Driftwatch

Plaid / Plaid API (2020-09-14) /

Breakingdirection flip: their tools call this safe

access_token is no longer accepted

What changed

Usually ignored rather than rejected, so the call succeeds and does something subtly different.

Affects access_token on TransactionsRulesRemoveRequest reachable from 1 operation. Grep for it: nothing else will tell you.

Who is affected

Code that sends Plaid's TransactionsRulesRemoveRequest objects, used by 1 Plaid operation.

Before and after

WhereBeforeAfter
TransactionsRulesRemoveRequest.access_tokenpresentabsent
TransactionsRulesCreateRequest.access_tokenpresentabsent
TransactionsRulesListRequest.access_tokenpresentabsent

Code that breaks

await client.post("/…", {
  // access_token is now ignored, not rejected
  access_token: value,
});

Based on Plaid’s published API specification. How severity is decided.