Published September 21, 2026.
Audit records delivered to your AWS Data Firehose stream now carry their payload as Brotli-compressed bytes in a new compressedJsonData field, on every record type. Production records have carried it since September 17, 2026.
The same contract covers two record types beyond the access records (type: 1) your stream carries today: transaction (type: 3) and wallet (type: 4) lifecycle records. Lifecycle records are active in Sandbox, and Ripple enables them in Production next.
This notice deprecates the uncompressed jsonData field.
Read the payload from compressedJsonData. Consumers that read jsonData keep working during the deprecation window, but only for access records. Transaction and wallet records never carry jsonData, so a jsonData-only consumer misses the new lifecycle payloads without seeing an error.
When Ripple enables transaction (type: 3) and wallet (type: 4) records in your environment, they start to arrive in your Firehose stream alongside access records. Prepare your consumer before they arrive:
- Ripple Custody (Wallet) doesn't backfill historical events. Lifecycle records start from activation.
- All record types arrive on the same stream. Filter on
type, and don't assume that every record is an access record. - Expect higher record volume. One transaction can produce a record for each status change.
For the source values that each record type uses, see Source values.
| Field | Status |
|---|---|
compressedJsonData | New. Base64-encoded Brotli-compressed JSON payload bytes. The canonical payload for access, transaction, and wallet records. |
compressionAlgorithm, compressionVersion, compressionQuality | New. The codec (br), contract version (1), and encoder quality (6). |
originalJsonDataSize, originalJsonDataSha256 | New. The byte length and SHA-256 of the uncompressed payload, for integrity checks. |
legacyJsonDataTruncated | New. Present and true only when Ripple Custody (Wallet) rebuilt an oversize access payload without request.body. |
jsonData | Deprecated. Base64-encoded uncompressed JSON payload bytes. Ripple Custody (Wallet) emits it on access records only, it might be absent, and Ripple removes it after the deprecation window. |
The envelope fields id, orgId, type, userId, deviceId, requestId, source, receivedAt, and createdAt keep the same meaning.
- Deprecation starts on publication of this notice, September 21, 2026.
- Removal is no earlier than October 21, 2026, a minimum of 30 days after publication, and happens only after Ripple confirms that known consumers have migrated.
- Ripple announces the removal date before it takes effect.
- Base64-decode
compressedJsonData. - Brotli-decompress the result.
- Parse it as JSON — the payload is identical to what
jsonDatacarried for access events. - Optionally verify the decompressed length against
originalJsonDataSizeand its SHA-256 againstoriginalJsonDataSha256. - Stop reading
jsonData, and handle records where it's absent.
For worked examples in Node.js and Python, the full field reference, and the before-and-after record shapes, see Firehose audit log reference.
A Firehose record must stay below 1,000,000 encoded bytes, counting the complete record with both payload representations.
- When a complete encoded access record reaches 1,000,000 bytes, Ripple Custody (Wallet) clears
request.body, rebuilds both payload representations from the reduced payload, and setslegacyJsonDataTruncatedtotrue. The compression metadata then describes the reduced payload. - If the record still doesn't fit, Ripple Custody (Wallet) can't deliver it, and you need to contact support.
- If delivery keeps failing, Ripple Custody (Wallet) disables the Firehose configuration until you re-enable it in Settings > Audit logs.
- Firehose audit log reference — full record reference, decode examples, and delivery guarantees
- Configure audit logging — set up and manage the Firehose connection