August 2026

Associated entities let one business pay employees under several ABNs, and the Beam participant sync endpoint reads from Beam instead of restarting registration.

Added

• Associated entities: a business can hold several ABN entities under one umbrella and share employees across them. CRUD and logo management under /api/businesses/{businessId}/associated-entities, with associatedentity:read, associatedentity:write and associatedentity:delete scopes, gated on an AssociatedEntities feature flag enabled per tenant. An employee is assigned an entity through their pay run settings.
• Payslips resolve branding per entity. An employee paid under an associated entity gets that entity's business block and logo, with no fallback to the parent business logo.
• STP pay events partition by associated entity. One pay run produces one lodgement per entity, and document identifiers are partition agnostic.
• Beam super contributions split into one employer block per associated entity, grouped by effective ABN. Member verification requests carry the entity's ABN, and GET /api/businesses/{businessId}/beam-participant/employers returns per-entity registration status.
• Beam validation items carry the entity name and the resolved employer, fund or payment they refer to, on both validate and submit failure paths.
• A nightly Beam health check reports drift between the local business setup and Beam as a per-business notification. Findings are fingerprinted by code, so a dismissed notification stays dismissed while the same problem persists.
• POST /api/businesses/{businessId}/teams/{memberId} adds an existing user to a business, requiring team:write.
• POST /api/businesses/{businessId}/transfer transfers business ownership, requiring businessdetails:write. Only the current owner can transfer, and the incoming owner receives the owner scope preset while keeping their existing scopes.
• GET /api/businesses/{businessId}/pay-runs/{payRunId}/bank-payments/search and GET /api/businesses/{businessId}/pay-runs/{payRunId}/super-payments/search return the bank and super payments for a pay run, requiring payrun:read.
• GET /api/businesses/{businessId}/employees/{employeeId}/payslips and GET /api/businesses/{businessId}/employees/{employeeId}/payslips/{payRunId}/download give a business-scoped view and download of an employee's payslips, requiring payrun:read.
• GET /api/businesses/{businessId}/employees/{employeeId}/employee-portal-access/eligibility reports whether an employee can be granted portal access, requiring employeeuser:read.
• Pay type definition levels: CRUD under /api/businesses/{businessId}/pay-type-definitions/{payTypeDefinitionId}/levels, using the paytypedefinition scopes and behind the PayTypeDefinitions feature flag.
• Advanced search accepts null literals, so IS NULL and IS NOT NULL filters work across search endpoints.
• DaysPerWeek on employee pay run settings.
• Super contributions and pay event lodgements can be deleted from the Paysense UI when their status permits, gated on supercontribution:delete and stp:write.
• Payment batch rows show the pay run they came from and link through to it.

Changed

• The Beam participant endpoints were reworked. POST /api/businesses/{businessId}/beam-participant/sync previously duplicated register, re-running Beam hosted registration and returning a hosted UI token without updating local records, despite its name. It reads Beam and overwrites the local default super fund and bank accounts according to SyncDefaultFund and SyncBankAccounts flags in a request body, where it previously took only a redirect URL. The re-registration behaviour moved unchanged to POST /api/businesses/{businessId}/beam-participant/re-register. GET /api/businesses/{businessId}/beam-participant returns a different payload: Beam's record as at the request, the status this system last stored, and a differences block describing what a sync would change, each block carrying its own timestamp. An unregistered business returns 200 with a single BeamNotRegistered finding.
• ContactName was split into ContactFirstName and ContactSurname on business create, business details update, the business details response, and employee bulk import. Both are required and capped at 100 characters. The old field has been dropped, so requests still sending ContactName fail validation.
• Scope enforcement was tightened across pay runs and configuration. Pay run employee and totals endpoints require payrun:read to read, payrun:write to write, and payrun:recalculate and payrun:regenerate for those actions, so a token that reached them without those scopes receives 403. Chart of accounts configuration and bank account deletion are also gated on the caller's scopes.
• POST /api/businesses/{businessId}/stp/pay-event-lodgements returns a lodgements array in place of a flat Id and Name. A pay run spanning associated entities creates one lodgement per entity, and each item carries that entity's id, name and registration number.
• GET /api/configuration/app-version returns thresholds per platform under Ios and Android rather than a single CurrentVersion and MinimumVersion pair. The two builds are reviewed and published independently and can diverge.
• Employee pay definition routes carry the pay type definition level. Search moved from /api/businesses/{businessId}/employee-pay-definitions/{payTypeDefinitionId}/search to /api/businesses/{businessId}/employee-pay-definitions/{payTypeDefinitionId}/level/{payTypeDefinitionLevelId}/search, and get, put, patch and delete moved from /api/businesses/{businessId}/employee-pay-definitions/{payTypeDefinitionId}/{businessPayTypeId} to /api/businesses/{businessId}/employee-pay-definitions/{payTypeDefinitionId}/level/{payTypeDefinitionLevelId}/{businessPayTypeId}. The old paths are gone. These endpoints sit behind the PayTypeDefinitions feature flag.
• The published surface matches what a tenant can call. The OpenAPI specification omits endpoints whose feature flag is off, and GET /api/admin/scopes returns only business-assignable scopes, excluding those for features the tenant has not enabled. It previously returned every defined scope.
• Logo upload is documented as it behaves. Business and associated entity logo uploads take multipart/form-data, accept PNG and JPG up to 5MB, and reject SVG. The specification previously claimed SVG support. The returned LogoUrl is served from /api/public/businesses/assets/{blobId}.{extension}.
• Bank and super payment searches exclude zero-value payments, and the composite employee and member account objects were replaced with flat fields including MemberAccountId and MemberNumber.
• Employee pay rates are normalised to an hourly rate when saved, and the rate as entered is returned unchanged.
• A pay run assigned to an associated entity cannot be finalised unless ATO settings report as Intermediary or Tax Agent. Businesses lodging as an intermediary without a registered agent number still produce schema-valid pay events.
• Super and bank payment splitting rounds each allocation to cents, away from zero, and applies a correction to the final allocation so the parts sum to the total.
• Employee portal activation emails link to a portal-specific redirect, which offers the MyPaysense (Beta) download for iOS and Android.
• Audit log search covers associated entity and pay type definition level actions.

Fixed

• Under-18 employees on a daily rate accrued no super. The 30-hour weekly eligibility gate counted rate units rather than hours, so a daily-rate employee working 38 hours across 5 days registered as 5 units and never cleared the threshold. Under ATO guidance an employee under 18 is entitled to super guarantee for any week they work more than 30 hours, regardless of what they earn.
• Super contribution payments were dropped from the Beam payload while the contribution was still marked Submitted. Submission fails fast when the payload loses payments.
• Payments marked Excluded were still validated, so an excluded payment could block a contribution.
• Beam validation errors were matched to their subject by ordinal position, so a message could attach to the wrong employer, fund or payment. Errors are resolved through a context index built with the payload.
• Date-only fields on pay run create and update shifted back a day. They serialise as local yyyy-MM-dd.
• Pay run employee metadata returned rates without converting them to the pay type's rate unit.
• Pay type, employee pay type and pay type level search returned no results. Advanced search also attempted to process non-string properties.
• Nullable enums resolved incorrectly in the OpenAPI schema, including on UpdateEmployeeTaxDetailsRequest.
• Recurring pay run actions mishandled amount-only leave entries and returned the wrong pay type name.
• MyPaysense (Beta): the refresh token was discarded on first login when biometrics were enabled immediately afterwards.