2026-11-07: support routing and consented view-as (Wave 5.5)#

• Support settings. platformSupportSettings and updatePlatformSupportSettings (supportMode partner_first or finbaze_direct, supportUrl, supportEmail, supportEscalationEnabled). Enum SupportMode.
• Escalations to FinBaze. supportEscalations(status, first, after), createSupportEscalation(input) and addSupportEscalationComment(escalationId, body); enums SupportSeverity and SupportEscalationStatus. A company user can create one from the embed only when the platform chose finbaze_direct.
• Request ids. Every response carries X-Request-Id; a caller's own id (8 to 64 characters of A-Z a-z 0-9 . _ -) is kept and written to the audit log. The header is now exposed to browsers (CORS), so embed errors carry requestId.
• Consented view-as. FinBaze staff open a platform company only under a support access grant. supportAccessGrants(companyId, includeEnded), decideSupportAccess(grantId, approve, attestation, stepUpAssertionId) and revokeSupportAccess(grantId); enums SupportAccessScope and SupportAccessStatus. Read-only grants refuse every change; filings, consent, firm connections and transfers are refused under any grant. Break-glass needs a second FinBaze admin, lasts two hours and is announced at once.
• Embed. New elements contact-support (session key contactSupport; events support.requested and support.escalation.created; the SDK opens supportUrl when the page has no support.requested handler) and support-access (session key supportAccess; features decide and revoke; events support.access.approved, .declined, .revoked). notification-banner approves or declines a pending support request in place (feature supportApproval; events support.access.approved and .declined). New operations requestPlatformSupport(companyId, screen, requestIds, componentVersion) for partner_first.
• Events. support.requested, support.escalation.created, support.escalation.updated, support.access_requested, support.access_granted, support.access_revoked, support.access_expired and support.break_glass, each with a JSON Schema in the catalogue.
• Step-up. The step_up provider accepts the action support_access.approve.
• Scopes. support:read and support:write.
• Audit. Rows written under a grant have actor kind support, the grant id and audience both, so they appear in platformAuditLogs.
• SDK. platform.support (settings, escalations, grants) and platform.sandbox (test clocks, seedTestCompany, resetSandbox).

See Support and view-as.