deprecate(issuing): deprecate the update-card headers and make the revoke and suspend request optional by armando-rodriguez-cko · Pull Request #396 · checkout/checkout-sdk-php

armando-rodriguez-cko · 2026-10-22T13:12:02Z

Summary

The API no longer documents the return-encrypted-cvv and Encryption-Key request headers on the card update operation, and encrypted_cvv is not part of any response. The revoke and suspend request bodies are optional. This PR deprecates the headers (they keep working when set) and lets revoke and suspend be called without a request.

Verified against the sandbox: update card with and without the deprecated headers (200 both, no encrypted_cvv returned).

A null request or an empty request object sends no body; a request with a reason sends {"reason": ...}. Verified against the sandbox: no body and {} return 200, [] returns 400.

Changes

lib/Checkout/Issuing/Cards/Update/CardUpdateHeaders.php: CardUpdateHeaders, $return_encrypted_cvv and $encryption_key marked @deprecated; removal in the next major version.
lib/Checkout/Issuing/IssuingClient.php:
- updateCardDetails(): the $headers parameter is documented as deprecated; headers set by the caller are still sent.
- revokeCard(): ?RevokeCardRequest $revokeCardRequest = null; null sends no body.
- suspendCard(): ?SuspendCardRequest $suspendCardRequest = null; null sends no body.
lib/Checkout/Issuing/Cards/Revoke/RevokeCardRequest.php, lib/Checkout/Issuing/Cards/Suspend/SuspendCardRequest.php: complete docblocks for $reason.
Tests: CardsClientTest covers revoke and suspend without a request (mocked client and real wire, empty body) and with a reason (JSON body). Comments in CardUpdateHeadersTest and CardsIntegrationTest reworded.

API Reference

PATCH /issuing/cards/{cardId}: https://api-reference.checkout.com/tag/cards/PATCH/issuing/cards/%7BcardId%7D
POST /issuing/cards/{cardId}/revoke: https://api-reference.checkout.com/tag/cards/POST/issuing/cards/%7BcardId%7D/revoke
POST /issuing/cards/{cardId}/suspend: https://api-reference.checkout.com/tag/cards/POST/issuing/cards/%7BcardId%7D/suspend

Breaking changes

None. Only docblocks and nullable defaults change; the deprecated headers are still sent when set, and existing calls passing a request behave as before.

README

No changes needed: the README does not cover the card update headers or revoke and suspend.

agent-wall-e · 2026-10-22T13:12:09Z

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:All changes are non-destructive docblock additions, @deprecated annotations, and making existing parameters nullable with default null — no new endpoints, persisted data, auth changes, or external integrations are introduced.

Operational gates

✅ jira_ticket (INT-1713)
✅ independent_review

Files analysed: 7

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

agent-wall-e · 2026-10-22T13:12:09Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`no_low_class_matched`	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
`prod_source_modified`	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
`2.2.6_logical_extension` — `All changes are non-destructive docblock additions, @deprecated annotations, and making existing parameters nullable with default null — no new endpoints, persisted data, auth changes, or external integrations are introduced.`	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

agent-wall-e

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:The change only adds @deprecated docblock annotations, makes existing method parameters nullable with default null (backward-compatible), and improves docblock comments — no new endpoints, persisted data, auth changes, or external integrations are introduced.

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

agent-wall-e · 2026-10-22T16:16:12Z

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:The PR only adds docblock deprecations, makes existing required parameters nullable with null defaults, and improves documentation comments — all changes are non-destructive, function-preserving, touch no new endpoints or external integrations, and are natural extensions of the existing API client abstractions.

Operational gates

✅ jira_ticket (INT-1713)
✅ independent_review

Files analysed: 9

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

agent-wall-e · 2026-10-22T16:16:12Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`no_low_class_matched`	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
`prod_source_modified`	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
`2.2.6_logical_extension` — `The PR only adds docblock deprecations, makes existing required parameters nullable with null defaults, and improves documentation comments — all changes are non-destructive, function-preserving, touch no new endpoints or external integrations, and are natural extensions of the existing API client abstractions.`	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

agent-wall-e

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:The PR only adds nullable defaults to existing method signatures, deprecates docblocks/annotations on existing fields, and improves documentation—no new endpoints, persisted data, auth changes, or external integrations are introduced.

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

agent-wall-e · 2026-10-23T09:49:02Z

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:The PR only adds deprecation annotations, makes existing parameters nullable with null defaults, and improves docblocks — all non-destructive changes that reuse existing code paths, endpoints, and abstractions without introducing new integrations, persisted data, auth changes, or background processes.

Operational gates

✅ jira_ticket (INT-1713)
✅ independent_review

Files analysed: 9

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

agent-wall-e · 2026-10-23T09:49:03Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`no_low_class_matched`	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
`prod_source_modified`	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
`2.2.6_logical_extension` — `The PR only adds deprecation annotations, makes existing parameters nullable with null defaults, and improves docblocks — all non-destructive changes that reuse existing code paths, endpoints, and abstractions without introducing new integrations, persisted data, auth changes, or background processes.`	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

agent-wall-e

✅ Auto-approved — this PR meets all Low-risk criteria.

All checks passed, no unresolved comments, and the change classification is:

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:The PR only adds deprecation annotations, makes existing request parameters nullable with default null, and improves docblocks—no new endpoints, persisted data, auth changes, or external integrations are introduced, and all existing call paths continue to work unchanged.

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

…voke and suspend request optional The API no longer documents the return-encrypted-cvv and Encryption-Key headers on the card update operation, so CardUpdateHeaders and the updateCardDetails headers parameter are now deprecated. Headers set by the caller are still sent. The revoke and suspend request bodies are optional in the API, so revokeCard and suspendCard now accept a null request, which sends no body.

…rypted CVV wording

…d headers

agent-wall-e · 2026-10-23T12:26:33Z

🟢 Risk Classification: LOW

Approval route: AI Auto-Approval
Rollback controls: Automated Instant Rollback + feature flags

Classification reasons

no_low_class_matched
prod_source_modified
2.2.6_logical_extension:The PR only adds deprecation annotations, makes existing request parameters optional with nullable defaults, and improves docblocks—no new endpoints, persisted data, auth changes, or external integrations are introduced, and all existing call paths continue to function identically.

Operational gates

✅ jira_ticket (INT-1713)
✅ independent_review

Files analysed: 9

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

agent-wall-e · 2026-10-23T12:26:34Z

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
`no_low_class_matched`	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
`prod_source_modified`	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.
`2.2.6_logical_extension` — `The PR only adds deprecation annotations, makes existing request parameters optional with nullable defaults, and improves docblocks—no new endpoints, persisted data, auth changes, or external integrations are introduced, and all existing call paths continue to function identically.`	classifying	§2.2.6	Sonnet 4.6 evaluator promoted minor → low: the change reuses existing code paths and does not cross a trust boundary.

Kinds:

classifying — this rule contributed to the chosen tier.
informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

sonarqubecloud · 2026-10-23T12:26:54Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

armando-rodriguez-cko requested a review from a team October 22, 2026 13:12

agent-wall-e Bot approved these changes Oct 22, 2026

View reviewed changes

agent-wall-e Bot approved these changes Oct 23, 2026

View reviewed changes

david-ruiz-cko approved these changes Oct 23, 2026

View reviewed changes

armando-rodriguez-cko added 6 commits October 23, 2026 14:26

test(issuing): tidy the revoke and suspend tests and drop the old enc…

eb6fc48

…rypted CVV wording

docs(issuing): use the no longer documented wording for the deprecate…

efe56db

…d headers

fix(issuing): send no body for an empty revoke or suspend request

533aedf

docs(issuing): align the header deprecation message

f823a3a

docs(issuing): wrap the deprecation docblocks

07430d7

armando-rodriguez-cko force-pushed the fix/INT-1713-issuing-card-update-headers branch from 37b7358 to 07430d7 Compare October 23, 2026 12:26

armando-rodriguez-cko merged commit 4fb9897 into master Oct 23, 2026
6 checks passed

armando-rodriguez-cko deleted the fix/INT-1713-issuing-card-update-headers branch October 23, 2026 13:02

Navigation Menu

Repository navigation

deprecate(issuing): deprecate the update-card headers and make the revoke and suspend request optional - #396

deprecate(issuing): deprecate the update-card headers and make the revoke and suspend request optional#396
armando-rodriguez-cko merged 6 commits into
masterfrom
fix/INT-1713-issuing-card-update-headers

armando-rodriguez-cko commented Oct 22, 2026 •

edited

Loading

Uh oh!

agent-wall-e Bot commented Oct 22, 2026

Uh oh!

agent-wall-e Bot commented Oct 22, 2026

Uh oh!

agent-wall-e Bot left a comment

Uh oh!

agent-wall-e Bot commented Oct 22, 2026

Uh oh!

agent-wall-e Bot commented Oct 22, 2026

Uh oh!

agent-wall-e Bot left a comment

Uh oh!

agent-wall-e Bot commented Oct 23, 2026

Uh oh!

agent-wall-e Bot commented Oct 23, 2026

Uh oh!

agent-wall-e Bot left a comment

Uh oh!

agent-wall-e Bot commented Oct 23, 2026

Uh oh!

agent-wall-e Bot commented Oct 23, 2026

Uh oh!

sonarqubecloud Bot commented Oct 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Conversation

armando-rodriguez-cko commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

agent-wall-e Bot commented Oct 22, 2026

🟢 Risk Classification: LOW

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Oct 22, 2026

Uh oh!

agent-wall-e Bot left a comment

Choose a reason for hiding this comment

Uh oh!

agent-wall-e Bot commented Oct 22, 2026

🟢 Risk Classification: LOW

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Oct 22, 2026

Uh oh!

agent-wall-e Bot left a comment

Choose a reason for hiding this comment

Uh oh!

agent-wall-e Bot commented Oct 23, 2026

🟢 Risk Classification: LOW

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Oct 23, 2026

Uh oh!

agent-wall-e Bot left a comment

Choose a reason for hiding this comment

Uh oh!

agent-wall-e Bot commented Oct 23, 2026

🟢 Risk Classification: LOW

Classification reasons

Operational gates

Uh oh!

agent-wall-e Bot commented Oct 23, 2026

Uh oh!

sonarqubecloud Bot commented Oct 23, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

armando-rodriguez-cko commented Oct 22, 2026 •

edited

Loading