[pengying]

Adds five entries to the October 2026 block of mintlify/changelog.mdx, covering 2026-10-12 to 2026-10-19. Entries already in the changelog (the EXTERNAL_ACCOUNT.ACCOUNT_INFO_UPDATED webhook, the card decline reasons, the payout failureReason sandbox values) are not repeated.

Entries and sources

Entry	Sources	Corroboration
Sandbox placeholder signatures are deprecated	grid-api #1194	Spec and docs only
POST /customers names the missing agreement	grid-api #1170, webdev #38032	Two sources
Narrower otpLength and expirationSeconds	grid-api #1177	Single source
Fixed: refund.settledAt on OUTGOING_PAYMENT.REFUND_COMPLETED	webdev #38112	Single source
Fixed: Retry-After on per-client 429	webdev #38106	Single source. Error429 in the spec already documents the header.

No Jira issue resolved in the window with the grid or grid-api label matched a customer-visible change. No #shipped post in the window corresponds to a documented API change.

Needs confirmation

• clientPublicKey format (grid-api docs(auth): accept only a compressed clientPublicKey for passkey, OAuth and refresh #1171, fix(auth): require lowercase, form-specific clientPublicKey hex #1189; webdev #38016 to #38019). The spec now accepts only a compressed lowercase key on passkey challenge, OAuth verify, and session refresh, and a lowercase uncompressed key on wallet export. fix(auth): require lowercase, form-specific clientPublicKey hex #1189 says the server enforces this only after webdev regenerates its vendored client. I could not confirm that enforcement is live, so I left it out.
• Single-source entries. Confirm the OTP range validation on PATCH /config is enforced, that the refund settledAt fix and the Retry-After change are deployed, and that the Retry-After: 60 fallback is worth documenting.
• Silent payment addresses on Spark (#shipped, 2026-10-15). This is an SDK change, not part of the Grid API reference. I could not find a Grid page to link.

Deliberately excluded

• Agents API (grid-api feat(agents): read and create agents; device-code status takes the code in the body #1179 to feat(agents): agents read and edit their customer's identity and start verification #1186, fix(agents): agent quote operations and actions return Quote #1192, feat(agents): agent cards and agent deposits #1197, feat(agents): agent cross-chain and Spark-address sends #1198; webdev #37840, #37843). The docs label it "Agents (experimental)" and the endpoints return 403 when the Agents API is not enabled for the platform, so I treated it as flag-gated. Several of these PRs also change routes, which would be breaking changes for early users.
• Embedded care chat (grid-api feat(care): document the embedded care chat endpoints #971). Returns 403 for a platform without embedded care.
• Documentation clarifications of existing behavior: docs(spec): document the 403s on receiver lookup and quote, and what SENDER_NOT_ACCEPTED means #1176 (403 codes on receiver lookup and quotes), docs: when PATCH /cards/{id} cannot unfreeze a card #1167 (when PATCH /cards/{id} returns 409), docs: correct sendingAmount default on GET /exchange-rates #1162 (GET /exchange-rates sendingAmount default), Describe the 202 on POST /quotes as the immediate-execution SCA pause #1113 (202 on POST /quotes), docs(sandbox): move the manual cancellation suffixes to their own page #1193 (sandbox cancellation page move).
• Internal and unreleased: schema syncs and lint changes (lint(openapi): require enums with more than one value to be named schemas #1160, refactor(schemas): name the nullable response enums and the accepted job status #1164, chore: Sync account schemas #1168, chore: Sync account schemas #1173, docs: use a checksum-valid routing number in USD account examples #1174), webdev refactors, gatekeeper removals, CI and test changes, the Grid RFI partner portal work, the API IP allowlist setting, and card dispute money movement (#shipped, internal ops process).
• Already in the changelog: periodic statements and balance changes.

Test plan

• make lint-markdown could not run in this environment (the lint:markdown npm script is missing).
• I checked each field name, error code, and range against openapi/ in this repo. I did not run make build because no OpenAPI source changed.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated
grid-cards-demo	Ignored		Oct 19, 2026 4:16pm UTC
grid-flow-builder	Ignored		Oct 19, 2026 4:16pm UTC
grid-wallet-demo	Ignored		Oct 19, 2026 4:16pm UTC

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Grid	🟢 Ready	View Preview	Oct 19, 2026, 4:17 PM

[greptile-apps]

Confidence Score: 5/5

[Low impact] The documentation changes appear safe to merge.

Summary

Adds five entries to the October 2026 changelog:

• The changelog points sandbox users to real signatures instead of placeholders.
• The changelog names the agreement behind each customer creation error.
• The changelog lists the accepted ranges for embedded-wallet OTP settings.
• The changelog explains that completed refund webhooks include the settlement time.
• The changelog explains when callers can retry after a per-client rate limit.

No actionable issues found.

_{Reviews (1) · Last reviewed commit: "docs: changelog for week of 2026-10-19" · Reviewed by Greptile}