> For the complete documentation index, see [llms.txt](https://docs.corppass.gov.sg/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.corppass.gov.sg/technical-specifications/corppass-authorization-api-legacy/changelog.md).

# Changelog

### **v2.3 (8-Feb-2025)**

#### **New Features**

* **Pushed Authorization Request (PAR) Flow Support**
  * Added a new section detailing the **Pushed Authorization Request (PAR) Endpoint**.
  * This allows clients to push authorization requests **directly to the server** before redirecting users for authentication.
* **Client Authentication with Client Assertion JWT**
  * Introduced a dedicated section explaining JWT-based client authentication.
  * Added `jti` (JWT ID) claim, which will be **mandatory** in a future major release.

#### **Deprecations**

* **`esrvcID` Query Parameter (Authorization Endpoint)**
  * Marked for deprecation. Clients should **avoid relying on `esrvcID`** as it will be removed in an upcoming release.

***

### **v2.2 (15-Jan-2025)**

#### **Deprecations**

* **Authorization Endpoint: `esrvcID` Query Parameter**
  * Added an official **deprecation notice** for `esrvcID`. RPs should transition away from this parameter.

***

### **v2.1 (26-Nov-2024)**

#### **Major Updates**

* **Introduction & Documentation Improvements**
  * Clarified the **OIDC flow diagram** with a **focused summary**.
  * Improved readability in key sections.
* **OpenID Discovery Endpoint**
  * **Added support for new algorithms**:
    * Signing: `ES256K`, `ES384`, `ES512`
    * Encryption: `ECDH-ES+A128KW`, `ECDH-ES+192KW`
  * **Added user claims:** `email`, `email_verified`
* **Authorization Endpoint**
  * Introduced a **"Required"** column in the request parameters table for clarity.
  * **Changed HTTP redirect behavior:**
    * Redirects during Singpass login now return **HTTP 303 (See Other)** instead of **302 (Found)**.
  * Removed outdated **curl request examples**.
* **Token Endpoint**
  * **Client Assertion JWT Updates**
    * Introduced the `jti` (JWT ID) claim for **client authentication**.
    * This will become **mandatory in the next major version**.
  * **Access Token Structure Changes**
    * Updated descriptions for `scope` and `sub`.
    * **Added `client_id` and `jti` claims** to the access token.
  * **Removed curl request examples** for better maintainability.
* **ID Token Structure**
  * Clarified that the **order of key-value pairs in `sub` is not guaranteed**.
  * Added support for `email` and `email_verified` claims.
* **Authorization Info Endpoint**
  * **Changed HTTP method from `POST` to `GET`**.
  * **Deprecated** the use of `scope` in request bodies.
* **New Sections Added**
  * **Overview of JWS & JWE**
  * **Scopes Overview**

***

### **v2.0 (16-May-2024)**

#### **Breaking Changes**

* **Authorization Endpoint Redirect Code Change**
  * Redirect behavior during Singpass login changed from **HTTP 302** to **HTTP 303** to align with best practices.
* **Authorization Info Endpoint**
  * **New Claims Introduced**: `sub` now included.
  * **Error Handling Enhancements**: Added standardized error responses.
* **Token Endpoint**
  * **Error Fields Section Added** to provide more detailed error messages.
* **Single Sign-On (SSO) Discontinued**
  * Officially **removed SSO support**. RPs should transition to alternative authentication methods.

***

### **v1.5 (11-Apr-2024)**

#### **Fixes**

* **Hyperlink Fixes in Staging & Production URLs**

***

### **v1.4 (1-Jun-2023)**

#### **Fixes**

* **Face Verification AMR Claim Update**
  * Corrected the return value for **Face Verification (`AMR` claim)** from `"fb"` to `"fv"`.

***

### **v1.3 and Older**

* Minor documentation updates and schema refinements.
* Inclusion of `uuid` in `sub` claim (v1.2).