Add card tokenization 2FA platform config

[DhruvPareek]

Reason

Grid will deliver card-network tokenization authentication codes through Twilio and Amazon SES. Platforms need per-platform branding and sender configuration that is independent of embedded-wallet eligibility.

Overview

This PR does not add an endpoint. It extends only the existing platform configuration endpoints:

• GET /platform/config
• PATCH /platform/config

Both endpoints now include an optional cardTokenization2faConfig. The configuration follows the direct storage model used for Turnkey OTP customization: a successful PATCH is the configuration returned by GET and used by subsequent delivery attempts. There is no approval status, rejection reason, or requested/effective split.

Platforms may set a custom SES fromAddress and a per-platform Twilio Verify templateSid. V1 intentionally does not preflight provider readiness: an unverified SES identity or unavailable Twilio template may cause delivery to fail and retry. The schema enforces that logoUrl starts with https://.

Example PATCH body:

{
  "cardTokenization2faConfig": {
    "displayName": "Acme",
    "logoUrl": "https://acme.com/card-email-logo.png",
    "email": {
      "fromAddress": "cards@acme.com",
      "fromName": "Acme Cards",
      "replyToAddress": "support@acme.com",
      "subject": "Your Acme card verification code",
      "bodyText": "Use this code to finish adding your Acme card."
    },
    "sms": {
      "templateSid": "HJ00000000000000000000000000000000",
      "bodyText": "Use this code to finish adding your Acme card."
    }
  }
}

The relevant portion of the GET and PATCH response has the same shape:

{
  "cardTokenization2faConfig": {
    "displayName": "Acme",
    "logoUrl": "https://acme.com/card-email-logo.png",
    "email": {
      "fromAddress": "cards@acme.com",
      "fromName": "Acme Cards",
      "replyToAddress": "support@acme.com",
      "subject": "Your Acme card verification code",
      "bodyText": "Use this code to finish adding your Acme card."
    },
    "sms": {
      "templateSid": "HJ00000000000000000000000000000000",
      "bodyText": "Use this code to finish adding your Acme card."
    }
  }
}

The JSON property uses 2fa to follow the API lower-camel-case convention; component schema names retain the conventional 2FA acronym. Shared Twilio/SES service credentials and default fallbacks remain internal.

This is the source OpenAPI change. Generated webdev artifacts and the sparkcore implementation are separate PRs in the implementation stack.

Test Plan

• make build
• make lint

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
grid-flow-builder	Ignored	Preview	Jul 22, 2026 10:09pm
grid-wallet-demo	Ignored	Preview	Jul 22, 2026 10:09pm

[DhruvPareek]

• Add card tokenization 2FA platform config #718 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

✱ Stainless preview builds for grid

This PR will update the grid SDKs with the following commit messages.

cli

feat(api): add card-tokenization-two-factor-auth-config parameter to config

go

feat(api): add card tokenization 2FA config to platform config

kotlin

feat(api): add cardTokenizationTwoFactorAuthConfig to platform config

openapi

feat(api): add cardTokenizationTwoFactorAuthConfig to config

php

feat(api): add card tokenization 2FA config to platform config

python

feat(api): add card_tokenization_two_factor_auth_config parameter to config update

ruby

feat(api): add card_tokenization_two_factor_auth_config to platform config

typescript

feat(api): add cardTokenizationTwoFactorAuthConfig field to config

⚠️ grid-openapi studio · code

Your SDK build had at least one "warning" diagnostic.
generate ⚠️

✅ grid-ruby studio · code

Your SDK build had at least one "note" diagnostic.
generate ✅ → build ✅ → lint ✅ → test ✅

⚠️ grid-go studio · code

Your SDK build had a failure in the lint CI job, which is a regression from the base state.
generate ✅ → build ✅ → lint ❗ → test ❗

go get github.com/stainless-sdks/grid-go@fb91bfe6f419a92da641729bbaaea7299f267b73

⚠️ grid-kotlin studio · code

Your SDK build had a failure in the test CI job, which is a regression from the base state.
generate ⚠️ → build ✅ → lint ✅ → test ❗

⚠️ grid-python studio · code

Your SDK build had a failure in the lint CI job, which is a regression from the base state.
generate ✅ → build ✅ → lint ❗ → test ❗

pip install https://pkg.stainless.com/s/grid-python/6139de9ef09e6e71f6ac3d4aba2d228bb070184c/grid-0.0.1-py3-none-any.whl

✅ grid-typescript studio · conflict

Your SDK build had at least one note diagnostic.

✅ grid-php studio · code

Your SDK build had at least one "note" diagnostic.
generate ✅ → lint ✅ → test ✅

⚠️ grid-cli studio · code

Your SDK build had a failure in the build CI job, which is a regression from the base state.
generate ⚠️ → build ❗ → lint ❗ → test ❗

---

This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push.
If you push custom code to the preview branch, re-run this workflow to update the comment.
Last updated: 2026-07-23 02:06:09 UTC

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
Grid	🟢 Ready	View Preview	Jul 21, 2026, 1:38 AM

[greptile-apps]

Greptile Summary

This PR adds platform-level configuration for card-tokenization authentication messages. The main changes are:

• New email and SMS branding schemas.
• Optional configuration on platform config GET and PATCH models.
• Updated PATCH examples and generated OpenAPI bundles.

Confidence Score: 4/5

The HTTPS validation gap needs to be fixed before merging.

• The new schema permits non-HTTPS logo URLs despite documenting an HTTPS-only contract.
• The SMS fallback description can lead clients to expect delivery behavior that the feature overview does not guarantee.
• The source references and generated bundles are otherwise consistent.

openapi/components/schemas/config/CardTokenization2FAConfig.yaml and openapi/components/schemas/config/CardTokenization2FASmsConfig.yaml

Security Review

The new logo field says it accepts only HTTPS URLs, but its schema accepts any absolute URI scheme. Enforcing HTTPS at the API boundary prevents insecure logo configuration.

Important Files Changed

Filename	Overview
openapi/components/schemas/config/CardTokenization2FAConfig.yaml	Adds the aggregate configuration, but does not enforce the documented HTTPS-only logo URL.
openapi/components/schemas/config/CardTokenization2FAEmailConfig.yaml	Adds optional email sender and branding fields with basic format and length constraints.
openapi/components/schemas/config/CardTokenization2FASmsConfig.yaml	Adds SMS template settings, but describes fallback behavior that conflicts with the stated delivery contract.
openapi/components/schemas/config/PlatformConfig.yaml	Adds the optional card-tokenization configuration to platform responses.
openapi/components/schemas/config/PlatformConfigUpdateRequest.yaml	Adds the optional configuration to the existing partial-update request.
openapi/paths/platform/config.yaml	Extends the PATCH example with the new configuration.
openapi.yaml	Updates the generated root bundle with the new schemas and example.
mintlify/openapi.yaml	Keeps the Mintlify bundle aligned with the generated root specification.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
openapi/components/schemas/config/CardTokenization2FAConfig.yaml:12-16
**HTTPS Restriction Is Not Enforced**

The description requires an HTTPS logo, but `format: uri` also accepts values such as `http://example.com/logo.png`. The PATCH schema therefore permits configuration outside its stated contract, which can produce insecure or broken logo rendering in later authentication emails.

```suggestion
  logoUrl:
    type: string
    format: uri
    pattern: '^https://'
    maxLength: 512
    description: HTTPS URL of the logo displayed in email messages.
```

_{Reviews (1): Last reviewed commit: "Add card tokenization 2FA platform confi..." | Re-trigger Greptile}

[github-actions]

⚠️ Breaking OpenAPI changes detected

This PR introduces breaking changes to openapi.yaml:

API Changelog 2025-10-13 vs. 2025-10-13

API Changes

POST /transactions/{transactionId}/cancel

• ⚠️ api path removed without deprecation

---

Detected by oasdiff. This PR will need approval from an API reviewer before merge.