This release expands APIsec’s authentication resolution capabilities with Private-Key Client Authentication support, introduces a Global Viewer role for organization-wide read-only visibility, and simplifies endpoint configuration with bulk Require Authentication controls. It also improves ticket synchronization, Dry Run reliability and diagnostics, and report generation.

What's New​

Private-Key Client Authentication (private_key_jwt)​

APIsec now supports private-key JWT client authentication (RFC 7523) for OAuth 2.0 client-credentials flows, via Custom Authentication Chains. Instead of a shared client secret, the client authenticates to the token endpoint with a signed JWT assertion—an asymmetric credential. A new pre-request signing operation produces the assertion from a key supplied as a chain parameter (never stored in the chain). This lets scans authenticate against identity providers that require public/private-key client authentication, and lets customers move off symmetric secrets to key-pair credentials whose private key never leaves their control.

Why this matters​

• Asymmetric client credentials, not shared secrets. private_key_jwt (RFC 7523) is a major OAuth client-authentication method — the client proves itself with a signed JWT instead of a client secret, matching providers that mandate key-pair client authentication.

Configuration: The Custom Authentication Guide covers setting up private-key JWT client authentication via a Custom Authentication Chain.

Global Viewer Role​

A new Global Viewer role provides read-only access across all applications in the tenant. Unlike the standard Viewer and User roles, which are limited to applications shared directly or through teams, Global Viewers can view applications across the organization without edit permissions.

Why this matters​

• Provides organization-wide visibility without granting modification access
• Simplifies access for auditors and other read-only stakeholders
• Maintains separation between visibility and application management

SSO setup: mapping a group to the Global Viewer role is documented for Azure Entra ID — see Azure Entra SSO configuratio. Okta and Ping guides will follow soon.

Bulk Update — Endpoint's Authentication Requirement​

You can now enable or disable Require Authentication for multiple endpoints at once from the Endpoints tab. Bulk changes are recorded in the user activity report. Existing onboarding behavior remains unchanged.

Why this matters​

• Reduces the effort required to configure authentication requirements across large APIs
• Makes endpoint-level authentication configuration faster and more consistent
• Provides an audit trail for bulk configuration changes

Improvements​

Azure DevOps and Jira Ticket Synchronization on Host URL Changes​

Updating an instance's host URL now closes tickets associated with the previous host and recreates them against the new host.

Impact​

• Keeps external issue trackers synchronized with the updated API environment
• Prevents tickets from remaining associated with an outdated host URL

Dry Runs Use the Instance's Known-Good Hosted Agent​

Dry Runs now execute through the instance's healthy configured Hosted Agent instead of falling back to another agent.

Impact​

• Improves Dry Run reliability for Private Hosted Agent deployments
• Ensures validation uses the same trusted scan environment configured for the instance

Clearer Dry Run Failures​

Dry Run results now provide actionable failure messages when an agent returns a non-success response with an error message. Responses that return a success status but indicate that the request was rejected are now correctly classified as Not Testable.

Impact​

• Makes Dry Run failures easier to diagnose
• Improves the accuracy of endpoint testability results

More Reliable Report Generation​

Report generation now retrieves detection data more efficiently and provides an actionable reason when it can't generate a report. Impact

• Improves report-generation reliability
• Provides clearer guidance when report generation fails

NG Production Release Update - APIsec_cloud_7.9.2.0 ( September 18, 2026 )​

This release expands Automated Authentication Discovery to support additional enterprise identity providers, introduces the next-generation Browser Bolt v2 with social login support, and adds Jira Story creation for vulnerability tickets. It also delivers reliability and security improvements for Private Hosted Agents, along with GraphQL scanning and reporting enhancements.

What's New​

More Identity Providers for Automated Authentication Discovery​

Automated Authentication Discovery now supports AWS Cognito, Keycloak, Duende IdentityServer, and WSO2 Identity Server, in addition to the existing Auth0, Okta, PingOne, and IBM identity providers.

APIsec can identify these providers even when they are not explicitly named in the API specification and build the authentication flow by following the application's redirect.

Why this matters

• Enables authenticated scanning across more enterprise identity platforms
• Reduces manual authentication configuration during API onboarding
• Helps customers get authenticated scans running with less setup

Note: For WSO2 Identity Server, APIsec uses the opaque access token issued for the target API rather than the identity token.

Browser Bolt v2​

Browser Bolt v2 improves browser-based API onboarding, including support for capturing authenticated sessions through social login.

Why this matters

• Makes it easier to onboard APIs that require browser-based authentication
• Supports applications using social login during authentication
• Improves the capture experience for authenticated APIs

Availability: Browser Bolt v2 is ready for publication to the Chrome Web Store and will be available for installation once the store review is complete.

Create Jira Issues as Stories​

Jira integrations now support Story as an issue type in addition to Bug and Task. The selected issue type is validated against the target Jira project when testing the connection.

Why this matters

• Gives teams more flexibility to align APIsec tickets with their Jira workflow
• Prevents ticket-creation failures caused by unsupported issue types
• Confirms that the selected issue type can be created before vulnerabilities are reported

Improvements​

New Private Hosted Agent Image — Reliability & Security Updates​

A new Private Hosted Agent image includes reliability and security improvements. Hosted-agent work can now be automatically reclaimed and redelivered when a backend instance becomes unresponsive during a scan, preventing scans from failing due to this type of backend interruption.

Why this matters

• Improves scan reliability for Private Hosted Agent deployments
• Helps scans continue through backend instance interruptions
• Includes the latest security and reliability updates

Note: Customers using Private Hosted Agents should upgrade to the latest image.

OWASP Coverage Report Improvements​

Problem

The Percentage of Endpoints at Risk chart in the OWASP Coverage report could show incorrect endpoint counts and percentages, with inconsistencies between the UI and generated PDF.

Solution

Endpoint counts and percentages are now calculated consistently, and the report visualization and vulnerability-category legend have been corrected.

Impact

• Improves the accuracy of OWASP Coverage reporting
• Ensures the UI and PDF present consistent results
• Provides clearer vulnerability-category visualization

GraphQL Scan Improvements​

Problem

GraphQL scans could encounter an internal APIsec error during the OIDC/JWKS authentication discovery step, and the discovery-JWKS test was missing its description.

Solution

The authentication discovery workflow has been corrected for GraphQL APIs.

Impact

• GraphQL authentication discovery now completes successfully
• Improves the consistency of GraphQL security testing

NG Production Release Update - APIsec_cloud_7.9.1.0 ( September 11, 2026 )​

This release expands APIsec’s security testing and enterprise workflow capabilities with new Numeric Bound Fuzzing and Monetary Integrity tests, automated authentication discovery, enhanced Jira integrations, and new FedRAMP and HIPAA/HITRUST compliance reports. It also adds read-back validation for Mass Assignment findings and improves the accuracy and reliability of authentication, parameter hydration, BOLA testing, reporting, and private Hosted Agent scan improvements.

What's New​

Automated Authentication Discovery​

When you onboard an application, APIsec now automatically determines which identity provider the API uses and builds a login for it — discovery starts automatically as soon as the spec registers, with nothing to click. The Configure Credentials card on the App Model panel drives the flow: while discovery runs, the card shows no action, and once a login is ready, the button reads Provide Credentials. Enter the account and the card moves to Completed, attaching a "Discovered login" auth set as the instance default so your next scan can run authenticated.

APIsec recognizes a provider named in the spec or discovers it by probing when the spec doesn't name one — supporting common identity providers such as Auth0, Okta, PingOne, and IBM, plus browser-based login flows. If a provider is found but no login can be built, or the credentials are wrong, the card falls back to the normal Add Authentication drawer without error — you're never left retrying.

Why this matters

• Removes most of the manual work of configuring authentication
• Gets scans running authenticated against common enterprise identity providers
• Falls back cleanly to manual setup when a login can't be discovered

What to expect

• No scan starts automatically — discovery only configures the login; running a scan is still a deliberate action.
• Passwords are masked wherever they're shown.
• A pending credentials prompt won't expire — respond whenever it's convenient.

New Security Test Categories — Numeric Bound Fuzzing & Monetary Integrity​

APIsec now introduces two new security tests for identifying input-validation and business-logic vulnerabilities in numeric and monetary fields.

Numeric Bound Fuzzing tests numeric fields with values outside expected boundaries to identify missing input validation.

Monetary Integrity extends this approach to financial workflows, testing whether APIs enforce valid monetary amounts and, where possible, confirming that unexpected values do not affect the underlying system.

Why this matters​

• Identifies vulnerabilities caused by missing numeric and monetary validation
• Helps uncover business-logic flaws that can lead to financial impact
• Provides stronger validation of findings by confirming whether unexpected values actually affect system state

Mass Assignment — Read-Back Confirmation​

Mass Assignment testing now confirms whether an unauthorized or unexpected field actually changed system state after the request is submitted.

Why this matters​

• Increases confidence in Mass Assignment findings
• Distinguishes exploitable behavior from requests that are merely accepted
• Provides stronger evidence for remediation

Choose the Jira Issue Type​

Jira connections now support Task in addition to the existing Bug issue type. You can select the issue type to create when reporting vulnerabilities, and APIsec validates the selected type against the target project during connection testing.

Why this matters​

• Aligns vulnerability tickets with your existing Jira workflow
• Gives teams flexibility to use Bug or Task based on their process
• Existing Jira connections continue to use Bug by default

Note: Support for Story is coming in an upcoming release.

Map Vulnerability Metadata to Jira Custom Fields​

Jira connections now support mapping APIsec vulnerability metadata, constants, and labels to your Jira custom fields.

Why this matters​

• Automatically populates tickets with the information your teams need
• Aligns APIsec tickets with existing Jira workflows
• Reduces manual ticket updates

Issue-Tracker Link and Unlink Activity Trail​

Linking or unlinking an issue tracker from an application instance is now recorded in Activity Logs, including the connection, user, and timestamp.

Why this matters​

• Provides an audit trail for issue-tracker configuration changes
• Improves visibility into where and when ticketing integrations were changed

Sign in with Google​

Users can now sign in to APIsec using Google Social Login, including linking a Google account to an existing email/password account.

Availability: Live on cloud.apisecapps.com

FedRAMP & HIPAA/HITRUST Compliance Reports​

FedRAMP and HIPAA/HITRUST compliance reports are now available in production, providing the appropriate control mappings and reporting templates. Generate them alongside your other reports.

Why this matters​

• Simplifies compliance reporting for regulated organizations
• Presents security findings in the context of applicable FedRAMP / HIPAA-HITRUST controls

Improvements​

Comments on Jira Bulk Updates​

When APIsec updates multiple Jira issues in a single action — for example, bulk-closing findings that are resolved or bulk-changing their disposition — it now also posts the corresponding comment to each issue (the reason the finding was closed, the disposition applied, and so on).

Why it works this way — a Jira limitation: Jira's bulk update and bulk transition APIs do not allow a comment to be attached as part of the bulk operation. To make sure your issues still get that context, APIsec applies the comments as a follow-up step, adding them to each issue individually after the bulk update completes. For very large batches, this means the comment appears shortly after the status change, not at the exact same instant.

Impact​

• Keeps Jira issues annotated with the reason behind each APIsec-driven change, even during bulk operations
• Restores the comment context that Jira's bulk API otherwise omits
• The earlier warning that bulk updates would not include comments has been removed

Clearer Test Credentials & Dry Run Results​

Test Credentials and Endpoint Dry Run now provide more accurate and actionable results for connectivity, authentication, and path-placeholder scenarios.

Impact​

• Makes authentication and connectivity issues easier to diagnose
• Reduces false reports of invalid credentials or unreachable endpoints
• Provides clearer guidance when rate limiting is encountered

More Accurate Parameter Hydration​

APIsec now handles arrays, JSON-encoded examples, and object-schema path parameters more accurately during specification hydration. Impact

• Reduces malformed request values
• Improves endpoint testability and scan coverage
• Better preserves values defined in API specifications

More Precise BOLA Testing​

Basic BOLA scenarios now use the object ID configured for each individual operation instead of reusing an ID from another operation.

Impact​

• Improves accuracy of multi-step BOLA testing
• Ensures each operation is tested against its intended resource

Endpoint Values Are Sent as Configured​

Values configured directly on an endpoint request body now take precedence over an instance-level Global Parameter with the same field name.

Impact​

• Ensures endpoint-specific configurations are respected during scans
• Provides more predictable request generation

Penetration Testing Report Downloads​

Penetration Testing Reports now generate and download more reliably for applications with large numbers of findings, with clearer feedback when generation fails.

• Consistent "No Longer Detected" Terminology
  • Findings that are no longer observed are now consistently labeled No Longer Detected across the Dashboard, Security Hub, Developer Report, and Proof of Test.
• Compliance reports continue to use Resolved.

Impact​

• Provides consistent terminology across security workflows
• Makes finding lifecycle states easier to understand

New Private Hosted Agent — Faster Scans​

A new Private Hosted Agent version is now available that runs scans faster and more reliably. It combines increased scan parallelism with memory and I/O tuning, so large, long-running scans complete substantially faster. Update your Private Hosted Agents to the latest version to benefit.

Impact​

• Faster scan completion, especially on large or long-running scans
• Improved reliability under heavy load
• No configuration change required — simply update the hosted-agent image

External Ticket Closure Reasons​

When APIsec automatically closes an external ticket because a finding is resolved or marked out of scope, the ticket now includes the resolution reason.

Impact​

• Provides better context in external issue trackers
• Improves traceability between APIsec findings and ticket lifecycle changes

Azure DevOps — Risk-Accepted Revoke​

Revoking a "Risk Accepted" disposition now adds a comment to the linked Azure DevOps work item identifying the action, without changing the work-item state.

Browser Bolt Onboarding Improvements​

Browser Bolt onboarding now preserves custom application names, correctly identifies path parameters, and retains all endpoints from single-domain captures.

Activity Log — Vulnerability Ticket Filter​

A new Log Vuln Tickets filter is now available in Activity Logs and Task Logs. We also removed a stale Jira bulk-close warning.

This release expands APIsec's platform capabilities across API lifecycle management, security validation, CI/CD automation, and operational visibility. New capabilities include flexible App Model onboarding controls, GitHub App integration, Platform ID-based API registration for CI/CD, Splunk audit-event forwarding, endpoint change visibility during spec reloads, and Personal Access Token expiry notifications. The release also introduces exploit-validation visibility and new security tests for refresh-token replay.

What's New​

Register and Scan APIs Using Platform ID​

CI/CD pipelines can now register and resolve APIs using a customer-defined Platform ID and optional version instead of storing APIsec application IDs between pipeline runs.

Why this matters​

• Enables stateless CI/CD onboarding without persisting APIsec IDs
• Re-running a pipeline updates the existing application instead of creating duplicates
• Existing applications can be looked up or associated using their Platform ID

Audit Event Forwarding to Splunk​

Administrators can now forward APIsec audit events, including sign-ins and application or user changes, to Splunk through a Splunk HTTP Event Collector (HEC) integration. The integration includes connection testing and supports resilient delivery when the Splunk endpoint is slow or temporarily unavailable. Self-signed certificates are supported for on-premises Splunk deployments.

Why this matters​

• Extends APIsec audit visibility into existing SIEM workflows
• Helps security teams centralize platform activity and monitoring
• Provides reliable event delivery without impacting platform operations

App Model — Skip / Undo Skip Onboarding Steps​

You can now skip the Authentication, RBAC, or BOLA onboarding step when it does not apply to an application. Skipped steps are clearly identified in the App Model and can be restored at any time using Undo Skip.

Why this matters​

• Keeps applications from remaining in Building when an onboarding area is not applicable
• Provides clear visibility into skipped onboarding steps
• Skipping is limited to onboarding progress and does not disable scanning or dismiss existing vulnerabilities

GitHub App Integration​

APIsec now supports a GitHub App integration for connecting source repositories. The integration provides repository inventory, lifecycle and coverage synchronization through webhooks, and per-repository coverage visibility.

Why this matters​

• Simplifies connecting GitHub repositories with APIsec
• Keeps repository status and coverage information synchronized
• Provides visibility into API security coverage at the repository level

Endpoint Diff on Spec Reload​

APIsec now displays a clear comparison of added and removed endpoints when an OpenAPI specification is reloaded. The changes are scoped to the reloaded instance and can be reviewed through the activity log.

Why this matters​

• Makes API changes easier to review after a specification reload
• Provides clear visibility into endpoint additions and removals
• Helps teams understand how a reload changes the API inventory

Personal Access Token Expiry Notifications​

Users can now receive notifications when a Personal Access Token is approaching expiration and when it expires. Expiry notification preferences can be configured from Account settings.

Why this matters​

• Helps prevent automation interruptions caused by expired tokens
• Gives users advance notice to rotate credentials
• Provides control over token-expiration notifications

Delete Endpoints Without Reloading the Spec​

Endpoints can now be removed directly from the endpoint inventory without reloading the entire API specification. Endpoint deletions are recorded in the activity log and propagated downstream.

Why this matters​

• Allows users to remove unwanted endpoints immediately
• Eliminates the need for a full specification reload
• Provides an auditable record of endpoint changes

Refresh Token Replay​

A new authentication test identifies refresh tokens that can be redeemed more than once, including cases in which token rotation occurs without detection of reuse.

Improvements​

Clearer Test Credentials and Dry Run Failures​

Test Credentials and Dry Run now display the underlying transport error, such as TLS or certificate failures, instead of a generic error message.

Impact​

• Makes connectivity and certificate issues easier to diagnose
• Provides more actionable information when validation fails

OAuth Tests for Custom Authentication Chains​

OAuth-focused security tests, including authorization-code replay and open redirect testing, now execute for applications configured with OAuth through a Custom Authentication Chain.

More Accurate Numeric Parameter Hydration​

Numeric parameters, including double and float values, now hydrate using their configured global values instead of being sent as null.

Dynamic Parameter Values​

Relative dates, timestamps, and UUIDs now resolve correctly at scan time in the requested format. Interdependent date relationships are preserved, while invalid type or format combinations now return a clear validation error.

Gateway Path-Prefix Reachability​

Scans using a gateway path prefix that does not respond at the bare host now fall back to an endpoint-level reachability check instead of being incorrectly aborted during preflight.

Content-Type on Body-less Requests​

Body-less requests no longer automatically use Content-Type: application/json . APIsec now honors the declared content type and sends an appropriate Accept header where applicable.

More Accurate Injection and Authentication Enforcement Detection​

Detection logic has been refined to reduce time-based injection false positives and correctly identify input-less endpoints that reject unauthenticated requests as authentication-enforced.

Resolution Reasons Flow to Issue Trackers​

Resolution or dismissal reasons are now passed to linked issue-tracker tickets, and the ticket is automatically closed to keep the finding status synchronized.

Coverage and Readiness Reports​

Business Unit and Team filters now correctly update the Readiness Coverage chart, and the Coverage Overview total is now consistent between the UI and generated PDF.

NG Production Release Update - APIsec_cloud_7.8.2.0 ( August 18, 2026 )​

This release introduces email notifications for key scan and Hosted Agent events, automated TOTP authentication for browser-based scans, and additional CI/CD capabilities. It also adds Business Unit and Team-scoped Security Hub exports and improves scan reliability, TLS testing, parameter configuration, and ServiceNow and Azure DevOps integrations.

What's New​

Email Notifications for Key Events​

You can now opt in to email notifications for events that need your attention, including scan failures and Hosted Agent token expiration. Notifications are off by default for each user and can be enabled from Notification Preferences. You have flexible control over both when and what you receive:

• Choose live, daily, or weekly email delivery based on your preference.
• Enable notifications across all applications, select only specific applications, or select all and exclude specific applications.
• Configure each notification type independently to receive only the alerts that are relevant to you.

Why this matters​

• Gives users control over the volume and frequency of email notifications
• Helps surface important events without requiring constant dashboard monitoring
• Reduces notification noise by allowing application-level filtering

Availability: ROLE_ADMIN and ROLE_USER in Enterprise tenants only. PLG users do not currently have access to Notifications.

Note: Notifications for API (Personal Access) Token expiration are coming in an upcoming release.

Automated Two-Factor (TOTP) Authentication During Scans​

Scans can now automatically complete login flows that require a six-digit authenticator-app code, such as Google Authenticator, Authy, or Microsoft Authenticator. The agent generates and submits the time-based code using the configured authenticator secret.

Why this matters​

• Enables authenticated scanning without disabling two-factor authentication
• Eliminates manual intervention during scans
• Supports more realistic security testing of protected applications

Note: Available with the APIsec cloud agent. Private Hosted Agent support is coming in an upcoming release.

Improvements​

List Scans by Status via API Credentials​

The List Scans API now supports Personal Access Tokens and status filtering for scans that are running, completed, failed, or aborted. CI/CD pipelines can use this to identify and retrieve scans without requiring the scan ID.

Why this matters​

• Simplifies CI/CD scan orchestration
• Helps prevent unnecessary duplicate scan execution
• Provides greater flexibility for automated workflows

Simpler CI/CD Setup​

The APIsec host is now built into scan-and-gate and code-bolt, eliminating the need to provide the api-url flag.

Why this matters​

• Simplifies CI/CD configuration
• Reduces configuration errors

Security Hub CSV Export by Business Unit and Team​

Security Hub vulnerability data can now be exported to CSV based on the selected Business Unit and Team.

Why this matters​

• Simplifies reporting for specific organizational groups
• Provides focused vulnerability data for analysis and reporting

Issue Fixes​

Scans Against WAF-Protected Targets​

Problem​

Scans against WAF-protected targets could fail the reachability check when required custom headers were configured.

Solution​

The pre-scan reachability check now includes the instance's configured custom headers.

Impact​

• Improves scan reliability for WAF-protected applications
• Prevents valid targets from being incorrectly marked unreachable

Instances with an Empty Base URL​

Problem​

Instances without a valid base URL could be dispatched to a Hosted Agent, resulting in reachability testing failures.

Solution​

Instances resolving to / are now identified as unreachable before reachability triggers with a clear diagnostic.

Impact​

• Prevents Hosted Agent crashes caused by invalid instance URLs
• Provides clearer feedback for incomplete API configurations

SSL Test for TLS 1.1​

Problem​

The SSL security test could skip TLS 1.1 validation.

Solution​

TLS 1.1 is now correctly evaluated during SSL testing.

Impact​

• Improves coverage of legacy TLS configurations
• Ensures TLS 1.1 endpoints are properly assessed

Numeric Body Parameter Configuration​

Problem​

Required numeric body parameters could not be cleared to use a global variable.

Solution​

Numeric parameters can now be cleared using the - sentinel to resolve their value from a global variable at scan time.

Impact​

• Provides greater flexibility for parameter configuration
• Preserves validation for genuinely invalid numeric values

Endpoint Dry Run Testability​

Problem​

Endpoint Dry Run could use an internal validation request as the displayed test result, leading to an inaccurate testability verdict.

Solution​

The internal validation probe is now handled separately from the actual testability result.

Impact​

• Provides more accurate endpoint readiness information
• Improves confidence in Dry Run results

ServiceNow AVR — Risk Accepted Status​

Problem​

Marking a finding as Risk Accepted in APIsec could set the linked ServiceNow AVR item to Closed.

Solution​

Risk Accepted findings now set the ServiceNow item to Deferred, while redetected findings continue to reopen as expected.

Impact​

• Aligns ServiceNow status with the intended risk disposition
• Improves synchronization between APIsec and ServiceNow workflows

Azure DevOps Ticket Auto-Creation​

Problem​

Automatic ticket creation could fail for configured Azure DevOps integrations.

Solution​

Azure DevOps ticket creation has been corrected and now works reliably with configured integrations.

Impact​

Restores automated issue creation Improves reliability of Azure DevOps workflows

NG Production Release Update - APIsec_cloud_7.8.1.0 ( August 07, 2026 )​

This release introduces centralized metadata tag management, CSV export for the Security Hub Vulnerability Age Matrix, and deeper ServiceNow Vulnerability Response integration. Additional improvements enhance SSO team synchronization, parameter hydration, issue-tracker configuration, and hosted agent security, while several fixes improve Postman imports, automatic ticketing, and authentication detection accuracy.

What's New​

Application Metadata Tags​

Administrators can now create and manage metadata tag fields, assign tags to applications and instances, and search tags across the platform. Metadata tags are also included when creating tickets in the connected ServiceNow issue tracker.

Why this matters​

• Simplifies application organization and search
• Prevents duplicate metadata definitions
• Provides richer context in issue-tracker workflows

ServiceNow Vulnerability Response Integration​

The ServiceNow integration now aligns with the native Vulnerability Response (VR) workflow. Risk Accepted and False Positive dispositions synchronize between ServiceNow and APIsec, and metadata tags are automatically included on Application Vulnerable Items (AVIs).

Why this matters​

• Aligns remediation with existing ServiceNow approval workflows
• Synchronizes vulnerability dispositions across both platforms
• Improves filtering and routing using metadata tags

Export Vulnerability Age Matrix to CSV​

You can now export the underlying detections from the Security Hub Vulnerability Age Matrix directly to CSV for offline analysis and reporting.

Why this matters​

• Simplifies reporting and data analysis
• Exports all matching detections, not just the current page
• Includes key vulnerability and application details for further processing

Improvements​

Improved Parameter Hydration Coverage​

Problem​

Parameter hydration provided limited coverage for certain request structures and authentication configurations.

Solution​

Parameter hydration has been enhanced to better support array-based request bodies and complex authentication scenarios.

Impact​

• Improves parameter discovery coverage
• Produces more complete scan inputs
• Increases scan accuracy for complex APIs

Automatic Ticket Creation​

Problem​

Automatic ticket creation could fail if the owner of a scheduled scan had been deprovisioned from the tenant.

Solution​

Automatic ticket creation no longer depends on the original schedule owner's account.

Impact​

• Ensures automatic ticket creation continues uninterrupted
• Improves reliability across user and ownership changes

Test Connection Click Reliability​

Problem​

Buttons only responded when users clicked directly on the label text. Clicking elsewhere within the button did not trigger the action.

Solution​

Button interactions have been updated so the entire button surface is clickable.

Impact​

• Improves usability and click responsiveness
• Provides a more consistent user experience across the application

Postman Import for Array-Based Request Bodies​

Problem​

Importing Postman collections containing arrays of similar objects could result in incomplete request bodies.

Solution​

All array elements are now imported correctly.

Impact​

• Preserves complete request payloads
• Improves scan accuracy for bulk operations

Authentication Detection Accuracy​

Problem​

Certain APIs could generate false authentication findings when credentials were supplied in the request body or when authentication failures were returned within HTTP 200 responses.

Solution​

Authentication detection now evaluates both response content and configured authentication rejection indicators instead of relying solely on HTTP status codes.

Impact​

• Reduces false authentication findings
• Improves detection accuracy for modern API implementations
• Provides more reliable authentication validation

Private Hosted Agent Security Updates​

The Private Hosted Agent has been updated with the latest runtime, dependency, and security improvements.

Why this matters​

• Improves the security posture of hosted agent deployments
• Incorporates the latest dependency updates
• No changes are required to existing deployment workflows

This release improves scan reliability for hosted-agent deployments, introduces SSO group-to-team mapping, enhances CI/CD automation by preventing duplicate scans, and expands Dashboard V2 with clearer application health and policy visibility. Additional improvements strengthen SSL/TLS and PII detection accuracy, while several workflow enhancements improve the overall user experience.

What's New​

Resilient Handling of Unreachable Hosted Agents​

Scans now verify that the configured hosted agent is reachable before execution and continue monitoring connectivity throughout the scan. If the hosted agent or target becomes unreachable, the scan stops immediately and reports a clear failure reason instead of continuing with unsuccessful test execution.

Why this matters​

• Detects connectivity issues before lengthy scan failures occur
• Provides clear diagnostics when hosted agents become unreachable
• Ensures scans always execute using the configured scan environment

Note: Additional hosted-agent health monitoring and scheduled scan notifications are planned for a future release.

Prevent Duplicate Scans in CI/CD Pipelines​

The Scans API now supports querying for running scans, allowing CI/CD pipelines to determine whether a scan is already in progress before starting another.

Why this matters​

• Prevents duplicate scan execution
• Optimizes CI/CD pipeline efficiency
• Reduces unnecessary scan activity

Dashboard V2 Enhancements​

Dashboard V2 now provides a more accurate view of application readiness, policy compliance, and recommended next steps directly from the Overview page.

Why this matters​

• Improves visibility into application health
• Surfaces policy compliance more clearly
• Reduces navigation during application onboarding and review

Improvements​

SSL/TLS Enforcement Detection​

Problem​

SSL/TLS enforcement testing could report a vulnerability when an endpoint responded to an HTTP request with an error status, even though it was not serving content over unencrypted HTTP.

Solution​

Detection logic now reports an SSL/TLS enforcement vulnerability only when the endpoint successfully serves content over HTTP. Non-success HTTP responses are surfaced as Informational detections instead.

Impact​

• Reduces false positives for non-success HTTP responses
• Preserves visibility through Informational detections
• Improves confidence that SSL/TLS findings represent actual unencrypted traffic
• Existing findings may be reclassified as Informational after the next scan as part of this refinement

Improved PII Detection​

Problem​

PII detection could miss certain sensitive data patterns.

Solution​

Detection logic has been enhanced to identify previously missed cases.

Impact​

• Improves detection coverage
• Produces more reliable PII findings

Guided Actions Status Updates​

Problem​

The Guided Actions authentication step did not immediately reflect completed authentication until the page was refreshed.

Solution​

Authentication status now updates automatically after successful configuration.

Impact​

• Provides real-time onboarding progress
• Eliminates unnecessary page refreshes

Auto-Reload Schedule Updates​

Problem​

Changes to an Auto-Reload schedule were not reflected immediately after saving.

Solution​

The next scheduled reload time now updates as soon as the configuration is saved.

Impact​

• Displays accurate scheduling information immediately
• Improves configuration visibility

Security Hub Notification Recipients​

Problem​

SSO-provisioned users could not be selected as Security Hub notification recipients.

Solution​

SSO users can now be added as Security Hub recipients.

Impact​

• Improves notification management for SSO-enabled organizations
• Supports Security Hub workflows using federated identities

NG Production Release Update - APIsec_cloud_7.7.3.0 ( July 21, 2026 )​

This release expands authentication capabilities with headless browser-based authentication for Custom Auth Chains. Additional improvements strengthen CI/CD automation, scheduled scan reliability, detection accuracy, and API credential security, while numerous fixes improve usability and platform reliability.

What's New​

Browser-Based Authentication for Custom Auth Chains​

Custom Auth Chains now support browser-based authentication for login flows that require JavaScript execution, such as OAuth 2.0 Authorization Code with PKCE. A browser-enabled hosted agent can execute browser-dependent authentication steps while preserving the existing authentication workflow for the remainder of the chain.

Why this matters​

• Enables authenticated scanning of applications that require browser-based login flows
• Supports modern identity providers using OAuth 2.0 with PKCE
• Expands authentication coverage for enterprise applications

Note: A browser-enabled Hosted Agent image is available for deployments requiring browser-based authentication. Standard Hosted Agent deployments remain unchanged.

Expanded API Token Scopes for Automation​

API Credentials now support additional fine-grained scopes for CI/CD automation, including Scan Profiles, Scheduled Scans, Integration Connections, and Issue Tracker management.

Why this matters​

• Enables more granular access control for automation
• Supports least-privilege security practices
• Improves flexibility for CI/CD integrations

Improvements​

Improved Scheduled Scan Reliability​

Scheduled scans now execute more reliably for applications configured with multiple authentication profiles.

Why this matters​

• Improves scan reliability for complex authentication configurations
• Reduces unexpected scan failures during scheduled execution

Enhanced Detection Accuracy​

Detection improvements have been made for time-based MySQL injection and credential-enforcement validation, reducing false positives and improving scan accuracy.

Why this matters​

• Improves confidence in security findings
• Reduces false positives during automated testing

One-Time Display of API Tokens​

Newly created Personal Access Tokens are now displayed only once during creation, matching the existing behavior for Client Credential secrets.

Why this matters​

• Improves protection of sensitive credentials
• Encourages secure token management practices

Parameter Discovery Authentication​

Problem​

Parameter Discovery could ignore the selected authentication profile and execute under a different credential.

Solution​

Parameter Discovery now consistently uses the selected authentication profile.

Impact​

• Improves parameter discovery accuracy
• Produces more complete results for multi-role applications

Multi-Team Application Visibility​

Problem​

Users belonging to multiple teams could see applications from only one team.

Solution​

Applications from all assigned teams are now displayed correctly.

Impact​

• Improves application visibility for multi-team users
• Ensures access matches assigned team memberships

Large Header Values​

Problem​

Very large numeric header values could prevent Environment headers from being saved.

Solution​

Large numeric values are now handled correctly during header configuration.

Impact​

• Improves compatibility with applications using large numeric identifiers
• Prevents configuration save failures

Ticket Creation from Scan Details​

Problem​

Creating tickets directly from the Scan Details page did not consistently create issues in connected trackers.

Solution​

Ticket creation now functions correctly, with ticket IDs reflected in Vulnerabilities and Threat Detection views.

Impact​

• Improves issue management workflows
• Provides better visibility into linked tickets

Specification Reload Resiliency​

Problem​

Specification reloads could fail when previously imported specifications contained unresolved references.

Solution​

Reloads now tolerate unresolved references, and failures provide clearer diagnostic information.

Impact​

• Improves specification reload reliability
• Simplifies troubleshooting when reloads fail

Guided Actions Scan Status​

Problem​

Guided Actions could incorrectly report an authenticated scan after an unauthenticated scan completed.

Solution​

Scan status now accurately reflects the type of scan that was executed.

Impact​

• Improves scan reporting accuracy
• Reduces confusion during remediation workflows

Scan Profile Validation​

Problem​

Scan Profiles could be saved without any selected endpoints, resulting in validation errors.

Solution​

At least one endpoint must now be selected before saving.

Impact​

• Prevents invalid Scan Profile configurations
• Improves user experience during profile creation

Duplicate Application Prevention​

Problem​

Concurrent uploads of the same API specification could create duplicate applications.

Solution​

Duplicate application creation is now prevented.

Impact​

• Improves application inventory consistency
• Prevents duplicate onboarding

Auto-Onboard Activity Logging​

Problem​

Auto-onboarding activities were difficult to identify in Activity Logs.

Solution​

Activity Logs now include improved logging and a dedicated Auto Onboard filter.

Impact​

• Improves visibility into automated onboarding activities
• Simplifies operational troubleshooting

NG Production Release Update - APIsec_cloud_7.7.2.0 ( July 09, 2026 )​

This release introduces centralized API credential management, reusable global authentication profiles, OAuth PKCE support using Custom Authentication Chains, enhanced authentication validation for API-driven scans, and new Scan-and-Gate capabilities for CI/CD pipelines. Additional fixes improve BOLA scenario generation and polish SSRF detection reporting.

What's New​

API Credentials Management​

A new API Credentials page provides self-service management for both Personal Access Tokens (PATs) and OAuth Client Credentials. Users can create, manage, and revoke their own credentials, while administrators can manage credentials across the tenant.

Why this matters​

• Centralizes credential management in a single location
• Simplifies API automation and integrations
• Improves security through scoped, expiring credentials

Global Credentials​

Global Credentials allow a single authentication profile to be shared across multiple application environments. Updating a global credential automatically applies the change wherever it is linked.

Why this matters​

• Simplifies credential rotation across applications
• Reduces administrative effort and configuration drift
• Maintains secure access through application-aware RBAC

OAuth PKCE Support​

Custom Authentication Chains now support OAuth 2.0 Authorization Code flows with Proof Key for Code Exchange (PKCE). APIsec automatically manages PKCE parameters during authentication, simplifying configuration for supported identity providers.

Why this matters​

• Enables authenticated scanning of APIs protected by PKCE
• Simplifies OAuth configuration for modern identity providers
• Expands support for secure authentication workflows

Pre-Scan Authentication Validation​

API-driven scans can now optionally validate authentication credentials before scan execution. When enabled, the platform performs a lightweight authentication check against the endpoint used during the most recent Test Authentication execution. If the credentials are rejected, the scan is terminated instead of proceeding with unauthenticated requests.

API callers can control this behavior using the ignoreAuthFailure flag in the scan request:

• ignoreAuthFailure: false (default) — The scan is aborted if authentication validation fails.
• ignoreAuthFailure: true — The scan continues even if authentication validation fails, allowing unauthenticated portions of the scan to proceed.

Why this matters​

• Detects authentication issues before scan execution
• Prevents unnecessary scans caused by invalid credentials
• Gives API integrations the flexibility to either fail fast or continue with partial coverage based on automation requirements

Note: This capability is currently opt-in for API-triggered scans. Existing UI, scheduled, and API scan behavior remains unchanged unless explicitly enabled.

Scan-and-Gate Enhancements​

The Scan-and-Gate container now supports evaluating existing scan results without triggering a new scan and provides direct links from CI/CD failures to the corresponding findings in APIsec.

Why this matters​

• Accelerates CI/CD pipelines
• Simplifies investigation of failed security gates
• Improves developer productivity during remediation

Issue Fixes​

BOLA Scenario Generation​

Problem​

Automatically generated BOLA scenarios could include duplicate entries for the same endpoint.

Solution​

Scenario generation now removes duplicate endpoints based on HTTP method and path.

Impact​

• Produces cleaner BOLA scenario lists
• Prevents duplicate test execution during BOLA scans

SSRF Detection Messaging​

Problem​

SSRF detection findings contained a typographical error in the assertion text.

Solution​

The finding message has been corrected across all SSRF detection variants.

Impact​

• Improves the quality and professionalism of customer-facing reports

NG Production Release Update - APIsec_cloud_7.7.1.0 ( July 03, 2026 )​

This release introduces Dark Mode, removes the 30-day access limit for PLG users, strengthens Hosted Agent security, and enhances authentication failure handling across supported authentication schemes. Additional fixes improve hosted-agent scheduling, protect sensitive data, enhance diagnostics for authentication failures, and improve the accuracy of Security Hub reporting.

What's New​

Dark Mode​

Dark Mode is now available across the platform. Users can switch between light and dark themes at any time from User Preferences. Currently, their preference isn't preserved across different browser sessions.

Why this matters​

• Improves readability in low-light environments
• Reduces eye strain during extended sessions
• Let users personalize their experience without administrator involvement

Partial Credential Enforcement​

A new detection category identifies APIs that advertise multiple authentication requirements—such as Authorization headers, API keys, session cookies, or XSRF tokens—but enforce only a subset during request validation. Endpoints that accept requests with one or more required credential elements missing are flagged for review.

Why this matters​

• Detects authentication gaps that may be overlooked by traditional authentication tests
• Helps ensure every required credential element is actively validated
• Identifies weaknesses in composite authentication schemes involving multiple headers or cookies
• Improves detection accuracy by validating both HTTP responses and application response content to minimize false positives

Improvements​

Extended Access for PLG Users​

The 30-day access restriction for PLG users has been removed. Existing users who were previously locked out automatically regain access without requiring any action from users, administrators, or support.

Why this matters​

• Enables uninterrupted product exploration
• Eliminates unnecessary access interruptions
• Provides a smoother onboarding experience

New Hosted Agent Release​

A new Hosted Agent version introduces improved startup validation for mutual TLS (mTLS) certificate configuration. Certificate configuration issues are now detected during startup with clear, actionable error messages.

Why this matters​

• Detects certificate configuration issues earlier
• Reduces scan failures caused by invalid mTLS configuration
• Improves deployment reliability for private Hosted Agents

Note: Customers running Private Hosted Agents are encouraged to deploy the latest agent version to receive these improvements.

Enhanced Authentication Failure Handling​

Authentication failure detection has been expanded to support Basic Authentication, API Key, and HMAC authentication schemes. A new option also allows scans to continue after authentication failures while clearly identifying unauthenticated requests.

Why this matters​

• Improves visibility into authentication configuration issues
• Produces more reliable scan results across supported authentication methods
• Allows teams to troubleshoot authentication failures while still collecting partial scan results

Issue Fixes​

Scheduled Scans for Hosted Agent Applications​

Problem​

Scheduled scans for applications configured to use Hosted Agents could fail without appearing in Scan History.

Solution​

Scheduled scans and Test Credentials now consistently use the configured Hosted Agent for scan execution.

Impact​

• Improves the reliability of scheduled scans
• Ensures failures are visible in Scan History
• Supports environments accessible only through Hosted Agents

Protected Header Values During Test Reachability​

Problem​

Confidential header values could be displayed in clear text during Test Reachability.

Solution​

Sensitive header values remain masked across all application views, including Test Reachability.

Impact​

• Protects confidential authentication data
• Improves the security of environment configuration workflows

Improved Test Credentials Diagnostics​

Problem​

Authentication and connectivity failures often returned a generic "Internal Server Error," making troubleshooting difficult.

Solution​

Test Credentials now surfaces the target system's HTTP status code, response body, and diagnostic information when available.

Impact​

• Simplifies troubleshooting of authentication and connectivity issues
• Provides clearer diagnostics for WAF, OAuth, networking, and access configuration problems

Security Hub Summary Accuracy​

Problem​

Security Hub summary metrics may display inaccurate counts of scans, endpoints, and vulnerabilities.

Solution​

Security Hub now calculates summary metrics correctly and excludes informational findings from vulnerability totals.

Impact​

• Improves reporting accuracy
• Aligns dashboard metrics with application-level reporting

Security Hub Timezone Reporting​

Problem​

Security Hub summary metrics displayed zero values for users in certain time zones.

Solution​

Date calculations have been updated to ensure consistent reporting regardless of the timezone.

Impact​

• Provides accurate Security Hub metrics across all supported time zones
• Ensures consistent reporting for global teams

This release introduces HMAC authentication support, ServiceNow AVR integration, Advanced BOLA testing, Dashboard V2 enhancements, and a new SSL Enforcement detection category. Additional improvements strengthen hosted-agent management, information-detection workflows, and automation capabilities via scan-profile execution APIs.

What's New​

HMAC Authentication​

APIsec now supports HMAC-signed authentication for APIs that require request-level signatures. HMAC profiles support configurable signed components, timestamp validation, nonce support, and multiple encoding formats.

Why this matters​

• ​ Enables testing of APIs protected by HMAC authentication
• ​ Supports secure integrations that do not rely on bearer tokens
• ​ Expands coverage for enterprise authentication models

ServiceNow Application Vulnerability Response (AVR) Integration​

APIsec now integrates with ServiceNow Application Vulnerability Response (AVR), automatically creating and synchronizing Application Vulnerable Items (AVIs) for detected vulnerabilities.

Each vulnerability is tracked independently, while repeat detections are correlated to existing records to prevent duplicate ticket creation. Bidirectional traceability links findings in APIsec with their corresponding records in ServiceNow.

AVIs can also be marked as False Positive or Risk Accepted directly within ServiceNow. These dispositions automatically synchronize back to APIsec, ensuring findings remain consistent across both platforms without manual updates.

Why this matters​

• ​ Streamlines vulnerability remediation workflows
• ​ Improves collaboration between security and operations teams
• ​ Eliminates manual reconciliation between APIsec and ServiceNow
• ​ Provides end-to-end traceability from detection through remediation

Note: Marketplace availability is pending ServiceNow certification and review. The certified application will be published to the ServiceNow Store once approved.

Scan Profile Initiation via API​

Scans can now be launched through the API using a Scan Profile, enabling CI/CD pipelines and automation workflows to execute scans with predefined scope and configuration.

Why this matters​

• ​ Simplifies automation and CI/CD integrations
• ​ Ensures consistent scan execution across environments

Advanced BOLA Scenarios​

A new Advanced BOLA scenario builder enables multi-step Broken Object Level Authorization testing with explicit workflows for the owner and attacker.

Dry-run validation allows teams to verify credential routing before executing a full scan.

Why this matters​

• ​ Supports more realistic authorization testing scenarios
• ​ Improves confidence before launching production scans
• ​ Reduces false positives during BOLA validation

Redesigned Administrator Dashboard​

A redesigned Dashboard experience is now available for tenant administrators. The updated dashboard introduces a dedicated Security Exposure tab for monitoring open vulnerabilities, enhanced application-model visualizations that highlight onboarding blockers across Network, Authentication, and Other categories, and improved discovery-flow rendering for clearer visibility into application setup progress.

Why this matters​

• ​ Provides better visibility into security exposure and onboarding status
• ​ Simplifies identification of configuration and reachability blockers
• ​ Improves consistency and accuracy across dashboard reporting surfaces
• ​ Delivers a cleaner, more intuitive administrative experience

Informational Detection Actions​

Informational findings now support the same workflow actions as vulnerabilities, including Create Ticket, False Positive, and Risk Accepted.

Why this matters​

• ​ Provides consistent triage workflows across all findings
• ​ Improves tracking and disposition management of informational observations

SSL Enforcement Detection​

A new SSL Enforcement category identifies endpoints that accept plaintext HTTP connections when HTTPS enforcement is expected.

Why this matters​

• ​ Helps identify insecure transport configurations
• ​ Strengthens API transport-layer security validation

Improvements​

Hosted Agent Management Enhancements​

Administrators can now manage hosted agents deployed by other administrators, including downloading deployment scripts and rotating tokens. User-deployed hosted agents remain private and manageable only by their owners.

In addition, downloading a hosted-agent deployment script no longer impacts a running agent's authentication state. Token rotation now occurs only when explicitly requested.

Why this matters​

• ​ Improves operational continuity for shared hosted agents
• ​ Prevents unintended disruption of running agents
• ​ Simplifies hosted-agent administration

Informational Findings in Issue Trackers​

Informational findings now use dedicated ticket titles when synchronized to external issue trackers, making them easier to distinguish from vulnerability findings.

Why this matters​

• ​ Improves triage and reporting clarity
• ​ Reduces confusion when reviewing informational observations in ticketing systems

NG Production Release Update - APIsec_cloud_7.6.2.0 ( Jun 17, 2026 )​

This release introduces the ability to rediscover Business Flows on demand, improving visibility after API specification updates. Additional enhancements improve parameter management, Personal Access Token support, vulnerability reporting accuracy, and Postman collection processing. The release also includes access-control hardening for user and team management endpoints, as well as dependency updates across the platform.

What's New​

Re-Discover Business Flows​

A new Re-Discover Flows action is now available on the Business Flows tab, allowing users to trigger a fresh AI-powered flow discovery against the latest application specification.

The action is available to users with edit permissions and is especially useful after reloading an API specification or adding new endpoints.

Why this matters​

• Keeps business flow mappings aligned with API changes
• Simplifies the discovery of newly added endpoints
• Prevents duplicate discovery requests while processing is in progress

Improvements​

Parameter Configuration CSV Re-Upload​

Re-uploading a parameter configuration CSV now correctly applies updated parameter values.

Why this matters​

• Simplifies bulk parameter maintenance
• Ensures configuration updates are reflected without manual re-entry
• Improves the reliability of CSV-based parameter management

Personal Access Token Support for Team Operations​

Problem

Certain team-related operations failed when using Personal Access Tokens (PATs) generated by USER-role accounts.

Solution

Team filtering, team listing, and application-sharing workflows now consistently support USER-role PATs.

Impact

• Improves API automation using PAT authentication
• Aligns PAT behavior with standard authenticated user workflows

Vulnerability Count Consistency​

Problem

 Vulnerability counts could differ between the Overview and Detail pages when switching between application instances.

Solution

 Instance-specific data now refreshes correctly when navigating between instances.

Impact

• Provides consistent vulnerability counts across views
• Improves reporting accuracy for severity and triage metrics

Postman Parameters with Dotted Names​

Problem

Postman parameters containing dotted names ( for example, user.profile.id) were not always applied correctly during scans.

Solution

Dotted-name parameters are now resolved and applied correctly across headers and query parameter variables.

Impact

• Improves scan accuracy for Postman-based applications
• Supports more complex parameter structures during onboarding and reloads

Enhanced Access Controls for User and Team Operations​

Access controls have been tightened for ROLE_USER accounts across selected user, team, and application endpoints.

Why this matters

• Reduces unnecessary visibility into users, teams, and team-scoped applications
• Strengthens tenant isolation and least-privilege access controls
• Addresses findings identified during external security testing

NG Hotfix Release Update - APIsec_cloud_7.6.1.1 (Jun 05, 2026)​

This hotfix resolves OAuth2-authenticated scans and request body handling, as well as a scan-time display correction and a BOLA configuration enhancement. Affected scans recover automatically on the next run after the deploy.

OAuth2 Scan Failures​

Issue

• Scans configured with OAuth2 authentication failed to start. Customers attempting to run scheduled or on-demand scans against existing OAuth2 credentials saw token resolution errors.

Fix

• Token resolution now correctly handles OAuth2 credentials saved before the recent response-key enhancement. Customers with explicitly-configured response keys are unaffected.

Impact

• Scheduled and on-demand scans on existing OAuth2 credentials resume automatically.
• No customer action is required. Recovery is automatic on the next scan after deployment.

Request Body Placeholder Handling​

Issue

• Request bodies referencing variables that could not be resolved at scan time were being sent to target APIs as literal placeholder text, causing the target API to reject the request with a 400 error.

Fix

• Unresolved placeholders are now emitted as JSON null, matching the expected field type.

Impact

• Scans no longer fail on endpoints whose bodies reference unresolved variables.
• Test execution coverage is restored on the affected endpoints.

Scan Time Display​

Issue

• Scan timestamps on the Scan History and Scan Details pages display UTC time alongside the local timezone label, resulting in inconsistent and confusing scan times.

Fix

• Timestamps are now converted to the user's local browser timezone, with a clear offset label appended (for example, GMT+3). Scan duration also benefits from the same fix.

Impact

• Scan start time and duration reflect the user's actual local time.
• Time formatting is consistent across Scan History and Scan Details.

BOLA Endpoint Selector — Show All Endpoints​

Improvement

• Added a "Show all endpoints" toggle to the BOLA Add Scenario configuration step. The default filtered view is unchanged.

Impact

• Customers configuring BOLA on APIs with non-standard endpoint naming conventions can now select directly from the full list of endpoints.
• No change to the default flow.

NG Production Release Update - APIsec_cloud_7.6.1.0 (Jun 03, 2026)​

This release focuses on improving API onboarding, compliance reporting, and automation. Key highlights include Postman Environments, MITM Proxy onboarding, ISO 27001 and PCI DSS 4.0 reports, short-lived OAuth credentials for CI/CD integrations, and usability improvements across vulnerability investigation, parameter discovery, and hosted agent management.

What's New​

Expanded Visibility for Informational Detections​

Informational findings are now tracked separately from vulnerabilities while supporting the same triage workflows, including ticket creation, False Positive, and Risk Accepted actions.

Why this matters

• Improves visibility into security observations beyond direct vulnerabilities
• Provides richer context in Pentest Reports

MITM Proxy Application Onboarding​

Applications can now be onboarded using MITM proxy capture files (.mitm and .flows ). APIsec automatically extracts endpoints and generates an OpenAPI Specification (OAS).

Why this matters

• Simplifies the onboarding of undocumented APIs
• Expands support for traffic-capture-based API discovery

Compliance Reports — ISO 27001 & PCI DSS 4.0​

Customer-downloadable compliance reports for ISO 27001 and PCI DSS 4.0 are now available under Application → Reports.

Why this matters

• Simplifies audit preparation and evidence collection
• Provides standardized compliance reporting

API Credentials — Short-Lived OAuth Tokens​

You can now create API Clients that issue short-lived OAuth 2.0 access tokens for CI/CD pipelines and integrations, eliminating the need for long-lived credentials.

Why this matters

• Improves security for automation workflows
• Provides finer-grained access control for integrations

Postman Environment Support​

You can now attach Postman Environment files to Postman-based applications to automatically resolve {{variable}} placeholders during reloading a spec.

Why this matters

• Improves scan accuracy by resolving environment-specific values

Originating Scan Context for Vulnerabilities​

Vulnerabilities now include an Originating Scan link that takes you directly to the scan where the finding was first detected, with evidence pre-expanded.

Why this matters

• Simplifies investigation and validation
• Preserves historical detection context across rescans

Parameter Hydration — Improved Discovery Experience​

Parameter discovery is now organized by endpoint, with inline editing, confidence indicators, and clearer progress tracking based on endpoint coverage.

Why this matters

• Improves usability for large APIs
• Makes parameter validation and discovery easier to manage

Improvements​

OAuth2 Response Key Support​

OAuth2 authentication profiles now support configurable response keys, enabling token extraction from custom fields, such as id_token, or from nested response structures.

Applications without a configured response key continue using access_token by default.

Why this matters

• Supports a broader range of OAuth implementations
• Simplifies integration with custom identity providers
• Reduces authentication configuration workarounds

Improved Hosted Agent Reliability​

Hosted-agent scans now use extended polling timeouts, reducing premature timeouts during large scans and in slower environments.

Agent-side failures that were previously difficult to diagnose are now surfaced directly within scan details.

Why this matters

• Improves scan reliability for large applications
• Reduces false scan-stuck scenarios
• Provides clearer troubleshooting information when failures occur

Explicit Hosted Agent Assignment for New Instances​

New application instances no longer automatically inherit a hosted agent assignment. Users can now explicitly choose whether to associate a hosted agent or use cloud-based scan execution. Existing instances are unaffected.

Why this matters

• Prevents unintended hosted agent assignments
• Improves transparency during instance creation

Aborted Scans Show the Correct Status​

Hosted-agent scans that are intentionally stopped now display an Aborted status instead of remaining Active.

Why this matters

• Improves scan status accuracy
• Makes it easier to distinguish user-aborted scans from failed executions
• Provides clearer operational visibility

Security Improvements​

Private Hosted Agent Security Updates​

The Private Hosted Agent image has been updated with the latest dependency and security updates.

Why this matters

• Keeps hosted agent deployments aligned with the latest security updates
• Improves the overall security posture of self-managed scan environments

Issue Fixes​

Personal Access Token Error Handling​

Issue: Malformed Personal Access Tokens (PATs) could return a generic 500 Internal Server Error when accessing platform APIs.

Fix: Authentication failures now return clear 401 Unauthorized responses with actionable error details.

Impact

• Simplifies troubleshooting for API integrations
• Provides clearer authentication failure feedback

Parameter Discovery Status Accuracy​

Issue: The AppModel dashboard could show Review Discovered Parameters as In Progress even when no user had reviewed or updated any parameters.

Fix: The workflow now moves to In Progress only after a user modifies a discovered parameter.

Impact

• Progress indicators now reflect actual user activity
• Reduces confusion during parameter review workflows

Auth Test Results Endpoint Loading​

Issue: The endpoint selector in Auth Test Results intermittently displays No Data.

Fix: Improved endpoint retrieval reliability for large applications.

Impact

• Improves the stability of Auth Test Results workflows
• Reduces intermittent endpoint loading failures

Vulnerability Scorecard Counts​

Issue: Instance-level Critical and High vulnerability counts included findings marked as False Positive or Risk Accepted, inflating the totals.

Fix: Scorecards now count only active findings, matching the displayed tooltip and application-level reporting.

Impact

• Provides more accurate vulnerability counts
• Aligns scorecards with triage workflows and reporting

MySQL Injection Category Display​

Issue: MySQL Injection scans are displayed as SQL Injection in scan progress and results, and could execute twice during certain batch scans.

Fix: MySQL Injection now runs and is displayed as a dedicated category across the platform.

Impact

• Improves scan visibility and reporting accuracy
• Eliminates duplicate execution during batch scans

Postman Reload Error Messaging​

Issue: Postman spec reload failures caused by an invalid Collection ID or API Key displayed a generic error message.

Fix: Error messages now identify which credential is invalid.

Impact

• Simplifies troubleshooting of Postman reload failures
• Helps users resolve configuration issues more quickly

This release expands Postman-based onboarding and scan workflows with support for spec reloads via Postman URL and Gateway integrations, Postman Environment variable resolution, and new OAuth-focused security test categories for authorization code replay and open redirect detection.

The release also improves hosted agent resiliency, API token-based scan execution, and Postman variable resolution during endpoint discovery and parameter hydration. Additional fixes improve MySQL injection category accuracy, strengthen the reliability of OAuth parameter hydration, and include platform-wide security hardening updates.

What's New​

Postman Collection — Spec Reload via URL and Postman Gateway​

Applications can now reload Postman-based API specifications directly from a Postman URL or via the Postman Gateway integration, without requiring manual collection downloads. File upload support introduced previously remains available.

Users can now reload specs using:

• Postman URL — provide the Postman Collection ID and API key to fetch the latest collection directly from the Postman cloud
• Postman Gateway — reload collections through the configured Postman Gateway integration
• File Upload — continue uploading updated collection files manually

On-prem deployments continue to support only file-upload reloads.

Why this matters

• Simplifies keeping Postman-based applications synchronized with API changes
• Eliminates manual collection, download, and upload workflows
• Accelerates API inventory refresh and onboarding updates

Postman Environment Support​

Postman Environment files are now supported for Postman-based applications, allowing {{variable}} placeholders to resolve into actual values during onboarding and scans.

Environment files can now be added:

• During application onboarding
• While adding a new instance
• From the Parameters Configuration page
• By replacing the environment before completing onboarding

Resolved values now appear in both the endpoint inventory and parameter configuration views. Multiple environments can coexist within the same application, with environment selection available per scan.

Why this matters

• Eliminates unresolved Postman variable placeholders during scans
• Improves scan accuracy and endpoint discovery
• Simplifies managing multiple deployment environments within a single application

New OAuth Security Test Categories​

Two new OAuth-focused security test categories are now available for applications configured with custom OAuth 2.0 authorization code flows.

Authorization Code Replay

• Detects whether OAuth authorization codes can be reused after a successful token exchange, violating OAuth2 security requirements.

OAuth Open Redirect

• Detects improper validation of redirect_url values in OAuth authorization flows that may allow attacker-controlled redirects. Both tests execute the application's full authentication chain end-to-end using the configured OAuth flow.

Why this matters

• Expands OAuth security coverage for authorization-code-based applications
• Detects authentication bypass and token replay vulnerabilities
• Validates real-world OAuth implementation security behavior

Immutable Docker Tags for Scan and Gate​

The apisec/apisec-scan-and-gate Docker image is now published with immutable timestamp-based version tags in addition to latest .

Why this matters

• Supports CI/CD change-control requirements
• Enables reproducible pipeline executions
• Simplifies environment promotion and rollback workflows

Improvements

Scan Support for APIs Running on TLS 1.0 and TLS 1.1​

APIsec can now successfully establish TLS handshakes and execute scans against API endpoints that support only legacy TLS 1.0 or 1.1.

Additional connection resiliency improvements include:

• Improved tolerance for connection shutdown events during scan execution
• Enhanced diagnostic reporting for exceptions that previously surfaced empty error messages

Why this matters

• Enables end-to-end security testing for APIs running legacy TLS configurations
• Improves scan resiliency during connectivity interruptions
• Provides clearer diagnostics for troubleshooting scan failures

Hosted Agent Management — Scan Execution Using API Tokens​

Scans can now be invoked through private hosted agents using API Tokens (PATs) for authentication. Deployment templates for Docker Linux and Windows have also been refreshed.

Why this matters

• Simplifies CI/CD-based hosted-agent scan execution
• Expands automation flexibility using PAT authentication
• Improves deployment consistency across environments

Hosted Agent Management — Token Expiry Accuracy​

Fixed token validity calculations for hosted agent tokens so that displayed expiry information now accurately reflects the actual remaining token lifetime.

Why this matters

• Improves visibility into token expiration timelines
• Helps teams rotate tokens proactively before expiry
• Prevents confusion caused by incorrect validity calculations

Postman Variable Resolution Improvements​

Postman variable placeholders are now consistently resolved from collection variables, environment files, and request examples across endpoint inventory, scan execution, and AI-assisted parameter hydration.

Why this matters

• Improves consistency across Postman-based applications
• Ensures resolved endpoint and parameter values are used throughout the platform
• Enhances scan accuracy and parameter discovery workflows

Issue Fixes​

1. MySQL Injection Category Display and Execution​

Issue

• MySQL Injection scans were displayed and executed as generic SQL Injection tests, resulting in incorrect category visibility and duplicate-dispatch behavior during scans.

Fix

• MySQL Injection now executes and is displayed as a dedicated category, with MySQL-specific timing strategies and correct scan labeling.

Impact

• MySQL Injection scans now display correctly throughout scan workflows
• Prevents duplicate execution behavior between SQL and MySQL injection categories
• Improves category-level scan visibility and reporting accuracy

2. AI-Assisted Parameter Hydration — Postman OAuth Placement​

Issue

• Re-Discover Parameters failed in Postman-based applications using OAuth2 credentials configured with query-parameter token placement.

Fix

• OAuth placement values are now normalized correctly during Postman auth extraction, and invalid placement values now surface as actionable auth-resolution errors instead of validation crashes.

Impact

• Restores parameter discovery for affected Postman OAuth applications
• Improves the reliability of AI-assisted parameter hydration workflows
• Provides clearer diagnostics for malformed authentication configurations

NG Production Release Update - APIsec_cloud_7.5.2.0 ( May 15, 2026 )​

This release introduces a new Dashboard with role-aware visibility and guided onboarding, along with Postman Collection reload, Django support in Code Bolt, editable Business Unit/Team names, and locale-aware date formatting. Reliability and diagnostics also improve across hosted agents, gateway integrations, SwaggerHub onboarding, and Guided Actions.

Introducing Dashboard​

The new Dashboard is now available from the main navigation, providing centralized visibility into application security posture and compliance status. It supports role-aware views for ADMIN, USER, and VIEWER/Auditor roles, with data scoped by access level. VIEWER/Auditor roles get tenant-wide compliance visibility via the Security Policy Applications view without requiring direct application assignment. A guided onboarding tour is included for first-time users.

Why this matters​

• Centralized visibility into application health and compliance
• Tenant-wide compliance review for audit and governance teams without operational access
• Guided navigation for first-time users

Coming Next​

• An Onboarding Health view alongside security posture and compliance, surfacing how completely each application is onboarded and where attention is needed to move it forward. Includes an Onboarding Score quantifying completeness across key milestones, so stalled applications and next actions are immediately visible.

Spec Reload Using Postman Collections​

Applications can now reload their API specification using an updated Postman Collection file, regardless of whether they were originally registered using OpenAPI (OAS) or Postman Collection format.

Why this matters​

• Simplifies keeping API definitions in sync with Postman collections
• Eliminates the need to recreate applications when collections change
• Improves visibility into specification refresh activity

Note: Reloading Postman Collections via a URL or Gateway integration isn't supported yet and will be added in a future release.

Editable Business Unit and Team Names​

Administrators can now rename Business Units and Teams directly from Team Management.

Why this matters​

• Simplifies organizational updates and restructuring
• Reduces the need to recreate teams or business units for naming changes
• Improves flexibility when managing large organizations

Code Bolt — Django Framework Support​

Code Bolt now supports Django, expanding coverage for Python-based applications and APIs.

Why this matters​

• Enables automated onboarding and analysis for Django applications
• Expands framework compatibility for Code Bolt users
• Simplifies API discovery for Python environments

Issue Fixes​

Private Hosted Agent Visibility in Scan Details​

• Issue: Private hosted agents created by ROLE_USER users were not visible in the Scan Details page, making it difficult to identify which execution environment was used for a scan.
• Fix: Private-hosted agents are now visible on the Scan Details page while maintaining existing ownership and access restrictions.

Impact

• Improves visibility into scan execution environments
• Preserves secure ownership boundaries for privately managed agents
• Hosted agents created by administrators remain shared across the organization

Postman Gateway Integration — Collection Registration​

• Issue: Applications imported from Postman Gateway integrations failed to register and displayed a generic "Something went wrong" error.
• Fix: Resolved the registration issue affecting Postman workspace imports.

Impact

• Improves the reliability of Postman workspace onboarding
• Applications now register successfully from connected Postman workspaces

SwaggerHub Integration — Project API Loading​

• Issue: Selecting a SwaggerHub project caused the APIs table to fail loading with an internal server error.
• Fix: Resolved the project-loading issue affecting SwaggerHub integrations.

Impact

• Restores reliable API loading from SwaggerHub projects
• Improves the stability of SwaggerHub integrations

Improved Reachability Error Reporting​

• Issue: Some endpoints returned a generic “Internal APIsec error during test execution” message when connectivity, DNS, TLS, or timeout issues prevented successful communication with the target environment.
• Fix:
  • Scan results now surface specific network and connectivity errors directly in test execution results instead of displaying a generic internal error.
  • Timeout handling was also improved to provide additional time for slower responses before marking requests as failed prematurely.

Impact

• Simplifies troubleshooting for connectivity issues
• Provides clearer diagnostics during scan failures
• Reduces ambiguity in hosted agent troubleshooting

Locale-Aware Date and Time Formatting​

• Issue: Dates and timestamps were displayed in a fixed UTC format regardless of the user's locale or time zone.
• Fix: Date and time formatting now automatically adapts to the user’s browser locale and timezone settings.

Impact

• Improves readability across global regions
• Displays timestamps using local date/time conventions
• Eliminates inconsistencies caused by UTC-only formatting

Guided Actions — Authentication Status Display​

• Issue: The Guided Actions Scanned pill incorrectly displayed “No Credentials are configured” even when valid authentication credentials existed.
• Fix: Resolved the authentication state validation issue in Guided Actions.

Impact

• Authentication status now reflects the actual configuration state
• Reduces confusion during scan workflows
• Improves the reliability of Guided Actions recommendations

NG Production Release Update - APIsec_cloud_7.5.1.1 ( May 08, 2026 )​

Applications Page Handling for PLG Users​

Improved handling of team membership checks when loading the Applications page for PLG (Product-Led Growth) users. Users without team associations are now handled gracefully.

Impact

• Improved reliability and user experience for tenants without team structures.

NG Production Release Update - APIsec_cloud_7.5.1.0 ( May 05, 2026 )​

This release improves integration, visibility, and usability across the platform. Key updates include in-product CI/CD script generation, scan source tracking for better auditability, and redesigned Team Management and Applications pages for more efficient access and prioritization. The Guided Actions panel helps users quickly understand application health and take targeted actions such as configuring authentication, improving coverage, and addressing findings, while TLS version detection enhances security by identifying outdated configurations.

SSL/TLS Version Detection​

APIsec now detects deprecated TLS versions (TLS 1.0 and 1.1) and reports them with supporting evidence, including the negotiated cipher suite. This applies to both cloud and hosted agent scans.

Why this matters

• Identifies outdated and insecure configurations
• Helps enforce modern security standards
• Improves visibility into transport-layer risks

Parameter Hydration — Custom Authentication Support and Reliability​

The parameter hydration agent now supports applications with custom authentication and includes additional resiliency for applications using static API keys. This ensures parameters are discovered and processed reliably without failures across different authentication setups.

Why this matters

• Enables consistent parameter discovery for APIs using custom authentication and API keys
• Reduces hydration failures, improving overall scan coverage
• Improves reliability and performance for large and complex applications

CI/CD Integration — Script Generation in the UI​

You can now generate CI/CD pipeline scripts directly from the Application page. Select your pipeline type (GitHub Actions, GitLab CI, Jenkins) and copy a ready-to-use script with pre-filled Application and Instance IDs. CI/CD setup instructions are also available from the Integrations page.

Why this matters

• Simplifies pipeline integration setup
• Eliminates manual configuration errors
• Speeds up CI/CD onboarding

Scan Source Tracking​

Scan History now shows how each scan was triggered (Manual, Scheduled, or CI/CD).

Why this matters

• Improves the auditability of scan activity
• Distinguishes automated vs manual scans
• Helps track CI/CD-driven testing

Guided Actions Panel​

A new Guided Actions panel provides a health score, real-time status indicators, and contextual recommendations based on the application's current state. Users can quickly identify issues across authentication, configuration, coverage, and findings, and navigate directly to the relevant areas.

Why this matters

• Highlights what needs attention across key areas in one place
• Provides actionable recommendations based on the current state
• Reduces time spent navigating and diagnosing issues

Applications Home Page Redesign​

The Applications page now includes risk scoring, advanced filtering, and improved visibility into application status.

Why this matters

• Quickly identify high-risk or untested applications
• Simplify filtering and prioritization
• Improve visibility into team ownership and risk

New Team Management Experience​

Team Management has been redesigned into a unified workspace with improved usability and performance.

Why this matters

• Simplifies management of teams, users, and business units
• Reduces navigation overhead
• Improves responsiveness and usability

Team Management — Application Assignment​

You can now assign and manage applications directly within the Team Management view.

Why this matters

• Eliminates the need to navigate to individual applications
• Centralizes access management
• Speeds up onboarding and team configuration

Quick Start Authentication (Paste Token)​

You can now run scans by pasting a bearer token directly into the configuration—no setup required.

Why this matters

• Speeds up onboarding for secured APIs
• Reduces configuration effort
• Enables quick validation workflows

Register Applications Using Burp Proxy XML​

We have extended non-OAS onboarding to support Burp Proxy XML exports. You can now register applications using traffic captured in Burp, enabling onboarding when API specifications aren't available. APIsec parses the Burp XML, converts it into an OpenAPI Specification (OAS), and extracts the environment base URL during registration. You can review and update the base URL before completing setup. Once registered, the generated OAS is available for download, allowing you to refine or extend it and reload the updated specification as needed.

Why this matters

• Expands onboarding support for APIs without existing specifications
• Leverages Burp captures to quickly bring APIs into testing
• Reduces dependency on formal API documentation
• Provides flexibility to refine and reuse the generated API specification

This release focuses on improving visibility, usability, and scan accuracy across the platform. Key updates include enhanced Developer Reports with full endpoint coverage, and a redesigned Hosted Agent dashboard for better operational visibility. Security testing has been expanded with new detection categories for SSL/TLS vulnerabilities and JWT header injection, helping teams identify critical risks earlier. Additionally, improvements to parameter hydration and UI consistency streamline workflows and reduce manual effort. Several fixes address issues in authentication handling, Postman imports, performance for large APIs, and reporting accuracy—resulting in a more stable and reliable testing experience.

Developer Report with Full Endpoint Coverage​

The existing Developer Report has been enhanced to include all tested endpoints, not just those with active findings. It now also provides a clearer view of the last scan summary, overall test coverage, and OWASP API Security Top 10 coverage.

Why this matters

• Gives developers complete visibility into what was tested, not just what failed
• Helps teams understand coverage gaps and validate scan completeness
• Makes it easier to track both active and resolved vulnerabilities

Coming Soon

• A new Proof of Test Report will be introduced in May, providing detailed evidence of test execution to better reflect its purpose as compliance evidence.

Hosted Agent Dashboard Redesign​

The Hosted Agents page has been redesigned to provide immediate visibility into agent health and activity. Inactive or Unresponsive Agents are surfaced first, so teams can quickly identify and resolve issues.

Why this matters

• Quickly identify unhealthy agents without scanning the full list
• Prevent scan disruptions with proactive certificate expiry alerts
• Manage agents directly from a single view (restart, rotate token)
• Improves operational efficiency for teams managing multiple environments

New Security Detection Categories​

SSL/TLS Vulnerabilities​

APIsec now detects:

• Expired SSL certificates
• Weak RSA key sizes below recommended standards

These checks run automatically for REST APIs with SSL enabled.

Why this matters

• Helps identify critical transport-layer security issues early
• Ensures APIs meet modern encryption standards
• Reduces risk from misconfigured certificates

JWT Header Injection (jku / iss Misuse)​

A new detection category identifies vulnerabilities where JWT validation can be bypassed by manipulating header fields such as jku or iss.

Why this matters

• Detects high-impact authentication bypass risks
• Validates secure token verification practices
• Provides actionable evidence for remediation

Application Details Sidebar Consistency​

The Application Details sidebar is now consistently available across Scan History, Scan Details, and RBAC Map pages.

Why this matters

• Provides quick access to the application context across workflows
• Reduces navigation effort
• Improves overall usability

Team Management — Application Assignment​

Assigning applications to teams previously required navigating to individual applications, making the process time-consuming and difficult to manage at scale. Team Management has now been enhanced to allow assigning and managing applications directly within the team configuration. Administrators and team owners can add or remove applications in one place. Assigned applications are listed in the team view, with an option to remove them, and updates are reflected immediately without a full-page reload.

Why this matters

• Simplifies access management by centralizing team and application assignments
• Eliminates the need to navigate across multiple application screens
• Speeds up onboarding and team reconfiguration workflows
• Improves efficiency for administrators and team owners managing access at scale

Register Applications Using HAR Files​

You can now register applications using HAR (HTTP Archive) files, enabling onboarding of APIs captured from browser traffic or other tools that support HAR export. This is especially useful when API specifications or documentation are not available. The platform automatically parses the HAR file, converts it into an OpenAPI Specification (OAS), and extracts the environment base URL during registration. Users can review and update the base URL before completing the setup. Once registered, the generated OAS is available for download, allowing users to refine or extend it and reload the updated specification as needed.

Why this matters

• Enables onboarding of undocumented or legacy APIs without existing specifications
• Reduces dependency on API documentation to begin security testing
• Accelerates application registration with automatic parsing and conversion
• Provides flexibility to refine and reuse the generated API specification

Issue Fixes and Improvements​

1. Custom Authentication — Nested Body Fields Preserved

• Issue: Nested authentication fields using dotted keys caused sibling fields in the request body to be overwritten or removed.
• Fix: Authentication values are now written correctly without affecting adjacent fields, ensuring valid request payloads during scans.

2. Postman Import — Request Body Preservation

• Issue: Request bodies containing stringified JSON or special characters were dropped during import.
• Fix: All request bodies, including those with embedded JSON or special characters, are now preserved correctly.

3. Postman Import — Collection Variables Not Visible

• Issue: Large Postman collections failed to populate variables in the Parameters Configuration screen.
• Fix: Variable handling has been updated to ensure all collection-level variables are correctly imported and displayed.

4. Endpoints Tab Performance for Large APIs

• Issue: The Endpoints tab was slow or timing out for applications with large numbers of endpoints.
• Fix: Performance improvements ensure faster load times and more reliable access, even with large API inventories.

5. Pagination Reset Issue

• Issue: Navigating through results and interacting with the UI caused pagination to reset to page 1.
• Fix: Pagination state is now preserved across interactions, improving usability for large datasets.

6. Team Management UI Issues

• Issue: UI misalignment and disabled actions occurred when managing team members.
• Fix: Layout and interaction issues have been corrected for a smoother team management experience.

7. Team Management Performance

• Issue: Editing or canceling actions triggered unnecessary full reloads.
• Fix: Only the affected section now refreshes, improving responsiveness and reducing load times.

8. Developer Report — Incomplete Evidence

• Issue: Reports displayed only dry run data instead of actual test execution evidence.
• Fix: Reports now include the full test chain, ensuring accurate and complete evidence for findings.

9. Custom Authentication — Sensitive Data Masking for Form-Encoded Requests

• Issue: When using application/x-www-form-urlencoded request bodies in custom authentication, sensitive values (such as client_secret) were displayed in clear text during Test Authentication, specifically in the request body field and the extracted values table.
• Fix: Sensitive fields are now masked in both the request body display and the extracted values table during Test Authentication.

NG Production Release Update - APIsec_cloud_7.4.3.0 (April 20, 2026)​

This release improves platform reliability, scan accuracy, and troubleshooting visibility. Key updates include detailed reachability diagnostics, real-time parameter discovery, improved Postman collection handling, and intelligent parameter encoding for more accurate testing 👕. Performance enhancements significantly improve RBAC configuration for large environments, and platform resilience is strengthened with automatic hosted agent fallback. Several critical issues related to Security Hub, authentication handling, request routing, and scan accuracy have also been resolved, improving overall stability and confidence in scan results.

Parameter discovery has been improved to provide better visibility and faster feedback during execution.​

Results are now streamed incrementally as endpoints are processed, allowing users to see updates in real time instead of waiting for the full discovery to complete. Additionally, the parameter management view now includes metadata, including the hydration strategy used for each parameter and the current execution status.

Why this matters

• Improves visibility into parameter discovery progress and behavior
• Reduces wait time for initial results, especially for large APIs
• Simplifies troubleshooting and validation
• Enhances usability when working with large endpoint sets

Enhanced Parameter Visibility in UI​

The parameter management view has been enhanced with additional metadata and improved filtering capabilities.

Users can now view the hydration strategy applied to each parameter and track the execution status of parameter discovery.

Why this matters

• Improves transparency into parameter discovery behavior
• Simplifies troubleshooting and validation
• Enhances usability for large APIs

New Security Test Category: Mass Assignment​

A new Mass Assignment test category has been introduced to detect vulnerabilities where APIs unintentionally allow modification of restricted or sensitive fields.

This category uses a two-step assignment-and-confirmation approach to accurately identify exploitable scenarios. Findings are classified into severity tiers and include supporting evidence to help validate and prioritize issues. Results are also integrated into Security Hub and reporting.

Why this matters

• Enables the detection of a critical and commonly overlooked API vulnerability
• Improves accuracy through confirmation-based validation
• Provides clear, evidence-backed findings with severity prioritization
• Ensures visibility in Security Hub and compliance reporting

Enhanced GraphQL Directive Authorization Testing​

GraphQL security testing has been enhanced to better detect authorization weaknesses in APIs using directive-based access control.

The platform now evaluates operations protected by directives (such as @auth) across different permission levels, including mutations, subscriptions, and field-level access. This enables detection of cases where lower-privileged users can bypass intended access restrictions 🔐 .

Why this matters

• Improves detection of authorization bypass in GraphQL APIs
• Expands coverage beyond queries to include mutations and subscriptions
• Validates the enforcement of directive-based access controls
• Helps identify privilege escalation risks across user roles

Structured Reachability Failure Analysis​

Diagnosing why an API was unreachable previously required manual investigation or support involvement because of generic error messages.

This release introduces detailed, step-by-step reachability diagnostics across the full execution flow. When an API instance cannot be reached, users now see exactly which stage failed (DNS, TCP, SSL, HTTP, or authentication).

Why this matters

• Enables self-service troubleshooting without relying on support
• Significantly reduces time to identify connectivity issues
• Provides clear, actionable failure points instead of generic errors

Improved Postman Collection Conversion​

Postman collection conversion has been streamlined to improve reliability and performance.

The conversion process now runs directly within the platform, removing dependency on external services and improving handling of non-standard collection formats.

Why this matters

• Faster application onboarding with no external service dependency
• Improved compatibility with real-world Postman collections
• Reduces the need for manual pre-processing of collections

RBAC Configuration Performance Improvements​

RBAC configuration handling has been optimized for large environments.

Batch operations now run concurrently, and partial failures are surfaced rather than silently ignored.

Why this matters

• Significantly reduces load times for large tenants
• Improves visibility into configuration failures
• Enhances usability of RBAC management workflows

SSO Integration Support for Ping Identity​

Single Sign-On (SSO) support has been extended to include Ping Identity, enabling organizations to integrate APIsec with their existing identity provider for seamless authentication and user management.

The integration supports standard SAML-based authentication flows, allowing users to securely access the platform using their enterprise credentials.

Why this matters

• Expands compatibility with enterprise identity providers
• Simplifies user onboarding and access management
• Improves security through centralized authentication
• Aligns with enterprise SSO standards and practices

Some things in this release aren’t just for reading 👀

Issue Fixes and Improvements​

1. Improved Handling of Nullable Schema Definitions

• Value generation for schemas using anyOf with nullable branches has been stabilized to prevent incorrect type selection.

2. Security Hub Crash for Non-English Locales

• Issue: Security Hub failed to load for users with non-English locales due to localized date formatting incompatibility.
• Fix: Date handling has been corrected to support all locales, ensuring consistent behavior across regions.

3. Incorrect Handling of Dotted Keys in Custom Authentication

• Issue: Custom authentication fields using dotted notation were incorrectly mapped, resulting in authentication failures.
• Fix: Nested field handling has been corrected to ensure authentication values are applied to the correct structure.

4. Incorrect Request Routing for URI-Unsafe Characters

• Issue: Requests containing certain characters in the URL path were incorrectly routed, leading to invalid test execution.
• Fix: Request handling has been corrected to preserve the intended request path.

5. Encoding Metadata Handling Failure

• Issue: Encoding-related metadata caused failures during test execution due to incompatible data handling.
• Fix: Metadata handling has been corrected to ensure encoding intelligence is properly utilized during scans.

6. GraphQL Request Construction Issues

• Issue: Certain GraphQL test cases generated malformed request payloads.
• Fix: Request construction has been corrected to ensure valid payload generation across GraphQL tests.

7. Missing Scan Context in Logs

• Issue: Scan identifiers were not consistently included in logs, making traceability difficult.
• Fix: Logging context has been corrected to ensure scan identifiers are consistently captured.

8. Incorrect Test Execution via “Scan Now”

• Issue: Triggering scans for specific categories could result in incorrect tests being executed.
• Fix: Test mapping has been corrected to ensure accurate execution of selected categories.

9. Loss of Reachability Diagnostic Details

• Issue: Detailed reachability diagnostics were not propagated to the UI, resulting in generic error messages.
• Fix: Diagnostic details are now preserved and returned, enabling detailed visibility into failures.

10. Instance Name Display Issue

• Issue: Instance names were incorrectly populated in certain onboarding scenarios.
• Fix: Instance naming logic has been corrected.

NG Production Release Update - APIsec_cloud_7.4.2.0 (April 14, 2026)​

Improved Query Parameter Handling for SCIM APIs​

Security testing for APIs using SCIM-style query parameters has been enhanced to support more flexible query handling.

Enhancement: The platform now adapts how query parameters are processed based on API behavior, allowing effective testing of APIs that require non-standard query formats.

Impact:

• Improves test coverage for SCIM-based APIs
• Enables more meaningful injection testing within query parameters
• Supports APIs with non-standard query parsing behavior

Manage Instance Headers via API Tokens​

Instance-level headers can now be managed programmatically using API tokens.

Enhancement: Teams can retrieve and update instance headers through API calls, enabling integration with automated workflows.

Impact:

• Enables CI/CD-driven configuration management
• Reduces manual updates
• Ensures secure handling of confidential headers

SSO Support for Viewer (Auditor) Role​

The Viewer (ROLE_AUDITOR) role now supports Single Sign-On (SSO) integration.

Enhancement: Organizations can provision and manage Viewer users through their identity provider.

Impact:

• Simplifies the onboarding of read-only users
• Aligns access control with enterprise identity systems
• Enables automated user provisioning

Improved Visibility for Custom Authentication Failures​

Issue:
Custom Authentication failures during scan execution were not consistently reported across different execution environments.

Fix:
Custom Authentication resolution failures are now surfaced consistently across both public and private hosted agent executions.

Impact:

• Prevents scans from running when authentication is unresolved or the Hosted Agent is unresponsive
• Improves debugging of authentication workflows
• Ensures consistent behavior across execution environments

Upcoming Improvement:
A UI option will allow associating instance URLs with specific hosted agents to ensure correct execution routing during test authentication and dry runs.

Slack Notifications Not Sent After Scan Completion​

Issue:
Slack notifications weren't being delivered after scan completion due to a regression.

Fix:
Notification workflows were corrected to ensure alerts are sent reliably upon scan completion.

Impact:

• Restores visibility into scan completion status
• Ensures timely notifications for security teams

NG Production Release Update - APIsec_cloud_7.4.1.0 ( April 06, 2026 )​

This release focuses on improving usability, reliability, and collaboration across the platform. Key enhancements help teams keep API inventories automatically up to date, simplify sharing vulnerabilities via direct links, and reduce operational overhead with performance and stability improvements.

Several fixes also address real customer workflow challenges, including improving scan reliability for large APIs, ensuring reports generate consistently, strengthening handling of sensitive authentication data, improving RBAC usability, and ensuring reporting metrics remain accurate.

Together, these updates aim to make security testing more predictable, improve collaboration between security and engineering teams, and reduce the manual effort required to maintain accurate testing coverage.

Issue Fixes and Improvements

1. Improved Reliability of Parameter Hydration from Traffic Captures
   • Some parameters captured in Bolt traffic files weren't applied consistently, which could reduce scan depth for certain endpoints.
   • APIsec now ensures captured headers and parameters are applied correctly across endpoints, improving test coverage and reducing manual parameter configuration.
2. Sensitive Authentication Fields Now Masked in Custom Authentication
   • Sensitive fields used in custom authentication workflows could previously appear in plain text during test authentication.
   • Sensitive inputs are now masked in the interface to prevent accidental exposure during onboarding, reviews, or screen sharing.
3. Security Hub Metrics Now Respect BU and Team Filters Consistently
   • The Unique Endpoints tile in Security Hub didn't fully reflect the applied filters, which could cause confusion in reporting.
   • Metrics now consistently update based on selected Business Unit and Team filters, improving reporting accuracy.
4. Faster Scan Execution with Updated Private Hosted Agent Image
   • Customers running scans through private hosted agents experienced slower execution times in some environments.
   • An updated hosted agent image (apisec/hostedagent:2026-04-03-67) improves scan execution performance and stability.
5. Developer Report Generation Reliability Improvements
   • SSO users were unable to generate Developer Reports due to a workflow issue where the report never completed processing.
   • Report generation now completes reliably, allowing teams to access technical remediation reports when needed.
6. Integration Status Now Reflects Credential Health Accurately
   • Issue tracker integrations and Notifications could appear healthy even after credentials have expired.
   • Connection status now correctly reflects credential validity, so teams can quickly identify integration issues.
7. Improved Stability for Large-Scale Scans
   • In some cases, with very large APIs, scans can get stuck in progress and cannot be stopped manually.
   • Improvements now ensure:
     • Stuck scans are automatically marked as failed when appropriate
     • Users can abort scans when needed
   • Large API scans complete more reliably
8. RBAC Map Performance Improvements
   • Projects with many roles experienced slow RBAC map loading times, making it difficult to review authorization coverage.
   • Performance improvements now allow RBAC maps to load more reliably, even for larger role configurations.

• Developer Report for Investigation and Remediation
  • A new Developer Report is now available to provide the technical context needed to investigate and remediate vulnerabilities. While the OWASP Coverage report focuses on security posture and coverage, this report focuses on the execution details that developers typically need during troubleshooting.
  • The report includes the necessary evidence and reproduction context, so teams don't need to manually navigate multiple sections to gather logs. This helps streamline how findings are reviewed and handed off between security and engineering teams.
  • The Developer Report can be generated on demand from the Application → Reports section. Since vulnerabilities may change after new scans, the platform automatically prompts regeneration when updated scan results are available, ensuring teams always work from the latest findings.
• New Auditor Role for Read-Only Access
  • A new ROLE_AUDITOR (view-only role) is now available for users who need visibility into applications, scans, vulnerabilities, and reports without the ability to make changes or run operations.
  • Previously, the lowest level of access required assigning ROLE_USER with view permissions, which still allowed actions like registering applications and running scans. The new role provides a stricter read-only option for auditors, reviewers, or stakeholders who only need visibility.
  • Users assigned this role can log in, navigate the platform, and view only the applications explicitly shared with them, either directly or through team membership. They cannot modify configurations or perform operational actions.
  • This helps organizations safely grant visibility to audit or review stakeholders without introducing unnecessary operational access.

Issue Fixes and Improvements

This release also includes several fixes to improve platform reliability, data accuracy, and the user experience.

1. Improved Handling of Arrays in Postman Collection Imports
   • An issue where request body arrays imported from Postman collections were truncated to the first element has been resolved. Arrays are now preserved correctly during import, eliminating the need for manual body updates after onboarding.
   • This ensures request bodies generated from Postman collections remain complete and reduces manual correction effort during application setup.
2. Improved Handling of False Positive Updates with Azure DevOps Integration
   • An issue preventing vulnerabilities from being marked as false positives when Azure DevOps workflow states were misaligned has been addressed. The integration now better supports different work item workflows and clearer configuration guidance.
   • This reduces ticket update failures and improves the reliability of issue-tracking integrations.
3. Correct Handling of Endpoints Without Request Bodies
   • Endpoints without a defined request body were previously sent with a literal null value, which caused some APIs to reject requests with 400 errors. Requests are now sent without a body when one is not defined.
   • This improves scan reliability for endpoints such as GET and DELETE and prevents unnecessary scan failures.
4. Standardized Date Format Across the Platform
   • Date formats have been standardized across the product to improve consistency and reduce confusion when reviewing scans, reports, and vulnerability timelines.
5. Improved Accuracy of BOLA Vulnerability Detection
   • An issue that could incorrectly file BOLA vulnerabilities when resources were intentionally accessible to all users has been resolved. Vulnerabilities are now only reported when access controls are expected to restrict access.
   • This helps reduce false positives and improves trust in BOLA findings.
6. Improved Monthly Report Subscription Handling
   • Two improvements have been made to monthly email report subscriptions:
     • Reports are now generated based on user role, ensuring admins receive tenant-level metrics while users receive data only for applications they can access.
     • Duplicate subscriptions are now prevented when users are already added as recipients.
   • This improves report accuracy and prevents duplicate notifications.
7. Improved AWS Auto-Onboarding Stability
   • An issue where API Gateway auto-onboarding could fail when connection names contained special characters has been resolved, improving the reliability of automated onboarding workflows.
8. Improved Postman Auto-Onboarding Activity Logs
   • Duplicate completion status entries in Postman auto-onboarding logs have been resolved to provide clearer and more accurate activity tracking.

NG Production Release — APIsec Cloud 7.3.2.0 (March 13, 2026)​

Intelligent BOLA Scenario Management

The release brings meaningful improvements to how BOLA attack scenarios are discovered, surfaced, and managed. It builds on the platform's ability to automatically generate scenarios based on your API design and how your endpoints work together. Practitioners can now clearly see what's ready, what needs work, and what's actively protecting them.

The platform finds your APIs. Then it builds the attack scenarios.

APIsec's AI analyzes your API flows by examining endpoint design, data models, and how resources interact across your API. Based on this analysis, it automatically generates BOLA attack scenarios derived from real API behavior.

From there, practitioners can configure and validate scenarios before they become active in scans. The goal of this release is to make that process faster, clearer, and easier to manage.

Readiness Replaces Status for Clearer Scenario Management

Instead of relying on technical status labels, BOLA scenarios are now organized based on what they mean for your testing workflow. This makes it easier to understand what requires action and what is already protecting your APIs.

Scenarios are now grouped into three clear categories:

• Needs attention – Scenarios are missing required configuration, such as user assignment or parameter configurations. These cannot run until resolved.
• Active in scans – Scenarios that are validated, enabled, and currently running in your security tests.
• Not in scans – Scenarios that are ready to run but not yet enabled.

You can now clearly distinguish between scenarios that are ready to run and those that require configuration before they can run, helping teams prioritize their next steps faster.

Scenarios activate themselves. You stay in control.

Scenarios that pass validation are automatically enabled for scanning. No manual review queue. No activation overhead. Coverage begins the moment the platform understands the onboarded API. Practitioners retain full control and can disable any scenario if needed.

Configuration gaps surface automatically.

When validation fails due to missing authentication or incomplete setup, the scenario surfaces directly in the Needs attention section. At this point, we need to investigate what's blocking setup, and the next iteration will include more actionable guides for the practitioner to follow.

A new operational view for BOLA coverage.

The redesigned BOLA page opens with a dashboard-level summary showing total scenarios, how many need attention, how many are active in scans, and how many are inactive. The full state of your BOLA coverage, before you drill into a single row.

This is an ongoing initiative to rebuild the APIsec experience from the ground up. Tighter workflows, clearer signal, less noise. More to follow.

NG Hotfix Release Update - APIsec_cloud_7.3.1.1 ( March 06, 2026 )​

A hotfix was released today to address two areas impacting scan accuracy and API compatibility. Improvements to the Injection category reduce false positives by refining how response latency is analyzed during injection detection. In addition, the platform now supports request bodies for GET and DELETE endpoints, enabling accurate testing for APIs that require this pattern. These updates improve scan reliability and ensure broader compatibility with API implementations.

Improved Injection Detection Accuracy​

• Improved Baseline Latency Analysis: Baseline latency is now evaluated separately for successful and unsuccessful responses rather than averaging all responses together. This improves injection-detection accuracy, particularly for APIs where successful responses naturally take longer than error responses.

• Better Handling of High-Latency Applications: Applications with naturally high response times often generate false positives. For APIs with baseline latency above 3 seconds, detections are now triggered only when test responses exceed the baseline latency by approximately 6.9–8 seconds, helping reduce noise in slower environments.

• Refined Handling of Abnormally High Latency: Previously, any test response that took longer than 7 seconds could trigger injection detection. Extremely long responses caused by parsing complexity could incorrectly trigger detections. The platform now requires latency increases to remain within a defined range to qualify for injection detection, reducing false positives. Extremely high latency scenarios will be evaluated under a dedicated detection category.

• Removal of Error-Based Injection Detections: Server errors returned during injection tests previously triggered low-severity detections. Based on further analysis, these signals are now removed from injection testing and will be evaluated under a separate category focused on malformed input handling.

Support for Request Body in GET and DELETE Endpoints​

Some APIs require a request body for GET or DELETE endpoints, which is uncommon but supported in certain implementations. Previously, these requests could fail during testing because the request body was not transmitted correctly.

The platform now supports request bodies for GET and DELETE endpoints, ensuring APIs using this pattern can be tested accurately and behave consistently with tools like Postman. This improvement allows these endpoints to be validated successfully during security scans.

NG Production Release Update - APIsec_cloud_7.3.1.0 ( March 03, 2026 )​

AI-Powered Business Flow Analysis from API Documentation​

Understanding how endpoints within an API work together to support real business actions is challenging, especially across large specifications. Security teams have the docs, but translating them into user workflows takes time and deep domain knowledge.

AI-powered Business Flow Analysis automatically analyzes your API documentation to identify and visualize the logical flows behind real application behavior. This enables teams to see how endpoints connect to support real-world actions, not just review them in isolation.

Automatically Discover How Your Endpoints Work Together

1. Instead of reviewing endpoints one by one, the platform now analyzes your API specification to automatically derive business-level workflows.

2. Each flow clearly shows the sequence of API calls required to complete a real user action.

This helps answer common questions teams face during onboarding or testing:

• Which endpoints are part of the login flow?
• What sequence of calls creates a new resource?
• Which endpoint returns identifiers used by the next call in the sequence?

The platform automatically connects these steps so teams can quickly understand the business logic behind the API design.

On-Demand AI Analysis

Business flow analysis is initiated on demand to ensure efficient use of resources. Users can start the analysis by clicking "Start AI Analysis" in the Business Flows tab. Once initiated, the platform analyzes the API specification and derives the underlying business workflows. Depending on the API's size and complexity, the analysis may take a few minutes to complete. This approach allows teams to run the analysis only when needed, while still benefiting from automated insights into their application's business logic.

Why This Matters

Security risks often occur not within a single API endpoint, but within the sequence of actions across multiple endpoints. By automatically identifying these flows, teams gain a clearer understanding of how their APIs support real business operations, making it easier to analyze, test, and secure them.

Coming Next: The Foundation for Business Logic Security Testing

This capability is the baseline for an expanding set of business domain-aware test categories. Future releases will build on these discovered flows to test for security flaws at the business logic level — going beyond infrastructure vulnerabilities and individual endpoint checks to identify weaknesses in how your API behaves as a complete, working application.

Automatically Generated BOLA Attack Scenarios​

Identifying the right endpoints, users, and attack scenarios for BOLA testing usually requires deep knowledge of an application's business logic. The platform now eliminates that barrier by automatically generating BOLA attack scenarios based on your discovered API structure and business flows.

Test Real-World Authorization Risks Without Manual Setup

BOLA remains one of the most critical and common API vulnerabilities, yet testing it has historically required deep familiarity with how an API manages user-owned resources. The platform removes that barrier by analyzing API behavior and automatically recommending ready-to-use scenarios. For example:

• User A (Owner) creates a resource.
• User B (Attacker) attempts to access, modify, or delete that resource.

These simulated attacker attempts help determine whether the API correctly enforces authorization boundaries between users.

Guided Scenario Selection

The interface presents recommended scenarios grouped by resource type. Users can easily:

• Review the recommended attack scenarios.
• Select which scenarios to import into the BOLA configuration.

This makes it easy to quickly enable meaningful authorization testing without manually constructing attack sequences.

Why This Matters

BOLA remains one of the most common and critical API vulnerabilities. Detecting it often requires simulating how different users interact with the same resource across multiple endpoints.

With automatic scenario creation, teams can start testing these risks immediately, even if they are unfamiliar with the API's internal design.

Coming Next:

Future enhancements will further streamline the experience by automatically enabling scenarios that pass Dry Run validation, surfacing missing configuration details when validation fails, and providing clearer guidance to complete setup — moving teams from manual configuration toward intelligent, guided authorization testing.

Improved MuleSoft API Integration for Complete API Discovery​

Organizations using MuleSoft often organize their APIs across multiple files and asset types. This could previously result in applications being onboarded with missing or incomplete endpoints, limiting security teams' ability to test with confidence. This release improves the MuleSoft integration to ensure APIs registered through the MuleSoft Exchange are imported completely and accurately.

More Reliable Endpoint Discovery

• APIs onboarded through MuleSoft now include all endpoints defined in the specification.
• Fragmented specifications are automatically resolved.
• Applications are less likely to appear with missing or incomplete endpoints.

This ensures security scans cover the entire API surface, giving teams a more reliable inventory of their APIs

Flexible Specification Selection for Reload

When reloading API specifications from MuleSoft, users can now choose their preferred asset type, OAS or RAML, both for on-demand reloads and scheduled auto-reloads.

This flexibility helps teams capture additional resources when APIs are distributed across multiple specification files.

Why This Matters

Incomplete API imports can lead to missing endpoints and reduced security coverage. By improving how MuleSoft specifications are detected and processed, this update ensures teams can onboard APIs with greater accuracy and confidence, enabling more complete security testing.

UI/UX Improvements​

This release introduces a standardized UI theme that will serve as the design baseline across the platform. The update focuses on improving visual clarity and consistency while reducing overly bright or distracting colors. Key improvements include:

• Standardized theme to establish a consistent design foundation across the product
• Improved table styling for better readability and structure
• Refined badge designs to provide clearer status indicators
• Updated tab styling for more intuitive navigation
• Enhanced sidebar layout for improved usability and visual clarity

Issue Fixes and Improvements​

This release also includes several fixes to improve API onboarding reliability, parameter handling, and scan execution stability.

Improved Handling of Array Objects in Request Bodies

When APIs contained arrays of objects in request examples, the platform previously generated parameters only for the first object in the array. This could lead to incomplete parameter coverage during testing. The platform now preserves all objects within JSON arrays and applies variable placeholders to each object individually, ensuring more accurate parameter generation for complex request bodies.

Resolved Instance Creation Failures Caused by Spec Parsing

In some cases, creating an application instance or re-importing a specification would fail due to parsing issues in the API specification. These parsing issues have been addressed, ensuring that applications and instances can now be created reliably from valid OpenAPI specifications.

Improved API Registration for Invalid or Large Parameters

Certain APIs failed to register due to issues in the OpenAPI specification, such as missing parameter names or excessively large parameter identifiers. The platform now sanitizes these specifications during import by skipping variable creation for parameters without names and limiting the number of variables created in a single batch to prevent exceeding item size limits and excessive attribute growth.

Improved Endpoint Readiness Evaluation During Dry Run

When multiple Dry Run iterations were executed for an endpoint, the platform could incorrectly mark the endpoint as not ready for testing if an earlier iteration returned an error—even when a later request succeeded. The readiness evaluation logic has been improved to review all Dry Run responses and prioritize successful responses (HTTP 2xx) when determining the final readiness status.

Improved Stability for GraphQL Scan Execution

Some GraphQL scans failed due to a missing Dry Run context during test execution. The scanning service now consistently injects the required Dry Run context during scan execution, preventing errors and allowing scans to complete successfully.

Resolved False Positive Access Errors After User Deletion

Previously, if a user who marked a vulnerability as a false positive was deleted from the tenant, the platform could not retrieve the associated user information, causing errors when viewing or revoking the false positive. The platform now displays "Deleted User" in the Marked By field when the original user account no longer exists.

Improved Azure APIM Connection Error Handling

Testing Azure API Management connections previously returned a generic error when incorrect credentials were provided. The platform now surfaces clearer error responses when the Client ID does not exist in the specified Azure tenant or when permissions are misconfigured, helping users quickly identify and correct configuration issues

Improved Reset Password Flow – Fewer Blocked Users, Faster Access​

If you've received a message like "I never got the temporary password - what do I do now?", this update is for you.

What was happening before

When a new user signed up but didn’t log in right away:

Their account remained in a "force change password" state.

• If the temporary password email was lost or expired, they couldn't use the standard Forgot Password option.
• The system would silently reject the request.
• The user was effectively locked out, and the CS team had to step in manually.

This resulted in:

• Delays in getting the platform access
• Repeated support requests
• Manual intervention just to unblock basic login access

What's improved

New users can now request a Reset Password link, even if they never logged in with their original temporary password.

That means:

• If the welcome email was missed, deleted, or expired, users can recover on their own.
• No more silent failures when using "Forgot Password."
• No need for admins to manually recreate accounts just to unblock someone.

In practical terms:

• Account Recovery becomes smoother.
• Security teams avoid unnecessary access delays.
• Application owners spend less time troubleshooting first-login issues.
• Security posture is maintained.

Users are still required to set their own password securely. The only difference is that they are no longer blocked by their account's technical state. Password changes can be managed directly from their profile settings after login.

Why this matters

This update removes a common first-day frustration:

"I signed up, but can't get in."

Now users can regain access independently, and teams can focus on productive work instead of resolving edge cases in account state.

Continuous Endpoint Readiness Validation — Always Know the Current State, Without Manual Checks​

If you manage API security at scale, you've likely run into this situation:

• Credentials were updated.
• Payloads were refined.
• Parameters were corrected.
• A scan was executed.

And then the question arises:

"What's the current readiness state of my endpoints?"

Previously, answering that question often required manual effort.

The Challenge Teams Faced

Endpoint readiness was validated automatically only during specific setup moments, like:

• Immediately after instance creation
• When authentication credentials were created

While helpful, this approach created a gap in day-to-day workflows.

Readiness didn't Always Reflect the Latest Configuration.

In real environments:

• Credentials evolve.
• Privilege levels change.
• Parameters and payloads are adjusted.
• Authentication strategies are refined.

However, the readiness status reflected only the last Dry Run during setup, not necessarily the most recent working configuration.

To truly understand the latest readiness state, users often had to:

• Manually navigate to endpoints
• Trigger Dry Run again
• Revalidate authentication and payloads
• Reconfirm which credential worked

This manual loop became especially burdensome in large applications.

What's Improved

Readiness validation is now built directly into scan execution.

Every time you run a scan:

• The platform validates endpoint reachability.
• Authentication is verified using the active configuration.
• Request structure and expected response behavior are checked.
• Readiness status is automatically updated based on successful validation.

No additional manual action required.

What This Means for You

Readiness Always Reflects the Most Recent Scan

You no longer need to manually re-trigger Dry Run to understand current readiness.

If an endpoint validates successfully during a scan, its readiness status is updated automatically.

Reduced Manual Intervention at Scale

For applications with:

• Hundreds of endpoints
• Multiple authentication strategies
• Iterative payload refinement

You no longer need to perform endpoint-by-endpoint validation just to understand coverage readiness.

What Remains Available

Manual Dry Run is still available for:

• Troubleshooting specific endpoints
• Fine-tuning parameters
• Investigating unexpected responses

But it’s no longer required just to maintain an accurate readiness picture.

Why This Matters

Security and application teams need a dependable, up-to-date view of scan readiness, especially after making changes.

Now, readiness status is continuously aligned with real scan execution.

You can trust that what you see reflects the most recent, working configuration without extra manual effort to confirm it.

Coming Next: Preserving the Last Successful Readiness State

We are introducing an improved readiness model that preserves the Last Known Good validation state.

Instead of just two states: Ready for Deep Coverage and Ready for Testing, there will now be a third, more informative state:

Currently Not Ready for Deep Coverage

This means:

• The endpoint was successfully validated previously.
• It is not currently passing validation.
• A configuration or credential change likely affected it.

Improvements to Endpoint Readiness Accuracy​

As part of continuous readiness validation improvements, we addressed two scenarios that were quietly causing confusion for users trying to determine whether an endpoint was truly testable.

These issues weren't about dry-run capability; they were about visibility and clarity.

Large Response Handling — No More Silent Readiness Gaps​

For endpoints that return very large response bodies, Dry Run results sometimes failed to update the readiness status correctly.

In practice, this meant:

● The endpoint might respond successfully.
● Authentication might work correctly.
● The HTTP status might be valid.
● But readiness wouldn't update as expected.

For teams onboarding APIs that return large payloads, such as bulk data endpoints or reporting APIs, this created unnecessary doubt:

"The endpoint works. Why isn't it marked as testable?"

What's improved​

● Large responses are now handled gracefully.
● Essential validation signals are preserved even if the response body is truncated.
● Readiness updates correctly after Dry Run.
● Users are clearly informed when a response has been truncated.

This ensures readiness reflects actual behavior, not payload size.

Correct Interpretation of Error Fields — No More False Failures​

Some APIs include an error field in the response body, even when the HTTP status is 200 OK and error = false.

Previously, the presence of the keyword "error" could be misinterpreted as a failure, even when the endpoint executed successfully.

For security and platform teams, this led to confusing outcomes:

• Successful endpoints marked as not testable
• Time spent rechecking configurations unnecessarily
• Difficulty explaining readiness states to stakeholders

What's improved

• Endpoints returning HTTP 200 with error = false are now correctly marked as testable.
• Only genuine error responses trigger a failed readiness state.
• Readiness logic aligns with actual API behavior—not keyword presence.

This eliminates false negatives and reduces troubleshooting overhead.

RBAC & Access Control – Consistency and Permission Integrity Improvements​

We've implemented a set of improvements focused on RBAC accuracy, permission consistency, and reducing unexpected behavior when managing access at scale.

These updates ensure that access controls reflect your current API design and user entitlements, without hidden inheritance or inconsistent enforcement.

Endpoints Re-Added After Deletion Now Require Fresh RBAC Evaluation

Previously, when an endpoint was deleted and later reintroduced (via spec reload, manual addition, or discovery), it retained its prior RBAC permissions.

While the endpoint itself was recreated correctly, its historical permission state persisted. In scenarios where:

• Access rules had changed,
• Teams were restructured,
• Roles were updated,
• Or the endpoint was redesigned,

This could lead to outdated permissions being silently reapplied.

What's Improved

When an endpoint is re-added:

It is treated as a new endpoint.

No previous RBAC permissions are inherited.

• The endpoint enters an Inconclusive state.
• A fresh RBAC validation or map upload is required.

This ensures that access control always reflects your current security intent, not a historical configuration.

Dry Run Stability When Switching Consolidated View

Switching the consolidated view toggle during a Dry Run execution previously triggered a new Dry Run unexpectedly.

This could create:

• Duplicate validations
• Unnecessary execution cycles
• Confusion during troubleshooting

The toggle now behaves predictably without triggering unintended re-executions.

Team-Based Edit Permissions Now Fully Support Instance-Level Header Management

Previously, users granted Edit access via Teams could not manage instance-level headers even though users with direct Edit sharing could.

This created inconsistent permission behavior and limited configuration control for team-managed applications.

What's Improved

Users with Edit permissions, regardless of whether access is granted directly or via team, can now:

• Create instance-level headers
• Modify instance-level headers
• Fully manage application configuration as expected

Consistent "Access Denied" Messaging for View-Only Users

Users with View-only access (via team sharing) were correctly restricted from modifying RBAC permissions, but the error message displayed was inconsistent.

Instead of a clear permission message, users saw a generic configuration failure.

What's Improved

When a user without edit privileges attempts to modify RBAC:

They now see:

"Access Denied. Insufficient permissions to perform operation. Please contact your Administrator."

This aligns RBAC messaging with other protected actions across the platform and removes ambiguity.

Gateway & Integration Stability Improvements​

We've resolved several integration behaviors that affected onboarding reliability and connection status visibility.

Azure Gateway – Credential Updates Now Restore Offline Connections

Updating credentials for an offline Azure connection previously did not restore the connection to an online state.

This created uncertainty around:

• Whether credentials were valid
• Whether reconfiguration was required

Connections now correctly transition to online once valid credentials are updated.

Postman Gateway – Connection Type Behavior Aligned with UI Selection

When “Make Connection Private” was not enabled, connections were still being created as private.

This mismatch between UI intent and system behavior has been corrected.

Connection type now accurately reflects the selected configuration.

AWS API Gateway – Multi-Region Auto-Onboarding Reliability Improved

Scheduled auto-onboarding using AWS Central Role ARN previously iterated through multiple accounts but did not consistently onboard APIs across multiple regions.

Multi-region onboarding reliability has been improved to ensure broader and more predictable API discovery across accounts and regions.

BOLA Scenario & Execution Improvements​

Several improvements were made to enhance clarity and reliability in BOLA (Broken Object Level Authorization) testing workflows.

BOLA Scenario Setup No Longer Stuck in Loading State

In specific cases, BOLA setup remained in a loading loop due to header behavior (e.g., missing Accept header leading to unexpected content type responses).

The platform now handles these flows more predictably and reduces dependency on manual header adjustments during setup.

BOLA Execution Logs – Accurate Status & Correct Execution Order

Previously:

• All execution logs could appear as failed—even if only one step failed.
• Execution logs were displayed out of configured sequence.
• Correlation IDs and authentication context were missing.

Improvements ensure:

• Only genuinely failed steps are marked as failed.
• Logs appear in the configured execution order.
• Correlation identifiers and role context are properly reflected.
• Evidence aligns with actual execution results.

This significantly improves troubleshooting clarity during multi-step attack scenarios.

BOLA Scenario Management Now Properly Restricted for View-Only Users

Users with View-only access to an application (whether granted directly or via teams) were previously able to update or delete existing BOLA scenarios.

While View users were correctly restricted from creating new BOLA scenarios, they were not consistently restricted from modifying or deleting existing ones. This created a permission gap where users could alter security test configurations without having edit-level rights.

What's Improved

Users with View permissions can now:

• View BOLA scenarios
• Review configuration details
• Test BOLA scenarios

But they cannot:

• Update BOLA scenarios
• Delete BOLA scenarios

This aligns BOLA scenario management with the intended RBAC model and ensures:

• Consistent enforcement of View vs Edit permissions
• Protection against unintended modification of security test configurations
• Clear separation between visibility and control

Edit privileges are now required for all BOLA scenario management actions, regardless of whether access is granted directly or through a team.

Endpoint & Variable Handling Improvements​

Duplicate Variable Key Errors Resolved

Users encountered duplicate key parsing errors when:

• Updating endpoint environment variables
• Working with Postman collection imports
• Modifying body parameters
• Reloading specs with retained configuration

Variable parsing logic has been refined to prevent duplicate key conflicts and allow updates to proceed as expected.

Tenant & User Management Improvements​

"Add User" Button Available Even When Tenant Has No Users

When tenants are created without a primary contact:

• No users existed.
• The Tenant Administrator could not see the “Add User” option.
• User onboarding was blocked.

The Add User option is now available even if no users currently exist in the tenant, removing onboarding deadlocks.

Dashboard Accuracy Improvements​

Homepage Instance Count Corrected

An instance count discrepancy occurred when:

• An application without instances existed.
• The homepage derived counts from paginated application responses.

Counting logic has been corrected to prevent inflated totals.

As part of long-term improvements, instance counts will be sourced from the Analytics service for greater performance and reliability.

Scan Behavior Improvements – Redirect Handling​

Tests Skipped When Redirected to a Different Host When a request was redirected to a different host:

• Assertions were previously executed incorrectly..
• Results could be misleading.
• Request/response logs were unclear.

Now:

• If redirected to a different host, tests are skipped.
• Vulnerabilities are not filed in this scenario.
• Clear messaging explains why the test was skipped.
• If logs are available, guidance is provided for root cause validation.

If the redirect remains within the same host but changes endpoint path, assertions still run—preserving detection of proxy or gateway misrouting scenarios.

This ensures that results reflect the intended API surface.

Hosted Agent Security Update​

We resolved a high-severity vulnerability related to JDK 17.0.17 in the on-premises Hosted Agent image.

Customers deploying hosted agents will receive an updated image with security improvements applied.

UI Consistency Improvements​

Several small but noticeable UI refinements have been made:

• Correct favicon displayed after SSO login (no longer inherits third-party branding).
• Risk acceptance comments are preserved when updating acceptance dates.
• Scrollbar styling is consistent across modes and resolutions, including dark mode.

These refinements ensure visual consistency and prevent accidental data loss in workflow interactions.

Azure API Management Integration: Improved Support for Granular Azure RBAC Scopes

We resolved an issue that could prevent APIs discovered through the Azure API Management (APIM) integration from being displayed when using granular resource-scoped credentials.

What was happening

Azure Role-Based Access Control (RBAC) allows permissions to be granted at multiple hierarchy levels, including the Subscription, Resource Group, or individual resources (such as an APIM service). In this case, the integration was configured with credentials scoped directly to the APIM service resource rather than the resource group. This access model was intentionally chosen to restrict visibility to only specific resources. However, because APIsec previously relied on listing resource groups first, it could not traverse the hierarchy to locate the APIM service and enumerate APIs, even though valid access existed.

What's fixed

APIsec now supports this granular access model by:

• Discovering resources directly at the assigned scope level
• Parsing resource metadata to identify the associated resource groups and APIM services
• Traversing from those services to retrieve and onboard APIs correctly

This approach enables API discovery to succeed even when credentials are narrowly scoped to specific APIM resources.

Impact for customers

• APIs can now be discovered and onboarded when credentials are scoped at the APIM service or other granular resource levels
• No need to broaden permissions to the resource group or subscription level
• Better alignment with least-privilege access models commonly used in enterprise Azure environments

This enhancement ensures Azure APIM discovery works reliably across different RBAC scoping strategies while respecting customer security boundaries.

NG Production Release Update - APIsec_cloud_7.1.1.0 ( January 16, 2026 )​

This release delivers targeted improvements that help security teams discover, test, and govern APIs more accurately, automate securely at scale, and reduce noise during access validation. It introduces an API discovery workflow that guides teams to build a complete and reliable API inventory using browser traffic, source code, or automated pipelines, ensuring APIs are identified as they actually exist before testing begins.

In addition, the release includes greater RBAC testing control, deterministic credential selection for BOLA scenarios, programmatic authentication management via application scopes, team-based access via API Tokens, and support for confidential instance-level headers. Together, these updates address common enterprise challenges such as incomplete API visibility, session-sensitive endpoints, scalable integrations, and sensitive data handling, making API security testing more predictable, reliable, and aligned with real-world operational needs.

Guided API Discovery Workflow

We have introduced a guided API discovery workflow designed to help administrators, application owners, and security teams build a complete, accurate API inventory without guesswork or trial-and-error. Instead of forcing you down a single path, the platform starts by understanding your reality—how your applications are built, what access you have, and which tools you can realistically use.

Exclude Specific Endpoints from RBAC Testing

If you manage APIs with session-sensitive endpoints, such as logout, token revocation, or session invalidation, you can now exclude those endpoints from RBAC access checks.

Previously, RBAC testing evaluated every configured endpoint. For some APIs, this meant that logout endpoints were executed during access checks, unintentionally invalidating sessions mid-test and causing unrelated endpoints to appear inaccessible. This made RBAC maps inaccurate, misleading, and time-consuming to validate.

Deterministic Credential Selection for BOLA Create Scenarios

Testing BOLA vulnerabilities in real-world APIs often requires creating resources with the correct identity, especially in multi-tenant or role-segmented environments. This update gives you explicit control over which credential is used to create the initial resource in a BOLA create scenario.

Previously, the platform automatically selected a creator credential. In APIs where payloads, headers, or parameters include user- or tenant-specific identifiers, this could lead to inconsistent results or failed scenarios simply because the wrong credential was used.

Manage Authentication Programmatically Using Application Scopes

If you rely on automation or CI/CD pipelines, you can now create, update, list, and test authentication credentials using API Tokens, governed by existing application-level scopes.

Authentication is essential for running meaningful security scans, yet until now, managing credentials often required manual UI interaction. This enhancement enables secure, scoped automation without introducing new or confusing permission models.

Team-Based Access via API Tokens

For organizations structured around teams rather than individual applications, integrations can now operate at the team level rather than per application.

Confidential Instance-Level Headers

Some APIs require mandatory headers, such as API keys, for all requests, even during unauthenticated scans. You can now mark instance-level headers as confidential, ensuring sensitive values remain protected while still enabling accurate security testing.

Bug Fixes & Reliability Improvements:

• OAuth2 Authentication Test URL Accuracy

  Resolved an issue where the Test Authentication results for OAuth2 displayed an incorrect authentication URL due to authentication resolution failure. The platform now consistently shows the actual endpoint used during token resolution, ensuring users can accurately validate and troubleshoot authentication flows without confusion.

• MuleSoft Integration Stability Improvements

  Enhanced MuleSoft API onboarding to intelligently fall back from FAT-OAS to standard OAS when FAT-OAS is unavailable. This fix addresses onboarding failures experienced by some customers and ensures that APIs can be reliably discovered and registered across different MuleSoft configurations.

• Reload Spec Endpoint Deduplication

  Corrected an issue where Reload Spec did not properly handle endpoint group duplication. Reloading specifications now behaves as expected, removing obsolete endpoints without introducing duplicates and keeping application inventories clean and consistent.

• Hosted Agent Security Hardening

  Applied additional security improvements to the Hosted Agent to align with security best practices. These changes enhance the overall security posture without impacting existing workflows.

This release delivers a set of enhancements and fixes focused on secure onboarding, access governance, and testing accuracy. Authentication handling has been improved with automatic extraction of authentication credentials from Postman Collections, greater control over authentication selection during Dry Runs, and clearer validation outcomes to prevent misleading test results.

Access management has been strengthened through multi-user application access controls, enabling administrators to manage permissions at scale with better visibility and flexibility. RBAC-related improvements enhance both the accuracy of access validation and the clarity of security findings.

Operational reliability has also been improved through fixes to endpoint detection, expanded activity logging for automated onboarding, improved execution logs, and tighter security controls across UI and authentication workflows. Together, these updates reduce manual overhead, enhance trust in scan results, and reinforce the platform's overall security posture.

1. Automatic Authentication Extraction from Postman Collections

Onboarding APIs from Postman Collections is now faster and more streamlined. The platform automatically extracts authentication details from a Postman Collection and configures them during application onboarding, significantly reducing manual configuration and setup time.

• What's supported:

  • Basic Authentication and OAuth (Client Credentials grant type only) are automatically detected and configured after the instance is created.
  • Multiple authentication configurations defined in a Postman Collection are extracted and configured for the same application.
  • If Basic Authentication credentials are defined directly in request headers, they are recognized and configured as Basic Authentication in APIsec.
  • If a Bearer token or any other authentication header is present in the request headers, it is captured and configured using the "API Key" authentication type.

• Custom authentication handling: More complex authentication flows—such as multi-step token generation or substituting response values into headers other than Authorization —require Custom Authentication.

  • For these cases, a custom authentication chain is automatically created within the same application, rather than at the tenant level, keeping the configuration scoped and easier to manage.

• Improved Postman Collection retention:

  • APIsec now retains a copy of the Postman Collection in its workspace regardless of how it is onboarded —via URL or integration.
  • Previously, collections were stored only when onboarded through a file. With this enhancement, all Postman-based onboardings preserve the collection for future reference.

This update simplifies Postman-based onboarding while improving traceability, reusability, and long-term management of authentication configurations.

2. Multi-User Access and Permission Management

APIsec now makes it easier for administrators, application owners, and collaborators with edit access to review and manage which users or teams can view or edit applications. Permissions can be updated, and access can be revoked as needed.

• What's new:

  • Bulk User Assignment: Add multiple users to an application in a single action.
  • Clear Access Visibility: View a complete list of users and teams that have access to an application, along with their assigned permission levels.
  • Flexible Permission Control: Update permissions dynamically—switch a user's permissions between View and Edit access as needed.
  • Easy Access Removal: Remove users and teams access from an application when needed.

3. Authentication Selection for Dry Runs

Dry-run testing at the endpoint level is now more precise and transparent. Users can explicitly select the authentication credential to use when executing a dry run, giving them complete control over how endpoints are validated. Previously, dry runs automatically used any available credentials, which often resulted in non-working or unauthorized credentials being applied. This led to misleading results and made it difficult to determine whether failures were caused by authentication issues or by the endpoint payload.

• What’s improved:

  • Explicit Authentication Control: Select a specific, authorized credential to execute a Dry Run against a chosen endpoint.
  • Accurate Results: Dry Runs now reflect the API's actual behavior with the intended authentication, avoiding false negatives caused by invalid credentials.
  • Clear Visibility: Instead of marking endpoints as “ready for deep coverage” without context, the platform now shows detailed results from the Dry Run.
  • Enhanced Debugging: Users can review the authentication request details, including the request URL, headers, body, response code, and response body, to quickly identify successful responses, bad requests, or unauthorized access.

These improvements make Dry Runs more reliable, easier to debug, and far more effective for validating authentication before running full scans.

Bug Fixes

1. Improved RBAC Assertion Visibility

RBAC assertions now clearly explain how each role is expected to behave for a given endpoint and how the API actually responds, making authorization outcomes easy to interpret.

For each role tested, the assertion explicitly describes:

• Expected Access — whether the RBAC configuration allows or denies access to the endpoint.
• Observed Behavior — the actual response returned by the API.
• Security Outcome — whether the behavior is compliant or indicates a potential privilege escalation.

What's fixed:

• Complete Role Coverage: All roles evaluated during RBAC testing are now included in the scan result assertions and associated vulnerabilities.
• Accurate Test Log Representation: Each test log represents a unique role-based access check for an endpoint. When multiple roles fail, all corresponding test logs are now correctly marked as failed, instead of flagging only the first failure.

Impact:

This approach provides a per-role, per-endpoint explanation of authorization results, allowing users to clearly distinguish between allowed access, correctly blocked access, and unexpected access that represents a security risk.

2. Browser Bolt OAS Endpoint Detection

What’s Fixed:

Resolved an issue where OpenAPI specifications generated via Browser Bolt were onboarded successfully but displayed “No Endpoints Detected.” Endpoints defined in Browser Bolt–generated OAS files are now correctly parsed and surfaced after onboarding.

Impact:

Applications onboarded through Browser Bolt are now fully testable immediately, eliminating the need for manual verification or re-importing specifications.

3. RBAC Map Loading in Chrome

What’s Fixed:

Resolved a Chrome-specific issue where RBAC maps failed to load when configurations contained more than 20 roles.

Impact:

RBAC maps now load reliably in Chrome regardless of role count, allowing users to review and validate complex RBAC configurations without browser limitations.

4. Comprehensive Activity Logs for Auto-Onboard

What’s Fixed:

Corrected inconsistencies where Auto-Onboard events were not consistently captured in Activity Logs across multiple gateway integrations.

Impact:

Activity Logs now reliably record Auto-Onboard actions for all supported gateways, providing complete visibility into automated API discovery and registration.

5. Execution Log Completeness

What’s Fixed:

Resolved an issue where execution logs were missing descriptive details during scan analysis.

Impact:

Execution logs now provide clearer context, making it easier to understand scan behavior, analyze results, and troubleshoot issues.

6. SSO Sign-Out Configuration (Cognito)

What’s Fixed:

Fixed an issue where Allowed Sign-Out URLs were not automatically configured when creating a new App Client in Amazon Cognito.

Impact:

SSO sign-out now works as expected by default, preventing logout issues and ensuring a smoother authentication experience.

7. MuleSoft Connected App Support for Business Units

What’s Fixed:

Resolved an issue where APIsec could only discover and onboard APIs from the root MuleSoft organization when using a Connected App with client credentials. Previously, if a Connected App was authorized at a Business Unit level, API discovery failed, potentially causing internal server errors.

APIsec now correctly honors the scope of the access token issued by MuleSoft, aligning with MuleSoft’s access model.

Impact:

• APIs managed under child Business Units can now be successfully discovered and onboarded.
• Root-level authorization is no longer mandatory when valid Business Unit–scoped credentials are used.
• The Business Unit hierarchy—from the root organization down to the authorized Business Unit—is now correctly recognized and displayed.

This fix removes a critical onboarding blocker for enterprises using hierarchical MuleSoft organizations and enables broader adoption for customers with complex Business Unit structures.

Security Fixes

1. Clickjacking Vulnerability Resolved

What’s Fixed:

Addressed a Clickjacking vulnerability that could allow unauthorized UI interactions through embedded or framed content.

Impact:

This fix strengthens UI security and prevents unintended manipulation of the application, aligning with standard web security best practices.

"Note: The Browser Bolt has now been published to the Chrome Store. A few minor refinements are still required in the AI agentic flow, which are currently in progress and scheduled to be incorporated and released next week."

NG Production Release Update - APIsec_cloud_6.12.1.0 ( December 12, 2025 )​

This release includes updates across usability, automation, and platform reliability. It adds support for downloading OpenAPI specifications from applications, bulk management of instance-level parameters via CSV, and incremental UI workflow improvements.

The release also includes bug fixes, updates to spec parsing, clearer GraphQL error messages, expanded activity logging for automated API onboarding, and several operational changes related to reporting, cleanup, and system consistency.

Download OpenAPI Specifications (OAS) from Applications You can now download the OpenAPI Specification (OAS) for any application directly from the platform, a feature customers frequently request for quick access to the exact spec used during onboarding.

Here's how it works:

• Applications initially registered with an OAS will provide the specification for download.
• Applications onboarded via a Postman Collection are automatically converted to OAS, and the converted version is available for download.
• If an application's OAS has been reloaded multiple times, the latest version currently reflected in the application is what you will receive.

Coming soon: the ability to download an OAS including manually added endpoints.

Bulk Upload & Download of Instance-Level Parameter Values (CSV Support)

We have added new capabilities that make managing instance-level parameter values faster and far more convenient. With this enhancement, you can:

• Bulk upload instance-level parameters using a CSV file.
• Download existing instance-level parameter values, making it easy to preserve them before reloading a spec—particularly useful when choosing not to retain parameters during a spec reload. Additional improvements include:
• If an endpoint's request body contains null values, the platform will automatically substitute values from the instance-level parameters (if available).
• When instance-level parameter values are intentionally set to null, they are now correctly interpreted as null — not as the string "null".

These enhancements streamline large-scale parameter management and reduce manual cleanup after spec updates.

UI Improvements

Application Launch Routing: When an application is opened using an application/{applicationId} URL, users are now automatically redirected to the corresponding instance page. The system appends instances/{instanceId} to the URL to ensure a valid landing page.

If multiple instances exist in an application, the first available instance is selected by default. This prevents errors caused by missing or null instance IDs and provides a smoother navigation experience.

Improved Application List Navigation & Usability

Applications now load automatically in the list view, providing a clearer, more complete view of each application and its associated instances. We have also improved usability in the Applications list by enabling the right-click context menu, allowing users to copy URLs or open applications in a new tab.

Consistent Top Navigation Bar

The top navigation bar has been standardized across all main menu items, ensuring a consistent look and behavior throughout the application for a smoother user experience.

Bug Fixes & Improvements

1. OAuth2 Credential Stability - Fixed an issue where OAuth2 password values were unintentionally overwritten when updating advanced authentication properties.

2. BOLA Scenario Execution Reliability - Resolved a regression that prevented resource identifiers from being correctly substituted during BOLA dry runs, which caused scenarios to fail during testing and activation. The fix has been validated across affected use cases to ensure consistent behavior.

3. Swagger 2.0 Spec Parsing Improvements - Addressed an issue where body parameters were duplicated when multiple content types were defined in a Swagger 2.0 specification. The parser now correctly handles numerous content types without creating redundant parameters or sending duplicate request payloads.

4. Expanded Activity Logs for Auto-Onboard - Activity Logs now fully capture Auto-Onboard events for Azure API Management, Postman, and SwaggerHub integrations. This provides clearer visibility into when APIs are automatically discovered and onboarded.

5. Improved GraphQL SDL Upload Error Feedback - When GraphQL application creation fails during SDL file upload, the UI now surfaces clear error messages explaining the failure and highlighting any discrepancies detected in the SDL file, instead of returning a generic error state.

Security Categories Improvements

• Asymmetrical Assertions for Injections and SSRF

  • We have introduced several improvements to make injection and SSRF testing more efficient and accurate.
  • Earlier Detection: Injection tests are now executed even before authentication is configured, allowing vulnerabilities to surface much earlier in the API onboarding process. These checks are now included in the unauthenticated scan.
  • Iteration Optimization: The number of iterations is now capped at 100 when dealing with endpoints that have a large number of parameters, improving performance without reducing coverage.
  • Reduced False Positives: If a time-based injection is detected during an iteration, the system now performs an additional validation pass to confirm the finding and avoid false positives.

  These enhancements provide faster, more reliable detection for injection and SSRF vulnerabilities across your APIs.

• Error-Based Injection Detection

  • We have strengthened our injection testing capabilities by adding support for Error-Based Injection Detection. During review, we found a gap where error-based database injections were not being flagged, especially when backend systems leak database errors. This could lead to missed vulnerabilities and false negatives.
  • To address this, we have designed and documented an error-based detection blueprint that targets these scenarios. With this enhancement, whenever a test triggers a server error that does not occur during a dry run, the platform now raises an informational detection indicating that the API may be vulnerable to injection attacks.

• Enhancements to Broken Authentication and Token-Based Categories:

  • We have improved the heuristics used to identify unauthorized responses, which should provide more accurate results, especially for GraphQL scenarios. Additionally, the none and nonE token tests now include checks using unsigned tokens, expanding coverage for token validation weaknesses.

Enhanced Search for MuleSoft API Gateway

Finding the right APIs in MuleSoft just got easier. We have expanded our MuleSoft API Gateway integration to support backend-powered search, improving both speed and accuracy when locating APIs. Since MuleSoft does not offer a native REST API for search, we implemented a new workflow behind the scenes:

• The platform now retrieves the available APIs from MuleSoft, temporarily stores the data in memory, and applies the search filters on the backend to return precise, relevant results.

This enhancement replaces the previous UI-only search and provides a more reliable, scalable way to explore your MuleSoft API inventory.

Policy Model Enhancements

We have refined how compliance status is displayed within the Policy Model's Applications tab. The platform now presents each component's status more clearly, along with the specific reasons behind compliance or non-compliance. This makes it easier to understand what needs attention and why.

UI Improvements

• Scan Details Page: The Scan Details page has been redesigned for better readability and a more organized presentation of results.
• Enhanced Toast Messages in Teams: We have improved the toast notifications that appear when performing actions in Teams, making them more informative and easier to understand.

Bug Fixes & Improvements:

1. Improved Scan Stability with RBAC
   • Scans will no longer fail due to invalid or expired RBAC credentials. Previously, if any RBAC credential was invalid, the scan would stop immediately. We now validate only the primary credential used to run the scan, allowing RBAC tests to continue with whichever valid credentials are available.
2. Azure DevOps Bulk Closure Fix for User Stories
   • User Story work items in Azure DevOps now close correctly when vulnerabilities are marked as false positives or auto-resolved through Threat Detections.
3. Correct Access for Team Owners
   • Team Owners now consistently have edit access to all applications assigned to their team, ensuring proper permissions and control.
4. Reliable Spec Reload for Large APIs
   • Large specifications—now reload correctly when using options like “Retain existing endpoint configurations” or “Retain existing parameter values.”
5. Persistent Authentication Form Data
   • Re-selecting the same authentication method no longer clears previously entered data in the Authentication Credentials form.
6. Accurate RBAC Status Indicators
   • The App Modal now shows RBAC status updates immediately, accurately reflecting when RBAC configuration is in progress.
7. Clear Credential Name for BOLA Escalation Findings
   • When privilege escalation is detected during BOLA testing, the correct credential name is now displayed instead of showing a UUID, making results easier to understand.
8. Correct Handling of Body Parameters
   • Body parameters that include query fields are now updated correctly without overwriting other existing parameters.
9. Activity Logs for MuleSoft Auto-Onboard
   • Activity Logs now fully capture Auto-Onboard events from the MuleSoft API Gateway. This fix ensures complete visibility into when new APIs are detected and onboarded, giving teams clearer insight into automated actions happening behind the scenes.

NG Production Release Update - APIsec_cloud_6.11.1.0 ( November 17, 2025 )​

We are excited to introduce the latest updates that enhance automation, strengthen security controls, and deliver a smoother experience for APIsec customers.

Extending AWS Integration: Auto-Reload Spec & Automatic API Onboarding Now Supported using Central ARN

Building on our support for AWS API Gateway integration using Cross-Account Role Assumption, we are further expanding its capabilities. You can now take advantage of Auto-Reload Spec and Automatic API Onboarding across all connected AWS accounts, making ongoing API management more streamlined and smoother.

Auto-Reload Spec

• Automatically keeps your API specifications up to date with weekly scheduled reloads.
• Preserves your configured endpoints, parameters, and schema settings to avoid overwriting customizations.
• Automatically disables the reload schedule if an API is unlinked.

Automatic API Onboarding

• Automatically detects and registers new or previously unregistered APIs.
• Performs weekly onboarding in batches of up to 50 APIs.
• Provides complete visibility into onboarding actions through activity logs.

Azure DevOps Integration: Now Supporting User Story Work Items

We have expanded our Azure DevOps (ADO) integration to allow creating User Stories directly from the platform. Many teams depend on User Stories as their main work item type for Agile processes, and this update ensures smooth alignment with those workflows.

Feature Highlights:

• You can now configure the integration to create User Stories in addition to Issues.
• User Stories generated through APIsec will appear directly on your ADO boards, allowing smoother collaboration with engineering teams.
• All standard details are included automatically, ensuring tickets are ready for immediate triage.
• Existing configurations for creating issues continue to work as expected, preserving backward compatibility.

Enhancing Custom Authentication

We have made significant upgrades to Custom Authentication, providing users with more flexibility, visibility, and control when working with complex authentication flows. These enhancements make it easier to debug, test, and transform data during token generation.

• Auto-Generating Random UUIDs

  • Some authentication flows require a unique identifier (UUID) to be generated and submitted to obtain an authentication token (for example, a cookie or custom token).
  • The system now automatically generates a RANDOM_UUID that remains constant throughout the execution of the authentication chain, thereby ensuring consistency and facilitating the management of these complex multi-step authentication processes.

• Introducing two new transformation keywords: find and replaceall to help extract, modify, and refine authentication data dynamically:

  • find – Uses regular expressions (Regex) to locate and capture specific values within a string. It also supports indexing to capture a particular occurrence of a match (e.g., the second or third instance).
  • replaceall – Replaces one string with another and supports Regex for advanced matching. You can also use an empty replacement string to remove unwanted characters entirely.

• Additionally, multi-step transformations are now supported, so you can apply multiple transformation functions recursively to fine-tune how data is extracted and prepared for subsequent steps in the authentication chain.

• Improved Test Authentication Visibility

  • The Custom Authentication Test experience has been enhanced to provide complete transparency into the authentication flow. Each step now includes detailed logs showing how tokens are generated, how data is transformed, and how it is passed through the authentication chain.
  • This improvement makes it easier to debug issues, understand complex authentication sequences, and ensure every part of the flow works as expected.

Security Enhancement: Strengthening Authentication Token Scope

• As part of our continued commitment to platform security, we have implemented a key enhancement that tightens the scope and utilization of authentication tokens generated within the platform.
• This update ensures that each token is strictly bound to its intended context and permissions, minimizing the risk of privilege escalation or account hijacking.
• This improvement further strengthens the platform's overall security posture and aligns with best practices for token-based authentication systems.

Enhancing Teams: Expanded Control for Administrators and Team Owners

• We have introduced a new improvement to team management that gives Administrators and Team Owners greater control over their teams. They can now remove applications from a team directly, making it easier to maintain clean, accurate, and aligned team assignments with organizational needs.
• This enhancement streamlines team maintenance, ensuring that application access remains properly managed as teams evolve.

Improved Trial Experience for PLG Users: Streamlined Access and Upgrade Path

We have refined the 30-day trial experience to provide more precise boundaries and a smoother path to upgrading:

• Controlled Feature Access: Trial users can now view applications and run authenticated or unauthenticated scans, except for RBAC and BOLA scans, which remain restricted.
• Limited Configuration Access: After the trial period ends, configuration changes, such as adding new configurations or updating existing settings, are limited to ensure the platform remains within the intended evaluation period and to prevent continuous free testing beyond the trial.

Issue Fixes:

• Protected Sensitive Fields in Custom Authentication: Updating custom authentication will no longer overwrite sensitive values. Existing credentials and secure fields are now preserved unless explicitly changed.
• Improved Monthly Activity Report Accuracy: The Monthly Activity Report in the Security Hub has been updated to reflect more accurate timelines for the application creation.
• Prevented Parameter Overwrites During Spec Reload: Reloading an API specification will no longer overwrite existing DTO parameters that already exist in other endpoints.

We are excited to share the latest updates designed to make the APIsec customers' experience smoother, safer, and more powerful. Here’s what’s new:

AWS API Gateway Integration via IAM Role

APIsec now supports connecting to AWS API Gateway using IAM Roles in addition to IAM User credentials. Previously, integration required providing long-lived IAM User credentials, which raised concerns for some customers about credential management and security best practices. To address this, APIsec now enables a role-based integration that aligns with AWS security guidelines. With this enhancement, customers can securely provide a Role ARN (roleArn) instead of IAM User credentials. APIsec assumes the specified IAM Role to access the AWS API Gateway and perform read operations securely using temporary credentials.

• Key Benefits:

  • Eliminates the need for long-lived IAM User credentials
  • Follows AWS-recommended security practices using temporary credentials
  • Simplifies permission management with Role-based access control

Revoke Risk Acceptance on Vulnerabilities

Changed your mind about a vulnerability you previously accepted? No problem.

• Owners, admins, and collaborators with edit access can reactivate vulnerabilities that were previously marked as 'Risk Accepted'.
• If you’re using an issue tracker, the linked ticket will automatically update with comments — including who marked and revoked the decision.

Reload GraphQL Specs with SDL

GraphQL users, this one’s for you! You can now reload API specifications using GraphQL SDL.

• Upload your updated SDL file to refresh an existing spec.
• Choose whether to keep or remove:
  • Endpoints missing from the spec
  • Existing parameter values
  • Schema configurations

Auto-Reload Specification via API Gateways

The Auto-Reload Spec capability, first introduced for AWS API Gateway on August 22, 2025, followed by supporting Azure API Management (APIM) and MuleSoft API Gateway on September 04, 2025 is now extended to support SwaggerHub API Gateway.

• Supported Gateways: AWS API Gateway, Azure API Management (APIM), MuleSoft API Gateway and SwaggerHub.
• Scheduling: Reload jobs can be scheduled weekly, with support for more frequent synchronization planned for future releases.
• Configuration Options: Users can configure whether to retain or remove:
  • Endpoints missing from the specification
  • Existing parameter values
  • Schema configurations
• Reliability: Maintains accurate and up-to-date API specifications while minimizing the risk of data loss.
• Access Control: Only Administrators and Application Owners with gateway access can schedule this task.
• Unlinking Behavior: If an API is unlinked from its application, the scheduled synchronization is automatically disabled.
• Activity Logging: All scheduled activity statuses are recorded in the activity logs.

RBAC Retest for Individual Endpoints

No more re-running entire RBAC flows just to test new endpoints.

• You can now re-run access checks on a single endpoint.
• Previously discovered permissions stay intact — so you only validate what’s new.

Admin Controls for Teams and Business Units

Administrators now have more flexibility:

• Manage team members directly (not just team owners).
• Delete Business Units when needed.

Fixes & Improvements

• Postman Collection Onboarding: Fixed a confusing error message that showed onboarding as failed even though the application was successfully created.
• Empty Parameter Deletion: You can now delete empty parameters without errors.
• BOLA Dry Run: Supporting Multiple Resource Ids in the Select Resource attack scenarios in BOLA.
• UI – Application List View: Resolved an issue with pagination where data was displayed in the wrong columns.

NG Production Release Update - APIsec_cloud_6.10.2.0 ( October 21, 2025 )​

We have rolled out a series of enhancements that strengthen automation, performance monitoring, and security controls across the platform.

Auto-Reload Spec & Automatic API Onboarding — Expanded Gateway Coverage

We are excited to share that Auto-Reload Spec and Automatic API Onboarding now fully support SwaggerHub API Gateway and Postman API Platform, completing coverage across all major API gateways — Microsoft Azure APIM, MuleSoft, and AWS API Gateway.

• Auto-Reload Spec

  • Keeps API specs in sync through scheduled reloads (currently weekly).
  • Retains endpoint, parameter, and schema configurations as configured.
  • Automatically disables sync tasks if an API is unlinked.

• Automatic API Onboarding

  • Detects and registers new or unregistered APIs automatically.
  • Supports weekly onboarding in batches of 50.
  • All onboarding activities are logged for visibility.

These enhancements simplify API management, reduce manual effort, and keep your inventory current.

Test Authentication — Improved Visibility & Debugging

We have enhanced the Test Authentication workflow to make it more transparent, informative, and easier to troubleshoot

• Feature Highlights:

  • Clear visual indicator when authentication begins.
  • Displays actual request and response from the authentication step.
  • Provides detailed failure responses for easier debugging.
  • Sensitive information, such as passwords and secrets, remains masked.

These improvements remove the guesswork from authentication testing, making it faster and easier to identify and resolve issues.

Private URL Registration via Hosted Agent

• APIs can now be registered using Private OAS URLs through a hosted agent.
• The system will automatically detect and retrieve the OAS content if the agent is available and active, reducing manual steps.

RBAC Enhancements

We have refined RBAC behavior to improve stability, visibility, and control.

• Automatic deletion of scan configs when an RBAC identity is removed.
• Added missing logs after retest permissions.
• Improved RBAC dry run scan tracking and orphan identity handling.
• Enhanced coalescing of RBAC scan configs.
• Fixed allowing retest permissions after uploading an RBAC Map.
• Introduced RBAC Map Upload and Download for easier management.

OAS Enhancements & GraphQL Data Type Support

• Improves handling of GraphQL Array and BigDecimal datatypes in API definitions.
• Remove excessive data from API specifications to ensure successful application registration.

Scheduling Fix

• Corrected the Next Execution Date display for API Gateway Auto-Onboard and Auto-Reload jobs, ensuring accurate scheduling visibility.

NG Production Release Update - APIsec_cloud_6.10.3.0 ( October 31, 2025 )​

We have rolled out a series of enhancements that strengthen automation, performance monitoring, and security controls across the platform.

Policy Model

We are excited to introduce the Policy Model, a new framework that helps administrators set, enforce, and monitor security standards across all applications in their organization.

This model provides structure and visibility to key security expectations, including how frequently applications should be scanned, which test categories must be covered, and how teams should respond when vulnerabilities are discovered. By defining these controls upfront, organizations can ensure consistent security practices, identify gaps early, and keep remediation efforts aligned with SLAs and compliance goals.

Here is a breakdown of the core components included in this release:

• Scan Schedule: Specify how frequently applications need to be scanned — every few hours, daily, weekly, or monthly — to ensure continuous security coverage and timely detection of new risks.
• Test Scope: Execute the required test categories for each application. Applications must run these selected category types to remain compliant with their assigned policy.
• Response Actions: Define how newly discovered vulnerabilities should be handled. For example, automatically creating a ticket when a vulnerability meets a defined severity level ensures issues are appropriately tracked and routed to engineering teams for resolution.
• Risk Mitigation: Ensure vulnerabilities are remediated within the SLA defined in the policy. To stay compliant, active vulnerabilities must be resolved within the established timelines, thereby reinforcing accountability and reducing long-term exposure.

The Policy Model provides a consistent and repeatable way to manage security expectations at scale, helping teams stay aligned, proactive, and entirely in control of their application security posture.

Simplifying AWS API Gateway Integration with Cross-Account Role Assumption

Managing APIs across multiple AWS accounts just got a whole lot easier. Previously, organizations needed to create and maintain separate integration connections for each AWS account when onboarding APIs to the APIsec platform. This approach proves effective for smaller organizations. However, enterprises may have multiple accounts, which can result in higher operational overhead and more complex management for multi-account environments.

With this release, we are introducing support for AWS Cross-Account IAM Role Assumption (also referred to as Central ARN). This enhancement streamlines the onboarding and management process for organizations that use multiple AWS accounts. Here is how it works:

• A single Central Role ARN is configured in the APIsec platform.
• That role can securely assume Child Roles across multiple AWS accounts.
• This allows customers to create a single integration connection that grants access to APIs across all linked AWS accounts, eliminating the need for separate connections or repetitive setup.
• IAM role creation in child accounts is centrally managed, allowing the entire process to scale seamlessly as your AWS environment grows.

The central ARN provides a more straightforward integration, reduced manual configuration, and lower operational overhead for large multi-account AWS deployments.

Coming soon:

The ability to schedule weekly Auto-Onboarding with an exclusion option, allowing customers to automatically discover and register new APIs while skipping sample or test apps.

New Security Categories to Strengthen Authentication Exploitation Testing

We have expanded our security testing coverage with new categories that focus on authentication-related vulnerabilities. These additions enhance detection for potential weaknesses in API authentication flows and token management.

• OIDC Discovery: Checks if your API exposes an OpenID Connect (OIDC) discovery endpoint that could unintentionally disclose sensitive configuration details.
• JWKS Discovery: Validates whether your API exposes a JSON Web Key Set (JWKS) discovery endpoint, which could reveal cryptographic keys if misconfigured.
• Algorithm Confusion: Detects if your API is vulnerable to token forgery attacks through algorithm confusion, where mismatched signing and verification methods could be exploited.

These categories strengthen your API's defense against authentication exploits and ensure comprehensive coverage of identity and token security risks.

Authentication Enhancements Several improvements have been made across multiple authentication workflows to improve reliability and accuracy:

• Bearer Token Authentication: Now supports additional body parameters during tests and scans. Previously, URLs containing colons (:) were misinterpreted as delimiters, impacting token resolution. This has been fixed.

• Custom Authentication:

  • Improved null pointer exception handling.
  • Added support for specifying the Content-Type in custom authentication chain extraction rules to override incorrect content types returned by the authentication endpoint, preventing authentication failure errors.
  • Fixed missing response body details in authentication test results.

Spec Parsing Improvements

The Application Registration and Reload Spec processes now handle incomplete or malformed schemas more gracefully. The resolver sanitizes and corrects schema definitions before registration, preventing errors caused by undefined or null response types. This enhancement ensures smoother onboarding and reduces failures during spec reloads or updates.

RBAC Access Check improvements:

The RBAC dry run process now supports refresh tokens. If a token expires during a dry run, the system automatically generates a new one using the TTL value in the authentication configuration.

Security Upgrade

A new hosted image has been published to enhance security updates and ensure continued compliance with best practices.

Bolt Integration - Import Parameters and Payloads

We are pleased to announce the release of the first phase of Bolt Integration, designed to simplify and reduce application onboarding friction.

• Seamless Import: Parameters and payloads captured directly from the client's web applications using the Bolt plugin can now be imported into the platform.
• Hydration of Endpoints: By uploading a Bolt file under the application’s Endpoints tab, the platform automatically matches and hydrates endpoints with real data once confirmed.
• Faster Onboarding: This capability minimizes manual configuration, ensures endpoints are functional and test-ready, and expands security coverage.
• Future Roadmap: Additional enhancements, including direct Bolt-to-NG integrations, are planned to further improve the onboarding experience.

Auto-Reload Specification via API Gateways:

The Auto-Reload Spec capability, first introduced for AWS API Gateway on August 22, 2025, is now extended to support Azure API Management (APIM) and MuleSoft API Gateway.

• Supported Gateways: AWS API Gateway, Azure API Management (APIM), MuleSoft API Gateway.
• Scheduling: Reload jobs can be scheduled weekly, with support for more frequent synchronization planned for future releases.
• Configuration Options: Users can configure whether to retain or remove:
  • Endpoints missing from the specification
  • Existing parameter values
  • Schema configurations
• Reliability: Maintains accurate and up-to-date API specifications while minimizing the risk of data loss.
• Access Control: Only Administrators and Application Owners with gateway access can schedule this task.
• Unlinking Behavior: If an API is unlinked from its application, the scheduled synchronization is automatically disabled.
• Activity Logging: All scheduled activity statuses are recorded in the activity logs.

SSO User Visibility for Team and Application Sharing:

We have introduced support for listing SSO Users within the platform to simplify team management and application sharing.

• Unified User Listing: Both SSO and Non-SSO users are now visible when managing users in a tenant.
• Team Assignment: Administrators and Team Owners can add SSO users directly to Teams, ensuring proper access alignment.
• Application Sharing: Applications can now be shared seamlessly with SSO users, eliminating prior limitations where only manually created users were listed.

Manage Teams:

We are extending the team management capabilities beyond creation and updates to include team deletion.

• Scope of Access: Only Administrators who are designated team owners are permitted to delete a team.
• Governance and Security: This restriction ensures that team removal is handled with appropriate oversight, preventing accidental or unauthorized deletions.
• Consistency: The enhancement builds on the existing team management framework to provide a complete lifecycle for team administration.

NG Production Release Update - APIsec_cloud_6.9.2.0 ( September 19, 2025 )​

Instance-Based Custom Headers for Reachability & Endpoints

• Configuring headers just got a whole lot easier. Instead of re-entering the same header repeatedly at the endpoint level, you can now set Instance-Based Headers directly within your API.

• With this update, you can:

  • Add custom headers from App Config - Manage Headers and apply across all endpoints in an instance.
  • Fine-tune control – Apply headers only to the endpoints you choose.
  • Support reachability checks – Mark headers to be included when testing the reachability of your instance URLs.

Automatic API Onboarding - Azure API Management (APIM) and Mulesoft API Gateway

• The Auto-Onboard capability, first introduced for AWS API Gateway on June 16, 2025, is now extended to support Azure API Management (APIM) and Mulesoft API Gateway.

• The Auto-Onboard feature streamlines API onboarding by automatically detecting and registering unregistered APIs from AWS API Gateway. This ensures that all APIs, including newly published ones, are consistently onboarded and tested for vulnerabilities with minimal manual effort.

• Feature Highlights:

  • Automatically discovers and registers unregistered APIs in AWS API Gateway.
  • Admins can choose to onboard all available APIs or only those published after a specified date.
  • The system checks weekly for unregistered APIs and onboards them in batches of 50.
  • Any remaining APIs are automatically included in the next scheduled batch.

View and Revert False Positives

• Application Owners, Administrators, and collaborators with edit permissions can now:

  • View all vulnerabilities that were previously marked as false positives.
  • Revert them back if they were incorrectly flagged.

  Key Capabilities:

  • Audit Tracking - See who marked a vulnerability as a false positive and when it happened in the vulnerability details.

  • Seamless Issue Tracker Integration

    • When a vulnerability is marked as a false positive, linked tickets in Jira or Azure DevOps are automatically closed.
    • When a False Positive is revoked, the platform re-runs the test.
      • If the vulnerability is reproducible → it is restored as Active, and a new ticket is logged.
      • If not reproducible → it is marked as Resolved, and the linked ticket stays closed.

Team Member Management for Role Users

• Enterprise customers just got more flexibility in managing their teams!

  • Role Users as Team Owners: If an Administrator assigns you as a Team Owner, you can now add teammates, remove them, or adjust their permissions (choose between Edit or View).
  • Administrator control: Admins retain the ability to reassign or change Team Owners whenever needed.
  • Clear boundaries: While Team Owners can manage members, creating or deleting entire teams is still reserved for Administrators only.
  • Safer team deletion: Only Administrators can now delete teams. To prevent accidents, the system requires you to type the team’s name before confirming deletion.
  • Accountability: Team deletion is logged in the Activity Logs.

Security Hub Reports with PDF Attachment

• The monthly email reports just got an upgrade! We have added the Security Hub PDF as an attachment.
• It provides direct access to vulnerabilities and security insights without logging into the platform.

Improvements & Fixes

• We’ve been busy smoothing out a few rough edges and polishing the experience. Here’s what has been improved:

  • Threat Detections Pie Chart : Previously displayed the count of Vulnerable Endpoints, it now correctly shows the count of Open vulnerabilities.
  • Scan Setup Simplified : Scans no longer require testing all authentications before starting. Less friction, faster testing.
  • Endpoint Test Execution Error Handling : When a test is skipped due to a Timeout or Server error, it displays an appropriate message instead of failing without context and showing “Internal APIsec Error.”
  • Azure DevOps Test Connection : Trying to connect with invalid credentials prevents logging the user out.
  • Security Hub Tile Fix : The “Tests Run” metric was mistakenly showing All Time instead of Monthly Statistics. That’s now corrected.

  ---

This release includes feature enhancements, customer-driven improvements, and key bug fixes to improve platform usability, security, and transparency.

Enhanced Reachability Checks with Header Support for Private APIs

• Building upon the Smarter Reachability Checks, the platform now supports custom headers during reachability testing for Private API instances.
• Some instance URLs require specific headers to validate access. Users can now include these headers to ensure successful reachability checks. Once reachability is confirmed, scans can run as expected.
• If the same headers are also required for the API endpoints, they can be added through parameter configuration (if defined in the OAS) or via authentication credentials when the values are consistent across all endpoints.

GraphQL Fixes and Enhancements

• Improved validation: Invalid types are now blocked, and default values can’t be null.
• Stability improvements: Addressed issues with injections, SDL splitting, and value entry in certain edge cases.
• Improved consistency: Variable names and types remain unchanged when using example queries.

Improved Scheduled Scan Reliability

• We have addressed two separate issues affecting scheduled scans:

  • Users can no longer delete authentication credentials tied to scheduled scans, preventing unexpected scan failures.
  • If a scheduled scan is skipped due to a previously deleted authentication, the reason will now appear clearly in the activity logs.

Expanded Risk Acceptance Support for Tracked Issues

• Introduced the ability to create tickets for vulnerabilities marked as Risk Accepted, the platform now also allows users to mark a vulnerability as Risk Accepted even if a ticket already exists in the issue tracker.

Enhanced Access Control for Shared Applications

• Access controls have been strengthened for users with "View" permissions when applications are shared. This update ensures users can no longer access restricted resources beyond their intended scope. A few remaining edge cases involving integrations are being addressed in upcoming updates.

OAS Parsing Improvements

• This fix eliminates the need to convert curly double quotes within JSON string values, preventing data corruption during schema parsing.

Direct Access to Scan History and Details

• Scan History and Scan Details now have dedicated URLs that support direct access. Refreshing the browser on these pages no longer redirects users to the Application Details page.

HubSpot Integration for Support Tickets

• We have updated our support ticket system to integrate with HubSpot.
• While the "Contact Support" experience remains seamless within the platform, tickets are now routed through HubSpot to streamline tracking and response management.

Improved Tooltips for Scheduled Scans

• Tooltips in the Scheduled Scan section have been updated to clarify how profiles are used when creating or updating scans.

NG Production Release Update ( August 08, 2025 )​

This release includes feature enhancements, customer-driven improvements, and key bug fixes to improve platform security, usability, and transparency.

Stronger Email Deliverability

We have implemented several measures to improve email reliability, particularly for corporate recipients where strict filters often block legitimate communication.

• Safer links: Replaced raw.githubusercontent.com links with apisec.ai domain links to avoid being flagged by spam filters.
• Aligned sender domains: Updated sending addresses to trusted domains such as noreply@apisec.ai or support@apisec.ai. In some cases, a subdomain like mailer.apisec.ai is used and aligned with Amazon SES identity to improve trust scores.
• Better formatting: All emails now include a plain-text version alongside HTML for greater compatibility.
• Improved images: Switched from SVG to PNG for broader email client support.

Email Auto-Suggestions for Team Management

• When creating or updating teams, administrators will now see auto-suggestions for email addresses as they type when adding owners or members.
• This reduces typing effort, minimizes errors, and speeds up team setup.

Full Compatibility with OpenAPI 3.1.x

• We have expanded our platform’s support for OpenAPI Specification (OAS) 3.1.x, ensuring all native features, such as const, oneOf, anyOf, nullable, example, and enhanced JSON Schema compatibility.

GraphQL Fixes and Enhancements - We have addressed a few nagging issues in GraphQL, including:

• Fixed JSON values not saving or displaying correctly.
• Prevented the loss of original input parameters in the table when updating a query document.

RBAC Role Exclusion Bug Fix

• Excluding a role from RBAC not only removed it from scans but also deleted it from its associated authentication. This behavior has been corrected so that exclusion only affects RBAC dry runs and scans, leaving the authentication intact.

Easier Team and Business Unit Browsing

• Administrators can now view Teams and Business Units in alphabetical order on the Browse Teams page, making navigation quicker and more intuitive.

NG Production Release Update ( August 14, 2025 )​

This release delivers feature enhancements, customer-driven improvements, and key bug fixes to boost platform flexibility, reliability, and user experience.

Token Placement in the Body Parameters

We have enhanced Custom Authentication to support placing authentication tokens inside request body parameters, in addition to headers and cookies.

• A new "BODY" placement type allows inserting static or dynamic tokens into body parameters.
• This enhancement is compatible with complex, multi-step authentication flows, including chained requests, cookie handling, and extracting values from headers or response bodies.
• The test service identifies these parameters and excludes them from injection or manipulation testing.

Reload Specification with API Gateway

Users can now fetch and update API specifications directly from AWS API Gateway.

• Applications are automatically linked with the gateway connection and the OpenAPI Specification (OAS) when an API is registered directly from the API Gateway.
• In the upcoming sprint, applications linked to a gateway connection can be scheduled for automatic OAS reloads.
• Additionally, APIs onboarded via an API Gateway can now be reloaded using a file or URL when the gateway connection is offline.

Update and Delete Users

The APIsec platform now supports updating and deleting user accounts, in addition to user creation by Tenant Administrators.

Enhancements to OAS Specification Error Logging

The OAS spec resolver service now logs exceptions in the activity log when issues occur during API onboarding, enabling users to review detailed error information.

GraphQL Improvements

The following issues and improvements have been delivered.

• Ensures GraphQL selection sets always include at least one field.
• Supports JSON type for GraphQL input parameters.
• Preserves JSON parameter values during ADD operations by preventing variable map mutations.
• Mark operations as authenticated unless otherwise specified.

SwaggerHub API Gateway Integration

Improved error messaging for more effective troubleshooting of integration issues.

API Token Permission Handling

Corrected the handling of API token permissions to ensure proper access control

Instance URL Reachability Testing

Resolved an issue with the display of required headers.

NG Production Release Update ( August 22, 2025 )​

This release introduces advanced automation, enhanced usability, and targeted security improvements, empowering teams to maintain up-to-date specifications, streamline user and vulnerability management, and gain clearer insights into API security posture.

Auto-Reload Specification via API Gateway:

Building on the Reload Specification via API Gateway capability introduced on August 14, 2025, the new Auto-Reload Spec feature enables scheduled synchronization of API specifications, ensuring accuracy with minimal manual effort.

• Supported Gateway: AWS API Gateway (initial release).
• Scheduling: Reload jobs can be scheduled weekly. More frequent synchronization options will be introduced in future updates.
• Configuration Options: During reload, users can configure whether to retain or remove:
  • Endpoints missing from the specification
  • Existing parameter values
  • Schema configurations
• Reliability: Helps keep API specifications current while avoiding accidental data loss.
• Access Control: Only Administrators and Application Owners with API Gateway access can schedule this task.
• Unlinking Behavior: If an API is unlinked from its application, the scheduled synchronization is automatically disabled.
• Logging: Scheduled activity status is available in the activity logs.

Security Hub .

The Security Hub has been enhanced with a modernized user interface to improve clarity in presenting API security metrics and trends.

• UI Improvements: Cleaner presentation of security metrics and insights.
• Removed Dropdown: The applications dropdown, previously limited to 10 selections, has been removed as it did not reflect real-world usage.
• Upcoming Enhancements: Future releases will introduce filtering by Business Units and Teams for more meaningful analysis.
• Data Refresh: Metrics continue to update every 10 minutes using efficient caching.
• Role-Based Access:
  • Administrators view metrics across all onboarded applications.
  • Users view metrics only for applications they are authorized to access.

Bulk User Creation via CSV Upload

Administrators can now add multiple users simultaneously by uploading a CSV file, reducing the need for repetitive manual entry for Non-SSO Organizations.

• Sample Template: A downloadable CSV template with required headers (Display Name, Email, Role) is available on the Add Users page.
• Preview & Validation: Uploaded files are parsed into a table for review. Mandatory fields are validated, missing values are flagged, and issues such as invalid or duplicate emails are highlighted.
• Inline Editing: Errors can be corrected directly in the table without requiring a new upload.
• Smart Controls: The "Add Users" button remains disabled until all validation issues are resolved.
• Submission & Tracking: After submission, a confirmation toast appears, and progress is visible in the Activity Logs.

Controlled Auto-Sync for Vulnerabilities for Azure DevOps and Jira:

• Previously, all vulnerabilities discovered during scans were automatically synchronized with Jira or Azure DevOps, regardless of severity. This often resulted in excessively low-priority tickets for developers.
• With this update, synchronization can now be controlled by severity level. Users may specify which vulnerabilities are pushed into their issue tracker, allowing development teams to focus on resolving the most impactful issues first.

GraphQL Improvements

Enhancements to GraphQL scanning and validation include:

• Comprehensive capture of all arguments (required and optional) in variables/config, with proper tracking of optional fields such as enums.
• Resolution of incorrect readiness checks in GraphQL operations.
• Support for custom scalar types in UPDATE requests.

Applications List View

A new tabular Applications List View has been introduced, enabling users to view:

• Applications with their corresponding instances
• Endpoints
• Last scan date for each instance
• Vulnerabilities
• Endpoints at risk

Other Updates

• Users are now redirected to the login page when their refresh token expires.
• Several additional issue fixes and security enhancements have been applied to improve overall system reliability.

Here's a quick look at what's landed recently:

New Token-Based Test Categories

• We have expanded our test coverage to identify vulnerabilities related to authentication tokens. These new categories help uncover issues in token usage and handling that may otherwise go unnoticed.

Wildcard Support for Dynamic Certificate Resolution

• Managing certificates across multiple hosts is now way easier. You can now use * as a wildcard when mapping certificates to hosts. This means that one certificate can cover multiple domains, unless a specific one is explicitly defined.

Custom Authentication V2

• We can now configure the authentication flows through the UI.
• We have tested it against real customer scenarios, including complex multi-step workflows, and made necessary enhancements to support them.

Scan Execution Improvements

• Resolved issues with scheduled scans not triggering reliably.
• Enhanced handling of authentication-related errors in long-running scans is clearly displayed.
• Fixed an edge case where scanned endpoints were missing from the scan results, despite being executed.

Enhanced Test Visibility

• Logs are now split between Dry Run and Test Execution, making debugging easier.
• Logs now display the credentials and roles used in each test.
• Scan History includes stats for Tests Generated, Executed, and Skipped.
• Reasons for passed and skipped tests are now logged to support auditability.

API Token Scope Correction

• We have addressed issues related to API token scoping to ensure secure and consistent access control enforcement across the platform.

Spec Reload Enhancements

• The Reload Spec process is now asynchronous, reducing timeout errors during high-volume spec updates.
• Improved stability and error-handling make OAS reloads smoother.
• We now prevent overwriting instance-level parameters during spec reloads.
• Next up: safeguarding endpoint-level parameters and payloads.

Smarter Token Refresh

• For short-lived tokens, we have added the ability to define token renewal frequency per credential in OAuth, Bearer Token, and Custom Authentications.

Enhanced Instance Management

• We can now assign a custom name to each instance for better identification.
• Instances can be deleted independently without affecting the associated application or other instances.

We have rolled out several security enhancements, squashed bugs, and polished the UI in both Cloud and On-Premises versions.

NG Production Release Update ( July 03, 2025 )​

Introducing Custom Labels in Issue Tracker Integrations (JIRA & Azure DevOps)

• Some of our customers route issues to different teams based on label values in their project boards. While APIsec NG already included standard labels like APIsec, CVSS scores, and security categories, it didn't allow users to define their own—until now.

  What's new:

  • An optional Labels field is now available when configuring issue tracker integrations.
  • Supports single-word entries (e.g., AppSec).
  • Allows multiple labels separated by commas (e.g., AppSec,HighPriority,Internal).
  • This update enables smoother team routing and better integration with our customers existing workflows.

Choose a Private Hosted Agent for Scans

• Until now, the platform has automatically selected the hosted agent (APIsec or Private) based on instance reachability. This usually works, but not always.

• In cases where APIs are technically reachable yet block external requests (think trusted IP policies), this led to unnecessary roadblocks.

  What's improved:

  • You can now manually select the Hosted Agent when running ad-hoc or scheduling scans. This gives teams more control, especially in secure environments where trusted IPs are required for access.

Boomi API Gateway Integration v1

• We are excited to roll out V1 support for Boomi API Gateway!

• You can now integrate APIsec NG with Boomi API Gateway using a Platform API Token, making it easier to fetch and register OpenAPI specs for your applications.

  What you need to know:

  • This version supports authentication via platform tokens and requires application credentials to retrieve the OAS file.
  • Broader credential support and deeper integration options are planned for upcoming releases.

Streamlined "Contact Support" Experience

• Users can now submit tickets or share feedback directly from the platform, without being redirected to the PLG (cloud.apisecapps.com) tenant.
• The "Contact Support" button automatically sends an email and opens a ticket with our Support Team.

NG Production Release Update ( July 14, 2025 )​

We have rolled out several updates to make vulnerability management more intuitive across the board. Here's a quick tour of what's new:

Auto-Close Resolved Tickets

• Linked issue tracker tickets in Jira or Azure DevOps will now automatically close when their corresponding vulnerabilities are resolved in APIsec. There's no need for any manual action.

Bulk Ticket Creation from Threat Detections

• Enabled support for creating multiple tickets directly from the Threat Detections tab, allowing ticket creation per vulnerability group based on Category and Test Type.

Quick Actions for Vulnerabilities in Scan Details

• Introduced an Actions menu for each vulnerability listed in the Scan Details page, enabling users to:
  • Mark it as a False Positive
  • Accept the Risk (temporarily)
  • Create a Ticket in the issue tracker
  • Export Logs to review vulnerabilities
  • Export cURL to reproduce the issue locally

Smarter Reachability Checks

• If a private-hosted agent can't reach the hostname of the instance URL, the platform now tests the full endpoint path. This provides a more accurate assessment of reachability

Availability of Hosted Agent Information on the Scan Details Page

• Running scans with a private-hosted agent now displays the hosted agent name used, helping track the agents and simplify debugging.

NG Production Release Update ( July 21, 2025 )​

We are pleased to announce the following updates and improvements, designed to enhance platform functionality, integration capabilities, and user control. Here's a quick tour of what's new:

Reload Specification with Retain Options

• Users can now reload an API specification while preserving missing endpoints, existing parameter values, and schema configurations that are not included in the specification. This enhancement ensures that customized test inputs are preserved during specification updates, thereby improving consistency and minimizing the need for rework.

Support for Azure DevOps Integration via Service Principal

• In addition to existing support for Personal Access Tokens (PAT), the platform now supports Azure DevOps integration using Service Principal authentication. This provides a more secure and scalable option, particularly for organizations with strict credential management policies.

Profile Management for Scans

• We have introduced the ability to create and manage scan profiles. These profiles can be selected when initiating ad-hoc or scheduled scans, allowing users to configure scan behavior more effectively across different testing scenarios.

Auto-Ticketing Enhancements

• Enhancements have been made to the auto-closure of tickets in integrated issue trackers when vulnerabilities are marked as resolved.

Improvements in Security Tests & GraphQL

• Added SDL Validation and more injection strategies for GraphQL

NG Production Release Update ( July 25, 2025 )​

Here's what's new and improved in our platform this week:

Automatic Ticket Creation for Active Vulnerabilities

• Building upon our July 21 release, whenever we integrate an issue tracker into an application's instance, any vulnerabilities detected in subsequent scans will now automatically create tickets, ensuring that no issue is overlooked once a risk emerges.

Bulk False Positive Marking with Smart Sync Handling

• Building on the bulk ticket creation update from July 15, you can now select multiple vulnerabilities and mark them as false positives at once. If those vulnerabilities were already linked to an issue tracker, the related tickets will be automatically closed.

Handling of Large Dry Run Responses

• Previously, huge endpoint responses from Dry Run results were flagged as inconclusive. We have now optimized how these are processed by compressing the response data, ensuring that permissions are evaluated accurately, regardless of the payload size.

Spec Reload Functionality Updates

• This update corrects issues with schema consistency that sometimes occurred during manual additions.

Ticketing Now Available for Risk Accepted Vulnerabilities

• When a vulnerability is designated as "Risk Accepted" due to the implementation of mitigating controls, we now provide the capability to generate tickets for these "Risk Accepted" findings. This facilitates developers in planning a permanent resolution when appropriate.

Here's a quick look at what's landed recently:

Azure DevOps Integration Enhancements

• Azure DevOps can now be configured as an issue tracker.
• Support for specifying Area Path has been added, allowing users to define a hierarchical project structure for issue reporting.

Team Management & SSO Improvements

• Enabled support for creating teams and sharing applications with SSO users.

  Resolved Issues

  • Fixed problems with team visibility and application assignment for SSO users caused by incorrect identity mapping and duplicate references.
  • Users creating a new team are now automatically added as team members.
  • SSO users can now reliably view their teams under “My Teams” and assign applications via the “Share with Team” option under Administration.

Hosted Agent & Scheduled Scans

• Fixed: Scheduled scans using private hosted agents were failing if the Instance URL was only reachable internally.

• Improved SSRF Handling: A null pointer exception caused by an unreachable security-categories.apisec.ai SSRF URL is now handled gracefully.

• Customers using private agents should ensure that they have outbound access to this domain.

• Hosted agent-related security improvements.

Vulnerability Insights

• Added Last Found Date for active vulnerabilities.
• Added Resolution Date for resolved vulnerabilities.
• Included CWE IDs within security categories to improve visibility in the /detections endpoint.

RBAC Visualization Updates

• Introduced RBAC layouts in both Consolidated and Accordion views to clearly represent access scopes.

User Experience Improvements

• Dry Run Logs: These are now displayed separately for improved traceability.
• Loader Added: On the scan details page for better feedback during load time.
• Pagination: Implemented on the scan history page for performance and usability.

Reload Spec

• We've made several key enhancements to the Reload Spec feature for better accuracy and user experience, including Automated API Onboarding
• The spec reload process is now asynchronous, reducing timeout errors. Next, we will address preventing parameter overwrites.

Automatic API Onboarding

The Auto-Onboard feature streamlines API onboarding by automatically detecting and registering unregistered APIs from AWS API Gateway. This ensures that all APIs, including newly published ones, are consistently onboarded and tested for vulnerabilities with minimal manual effort.

Feature Highlights:

• Automatically discovers and registers unregistered APIs in AWS API Gateway.
• Admins can choose to onboard all available APIs or only those published after a specified date.
• The system checks weekly for unregistered APIs and onboards them in batches of 50.
• Any remaining APIs are automatically included in the next scheduled batch.

Platform Integrity & Logging

• Activity logs now maintain both user and system actions.
• Resolved discrepancies in vulnerability count on the scan details page.

OAS Validation & Sanitization

• Improved sanitization of invalid datatypes, circular references, and other inconsistencies in OAS files during application registration.
• Prevented registration of applications with invalid OAS.

Authorization Improvements

• Displayed accurate authorization state on the endpoint details page.
• Introduced a flexible custom authentication mechanism to support complex authentication flows involving multiple endpoint calls, headers, cookies, and tokens.
• Enabled token refresh support during long-running scans to ensure authentication stays valid throughout the execution window.

Hosted Agent Management

• Users can now view accurate hosted agent state and delete agents as needed.

IDP Initiated Flow

• Added support for IdP-initiated login flows using Okta, allowing seamless access to the platform directly from the Okta dashboard.

We’re excited to announce the latest updates in this release!

Authetication

• Building on the Test Authentication feature to validate credentials before running a scan, we are now adding two key improvements:

• Enhanced Debugging with Request Headers and Body

  • We have now added this crucial information to help troubleshoot authentication issues more effectively.

• Customizable Authentication Endpoint Selection

  • Users can now replace the default system-selected endpoint with a preferred one, ensuring more accurate token validation.

Manually add endpoints to an existing application, allowing users to:

• Test endpoints on the fly, even when API definitions are not yet ready to test.
• The platform generates an OAS specification dynamically by adding endpoint details and reloading the spec.
• Reload Spec parses the information, detects the sensitivity of endpoints and parameters, and generates variables, payloads, and parameters.

Enhanced UX

• Enhanced the platform experience by integrating inline videos for better guidance and usability. Additionally, we have enriched our documentation, including comprehensive release notes, to ensure clarity and ease of access to important updates.
• We have added in-context learning videos. This will help users have a quick view of what a use case is about before they try it out.
• We are launching the documentation portal for our platform. From the left navigation, users can now access the self-help portal to read product documentation, release notes, FAQs, and other important information for product use.

NG Production Release Update (April 15, 2025)​

We're excited to announce that several key enhancements have moved from Building to Done!

Certificate Support

• We've introduced support for certificate-based authentication during API testing. Customers can now securely upload client certificates to their Hosted Agent or its EFS-mounted volume within their environment. During scans, the Hosted Agent will automatically select and use the appropriate certificate based on the instance hostname, seamlessly working alongside token-based authentication configured in the APIsec platform.

Hosted Agents on the Windows platform

• We now support Hosted Agents on the Windows platform using Docker Desktop for Windows. This enables teams operating in Windows environments to deploy and run scans on private instances using the APIsec Hosted Agent for Docker on Windows.

Optimized Detections Data Skimming

The detections endpoint now excludes unnecessary data when listing vulnerabilities, significantly reducing payload size. This enhancement improves load times and prevents the browser from becoming unresponsive, particularly for APIs with many endpoints or a long vulnerability history.

OpenAPI Specification 3.1.0 Support

• We're excited to announce that the APIsec platform supports OAS 3.1.0 and gracefully handles any inconsistencies in parameter data types and examples within the spec files.

Several key improvements and bug fixes to enhance the accuracy and reliability of parameter and payload handling within the platform

• Custom header values defined in Global and Endpoint-based Variables are now correctly substituted during dry-run and scan execution.
• We can delete a header or query parameters without encountering validation errors, even if their value is null.
• Boolean values are now displayed correctly in the parameters configuration view.
• The system now allows payloads to be added to endpoints without predefined request bodies.
• The generation of faker data has been disabled and replaced with default and example parameter values to increase the likelihood of receiving successful responses from endpoints.

We've made several key enhancements to the Reload Spec feature for better accuracy and user experience

• Postman Collection Handling: Previously, attempting to reload a spec using a Postman Collection would silently fail but still return a success message. We've now added appropriate error handling and clear messaging to inform users that Postman Collections are not supported for the Reload Spec operation.

• YAML Support: Reload Spec now supports API specifications with the YAML extension via file upload and URL input.

• Rollback on Failure: We've addressed an issue where failed reloads could result in missing endpoints and parameters due to partial updates. The system now reverts to the previous stable state in the event of a failure to prevent any data loss or inconsistencies.

Several key improvements across security categories like CORS and Injection have been made to increase the accuracy and clarity of detections

• CORS Detection Enhancements: CORS issues are now reported as informational by default, and will only be escalated to a security detection if all of the following conditions are met:

  • The origin is explicitly allowed
  • Access-Control-Allow-Credentials is set to true
  • Authentication methods like cookies, Basic Auth, or Digest Auth are in use
  • The request method is GET or POST

• Injection Testing Fixes:

  • Fixed an issue where multiple test iterations reused the exact injection string, limiting test coverage. Unique payloads are now used adequately across iterations.
  • Resolved a bug in SQL Injection testing where only a single character of the injection string was sent, due to incorrect attribute mapping. Full payloads are now correctly passed and evaluated.

  Several UI enhancements have been implemented to improve clarity and user experience

  • Endpoint Risk Calculation: The risk is calculated only for High and Critical vulnerabilities, for a meaningful risk score.
  • Accurate Last Scan Date: The Last Scan Date displayed on the application’s instance tile now accurately reflects the most recent scan.
  • Tooltip Revamp: Tooltips across the platform have been revamped, making it easier to understand key elements at a glance.

Error Response Hardening:

• Improved security by ensuring error responses do not expose excessive information (such as internal messages, stack traces, or system details), aligning with best practices for minimizing information disclosure.

We're excited to announce the latest updates in this release!

Add Users to Tenant

• Administrators can view existing users within the tenant and invite new users. Update and delete functionalities are planned for future releases.

Reload Specification

• Users can now reload the latest OpenAPI Specification (OAS) to automatically discover new endpoints or updated schemas.

Bulk Risk Acceptance

• Users can now accept risks for multiple vulnerabilities by updating them in the Threat Detections tab.

Self-Service Endpoint Configuration

• Add new headers and query parameters.
• Update values for existing parameters.
• Update sensitivity of each individual attribute in an endpoint.
• Update Authentication requirement for individual endpoints
• Specify an example request body to hydrate parameters for a successful interaction with the endpoint.
• This self-service configuration gives customers more flexibility and control over their endpoints.

Dry Run Workflow Decoupling

• This feature helps customers understand how well each endpoint is prepared for security coverage and provides a path for the customers to take actions in the product to progressively improve readiness.Dry runs now happen before scans, speeding up value delivery. When onboarding an application, we now check endpoint readiness and sensitivity. Readiness status appear in the Endpoints View, and upcoming releases will let customers configure endpoints for progressive coverage for deeper category tests.

Global Hosted Agents

• Tenant Admins now have the ability to share Hosted Agents across all users in the tenant. This centralizes the creation and management of agents, enabling the scanning of the entire tenant application footprint.

Delete Hosted Agents

• As a follow-up to February’s Hosted Agent release, we’ve introduced the ability to delete existing hosted agents. Only the creators of agents can perform this action, and only deactivated agents can be deleted to prevent unintended impacts on application scans.

SSO Improvements

• We’ve made several improvements to the self-service SSO setup:
  • Previously, customers could only set up SSO once and needed the CS team for any subsequent changes. With this update, customers can now reconfigure SSO settings independently.
  • We’ve also adjusted the configurations to support a wider range of IDP versions.

Operational Improvements

• We continue to enhance the backend to support more efficient operations. we focused on:
  • Improved throughput and capacity utilization during inter-service communication.
  • Fixed an RBAC bug that incorrectly marked inaccessible endpoints as vulnerable.
  • Resolved BOLA issues that prevented scans in other categories if BOLA was in scope.
  • Made data transfer improvements in the Scan Orchestrator, enabling scans for larger applications.

We're excited to announce that several key enhancements have moved from Building to Done!

Single Sign-On (SSO) with Azure AD (SAML)

• Allowing users to log in with their enterprise credentials.
• Supports Active Directory Groups, enabling role-based access control based on group membership.
• Users can initiate login directly from the application using SP-Initiated flow.

Security Hub: Automated Monthly Email Reports for:

• Subscribed Users – Opt-in users will receive the report directly in their inbox.
• Recipients added by Tenant Admins – Admins can add recipients who are not part of the platform to receive reports.

Test Authentication Before Running Scans

• Test and Save Authentication feature validates credentials and helps prevent scan failures caused by authentication resolution issues.
• Allowing endpoint selection during test authentication and notifying users upon authentication failures are planned for future releases.

Improved Application Deletion Handling

• The system now handles application deletions asynchronously across multiple instances, scans, and vulnerability data.

Enhanced Documentation in Security Coverage

• Each Security Category in the Security Coverage tab now includes detailed descriptions, impact insights, and reference links for better clarity.

AI-Powered Endpoint Scan Summary

• AI-generated summaries highlight passed and skipped tests for quick insights into scan results.

Instance State Persistence

• Prevents users from landing on a random instance after a browser refresh, ensuring continuity.

Scan Details Page Performance Improvements

• Optimized for small and medium-sized APIs for faster loading times and improved usability.
• Additional backend enhancements for large APIs are planned for future releases.