Change Log

New Feature

• Read replicas and per-query database timeouts: Database queries accept an options argument. read_replica: true runs the whole operation against a read replica, and timeout sets the statement timeout in seconds. Passing options at all applies a default timeout of 19 seconds.

• ecdh_compute filter: Computes a shared secret from an EC private key and a public key, accepting either a PEM-encoded EC public key or a Base64url-encoded raw key. The result can be returned as raw bytes, hex or base64.

• hkdf filter: The HMAC-based Extract-and-Expand Key Derivation Function from RFC 5869, with optional salt, info, output length and hash algorithm.

• Binary request bodies for API Calls: A body passed directly to the api_call_send mutation through the api_call argument is now delivered to the external service byte for byte, so an encrypted binary payload can be sent as an HTTP request body.

• Deploy installs missing module dependencies: When a declared module is missing or its version does not match, deploy downloads it from the registry recorded in the module lock file's own registries map.

Improvement

• encrypt honours an explicit IV: The optional fourth argument, the initialization vector, now applies to symmetric algorithms. This makes deterministic-nonce schemes possible, such as Web Push message encryption.

• jwt_encode accepts raw EC private keys: For ES256, ES384 and ES512, a key may now be a Base64url-encoded raw private key scalar as well as PEM.

• Hardened archive extraction: Deploy and module archives are unpacked by a pure-Ruby unzipper rather than the system unzip, and entries carrying absolute paths or symlinks are rejected.

• Low-level errors get full Liquid diagnostics: Errors such as FrozenError are wrapped as a proper Liquid error, with location information and structured logging.

• Filter argument errors get a location: An invalid filter argument now renders with the usual Liquid error (path:line): prefix and full diagnostic data.

• Repeated errors logged once: Identical errors are de-duplicated by their rendered message within a single render.

Bug Fix

• split leaves an array unchanged instead of corrupting it, and returns a clear argument error when given a hash.

• Parse errors inside partials and JSON literals point at the partial's own file and line.

• Instance Clone stores zero-byte files correctly instead of dropping them.

• Type casting and sanitization switches are always restored after a caught error.

New Feature

• Multiline tag syntax: A Liquid tag can span multiple lines, so long or deeply nested arguments can be formatted for readability instead of being crammed onto one line. This applies to every tag, including assign, function, include and background.

• JSON literal arguments: JSON objects and arrays can be passed straight to tags and filters, with no assign or parse_json step first. Nested structures, variables as values and string interpolation are all supported.

Improvement

• Liquid errors carry a stack trace: A rendering error now reports the file and line it came from, rather than only a top-level message. It uses the same mechanism as the log tag.

• WebSocket subscriptions always resolve: A channel subscription now returns an explicit verdict either way. A failure arrives as a structured subscription_error carrying a machine-readable code (unauthorized, instance_not_found, subscribed_partial_error or internal), a human-readable description, and guidance on whether to retry.

• New websockets_require_subscribed_partial flag: This app/config.yml flag requires a channel to have a subscribed partial. It defaults to true, so a channel without one has its subscriptions rejected. Review your channels before upgrading if any of them rely on the previous behaviour.

• File upload library upgraded: Brings upstream security patches, bug fixes and performance improvements. No application changes are required.

Features

• Add show_in_quick_view toggle to ManageCustomField and filter in ViewOpportunity; add custom field columns to All Opportunities table
• Add Sort Activities button, rich text notes editor, wider activity drawer
• Add Mark as Won/Lost/Withdrawn to board card menu
• Add clear option to Lost Reason; fix Task Related Record hiding after category clear
• Add Name (email) label format to CRM-contact select options; add contact email as mailto link
• Pin Contact/Company/Lead Referred By/Form Submission on board card; add CRM links with hover icon
• Add id to nested object refs in opportunities API example responses
• Add LocalisationServices and wire setLocalisation on app mount

Bug Fix

• Fix task completion on Lost — use lowercase 'completed'/'open' status values; complete linked tasks; warn about linked tasks on Lost/Delete
• Fix response headers (response_headers: JSON syntax) and add Deprecation: true header to v1 opportunities route
• Comment out deleted_at from graphql mutation return fields; remove redundant deleted_at filters
• Fix Vue warnings in Reports
• Malformed UUID returns 400; add OPTIONS pages for collection and single-resource
• Fix F4 anti-patterns — replace direct axios.post with postWebhook service helper
• Fix date filter — change Target Conversion Date ui_element to date picker; fix date filter format error
• Fix Notes editor pre-populate — wrap setValue in nextTick to avoid Stencil race condition
• Fix board card relative date — use day-level wording (Today/Yesterday/Tomorrow/In X days)
• Update Opportunity Screen UI — status tag colour, contact email_2, company filter, copy icon hover, layout/card updates, Playwright E2E tests
• Fix data source foreign_property, Form Submissions tab blank issue, and Form Submission Details display
• Fix status validation, DELETE 204, filter opportunity_uuid from custom fields schema; fix sub-resource routing
• Fix missing-partial errors in v2 API — add blank line after frontmatter in 23 controller files
• Board view: remove breadcrumbs, fix column height/hover states/dark mode background; separate Board/Table View routes
• Fix exists condition on custom field filters — emit boolean true not quoted empty string; add custom field filtering
• Fix filter chip showing UUID — resolve display names for data source filters
• Fix activity drawer footer z-index overlap and remove list shadow
• Fix Notes editor not pre-populating on edit; fix dropped characters in Notes/Message fields
• Activities toolbar: remove Filter label, move sort after filter, add small-breakpoint layout
• Fix board card task row — icon visibility, text colour, DD MMM date format, layout, hover tooltip
• Fix board card custom fields and rendering; fix custom field values not showing/saving
• Remove ins-table shadow in task drawer
• Fix confetti firing on edit of already-Won opportunity; fire only on transition to won; replace with canvas-confetti fireworks
• Include scoped InputColor CSS in build output; fix stage colour picker
• Fix TypeError on Reports page — optional chaining in 7 report components; fix custom date range label
• Fix filter not applying and no-results empty state card in Opportunities view
• Add blank line after frontmatter in get_pipeline.liquid; fix colour picker # prefix; fix TypeError on .results
• Fix blank lines, trailing newlines, remove insites-tools.log from tracking; add path frontmatter to pipeline partials
• Fix TypeError on .remove(); fix Add Pipeline button loading state and save crash
• Fix tab routing errors and Vue warnings in Opportunities board/activity views
• Fix System Fields pagination, search bar visibility, and page size mismatch
• Add get_pipeline_details controller partial; fix edit pipeline page not loading
• Fix custom field values not showing in InfoCard/edit form; fix uuid display_field; fix data source lookup stuck loading
• Fix System Fields delete modal — add DELETE type-to-confirm input; update copy
• Fix pipeline stage API — block phantom sub-resource routes, add id to nested pipeline in stage responses
• Reduce board card sub-detail gap from 8px to 4px
• Fix task detail link opening with error in new tab
• Fix stage order not saving — sync drag state to reactive data
• Remove is_daylight_savings_time from localisationData localStorage
• Auto-select current date and time when opening Add Activity form
• Add task name link to details page and --iia-main hover colour in Opportunity Tasks
• Fix date fields to follow instance localisation format across forms
• Fix opportunity owner field using wrong lookup endpoint
• Fix board view NaN date display and target conversion date saving as null
• Fix table view loading — keep table mounted and use ListPage loadingScreen overlay
• Fix board view No Stage Added state — visibility, content height and small paragraph
• Show ADD PIPELINE button in header when search returns no results
• Restore total_entries in get_sales_target.graphql
• Split list/detail routes into separate endpoints for exact slug matching
• Replace hardcoded date/time display formats with localisation helpers

Improvements

• Update delete confirmation modal copy, button labels and DELETE input to match Figma
• Various build/lint/CSS cleanup (chunk-vendors build artifact, ESLint globals, insites-tools.log removal from tracking)

Hot Fix

• Fix activity Notes editor not loading its saved value on edit
• Fix activity Date/Time defaulting to today on edit — only default for new activities
• Make email activity Message a rich-text HTML editor; render as HTML in the timeline (SMS stays plain text)
• Fix opportunity Media File/Image custom fields not loading on edit — resolve __field property_upload in get_details and use InsInputFileWrap setFiles

New Feature

• asset_name_to_raw_url filter: Resolves an asset by name to its raw URL. {{ 'logo.png' | asset_name_to_raw_url }} returns the asset's raw URL, or nil when no asset of that name exists.

• expires_in argument for the jwt_token field: The User.jwt_token GraphQL field now accepts an optional expires_in argument, in seconds, capped at one year. When it is omitted the token expires with the instance session timeout.

Improvement

• JWT authentication hardened: Three changes, all on by default. Tokens now carry standard iat and exp claims and are rejected once expired. Each token carries an iss claim tied to its instance, so a token minted on one instance cannot be replayed against another. And changing a password advances a per-user invalidation watermark, which invalidates every JWT issued before the change.

• Cross-origin WebSocket support: A WebSocket connection now resolves the instance from the host rather than the Origin header alone, so cross-origin clients connect correctly. A channel with no explicit authorization now requires one before a cross-origin connection is accepted.

• Updated internal dependencies: Refreshed for security and currency.

Bug Fix

• min and max GraphQL aggregations compute against the requested field instead of the record id.

• hash_assign parses nested bracket lookups correctly.

• Postgres cardinality errors during deploys involving certain associations no longer occur.

• Stale MD5 cache entries are no longer left behind after a deploy.

• Instance Clone continues when an individual asset fails, instead of stopping.

Release Date: June 11, 2026

New Features

• Percentage Processing Fee — Orders and quotes now support a percentage-based processing fee via the is_percentage_processing_fee flag (default: false / fixed amount). The processing_fee_amount is automatically computed server-side on every save using the order/quote base (subtotal + tax + shipping − discounts, clamped to $0). Applies across the v2 API, CSV import, and quote-to-order conversion.
• Auto-generated Quote Number — quote_number is now automatically generated from the record ID on creation. The field is no longer required on POST or CSV import.

Bug Fixes

Quotes

• GET list and GET single: items[] flattened to canonical shape; id added to all nested objects
• POST: quote_status defaults to Draft when not supplied; enum and reference integrity validation added; quote_contact_id correctly derived; geo_json cascade fixed
• PATCH: enum validation and reference integrity checks added; quote_number now enforced
• DELETE: items[] flattened; id added to nested objects

Orders

• GET list and GET single: items[] flattened to canonical shape; doc examples corrected
• POST: items[] flattened in response; *_contact_id fields removed (not in schema); geo_json cascade fixed
• PATCH: items[] flattened in response; order_company correctly marked as not required

Order Items

• POST/PATCH: response shape corrected; null validation and UUID guards added
• PATCH: empty-string order.uuid now rejected
• GET list: page/size required flags corrected; 400 example fixed; nested id fields added

Order Discounts

• id added to nested order and discount objects across GET list, GET single, DELETE
• POST: UUID guards and enum validation added

Order Shipping Packages

• Status enum validation added to POST
• GET list: required flags corrected; sort validation added
• DELETE 200 example aligned with live response

Payments

• POST/PATCH: reference integrity and enum validation; null protection added
• DELETE: nested order id added; stale enum values removed; 404 shape corrected
• GET list: stale enum examples removed; unreachable 400 removed
• GET single: path param display and nested order id fixed

Quote Discounts

• GET single 404 and DELETE 404 doc examples aligned with live response shape
• POST: reference integrity and enum validation added
• PATCH: validation and doc fixes
• GET list: unreachable 400 example removed
• id added to nested quote and discount objects

Quote Items

• POST: reference integrity validation and doc fixes
• id added to nested objects in DELETE 200 doc example

Quote Shipping Packages

• POST: reference integrity and enum validation added
• GET list: page/size correctly marked Optional
• Doc: invalid enum values corrected; id added to nested objects

System Fields

• POST: success status corrected to 200; enum validation added
• PATCH: 404 guard and enum validation added
• DELETE: 404 guard prevents GraphQL internals leaking in error responses

Custom Fields

• DELETE now returns the deleted record; non-numeric id validation added
• Category and product custom field doc schema and example accuracy fixes

Configuration

• Stripe config: partial PATCH now preserves unset fields; non-boolean livemode rejected
• PATCH: empty-string rejected for measurement_unit and weight_unit

Freight Suppliers

• Fixed size field drift in DELETE
• page/size correctly marked Optional in GET list doc
• DELETE 200 example aligned with cURL path record

Products

• CSV SKU import is now atomic per row; duplicate SKU errors include the conflicting UUID
• effective_price is now always computed server-side on create/update and cannot be overridden via the API or CSV import
• Backfill migration recalculates effective_price on all existing products and variants using paginated queries (500 per page) to avoid table locks

Improvements

• id sub-field added to all nested relation objects (order, quote, contact, company, discount, product, product variant) across orders and quotes v2 API responses and doc examples
• All v2 API doc examples updated to reflect live response shapes
• Unreachable 400 examples removed from GET list endpoints across orders and quotes
• Stale enum values removed from payments and order shipping package docs
• CSV import templates for orders and quotes now include the Is Percentage Processing Fee column

Breaking Changes

• v2 API — Response shape: items[] on orders and quotes has been flattened from { id, properties: { uuid, ... } } to a flat object { id, uuid, ... } across all endpoints (GET list, GET single, POST, PATCH, DELETE). Any client reading item.properties.* will break.
• v2 API — Stricter validation: Enum fields on orders and quotes POST/PATCH now reject invalid values with 400. Previously invalid values were silently accepted.
• v2 API — Reference integrity: Quotes PATCH now rejects non-existent relation UUIDs. Order items POST and order discounts POST now reject empty or invalid UUIDs.
• v2 API — Required field: quote_number is now required on quotes PATCH.
• v2 API — Removed field: *_contact_id fields removed from Orders POST — these were not in the order schema and are no longer accepted.
• v2 API — Computed field: processing_fee_amount is now server-computed on every save. Any client-supplied value is ignored and overwritten. Clients should stop sending this field and read it back from the response.
• Products — effective_price — effective_price on products and product variants now always stores the ex-tax active list price. Previously it stored the raw sale_price or regular_price regardless of tax-inclusive flags.
  • Values change for tax-inclusive catalogs. Catalogs with is_tax_included, is_sale_price_tax_included, or is_variant_sale_price_tax_included set to true will see effective_price change after the backfill migration runs.
  • Listings sorted or filtered by effective_price will reorder. Re-test any storefront listing, sort, or price-range filter that reads this field.
  • effective_price is read-only. It is computed server-side on every create/update; values sent in POST/PATCH bodies or CSV imports are ignored and overwritten — read it back from the response.
  • total_price is unchanged. It stays tax-inclusive.

New feature

• Event Stream now records every create / update / delete made through the v2 API, matching the coverage already in place for admin-UI actions.
• Add POST /crm/api/v2/custom-fields/contacts endpoint.
• Add POST /crm/api/v2/custom-fields/companies endpoint.
• v2 Activity responses now expose created_by (set once at creation, immutable on edit) alongside last_updated_by, so the original creator stays visible after the activity has been edited.

Security

• Upgrade axios to ^1.16.0 to pick up upstream security patches; admin UI now handles 401 responses cleanly without throwing.
• Admin sessions opened via 2FA or SSO now respect the configured platform session timeout.
• Breaking — v2 API authentication failures now return an inline 401 JSON response ({"error":"unauthorized"}) on the original URL across all HTTP methods. Previously the response was a 302 redirect to the login page; clients that followed the redirect must update to handle the 401 directly.

Breaking changes

• v2 action endpoints (archive / restore / complete / open on contacts, companies, tasks) switched from PATCH to POST. PATCH on these URLs now returns 405. API clients must update to POST.
• v2 DELETE endpoints now return 204 No Content (was 200 with body). DELETE against a missing resource returns 404 with a documented JSON body, and against a structurally invalid uuid returns 400 with a clean JSON body.
• Custom-fields create error response key changed from errors (array) to singular error (string). Clients that parse the errors array on this endpoint must switch to error.

Improvements

• CRM address autocomplete migrated to the new Google Places API (PlaceAutocompleteElement), keeping the feature working as Google retires the legacy widget.
• Settings → Instance Configuration: the page no longer flashes a "Failed to fetch Instance Configuration Details" error during the backend's reconnect heartbeat, and now connects through the production WebSocket endpoint.
• v2 API documentation refreshed across the board to match the v5.14.1 contract — HTTP methods, URL bases, request/response examples, body-field tables, and field-mapping notes have all been corrected and aligned with what the API actually returns.

Bug fixes

• Fix broken redirects when the configured old_url contained a leading slash (was producing double-slash URLs).
• Fix table pagination crash on CRM Tasks, CRM Activities, Tasks List, and Dashboard when loading a page.
• Task detail panel and edit drawer now reflect changes immediately after saving an edit, without needing a page reload.
• Partial PATCH on /v2/contacts/{uuid} now preserves every untouched property — previously, sending only the field you wanted to change could either return a 400 error or null out the rest of the contact.
• Fix task edit drawer showing the wrong due date for tasks that already had one stored.
• Partial PATCH on /v2/tasks/{uuid} and /v2/tasks/comments/{uuid} no longer returns 400 when the request body omits a field; untouched properties are preserved, matching the contacts behaviour.

New Features

• Move Import Tickets from All Events page to Tickets page.
• Add additional fields to Advanced Filter for Tickets.
• Add link to CRM records on Ticket Details drawer.
• Add Event Name to Tickets export and fix import header mismatch.
• Render Events list date columns in device-local time.
• Show selected timezone on date field labels; update API doc descriptions.
• Sort display field options alphabetically by default.

Improvements

• Update v2 API update endpoints from PUT to PATCH.
• Remove event_uuid from Add Event Tickets example payload; move to controller_payload.
• Regenerate ticket PDF on contact assignment; add loading toast on View PDF.
• Update Sponsors list card layout to group company and sponsorship details.
• Load venue contacts from live venue record when editing event.
• Style circular avatar image on Sponsors and Speakers info cards; add initials fallback.
• Refine sponsor link layout, hit area, and ellipsis truncation.
• Update sponsor card company name and top-alignment styles.
• Update sponsor card link, separator, computation wrapper, and button alignment styles.
• Apply sponsor card styling to Speaker list cards.
• Centre-align Speakers card content and set inner gap.
• Venue contact card: hover/remove action, compact treatment, and button alignment.
• Fix venue contacts card on Event Venue tab.
• Fix duplicate contact re-selection in Assign Contact drawer.
• Enforce required fields on Events, Speakers, and Sponsors PATCH mutations.
• Enforce required fields on Tickets PATCH.
• Enforce question and answer as required on FAQs PATCH.
• Update delete confirmation modal content for tickets.
• Rename area card buttons; update delete confirmation modal for venues.
• Update delete confirmation modal content for system fields.
• Simplify delete pricing tier confirmation dialog text.
• Update division and pricing tier card action button labels.

Bug Fixes

• Fix sponsor link click opening edit drawer.
• Fix group ticket PDF empty content when created via API.
• Fix custom field time/datetime inputs to follow localization time format.
• Fix expense API docs showing incorrect required state for fields.
• Revert System Fields update endpoints from PATCH to PUT.
• Fix filter chips showing UUIDs for Purchased By Contact and Company fields.
• Fix failed to fetch data when filtering by Purchased By Contact/Company.
• Fix Category advanced filter showing invalid text conditions.
• Roll back Tax fields to conditional required and fix Tax* (%) label.
• Fix advanced filter chips not displaying dates using localization settings.
• Fix drawer delete not working on add event ticket list.
• Fix group ticket capacity error handling and drawer delete.
• Fix image upload failing on mobile.
• Fix date format in ticket PDF templates using day instead of month.
• Fix Company label in ticket contact details info table.
• Fix CRM Contact not prefilled when editing a speaker.
• Fix gross/net/tax calculation for expense and revenue fields in Events table.
• Fix page heading gross/net/tax totals and tax column display.
• Fix delete confirmation modals and wrong item deletion bugs.
• Fix ticket delete/PDF bulk action modal titles and button labels.
• Fix event date input/display timezone interpretation.

Improvement

• Faster related_records: Reduced object allocations in related_records, improving performance up to 4x.

• Asset cache invalidation now per-instance: Changed the internal implementation of cache invalidation for assets. The updated=... query parameter appended by the asset_url (and asset_path) filter is now derived from a per-instance assets_updated_at timestamp that is bumped whenever assets change, instead of being derived per asset. This means all asset URLs are invalidated together when any asset is updated, ensuring CDN caches stay consistent.

• Batched page loading on deploy: Pages are now loaded in batches during deploy, providing better support for very large deploys - particularly those containing pages generated by Static Site Generators (SSG).

• Faster Instance Clone asset dump: The asset manifest step of insites-cli duplicate is significantly faster, reducing the time spent in the export phase of cloning instances with large numbers of assets.

• InstanceClone clone-record status on export failure: Previously, InstanceClone could leave the target instance's clone record in pending indefinitely when export failed (for example due to an oversized file). Failures are now surfaced cleanly as a terminal failed status with a sanitized error message, so insites-cli polling resolves instead of hanging.

New Feature

• cache_control argument for admin_assets_create and admin_asset_update mutations: When provided, the value (for example max-age=31536000, public) is stored in the asset's metadata and applied as the Cache-Control header on the underlying object in the file storage provider (S3, R2, etc.), allowing CDNs and browsers to cache assets according to your policy.

• authorization_policies argument for admin_page_create and admin_page_update mutations: Authorization policies can now be associated with a page by name (the same identifier used in Liquid frontmatter, e.g. page_policy or modules/my_module/page_policy), in addition to the existing authorization_policy_ids. Names and ids can be combined; all provided names must resolve to existing AuthorizationPolicy records.

Deprecation

• Deprecated url argument in admin_assets_create: Asset URLs are now derived from the asset name and the per-instance CDN, so the argument is ignored. Upload bytes via admin_assets_presign_urls first, then call admin_assets_create without the url argument. The argument will be removed in a future release.

New Features

• Per-endpoint Markdown documentation, designed for use with AI assistants. Each endpoint can now be exported as a clean Markdown snippet containing the cURL and Controller request examples, parameter list, response shape, and object reference.
• "Copy for LLM" and "View as Markdown" buttons added to every endpoint — copy the endpoint's full Markdown to your clipboard, or open the raw Markdown in a new tab to share or paste into your AI tool of choice.
• Resource pages now have a sticky table of contents listing all endpoints, so you can jump between endpoints without scrolling back to the top. Responsive layout on narrower screens.
• Redesigned API documentation layout. Endpoint details on the left, live example request and response on the right — easier to scan, easier to compare an endpoint's parameters against its example output.
• Per-endpoint Markdown now includes the Controller (Liquid) example alongside the cURL example, matching what the HTML docs show.
• Search behaviour for list endpoints is now documented on the API Overview page — which fields are searchable, how search_by / keyword / exact interact, and how search combines with pagination and sort.

Improvements

• Endpoint parameters are now split into clearly-labelled Path Parameters, Body Fields, and Query Parameters sections — no more confusion about which values go in the URL versus the JSON body.
• Every endpoint now has a single canonical URL — /admin/api/<module>/<resource>#<endpoint>. Older URLs redirect there automatically so existing bookmarks and shared links keep working.
• Markdown export's Object section now matches the HTML resource reference — nested fields show with dot notation, object-type parents are typed correctly, and list-only query parameters no longer leak into the response shape.
• Sidebar navigation and dark mode now hold up cleanly across every module.
• Parent-resource path parameters (e.g. event_uuid on event sponsors, cart_uuid on cart items) now show a description instead of rendering blank.
• Body Fields in the Markdown export are cleaner on POST and PATCH endpoints — fixed duplicate rows and broken dot-notation paths on resources with object references.
• Body Fields no longer lists response-only file metadata (.file_name, .extension, .url) under upload fields. The information is still available in the resource's response Object reference where it belongs.
• Test Request panel cleaned up — the API URL preview now uses the same code-block styling as the Example Request, and the payload editor stays in sync with the URL preview.
• Overview and Module Versions pages now share consistent page spacing with the rest of the docs.
• Dark mode polish across the sticky example panel and sidebar.

Security

• Upgraded the axios HTTP client from 0.27.x (end-of-life) to 1.16.0, picking up two years of security patches and bug fixes.
• Removed the bundled jQuery 1.12.4 dependency (end-of-life since 2016, multiple unpatched vulnerabilities).

Bug Fixes

• Controller examples are now valid Liquid out of the box — placeholder values are properly quoted so copy-pasting the example works without manual edits.
• DELETE endpoint cURL examples no longer include an empty request body flag.
• Locale data cached in the browser is no longer wiped when a localisation request fails — previous translations stay loaded until a successful refresh.

Breaking Changes

• Renamed external API v2 routes from /all_assets/api/v2/... to /asset/api/v2/... for a cleaner public API surface. External integrators must update their base path.

New Features

• Added GET /asset/api/v2/credentials so external API consumers can retrieve the S3 presigned-POST credentials required by the Add Asset flow. Listed in the API documentation under a new "Assets Credentials" section.