GBG Go Release Notes

​

September releases

​

New features

• New Australian document elements. The Australia DVS Security Identification Card element covers ASIC and MSIC cards. The Australia DVS Change of Name Certificate element records a change of name, including the previous names. These elements can be supplied when you start a journey or produced by a module.
• New identity elements. Passport, Driving Licence and Birth Certificate record the issuing country as a field, so one element serves every country. Aliases records other names a person uses, and Nationality records the nationality they declare. These elements can be supplied when you start a journey or produced by a module.
• Resume an unfinished journey. An applicant who closes the page can reopen the same link in the same browser and carry on where they stopped. Resume is on by default for every delivery. The resume window starts at the applicant’s first visit and does not extend when they return. The default is 7 days, and a delivery can ask for up to 30 days. The window never outlasts the journey’s data retention period. To turn resume off, set resumeMode to off in linkConfig on the journey start request. For hosted journeys, the resume credential is bound to the browser that obtained it.

• Your own SMS invite wording. A delivery or organisation can now set its own text for single-user SMS invites in linkConfig.smsInviteMessage. Use {{inviteUrl}} and {{firstName}} in the text, and the link is added if you leave it out.

​

Improvements

• Interaction request limits. Interaction submit and asset upload requests from an applicant’s device are now rate limited per journey instance. A request over the limit returns 429 with a Retry-After header. A submit request body is limited to 32 MB, and a larger body returns 400. A request can carry at most 50 documents, 50 biometric entries and 25 inline images.
• Australian document fields. The Australia DVS Marriage Certificate element gains documentNumber and issueDate, and registrationNumber is now optional on birth and marriage certificates. The Australia DVS Centrelink Concession Card element now stores the cardholder’s fullName.
• Business entity fields. dissolutionDate is now optional, headcount must be a whole number, and an associated person’s nationality is a country code.
• Bank accounts identified by IBAN. A bank account in subject.accounts[] can now carry iban without accountNumber. Each account needs at least one of the two, and a module that requires accountNumber still needs it.
• Token request documentation. The published OpenAPI specification now shows scope=gbg.token as required on client credentials token requests. Generated clients that left it out could not get a token.

​

Bug fixes

​

August releases

​

New features

• New domain elements. The following elements are now available to journeys and modules:
  • Australia DVS Visa, for an Australian visa number.
  • Consent, for an explicit consent record.
  • Stored Face, a reference to a face template held by a supplier, for reverification.
  • Entity Person Address, the home address of a person associated with a business.
• OpenAPI specification in YAML. GET /v2/captain/openapi.yaml now serves the specification as YAML, alongside the existing JSON version.

​

Improvements

• Delivery links last 7 days by default. An unconfigured link now lasts 7 days instead of 24 hours. Set linkConfig.ttlMinutes for a shorter lifetime. Action required. No link can last more than 7 days, and a longer requested lifetime is reduced to 7 days without an error. deliveryUrlTtlMinutes still works but is deprecated in favour of linkConfig.ttlMinutes.
• Schema API uses short IDs. POST /v2/captain/journey/schema/fetch now takes the same resourceId as the journey start request, for example my-delivery@latest, and takes the organisation from your token. The response returns deliveryId and resolvedVersion, which together pin a journey start to that exact version. Action required. The grId request member has been removed, and the response no longer contains full resource names. A request that sends grId receives 400.
• Business entity data. The legal form of a business, such as LLC or plc, has moved from subject.entities[].type to subject.entities[].businessType. The PrimaryEntity/type reference is now PrimaryEntity/businessType. Action required. A request that sends the legal form in subject.entities[].type now receives 400. Journeys and modules that reference PrimaryEntity/type must change to PrimaryEntity/businessType.
• Millisecond ordering for journey events. Journey action events now carry createdAtMs. Order a journey’s events by instance ID and createdAtMs, and fall back to createdAt for older events.

​

Bug fixes

​

July releases

​

New features

​

Improvements

• Document Classification V2 now outputs the anchor image. The variant produces the anchor image alongside its classification results, so the image is available earlier in the journey and can be consumed by parallel branches rather than waiting for extraction to complete.
• Document Extraction V2 no longer outputs the anchor image. The image is already produced by Document Classification V2 earlier in the journey, so the output has been removed from this variant to avoid duplication. Document Extraction V2 continues to extract data fields such as name, date of birth, document number, and expiry date.
• Document Authentication V2 now depends on both Document Classification V2 and Document Extraction V2. Place the variant after both modules in your journey. The supported module order is Document Classification V2, then Document Extraction V2, then Document Authentication V2.

​

Bug fixes

​

July releases

​

New features

​

Improvements

​

Bug fixes

​

July releases

​

New features

​

Improvements

​

Bug fixes

​

July releases

​

New features

• Personal information
• Documents
• Biometrics

​

Improvements

​

Bug fixes

​

July releases

​

New features

​

Improvements

• Promoted the overall journey result to the response root. The /journey/state/fetch and /journey/interaction/fetch endpoints now return the journey result as response.result, so you no longer need to read it from the nested context.result.
• Added the step name to each entry in steps[]. Entries now include a readable name alongside nodeId, so you can show which check ran without looking it up in the journey configuration.
• Added decision and evaluation nodes to steps[]. Responses now show which branch a journey took and why.
• Added support for the OAuth 2.0 client_credentials grant. Tokens issued through this grant are now accepted, where they were previously rejected with a 401 response.
• Documented how each emails[].type value maps to its domain element in the API reference. The values map as follows:

  Value	Domain element
  personal	PersonalEmail
  work	WorkEmail
  other	OtherEmails

• Corrected the API reference to show type as required on document submissions. The field has always been required, so document submissions must include it.
• Updated the Investigation Portal to show a Pass/Fail result rather than a score for the Biometrics Reverification variant.
• Removed the Relevance column from the Document Authentication V2 validation tab in the Investigation Portal, as it doesn’t apply to this variant.

​

Bug fixes

​

July releases

​

New features

​

June releases

​

New features

• Liveness Verification with Injection Attack Detection
• Facematch Verification - NIST
• Document Verification

​

June releases

​

New features

​

Improvements

​

Bug fixes

​

June releases

​

New features

​

Improvements

​

Bug fixes

​

June releases

​

New features

​

Improvements

​

Bug fixes

​

June releases

​

New features

• Document Classification v2
• Document Extraction v2
• Document Authentication v2
• Facematch Verification v2
• Liveness Verification v2
• Chip Authentication

​

Improvements

​

Bug fixes

​

June releases

​

New features

​

Improvements

​

Bug fixes

​

June releases

​

New features

• Added the ability to classify evaluation outcomes as Positive, Negative, or Neutral directly in the Journey Builder, enabling richer analytics and clearer interpretation of journey decisions at a glance.
  Classification is optional and fully backward compatible. Existing journeys continue to work unchanged, with unclassified outcomes appearing as “unclassified” in reporting.
• Added Investigation audit logs to the Journey Builder Audit log page through a new tabbed view, letting admins review both journey and investigation activity from a single, consistent interface.

​

Improvements

​

Bug fixes

​

May releases

​

New features

• Document Classification v2
• Document Extraction v2
• Document Authentication v2

​

Improvements

​

Bug fixes

​

May releases

​

New features

• Granular domain elements. Interaction inputs and outputs now travel as discrete domain elements with full provenance. Pre-fill values are preserved across steps even when the same field is collected more than once, and downstream consumers can see which step in a journey produced each value.
• Parallel module execution within a linear segment. When a journey segment contains independent modules, Go v2 now runs them concurrently, reducing end-to-end journey latency on multi-module flows.
• Module re-execution within a journey. A module can be executed more than once within the same journey instance — useful for retry, multi-document capture, and re-attempt patterns.
• Terminate-node interaction screens. Journeys can now display a final interaction screen at terminate nodes, so end users see a definitive completion or rejection message rather than the journey ending silently.
• Design-time Schema API. POST /journey/schema/fetch returns the interaction schema for a journey, derived from the published configuration, so Designer and integrating clients can render and validate against the exact contract Go will enforce at runtime.
• OnboardChildOrg. A new use case onboards child organisations with reciprocal parent/child relationships, retention policy, and a test-account flag. Child orgs are immediately able to consume shared resources via @ref.
• Configurable data retention per organisation. Progress events written to your S3 bucket now carry a RETAIN-<duration> object tag derived from the org’s retention duration, so lifecycle rules can enforce retention without per-bucket configuration.
• Automatic 30-day journey-data cleanup. Journey state older than 30 days is now purged automatically, in line with REQ-04-025.
• OAuth2 credential resolution. Delivery credentials can now be resolved through an OAuth2 token-exchange flow, with multi-client registry support, retry, exponential backoff, and concurrent-request deduplication.
• Brand resolution. A deterministic three-step brand-resolution chain selects the correct brand (logo, copy, theme) for an end user, including across child-org journeys.
• Iframe embedding allowlist. Journeys can only be embedded by origins on a configured allowlist, enforced at the platform via frame-ancestors and X-Frame-Options.
• Loqate runtime injection. The address-lookup card now receives its Loqate API key at journey execution time, so a single journey definition works across customers without rebuilding.
• Interaction events to S3. INTERACTION_STARTED and INTERACTION_COMPLETED are now forwarded to your progress-events bucket alongside module events.
• GBG Errors Catalog. Go v2 API error responses follow the platform-wide GBG Errors Catalog format — stable code, type, and details shape — replacing the ad-hoc error shapes of the previous orchestrator.
• JOURNEY_ABANDONED event. Go v2 records an explicit JOURNEY_ABANDONED event when a journey times out or is terminated, so abandonment is visible to the Investigation Portal and progress consumers as a first-class outcome.
• Journey deletion endpoint. Journey instances can be deleted explicitly via API (REQ-02-002), supporting right-to-be-forgotten workflows.

​

Improvements

• Higher throughput, lower latency. Go v2 is a ground-up rewrite on a modern runtime. Per-request CPU and memory footprint are materially lower than the previous orchestrator, and replica counts and HPA targets have been tuned for production load.
• Production-grade resilience. Per-dependency timeouts, retry policies, and circuit breakers are tuned for production traffic (GGO-13550). Failures in a downstream module no longer cascade into journey-wide outages.
• Token hardening. Device and end-user JWTs now carry explicit aud and scope claims and enforce TTLs. The Authorization: Bearer header is the sole supported credential transport — body credential fallbacks have been removed (REQ-01-003).
• Structured logging with PII filtering. Logs are emitted as structured JSON with a PII-filter stage on the stdout path, suitable for ingestion by Coralogix and downstream pipelines.
• Configurable journey context size limit. The maximum journey-context payload size is now controlled by an environment variable, so high-data journeys can be enabled without code changes.
• /version endpoint enriched. Go’s version endpoint now reports the build timestamp and the versions of bundled GBG dependencies (schema, flow compiler, end-user app/lib), so deployed builds can be identified unambiguously from the outside.
• Server-side schema-error volume capped. Go bounds the number of schema-validation errors returned per request, preventing unbounded log volume from pathological payloads.
• Service-principal allowlist for Flowable events. Go v2 only accepts Flowable callbacks from a configured set of service principals (GGO-13550).
• Compiler version in deployment cache key. Module deployments are cached against the flow-compiler version, so a compiler bump correctly invalidates stale deployments instead of serving them.

​

Bug fixes

​

April releases

​

New features

• Added Document Attachments module for supporting document collection. This module enables you to request and securely collect supporting documents during onboarding workflows such as Proof of Address, Proof of Income, and Marriage Certificate.
• Added PEP and Sanctions Standard OGM Push variant, enabling automated push of individual records for continuous compliance screening with configurable worklist targeting and success/error outcome reporting.

​

Improvements

• Dataset selection
• Customizable match thresholds (75-100)
• Sanction body filtering
• Automatic name transliteration to Latin alphabet
• DOB/country matching requirements
• PEP tier selection
• Configurable candidate limits

​

Bug fixes

​

March releases

​

New features

​

Improvements

​

Bug fixes

​

March releases

​

New features

​

Improvements

​

Bug fixes

​

March releases

​

New features

​

Improvements

​

Bug fixes

​

March releases

​

New features

​

Improvements

​

Bug fixes

​

February releases

​

New features

​

Improvements

​

Bug fixes

​

February releases

​

New features

• Enabled Update Modules feature in production environment. To learn more, refer to How to update modules in GBG Go.

​

Improvements

​

Bug fixes

​

February releases

​

New features

• Added support for UK Edited and Historical Electoral Roll dataset, providing comprehensive electoral register verification. This includes both current and historical voter registration data for improved UK identity verification workflows.
• Added support for UK National ID Register dataset, providing access to national identity registration data for improved UK identity verification workflows.

​

Improvements

​

Bug fixes

​

February releases

​

New features

​

Improvements

​

Bug fixes

​

February releases

​

New features

• Account numbers
• Sort codes
• Routing numbers
• IBAN/BIC codes
• Account holder information for UK, US, and international banking systems

{
  "context": {
    "subject": {
      "accounts": [
        {
          "type": "Bank Account",
          "accountNumber": "12345678",
          "sortCode": "12-34-56",
          "accountHolderName": "Jane Doe",
          "bankName": "Example Bank Ltd",
          "country": "GB",
          "accountType": "current"
        }
      ]
    }
  }
}

{
  "context": {
    "subject": {
      "accounts": [
        {
          "type": "Bank Account",
          "accountNumber": "12345678",
          "sortCode": "12-34-56",
          "accountHolderName": "Jane Doe",
          "bankName": "Example Bank Ltd",
          "country": "GB",
          "accountType": "current"
        },
        {
          "type": "Bank Account",
          "accountNumber": "89370400440532013000",
          "iban": "DE89370400440532013000",
          "bic": "COBADEFFXXX",
          "accountHolderName": "Jane Doe",
          "bankName": "Commerzbank",
          "country": "DE",
          "accountType": "savings"
        }
      ]
    }
  }
}

​

Improvements

​

Bug fixes

​

February releases

​

New features

​

Improvements

​

Bug fixes

​

January releases

​

New features

​

Improvements

​

Bug fixes

​

January releases

​

New features

​

Improvements

​

Bug fixes

​

December releases

​

New features

• You can now restore journeys to previous deployment versions directly from the Journey Dashboard. This feature provides improved version control and deployment safety, allowing you to quickly roll back to earlier journey configurations when needed. To learn more, refer to Restore journeys to a previous version.
• Integrated Intercom for in-app support chat, enabling you to access help resources and receive real-time assistance directly within the Go application.
• Added filtering and sorting capabilities to the Go dashboard for improved navigation and organization of journeys. To learn more, refer to Create journeys.

​

Improvements

• Added configurable Originating Agency Code (OAC) settings for Australian FVS document verification (driver’s license and passport) in Journey Designer.

​

Bug fixes

​

December releases

​

Bug fixes

​

November releases

​

New features and improvements

• Improved journey execution to enable modules to access and use subject information updated by other modules within the same journey. This capability allows for more sophisticated identity verification workflows where modules can build upon data gathered and enriched by previous steps.
• Added new PEP and Sanctions functionalities to the Investigation Portal. Functionalities include:
  • Results Summary tab for quick identification of PEP matches and sanctions database matches with clear, organized result summaries.
  • PEPs tab for detailed PEP match information, including confidence scores, identity details, and relevant metadata to support compliance decisions.
  • Sanctions tab for evaluating matches against sanctions lists, with results organized by source authority or dataset for clear compliance context.
  • PDF export capability to generate comprehensive reports of all PEP and Sanctions screening results for audit and regulatory compliance documentation.
• Improved the “Raw” tab in the Investigation Portal to display a clean, API-response-structured JSON object. The tab now shows relevant module output data (status, advice, notes, subject, documents) in a consistent format, making it easier to understand module results and troubleshoot issues.

​

Bug fixes

​

API changes

​

September releases

​

New features and improvements

• Session detail PDF exports now include a complete audit log showing the history of actions taken on the record. This enables offline compliance reviews and audits with full traceability.
• Increased the journey completion timeout from 30 minutes to 7 days, allowing customers more time to gather and submit required information during multi-step verification processes. This is particularly helpful for journeys requiring document collection or manual review steps.
• Enabled settings configuration for document and biometric verification modules in production environments. You can now customise module behavior according to specific business rules and requirements. To learn more, refer to the How to configure module settings in Go documentation.
• Enabled settings configuration for the Webhook module in preview and production environments. You can now customise the webhook module to accept your preview and production webhook URLs. For more details, refer to the How to use and configure a Webhook module in Go documentation.

​

Bug fixes

​

August releases

​

New features

• Added the ability to export customer sessions to PDF. This is great for record-keeping, compliance reporting, or sharing with stakeholders outside the GBG Go platform. For more details, see the Export journey session documentation.
• Added webhook support for customer journeys. You can now configure webhooks using the Webhook module to send real-time notifications about task status changes in your customer journeys to external apps. This enables better integration with your existing systems and workflows.

​

July releases

​

New features and improvements

• Processing tab: Navigate to this tab and expand the documents and biometrics module. Click More Details > Extracted Images to view and zoom the image.
• Documents & Biometrics tab: You can immediately view and zoom images when you navigate to this tab.

• Zoom In (+): Click to magnify the image for closer inspection.
• Zoom Out (-): Click to reduce the magnified image.
• Center: Click to center the image in the viewing area.
• Reset (X): Click to return the image to its original size and position.

​

Improvements

• No improvements added this month.

​

Bug fixes

​

May releases

​

Improvements

• Shortened the connection lines between modules in the journey designer canvas for a cleaner, more compact visual experience. The updated spacing makes it easier to view and work with complex journeys without excessive scrolling.
• Added support for optional asynchronous journey execution in pre-fill mode to prevent timeout issues with long-running processes. Developers can now receive immediate response with instance IDs and monitor progress separately.

​

April releases

​

Improvements

• Updated visual indicators for unlicensed modules with clearer icons and colors.
• Improved variant lists by removing unnecessary licensing indicators.
• Added a helpful guidance message when selecting unlicensed variants.

​

Bug fixes