---
id: change/bcapps/11435
type: change
title: "#11435 Validate unauthenticated public API responses before use"
summary: Unauthenticated external API responses are now validated for size, schema, and integrity before being used in tax and financial processing. The hardening covers VIES VAT validation, currency exchange rates, Nemhandel company status, and MTD fraud prevention endpoints.
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - codeunit nemhandel status page bckgrnd
  - codeunit mtd fraud prevention mgt.
  - codeunit update currency exchange rates
  - codeunit vat lookup ext. data hndl
  - codeunit vat registration log mgt.
system: finance
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:05:36.020Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: dc691ba9c2b7a61ee4dcc7d3b7a99c1a1140dadd
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/11435
    title: "microsoft/BCApps#11435: Validate unauthenticated public API responses before use"
    date: "2026-09-18"
    commit: dc691ba9c2b7a61ee4dcc7d3b7a99c1a1140dadd
    t: null
    quote: null
links:
  learn: []
  objects:
    - object/codeunit/13608-dk
    - object/codeunit/10541-gb
    - object/codeunit/1281
    - object/codeunit/248
    - object/codeunit/249
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 11435
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/11435
kind: pr
base_branch: main
major: "30"
merged_at: "2026-09-18T15:59:37Z"
author: dcenic
author_type: User
community_contribution: false
labels:
  - "Team: Finance"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 13
  additions: 1195
  deletions: 55
  al: 5
apps:
  - Base Application
  - NemhandelNotification
  - UKMakingTaxDigital
objects_touched:
  - key: codeunit/13608
    page: codeunit/13608-dk
    type: codeunit
    id: 13608
    name: Nemhandel Status Page Bckgrnd
    app: NemhandelNotification
    status: modified
  - key: codeunit/10541
    page: codeunit/10541-gb
    type: codeunit
    id: 10541
    name: MTD Fraud Prevention Mgt.
    app: UKMakingTaxDigital
    status: modified
  - key: codeunit/1281
    page: codeunit/1281
    type: codeunit
    id: 1281
    name: Update Currency Exchange Rates
    app: Base Application
    status: modified
  - key: codeunit/248
    page: codeunit/248
    type: codeunit
    id: 248
    name: VAT Lookup Ext. Data Hndl
    app: Base Application
    status: modified
  - key: codeunit/249
    page: codeunit/249
    type: codeunit
    id: 249
    name: VAT Registration Log Mgt.
    app: Base Application
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 648731
systems:
  - finance
  - development
  - integration
quote: null
joined_against:
  major: "30"
  commit: a4406cfa9e57437fedc49c53c327a199a854491e
---

# #11435 Validate unauthenticated public API responses before use

> Unauthenticated external API responses are now validated for size, schema, and integrity before being used in tax and financial processing. The hardening covers VIES VAT validation, currency exchange rates, Nemhandel company status, and MTD fraud prevention endpoints.

[Pull request](https://github.com/microsoft/BCApps/pull/11435) · merged into `main` (BC30) on 2026-09-18 by dcenic · 13 files (+1195 -55), 5 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Size caps on external responses: 64 KB for VIES and Nemhandel, 10 MB for currency exchange rates, 4 KB for the MTD public IP lookup
- VIES responses must echo the requested country code and VAT number, otherwise they are rejected
- Nemhandel responses must contain a cvrNummer matching the requested CVR; MTD exits early on non-2xx responses
- Every rejection emits telemetry and a Security Audit entry; Nemhandel telemetry no longer logs the request URI or reason phrase
- Tests added for size, schema and integrity checks, including CZ, ES and NA VAT test copies
- Behaviour changes for users or extensions.

## AL objects touched

- [Codeunit 13608 "Nemhandel Status Page Bckgrnd"](../../objects/codeunit/13608-dk.md), NemhandelNotification (DK layer): modified
- [Codeunit 10541 "MTD Fraud Prevention Mgt."](../../objects/codeunit/10541-gb.md), UKMakingTaxDigital (GB layer): modified
- [Codeunit 1281 "Update Currency Exchange Rates"](../../objects/codeunit/1281.md), Base Application: modified
- [Codeunit 248 "VAT Lookup Ext. Data Hndl"](../../objects/codeunit/248.md), Base Application: modified
- [Codeunit 249 "VAT Registration Log Mgt."](../../objects/codeunit/249.md), Base Application: modified

## Context

- Work items: AB#648731
- Labels: Team: Finance
- Systems: finance, development, integration

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).