET", "/user/items/list");
// Now: 404
```

6 new response fields

PlaidError.provided_account_subtypes
PlaidError.required_account_subtypes
Cause.required_account_subtypes
Cause.provided_account_subtypes
RiskCheckDetails.facial_duplicates
LinkTokenGetResponse.user_id

4 new request properties

SandboxPublicTokenCreateRequest.user_id
SandboxUserResetLoginRequest.user_id
TransferAuthorizationCreateRequest.request_guarantee
UserItemsGetRequest.user_id

Plaid2025-12-01 · cd9c70614 additive

Additive
/business_verification/create added
No action needed.
/business_verification/create
Additive
/business_verification/get added
No action needed.
/business_verification/get
Additive
/user/products/terminate added
No action needed.
/user/products/terminate
Additive
Request property event added
No action needed unless it is required.
FDXNotificationPayload.event · reachable from 1 operation

Plaid2025-11-12 · 3e2270cc4 breaking1 behavioral21 additive

Breaking
value no longer accepts "EMPLOYMENT"
A value you may have hardcoded is now rejected.
no longer accepts "EMPLOYMENT"
2 places: ConsumerReportPermissiblePurpose, LinkTokenCreateRequest.consumer_report_permissible_purpose
Code that breaks
```
// sending "EMPLOYMENT" for undefined is now rejected
```
Breaking
Response field identity_creation_result removed
Reads of this field return undefined, and the failure surfaces wherever that value is used rather than at the call.
2 places: UserUpdateResponse.identity_creation_result, UserCreateResponse.identity_creation_result
Code that breaks
```
// response.identity_creation_result is now undefined
const identity_creation_result = response.identity_creation_result;
```
Breakingdirection flip: their tools call this safe
value can now return "IDENTITY_ERROR", "USER_ERROR"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
PlaidErrorType · reachable from 273 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "IDENTITY_ERROR"
  // no branch for "USER_ERROR"
  default:
    throw new Error("unexpected value");
}
```
Breaking
value no longer accepts "cra_plaid_credit_score"
A value you may have hardcoded is now rejected.
Products · reachable from 31 operations
Code that breaks
```
// sending "cra_plaid_credit_score" for undefined is now rejected
```
Behavioral
default is now documented on /accounts/balance/get
An unhandled branch in your error handling.
POST /accounts/balance/get · 113 call sites
Additive
/beta/ewa_report/v1/get added
No action needed.
/beta/ewa_report/v1/get
Additive
/asset_report/audit_copy/pdf/get added
No action needed.
/asset_report/audit_copy/pdf/get
Additive
Request field now accepts null
A relaxation. Existing payloads are unaffected.
SandboxPublicTokenCreateRequestOptionsTransactions · reachable from 1 operation

16 new response fields

PhysicalDocumentExtractedData.issue_date
ExpenditureInsights.cash_flow
ExpenditureSummary.iso_currency_code
ExpenditureSummary.unofficial_currency_code
IncomeInsights.transfers_in
InvestmentTransaction.transaction_datetime
IncomeInsights.income_excluding_transfers
NegativeBalanceOccurrence.minimum_balance
IncomeInsights.total_income
CraBankIncomeSource.income_provider
CraBankIncomeSource.status
IdentityVerification.latest_scored_protect_event
IdentityVerificationCreateResponse.latest_scored_protect_event
IdentityVerificationRetryResponse.latest_scored_protect_event
ProtectUserInsightsGetResponse.reports
IdentityVerificationGetResponse.latest_scored_protect_event

2 new request properties

CraCheckReportLendScoreGetRequest.user_id
UserCreateRequest.with_upgraded_user

Plaid2025-10-22 · 554ac72a8 breaking18 additive

Breakingdirection flip: their tools call this safe
error_type can now return "SIGNAL_ERROR"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
can now return "SIGNAL_ERROR"
2 places: IdentityCreationResult.error_type, PlaidErrorType
Code that breaks
```
switch (response.error_type) {
  // existing branches …
  // no branch for "SIGNAL_ERROR"
  default:
    throw new Error("unexpected error_type");
}
```
Breakingdirection flip: their tools call this safe
value can now return "MORE_INFORMATION_NEEDED"
Producer-side tools call this additive. It breaks exhaustive switches, strict parsers and generated client enums.
PartnerEndCustomerStatus · reachable from 6 operations
Code that breaks
```
switch (response) {
  // existing branches …
  // no branch for "MORE_INFORMATION_NEEDED"
  default:
    throw new Error("unexpected value");
}
```
Breakingdirection flip: their tools call this safe
Response field city is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
ClientUserIdentityAddress.city · reachable from 3 operations
Code that breaks
```
// response.city may now be absent or null
const city = response.city ?? fallback;
```
Breakingdirection flip: their tools call this safe
Response field postal_code is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
ClientUserIdentityAddress.postal_code · reachable from 3 operations
Code that breaks
```
// response.postal_code may now be absent or null
const postal_code = response.postal_code ?? fallback;
```
Breakingdirection flip: their tools call this safe
Response field region is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
ClientUserIdentityAddress.region · reachable from 3 operations
Code that breaks
```
// response.region may now be absent or null
const region = response.region ?? fallback;
```
Breakingdirection flip: their tools call this safe
Response field street_1 is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
ClientUserIdentityAddress.street_1 · reachable from 3 operations
Code that breaks
```
// response.street_1 may now be absent or null
const street_1 = response.street_1 ?? fallback;
```
Breakingdirection flip: their tools call this safe
Response field value is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
ClientUserIdentityName · reachable from 3 operations
Code that breaks
```
// response may now be absent or null
const value = response ?? fallback;
```
Breakingdirection flip: their tools call this safe
Response field value is no longer guaranteed
Producer-side tools call this non-breaking. For a consumer it is a null dereference on an unknown future date.
IdentityCreationResult · reachable from 2 operations
Code that breaks
```
// response may now be absent or null
const value = response ?? fallback;
```
Additive
/beta/partner/customer/v1/create added
No action needed.
/beta/partner/customer/v1/create
Additive
/beta/partner/customer/v1/enable added
No action needed.
/beta/partner/customer/v1/enable
Additive
/beta/partner/customer/v1/get added
No action needed.
/beta/partner/customer/v1/get
Additive
/beta/partner/customer/v1/update added
No action needed.
/beta/partner/customer/v1/update
Additive
/cra/check_report/verification/pdf/get added
No action needed.
/cra/check_report/verification/pdf/get
Additive
/protect/report/create added
No action needed.
/protect/report/create

3 new response fields

AssetReport.insights
AccountAssets.account_insights
CraVoaReportAccount.investments

4 new request properties

CraCheckReportNetworkInsightsGetRequest.options
LinkTokenCreateRequestCraOptions.network_insights
UserThirdPartyTokenCreateRequest.user_id
CraCheckReportCreateRequest.network_insights

5 request fields now accept null

ClientUserIdentityAddress.city
ClientUserIdentityAddress.region
Request field now accepts null
ClientUserIdentityAddress.postal_code
ClientUserIdentityAddress.street_1