feature/INT-1695 - Add verification attempt-assets endpoints and card scheduled_activation_date

[david-ruiz-cko]

This pull request adds support for retrieving paginated address document verification attempts and their associated assets (such as document images), and introduces several new response models to represent these assets. It also enhances the ApiClient interface to allow custom headers for PATCH requests. Additionally, it improves type safety for address country codes and updates the report response model.

Address Document Verification API enhancements:

• Added methods to AddressDocumentVerificationClient and its implementation to retrieve paginated verification attempts (with optional query filters) and to fetch assets (document images) uploaded for a specific attempt, both asynchronously and synchronously. [1] [2] [3] [4] [5] [6] [7] [8]
• Introduced new response models: AddressDocumentVerificationAttemptAsset, AddressDocumentVerificationAttemptAssetType, and AddressDocumentVerificationAttemptAssetsResponse to represent and paginate assets. [1] [2] [3]

ApiClient interface improvements:

• Added overloaded patch and patchAsync methods to ApiClient and its implementation, allowing custom headers to be passed with PATCH requests. [1] [2] [3] [4]

Type safety and model updates:

• Changed the country field in the Address response model from String to the CountryCode enum for better type safety. [1] [2]
• Renamed the signedUrl field to pdfReport in AddressDocumentVerificationReportResponse and improved its documentation.…on_date

[agent-wall-e]

🟡 Risk Classification: MINOR

Approval route: AI Review + Human Approval
Rollback controls: Staged rollout + rollback

Classification reasons

• exceeds_bounded_scope:1684>250

Operational gates

• ✅ jira_ticket (INT-1695)
• ✅ independent_review

Files analysed: 73

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
exceeds_bounded_scope — 1684>250	classifying	§2.1 M8	More than 250 non-test, non-doc, non-lockfile lines changed.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🟠 Advisory review: Concerns worth a look

This PR needs a human approval. Before you give it, these are the things I'd want resolved.

The PR adds paginated attempt/asset retrieval endpoints, new response models, and PATCH-with-headers overloads. It looks broadly correct, but there is one breaking API change and one missing validation that need to be resolved.

Concerns

• Breaking rename: AddressDocumentVerificationReportResponse.signedUrl is renamed to pdfReport without any compatibility shim or migration note — any existing callers reading the old field name from a deserialized response will silently get null, and the PR description mentions this only in passing.
• The new getAddressDocumentVerificationAttemptAssets / getAddressDocumentVerificationAttemptAssetsSync implementations do not validate the attemptId parameter (unlike the matching IdDocumentVerificationClientImpl which validates both IDs), meaning a null/blank attemptId would silently build a malformed URL.
• BaseAttemptResponse removes the clientInformation field and replaces it with a phoneNumber field, but FaceAuthenticationAttemptResponse then re-adds clientInformation as its own field — this restructuring changes the inheritance contract for any existing subclasses and could break deserialization for code that already consumed clientInformation from the base class.
• DeclaredData and ClientInformation are changed from final to non-final classes using @SuperBuilder, which is a wider public API surface change than the PR describes and could affect downstream subclassing assumptions.
• No tests are visible in the truncated diff for any of the new client methods (paginated attempts, asset retrieval) or for the new PATCH-with-headers overloads — if integration/unit tests exist they are not shown, but their absence would leave these paths uncovered.
• The AttemptAssetsQueryFilter class is referenced throughout but is not shown in the diff; if it is newly added it should follow the same pattern as AttemptsQueryFilter, and if it is pre-existing its shape (and whether queryFilter can be null) should be verified.

⚠️ The diff was too large to read in full, so this review covers only part of the change.

---

_{This is not an approval. wall-e cannot auto-approve this PR — it is an opinion to help whoever does. Advisory review · us.anthropic.claude-sonnet-4-6 · wall-e 2026.06.19-02}

[agent-wall-e]

🟡 Risk Classification: MINOR

Approval route: AI Review + Human Approval
Rollback controls: Staged rollout + rollback

Classification reasons

• exceeds_bounded_scope:1806>250

Operational gates

• ✅ jira_ticket (INT-1695)
• ✅ independent_review

Files analysed: 75

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
exceeds_bounded_scope — 1806>250	classifying	§2.1 M8	More than 250 non-test, non-doc, non-lockfile lines changed.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud