https://your-app.azurestaticapps.net/blogKnowledge Base Blog2026-08-31T00:00:00.000Zhttps://github.com/jpmonette/feedKnowledge Base Bloghttps://your-app.azurestaticapps.net/img/favicon.png<![CDATA[August 2026]]>https://your-app.azurestaticapps.net/blog/august-20262026-08-31T00:00:00.000ZAssociated entities let one business pay employees under several ABNs, and the Beam participant sync endpoint reads from Beam instead of restarting registration.
Associated entities: a business can hold several ABN entities under one umbrella and share employees across them. CRUD and logo management under /api/businesses/{businessId}/associated-entities, with associatedentity:read, associatedentity:write and associatedentity:delete scopes, gated on an AssociatedEntities feature flag enabled per tenant. An employee is assigned an entity through their pay run settings.
Payslips resolve branding per entity. An employee paid under an associated entity gets that entity's business block and logo, with no fallback to the parent business logo.
STP pay events partition by associated entity. One pay run produces one lodgement per entity, and document identifiers are partition agnostic.
Beam super contributions split into one employer block per associated entity, grouped by effective ABN. Member verification requests carry the entity's ABN, and GET /api/businesses/{businessId}/beam-participant/employers returns per-entity registration status.
Beam validation items carry the entity name and the resolved employer, fund or payment they refer to, on both validate and submit failure paths.
A nightly Beam health check reports drift between the local business setup and Beam as a per-business notification. Findings are fingerprinted by code, so a dismissed notification stays dismissed while the same problem persists.
POST /api/businesses/{businessId}/teams/{memberId} adds an existing user to a business, requiring team:write.
POST /api/businesses/{businessId}/transfer transfers business ownership, requiring businessdetails:write. Only the current owner can transfer, and the incoming owner receives the owner scope preset while keeping their existing scopes.
GET /api/businesses/{businessId}/pay-runs/{payRunId}/bank-payments/search and GET /api/businesses/{businessId}/pay-runs/{payRunId}/super-payments/search return the bank and super payments for a pay run, requiring payrun:read.
GET /api/businesses/{businessId}/employees/{employeeId}/payslips and GET /api/businesses/{businessId}/employees/{employeeId}/payslips/{payRunId}/download give a business-scoped view and download of an employee's payslips, requiring payrun:read.
GET /api/businesses/{businessId}/employees/{employeeId}/employee-portal-access/eligibility reports whether an employee can be granted portal access, requiring employeeuser:read.
Pay type definition levels: CRUD under /api/businesses/{businessId}/pay-type-definitions/{payTypeDefinitionId}/levels, using the paytypedefinition scopes and behind the PayTypeDefinitions feature flag.
Advanced search accepts null literals, so IS NULL and IS NOT NULL filters work across search endpoints.
DaysPerWeek on employee pay run settings.
Super contributions and pay event lodgements can be deleted from the Paysense UI when their status permits, gated on supercontribution:delete and stp:write.
Payment batch rows show the pay run they came from and link through to it.
The Beam participant endpoints were reworked. POST /api/businesses/{businessId}/beam-participant/sync previously duplicated register, re-running Beam hosted registration and returning a hosted UI token without updating local records, despite its name. It reads Beam and overwrites the local default super fund and bank accounts according to SyncDefaultFund and SyncBankAccounts flags in a request body, where it previously took only a redirect URL. The re-registration behaviour moved unchanged to POST /api/businesses/{businessId}/beam-participant/re-register. GET /api/businesses/{businessId}/beam-participant returns a different payload: Beam's record as at the request, the status this system last stored, and a differences block describing what a sync would change, each block carrying its own timestamp. An unregistered business returns 200 with a single BeamNotRegistered finding.
ContactName was split into ContactFirstName and ContactSurname on business create, business details update, the business details response, and employee bulk import. Both are required and capped at 100 characters. The old field has been dropped, so requests still sending ContactName fail validation.
Scope enforcement was tightened across pay runs and configuration. Pay run employee and totals endpoints require payrun:read to read, payrun:write to write, and payrun:recalculate and payrun:regenerate for those actions, so a token that reached them without those scopes receives 403. Chart of accounts configuration and bank account deletion are also gated on the caller's scopes.
POST /api/businesses/{businessId}/stp/pay-event-lodgements returns a lodgements array in place of a flat Id and Name. A pay run spanning associated entities creates one lodgement per entity, and each item carries that entity's id, name and registration number.
GET /api/configuration/app-version returns thresholds per platform under Ios and Android rather than a single CurrentVersion and MinimumVersion pair. The two builds are reviewed and published independently and can diverge.
Employee pay definition routes carry the pay type definition level. Search moved from /api/businesses/{businessId}/employee-pay-definitions/{payTypeDefinitionId}/search to /api/businesses/{businessId}/employee-pay-definitions/{payTypeDefinitionId}/level/{payTypeDefinitionLevelId}/search, and get, put, patch and delete moved from /api/businesses/{businessId}/employee-pay-definitions/{payTypeDefinitionId}/{businessPayTypeId} to /api/businesses/{businessId}/employee-pay-definitions/{payTypeDefinitionId}/level/{payTypeDefinitionLevelId}/{businessPayTypeId}. The old paths are gone. These endpoints sit behind the PayTypeDefinitions feature flag.
The published surface matches what a tenant can call. The OpenAPI specification omits endpoints whose feature flag is off, and GET /api/admin/scopes returns only business-assignable scopes, excluding those for features the tenant has not enabled. It previously returned every defined scope.
Logo upload is documented as it behaves. Business and associated entity logo uploads take multipart/form-data, accept PNG and JPG up to 5MB, and reject SVG. The specification previously claimed SVG support. The returned LogoUrl is served from /api/public/businesses/assets/{blobId}.{extension}.
Bank and super payment searches exclude zero-value payments, and the composite employee and member account objects were replaced with flat fields including MemberAccountId and MemberNumber.
Employee pay rates are normalised to an hourly rate when saved, and the rate as entered is returned unchanged.
A pay run assigned to an associated entity cannot be finalised unless ATO settings report as Intermediary or Tax Agent. Businesses lodging as an intermediary without a registered agent number still produce schema-valid pay events.
Super and bank payment splitting rounds each allocation to cents, away from zero, and applies a correction to the final allocation so the parts sum to the total.
Employee portal activation emails link to a portal-specific redirect, which offers the MyPaysense (Beta) download for iOS and Android.
Audit log search covers associated entity and pay type definition level actions.
Under-18 employees on a daily rate accrued no super. The 30-hour weekly eligibility gate counted rate units rather than hours, so a daily-rate employee working 38 hours across 5 days registered as 5 units and never cleared the threshold. Under ATO guidance an employee under 18 is entitled to super guarantee for any week they work more than 30 hours, regardless of what they earn.
Super contribution payments were dropped from the Beam payload while the contribution was still marked Submitted. Submission fails fast when the payload loses payments.
Payments marked Excluded were still validated, so an excluded payment could block a contribution.
Beam validation errors were matched to their subject by ordinal position, so a message could attach to the wrong employer, fund or payment. Errors are resolved through a context index built with the payload.
Date-only fields on pay run create and update shifted back a day. They serialise as local yyyy-MM-dd.
Pay run employee metadata returned rates without converting them to the pay type's rate unit.
Pay type, employee pay type and pay type level search returned no results. Advanced search also attempted to process non-string properties.
Nullable enums resolved incorrectly in the OpenAPI schema, including on UpdateEmployeeTaxDetailsRequest.
Recurring pay run actions mishandled amount-only leave entries and returned the wrong pay type name.
MyPaysense (Beta): the refresh token was discarded on first login when biometrics were enabled immediately afterwards.
]]>Paysensehttps://paysense.com.au<![CDATA[July 2026]]>https://your-app.azurestaticapps.net/blog/july-20262026-07-31T00:00:00.000ZPayroll API route segments moved to kebab-case plural nouns, so client paths change.
Penny, an assistant in the Paysense UI, shipped as a first version behind a AiAssistant feature flag that is off by default. Chat runs over a SignalR hub at /chat. The tool catalogue is generated from the payroll OpenAPI specification, so it tracks the API surface, and every tool dispatch is gated on the calling user's scopes. Conversations persist and resume, reads of personal information are audited and rate limited, tax file numbers are not decrypted for assistant reads, and actions that write require an explicit confirmation step. Model requests are served from an Australian Azure AI Foundry endpoint.
Opening suggestions for Penny. An empty thread shows scope-filtered suggestion chips drawn from the current page, unreviewed notifications and a cross-business notification scan, capped in number, with a template greeting when the model is unavailable. Follow-up suggestions are offered after a turn.
Leave type definitions: group leave types into reusable named templates and tag them onto an employee's pay run settings. CRUD under /api/businesses/{businessId}/leave-type-definitions, with leavetypedefinition:read, leavetypedefinition:write and leavetypedefinition:delete scopes. Business leave type create, update and search accept an optional LeaveTypeDefinitionId, and employee pay run settings read and write it.
Business-scoped and employee-scoped notification endpoints: /api/businesses/{businessId}/notifications/search and /api/businesses/{businessId}/employees/{employeeId}/notifications/search, with matching /reviewed and /ignore writes.
Employee work patterns.
Employee portal self service for bank account and super fund details, at /api/employees/{employeeId}/bank-accounts and /api/employees/{employeeId}/super-funds.
Leave request forecast at /api/businesses/{businessId}/employees/{employeeId}/leave-requests/forecast, returning calculated leave units for a leave type and date range.
GET /api/configuration/app-version, an anonymous endpoint returning the current and minimum supported mobile app versions. MyPaysense (Beta) blocks below the minimum and offers an update above it.
Reports overview page in the Paysense UI, grouping payroll, tax and compliance reports with tab filtering by category.
MyPaysense (Beta): Upcoming and Previous tabs on the leave screen, leave balances moved into a bottom sheet, and leave units populated from the forecast endpoint as the leave type and dates are picked.
Payroll API route segments are now kebab-case and plural. Renamed concepts include businesses, employees, pay-runs, pay-event-lodgements, leave-requests, leave-types, leave-type-definitions, pay-types, pay-type-definitions, payslips, public-holidays, super-funds, timesheets, timesheet-records, timesheet-category-mappings, employee-pay-definitions and employee-pay-types. The singleton resources chart-of-accounts and beam-participant are unchanged. Old paths are not aliased.
Notification search and update are scoped to the caller's business memberships. Calls that previously returned tenant-wide notifications return only accessible records, TotalCount counts distinct notifications rather than association rows, and fetching an inaccessible notification by id returns 404.
Tenant-level scopes are rejected when assigning business-level scopes, and user invites require an explicit non-empty scope list.
Pay run type Initial is rejected on pay run create and update. It is set by the system only.
Employee portal access can only be granted or reactivated for fully onboarded employees. Employees in Onboarding status are rejected, and portal access responses include EmployeeStatus.
Pay type definition endpoints sit behind a PayTypeDefinitions feature flag, off by default. The pay type definition, employee pay definition and apply pay type definition endpoints return 404 when the flag is off. Default pay types are unaffected.
Beam participant calls are recorded in the audit log.
Owner scopes are immutable, and re-inviting an existing user is rejected.
The payroll journal did not balance. Post-tax deductions were credited without a matching debit, so credits exceeded debits by the total deduction amount. This also blocked Xero import.
Super contribution payments stayed in Sending or Submitted when Beam returned a refund, error, cancelled, dishonoured or missing payment response. Failing payments are matched by clearing house identifier and marked Failed with the returned message, and per-payment status is shown in the payments grid.
Super fund sync attempted to delete funds still attached to employees.
Member verification notifications rendered an empty severity chip because the payload carried Type where the client expected SeverityCode. Historical notifications have been migrated.
The MessageXchange client retried non-idempotent HTTP writes, which could duplicate submissions.
Payslips showed an hourly rate label for employees paid an annual rate.
Payslips omitted the CASH/CHEQUE payment method for cash payments.
Pay run settings, the new employee wizard, opening balances and timesheet category mappings returned 404 on pay type and leave type definition lookups when those feature flags were off.
The new employee wizard had no pay type definition selector, and pay type search for the selected definition errored.
Advanced search treated quoted strings as operator syntax.
The business switcher could drift from the business in the route, leaving the switcher, scopes, breadcrumbs and dashboard reading a stale selection.
Timesheet earnings mode was editable on employee pay run settings while the Timesheets feature was disabled, allowing a mode the employee could not use.
The chart of accounts add account modal failed to submit.
Tenant branding fell back to the Paysense default when the first branding request after a cold start timed out.
Deep linking or refreshing directly onto a list page's create or edit modal route redirected to the list without opening the modal.
MyPaysense (Beta): submitted timesheet entries appeared on the following day. Timesheet and leave timestamps are stored as wall clock time, but several responses and one mobile form path treated them as UTC.
MyPaysense (Beta): leave requests overlapping a Declined request were rejected. Processing, Imported and Finalised requests still block.
MyPaysense (Beta): the app crashed on a malformed employee context response. A recovery screen is shown instead.
MyPaysense (Beta): the dashboard Log hours action reached the timesheet screen while the Timesheets feature was disabled.