feat(cards): send card authorization requests to webhookEndpoint, configured through platform config by AaryamanBhute · Pull Request #1247 · lightsparkdev/grid-api

AaryamanBhute · 2026-10-28T16:59:07Z

Follow-up to #1212, addressing Shreya's review: card authorization needs neither its own resource nor its own URL.

Changes

Removes GET/PUT/DELETE /platform/card-authorization-endpoint and CardAuthorizationEndpointRequest.
CARD_AUTHORIZATION.REQUEST now goes to the platform's existing webhookEndpoint.
Adds cardConfigs.realTimeAuthorization (nullable CardRealTimeAuthorization with one field, timeoutBehavior), set through PATCH /platform/config. Omitting it keeps the setting, null turns real-time authorization off, and an object turns it on or updates it.
Drops isTest from CardAuthorizationRequest, along with the test delivery that gated saving the endpoint and its 400 WEBHOOK_DELIVERY_ERROR.
The response deadline is a fixed 1.5s, stated in the docs, and is not returned in the config.
Updates the real-time authorization docs, the webhook descriptions, the decline-reason and timeout-behavior descriptions, and the Stainless model config.

Nothing calls the removed resource yet. The webdev implementation (lightsparkdev/webdev#38554–#38557) has not merged and is being reworked to match.

🤖 Generated with Claude Code

vercel · 2026-10-28T16:59:09Z

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated
grid-cards-demo	Ignored	Preview	Oct 28, 2026 9:20pm UTC
grid-flow-builder	Ignored	Preview	Oct 28, 2026 9:20pm UTC
grid-wallet-demo	Ignored	Preview	Oct 28, 2026 9:20pm UTC

mintlify · 2026-10-28T16:59:13Z

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Grid	🟢 Ready	View Preview	Oct 28, 2026, 9:22 PM

github-actions · 2026-10-28T16:59:54Z

⚠️ Breaking OpenAPI changes detected

oasdiff reports 3 error / 1 warning changes to openapi.yaml.
This PR will need approval from an API reviewer before merge.

Errors (3)

DELETE /platform/card-authorization-endpoint — api path removed without deprecation [api-path-removed-without-deprecation].
GET /platform/card-authorization-endpoint — api path removed without deprecation [api-path-removed-without-deprecation].
PUT /platform/card-authorization-endpoint — api path removed without deprecation [api-path-removed-without-deprecation].

Warnings (1)

Show sample

POST webhook:card-authorization-request — removed the request property allOf[subschema #2]/data/isTest [request-property-removed].

Detected by oasdiff. Full report: job summary or the oasdiff-report artifact.

greptile-apps · 2026-10-28T17:02:03Z

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable contract or documentation issues were found.

Summary

Moves real-time card authorization to the platform's existing webhookEndpoint.

Card authorization decisions now use the platform’s shared webhook endpoint.
The separate card authorization endpoint and test enrollment are removed.

No actionable issues were found.

Diagram

sequenceDiagram
    participant P as Platform
    participant G as Grid
    participant W as webhookEndpoint
    P->>G: PATCH config to enable real-time authorization
    Note over G: Run Grid's authorization checks
    G->>W: Signed CARD_AUTHORIZATION.REQUEST
    alt Valid decision within 1.5 seconds
        W-->>G: APPROVE or DECLINE
    else Late or invalid response
        Note over G: Apply timeoutBehavior
    end
    Note over G: Check funding if proceeding
    G->>W: CARD_TRANSACTION outcome

_{Reviews (2) · Last reviewed commit: "docs(cards): tidy real-time authorizatio..." · Reviewed by Greptile}

ls-bolt · 2026-10-28T18:40:23Z

🦣 Congratulations @shreyav - your substantive review earned a Siberian unicorn! (rare)

This giant grazing rhinoceros carried a huge domed boss that supported a horn.

View your Frost-dex: https://zeus.dev.dev.sparkinfra.net/#/dinodex/shreyav?section=ice-age

ls-bolt · 2026-10-28T20:43:10Z

📌 Bolt Status

2026-10-28 20:43:09 UTC — ⚡ Agent lunar-compass-f7(#1) started

Feedback

ls-bolt · 2026-10-28T20:43:41Z

⚡ Review rounds — updated in place, latest first.

Round 2 · `99eca73`

Moved the CardRealTimeAuthorization Stainless model under platform config, removed the duplicated schema description, and reworded the PATCH description to call it a decision request (per @shreyav).
npm run lint:openapi reports 0 errors. Skipped the adversarial review because this round only changes docs and config placement.

Earlier rounds (1)

Round 1 · `05b5a3e`

Commits

429465a feat(cards): set the card authorization endpoint through platform config
637acd1 docs(cards): an unset authorization endpoint reads as null
d718c17 docs(cards): state the 1.5s authorization deadline instead of returning it
05b5a3e feat(cards): send card authorization requests to the platform webhookEndpoint
CARD_AUTHORIZATION.REQUEST now goes to webhookEndpoint, and cardConfigs.authorizationEndpoint is replaced by cardConfigs.realTimeAuthorization: { timeoutBehavior } | null (per @AaryamanBhute and @shreyav).
Dropped isTest, the pre-save test delivery, and the PATCH's 400 WEBHOOK_DELIVERY_ERROR.
Rebased onto main and rebuilt both bundles. npm run lint:openapi reports 0 errors. Adversarial review found nothing actionable.

Moves the endpoint from its own /platform/card-authorization-endpoint resource into cardConfigs.authorizationEndpoint on PATCH /platform/config, where every other platform setting lives. The test request now runs on the PATCH, and a failed test request rejects the whole update. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ng it responseTimeoutMs is a single global value that integrators can't act on, and lowering it would be a breaking change, so the deadline is now part of the documented contract. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…Endpoint Replace cardConfigs.authorizationEndpoint with cardConfigs.realTimeAuthorization, which carries only timeoutBehavior. CARD_AUTHORIZATION.REQUEST now goes to the platform's webhookEndpoint. Drop the isTest request and the test delivery that gated saving the endpoint. Co-Authored-By: AaryamanBhute <AaryamanBhute@users.noreply.github.com> Co-Authored-By: shreyav <shreyav@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lightspark-bot · 2026-10-28T20:47:45Z

This stack of pull requests is managed by Graphite. Learn more about stacking.

ls-bolt · 2026-10-28T20:48:16Z

⚡ Review ledger

Round 1

Use the existing webhook endpoint instead of a separate URL (@shreyav, decided by @AaryamanBhute) → FIXED: openapi/components/schemas/config/CardConfig.yaml realTimeAuthorization, openapi/webhooks/card-authorization-request.yaml
isTest is overly complicated (@shreyav, @AaryamanBhute: drop it) → FIXED: removed from CardAuthorizationRequest.yaml along with the test delivery
responseTimeoutMs shouldn't be returned (@shreyav) → FIXED: earlier round. 1.5s is a documented constant.

Round 2

Stainless model should move near platform config (@shreyav) → FIXED: .stainless/stainless.yml platform config models
Duplicated description (@shreyav) → FIXED: removed from CardRealTimeAuthorization.yaml
Reword the PATCH description: "enable real-time card authorization requests" (@shreyav) → FIXED: openapi/paths/platform/config.yaml
Is it a decision request? (@shreyav) → FIXED: the PATCH description now names it a CARD_AUTHORIZATION.REQUEST decision request

Move the CardRealTimeAuthorization Stainless model under platform config, keep one description of the setting, and call the request a decision request in the PATCH description. Co-Authored-By: shreyav <shreyav@users.noreply.github.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions Bot added the breaking-change Introduces a breaking change to the OpenAPI spec label Oct 28, 2026

mintlify Bot deployed to staging - mintlify October 28, 2026 17:00

View deployment

mintlify Bot deployed to staging - mintlify October 28, 2026 17:08

View deployment

shreyav reviewed Oct 28, 2026

View reviewed changes

Comment thread openapi/webhooks/card-authorization-request.yaml Resolved

shreyav reviewed Oct 28, 2026

View reviewed changes

Comment thread openapi/components/schemas/cards/CardAuthorizationRequest.yaml Resolved

shreyav reviewed Oct 28, 2026

View reviewed changes

Comment thread openapi/components/schemas/cards/CardAuthorizationEndpoint.yaml Resolved

mintlify Bot deployed to staging - mintlify October 28, 2026 19:54

View deployment

AaryamanBhute added the bolt label Oct 28, 2026 — with Graphite App

AaryamanBhute and others added 4 commits October 28, 2026 20:46

docs(cards): an unset authorization endpoint reads as null

637acd1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ls-bolt Bot force-pushed the card-authorization-endpoint-in-config branch from 6f255bb to 05b5a3e Compare October 28, 2026 20:47

ls-bolt Bot changed the title ~~feat(cards): set the card authorization endpoint through platform config~~ feat(cards): send card authorization requests to webhookEndpoint, configured through platform config Oct 28, 2026

mintlify Bot deployed to staging - mintlify October 28, 2026 20:48

View deployment

AaryamanBhute marked this pull request as draft October 28, 2026 20:48

shreyav approved these changes Oct 28, 2026

View reviewed changes

Comment thread .stainless/stainless.yml Resolved

Comment thread openapi/components/schemas/config/CardConfig.yaml Resolved

Comment thread openapi/paths/platform/config.yaml Resolved

mintlify Bot deployed to staging - mintlify October 28, 2026 21:22

View deployment

AaryamanBhute marked this pull request as ready for review October 28, 2026 21:32

mohamedwane approved these changes Oct 28, 2026

View reviewed changes

AaryamanBhute merged commit 3969566 into main Oct 28, 2026
12 checks passed

AaryamanBhute deleted the card-authorization-endpoint-in-config branch October 28, 2026 21:33

Conversation

AaryamanBhute commented Oct 28, 2026 • edited by ls-bolt Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

vercel Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mintlify Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Breaking OpenAPI changes detected

Errors (3)

Warnings (1)

Uh oh!

greptile-apps Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Diagram

Uh oh!

Uh oh!

ls-bolt Bot commented Oct 28, 2026

Uh oh!

Uh oh!

Uh oh!

ls-bolt Bot commented Oct 28, 2026

Uh oh!

ls-bolt Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Round 2 · 99eca73

Round 1 · 05b5a3e

Uh oh!

lightspark-bot commented Oct 28, 2026

Uh oh!

ls-bolt Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Round 1

Round 2

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

AaryamanBhute commented Oct 28, 2026 •

edited by ls-bolt Bot

Loading

vercel Bot commented Oct 28, 2026 •

edited

Loading

mintlify Bot commented Oct 28, 2026 •

edited

Loading

github-actions Bot commented Oct 28, 2026 •

edited

Loading

greptile-apps Bot commented Oct 28, 2026 •

edited

Loading

ls-bolt Bot commented Oct 28, 2026 •

edited

Loading

Round 2 · `99eca73`

Round 1 · `05b5a3e`

ls-bolt Bot commented Oct 28, 2026 •

edited

Loading