### `transaction.created`

### `transaction.updated` webhooks

- **Newly-created accounts now receive the enriched transaction payload by default.** The `_embedded.messages[]` projection — the per-network clearing/authorization message detail behind each transaction — is now included on `transaction.created` and `transaction.updated` webhooks **by default for any account created on or after 2026-07-09**, no opt-in required. **Existing accounts are unchanged**: every account that predates the switch was seeded into an exclusion list, so your current webhook shape is preserved. If a new integration cannot accept the `_embedded` projection, contact your Account Manager (or [product@astrada.co](mailto:product@astrada.co)) to opt out.

### `GET /card-verifications/3ds/{verificationId}` — Mastercard decline reasons

- **Failed 3DS verifications on Mastercard cards now tell you _why_, matching the Visa/Stripe behavior shipped last week.** When a Mastercard verification fails, `failureReason` now carries the issuer's `issuerMessage` and a real `category`/`code` decoded from the network `transStatusReason`, instead of collapsing every Mastercard failure into a single generic `authentication`-type reason. Your retry and cardholder-messaging logic can now branch on the same structured fields across all networks. Additive — no change required.

### `banklink.completed` webhook

- **You can now subscribe to** `banklink.completed` **.** The event fires when a Plaid bank-link enrollment finishes (via hosted-link completion or the `PATCH /bank-links/{id}` path); the payload carries the `bankLinkId` and the discovered `bankAccounts`.

### Bank Linking — integration docs & Postman

- **The Bank Linking flow now has a full integration guide and an importable Postman collection.** A new documentation cluster covers the bank-first → card-linking journey end to end (create link → Plaid connect → detect completion → link cards → receive feeds), and the banking API is now published as its own importable definition (`astrada-banking.json`) so integrators can pull it straight into Postman, kept in lockstep with the OpenAPI spec. No API change — documentation for the already-available bank-linking surface.

### Sandbox

- **Visa (VBDS)** `simulate-ingestion` **is now live in the sandbox**, completing the per-network simulate coverage announced at sandbox launch — you can now inject synthetic Visa clearing/authorization activity the same way you already can for Mastercard (SmartData) and Amex (GL).
- **sandbox field renamed:** the sandbox-only synthetic-card count field is now `newCards` (was `numberOfSyntheticCards`).