[kphurley7]

Agents read and edit their customer's identity and start verification.

• New GET/PATCH /agents/me/customer, POST /agents/me/verifications and POST /agents/me/kyc-link, using the existing IndividualCustomer, Verification and KYC-link schemas.
• New agent permission MANAGE_IDENTITY.
• Stainless maps the three operations under agents.me.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated
grid-cards-demo	Ignored	Preview	Oct 16, 2026 4:45pm UTC
grid-flow-builder	Ignored	Preview	Oct 16, 2026 4:45pm UTC
grid-wallet-demo	Ignored	Preview	Oct 16, 2026 4:45pm UTC

[k15z]

this reuses IndividualCustomerUpdateRequest, so email/phoneNumber/kycStatus/currencies all look settable and then 400. an AgentCustomerUpdateRequest like AgentQuoteRequest in 1183 would be cleaner. also the backend ignores unknown keys instead of 400ing (quotes reject them)

[k15z]

backend only accepts redirectUri if it exactly matches one global return URL (connect.lightspark.com in prod, nothing elsewhere), which makes sense for the leaked-token case. but the spec reuses KycLinkCreateRequest, which says any https uri works. maybe drop the body here? and since it's one global URL, another platform's customers would land on connect. probably wants to be a platform setting before anyone else uses this

[ls-bolt]

🦣 Congratulations @k15z - your substantive review earned a Giant short-faced kangaroo! (rare)

Forward-facing eyes and a single large toe distinguished Australia's largest known kangaroo.

View your Frost-dex: https://zeus.dev.dev.sparkinfra.net/#/dinodex/k15z?section=ice-age

[greptile-apps]

Confidence Score: 4/5

[High impact] The PR gives authorized agents new access to customer identity and KYC workflows.

Fix the identity update request schema before merging; the hosted KYC description also needs a small clarification.

Findings

1.  Update fields contradict endpoint rules ▶
2.  KYC prerequisite is unexplained ▶

Fix with agent prompt

### Issue 1
openapi/paths/agents/agents_me_customer.yaml:59
`PATCH /agents/me/customer` uses `IndividualCustomerUpdateRequest`, which requires `customerType` and offers fields such as `email`, `phoneNumber`, and `currencies`. But this operation says any field outside its identity allowlist returns 400. Generated clients therefore require an unlisted field and advertise updates the endpoint rejects. Use an agent-specific request schema containing only the allowed identity fields.

### Issue 2
openapi/paths/agents/agents_me_kyc-link.yaml:46
The new hosted KYC endpoint describes 409 only as customer not ready. The existing customer endpoint explains the prerequisite: when the provider requires contact checks, both email and phone must be `VERIFIED` first. Carry that condition into this endpoint and explain that the platform must complete the contact checks before the agent retries. Otherwise, developers cannot tell which step is missing.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds four agent operations for reading and updating customer identity, submitting verification, and generating a hosted KYC link.

• Agents can read and edit their customer's identity.
• Agents can submit their customer for KYC verification.
• Agents can create a hosted KYC link for their customer.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Agent with MANAGE_IDENTITY] --> B[Read customer]
  B --> C[Update identity fields]
  C --> D[Submit verification]
  D --> E{Missing fields?}
  E -->|Yes| C
  E -->|No| F[Follow verification status]
  A --> G[Generate hosted KYC link]
  G --> H[Customer completes hosted flow]

Loading

_{Reviews (1) · Last reviewed commit: "feat(agents): agents read and edit their..." · Reviewed by Greptile}

[greptile-apps]

Update fields contradict endpoint rules

PATCH /agents/me/customer uses IndividualCustomerUpdateRequest, which requires customerType and offers fields such as email, phoneNumber, and currencies. But this operation says any field outside its identity allowlist returns 400. Generated clients therefore require an unlisted field and advertise updates the endpoint rejects. Use an agent-specific request schema containing only the allowed identity fields.

Prompt To Fix With AI

This is a comment left during a code review.
Path: openapi/paths/agents/agents_me_customer.yaml
Line: 59

Comment:
**Update fields contradict endpoint rules**

`PATCH /agents/me/customer` uses `IndividualCustomerUpdateRequest`, which requires `customerType` and offers fields such as `email`, `phoneNumber`, and `currencies`. But this operation says any field outside its identity allowlist returns 400. Generated clients therefore require an unlisted field and advertise updates the endpoint rejects. Use an agent-specific request schema containing only the allowed identity fields.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[kphurley7]

Good catch. The operation now takes a new AgentCustomerUpdateRequest with only the identity fields an agent may change (fullName, birthDate, nationality, address, idType, identifier, countryOfIssuance and the EDD fields), and no customerType. Anything else, including email, phoneNumber and currencies, is still documented as a 400.

[greptile-apps]

KYC prerequisite is unexplained

The new hosted KYC endpoint describes 409 only as customer not ready. The existing customer endpoint explains the prerequisite: when the provider requires contact checks, both email and phone must be VERIFIED first. Carry that condition into this endpoint and explain that the platform must complete the contact checks before the agent retries. Otherwise, developers cannot tell which step is missing.

Knowledge Base Used: Customers and accounts API

Prompt To Fix With AI

This is a comment left during a code review.
Path: openapi/paths/agents/agents_me_kyc-link.yaml
Line: 46

Comment:
**KYC prerequisite is unexplained**

The new hosted KYC endpoint describes 409 only as customer not ready. The existing customer endpoint explains the prerequisite: when the provider requires contact checks, both email and phone must be `VERIFIED` first. Carry that condition into this endpoint and explain that the platform must complete the contact checks before the agent retries. Otherwise, developers cannot tell which step is missing.

**Knowledge Base Used:** [Customers and accounts API](https://app.greptile.com/lightspark/-/custom-context/knowledge-base/lightsparkdev/grid-api/-/docs/customers-and-accounts-api.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[kphurley7]

Updated. The 409 now matches the customer KYC-link endpoint: when the provider requires contact verification, the customer's email and phone must both be VERIFIED, and the platform must finish verify-email and verify-phone before the agent retries.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Grid	🟢 Ready	View Preview	Oct 16, 2026, 4:45 PM