Sessions now tell you what they found, not only what they read

The results of a Spain Public Administration session carry a new field: messages — situations the session detected while it ran, beside the records themselves. It travels in Get Session Results and in the payload of the ended and partial webhooks.

Nothing changes for an integration that ignores it. Most sessions detect nothing and the list is empty.

The one to route is `flag`

There are four types, and three of them describe how the reading went — an error, a warning, an info note. The fourth describes what the reading found.

A flag never means something failed on our side. It means the session found something about the person or the data that deserves a decision on yours: a signal a clean, successful verification would not normally carry. Treat it as an input to the rules that already decide when a case needs a human — a verification can be technically perfect and still be worth a second look.

Automate on message_id, never on the wording. message_id is the stable name of the situation — profile_identity_mismatch, crossed_identity — and a situation is reported once however many times it occurred, so messages is a set of facts about the verification rather than a trace of it. The text in message is written for a person and may be rewritten without the situation becoming a different one.

It points at the data it is about

location is a loc list — the same shape as the loc of a validation error: ["data", "customer", "profile"], with strings for fields and integers for array positions. An empty list means the message is about the session as a whole.

That is why it is a list and not a path written out: a results document contains arrays, and data.driver.vehicles.0.license_plate cannot be resolved without guessing whether 0 is a key or an index. With a loc you can put the message on the exact field in your own interface, with no parsing.

Where to read about it

What the session tells you, beside the data — the types, the loc, and a worked example: what happens when two administrations describe different people, and why that particular flag is a guarantee on this flow rather than something you should expect to see.
Get Session Results — every field, and what to do with each type.