Skip to main content

September

· 19 min read

NG Production Release Update - APIsec_cloud_7.9.5.0 ( September 29, 2026 )​

This release improves endpoint configuration by letting you manage identically named parameters independently, streamlines the Zendesk connection experience, and improves the reliability of finding-related actions by directing users to the Detections and Vulnerabilities views. It also refreshes the API reference Postman collection with updated sample values and adds Activity Logs endpoint documentation.

Improvements​

Endpoint Parameters with the Same Name Now Work Independently​

Problem​

  • Parameters with the same name in different parts of a request, such as the URL path and request body, could share only one value. Editing one instance could unintentionally overwrite the other.

Solution​

  • Repeated parameter names are now tracked and managed independently, allowing each instance to have its own value.

Impact​

  • Set different values for parameters with the same name across the request path, body, and other locations
  • Editing one parameter no longer overwrites another
  • No action required; the improvement applies automatically to existing and new endpoints

Scan Detail — Finding Actions​

Problem​

  • Actions such as marking a finding as a False Positive, accepting its risk, or creating a ticket could intermittently fail when performed from the Scan Detail page, particularly for findings from older scans.

Solution​

  • These actions are now available from the Detections and Vulnerabilities views instead of the Scan Detail page, where they continue to work as expected.

Impact​

  • Avoids intermittent failures when managing findings from older scans
  • Keeps finding management and ticket creation available from the Detections and Vulnerabilities views
  • Export as cURL and Export Logs remain available on the Scan Detail page

Zendesk Connection Flow Improvements​

The Zendesk connection flow now provides a clearer authorization experience, with the authorization step opening in a separate window and displaying confirmation before proceeding. Users receive an explicit success or failure message when the connection process completes.

Impact​

  • Clarifies the authorization process
  • Provides immediate feedback on connection success or failure
  • Existing Zendesk connections remain unaffected

API Reference Collection Refresh​

The published Postman API reference collection now uses refreshed, generic placeholder values in its sample requests and includes the previously missing Activity Logs endpoint documentation.

Impact​

  • Provides cleaner, reusable sample data
  • Improves API documentation coverage for Activity Logs
  • No changes to API behavior; documentation updates only

NG Production Release Update - APIsec_cloud_7.9.4.0 ( September 25, 2026 )​

This release expands APIsec’s integration and automation capabilities with Zendesk issue-tracker support, flexible application and instance metadata tags, and API access to Activity Logs using Personal Access Tokens. It also improves external-ID onboarding reliability and strengthens security-test accuracy across Dry Run, JWT forgery detection, and scan detail reporting.

What's New​

Zendesk Issue Tracker Integration​

Zendesk is now supported as an issue tracker through OAuth 2.0. When configuring the integration, you can choose which Zendesk status—Solved, Closed, Pending, or Hold—counts as resolved.

Why this matters​

  • Enables automated vulnerability ticketing in Zendesk
  • Aligns ticket resolution with your team's actual Zendesk workflow
  • Provides actionable field-level errors when connection or ticket creation fails
  • Keeps automatically created tickets consistent with manually created tickets through matching category and severity tags

Application and Instance Metadata Tags​

Metadata tags now support both fixed-option (ENUM) and free-text fields. Applications can also be tagged during registration, and you can add or remove individual options from an existing tag without replacing the entire option list.

Why this matters​

  • Supports custom attributes that don't fit a predefined list
  • Allows applications to be categorized during onboarding
  • Makes maintaining tag options safer and easier

Activity Logs via API and Personal Access Tokens​

You can now retrieve Activity Logs programmatically using a Personal Access Token. Admin-scoped tokens can access tenant-wide activity, while users can retrieve activity for applications they are authorized to access.

Why this matters​

  • Enables automated collection of activity history for audit and compliance workflows
  • Provides programmatic access without requiring manual UI review
  • Maintains the same role-based access boundaries used by the platform

Issue Fixes​

Application Lookup by External ID​

Problem​

After an application was deleted, reusing its external ID could result in stale lookup results or prevent the application from being re-onboarded.

Solution​

External-ID lookups now correctly recognize deleted applications, and re-registering a previously used external ID automatically reclaims the stale reference.

Impact​

  • Ensures accurate external-ID lookups after application deletion
  • Allows applications to be re-onboarded using a previously used external ID

Improvements​

Improved Security Test Accuracy​

  • Dry Run Testability
    • Endpoints that return HTTP 200 but contain an application-level error are now correctly identified as not testable, preventing deeper tests from running against requests that were not actually accepted.
  • JWT Forgery Coverage
    • JWT forgery tests now also cover endpoints that return HTTP 404 for unauthenticated requests, improving coverage for APIs that intentionally hide resource existence.
  • Scan Detail Log Selection
    • Dry Run entries in the scan request/response log now match by their unique identifier, preventing occasional mismatches in the displayed results.

NG Production Release Update - APIsec_cloud_7.9.3.0 ( September 24, 2026 )​

This release expands APIsec’s authentication resolution capabilities with Private-Key Client Authentication support, introduces a Global Viewer role for organization-wide read-only visibility, and simplifies endpoint configuration with bulk Require Authentication controls. It also improves ticket synchronization, Dry Run reliability and diagnostics, and report generation.

What's New​

Private-Key Client Authentication (private_key_jwt)​

APIsec now supports private-key JWT client authentication (RFC 7523) for OAuth 2.0 client-credentials flows, via Custom Authentication Chains. Instead of a shared client secret, the client authenticates to the token endpoint with a signed JWT assertion—an asymmetric credential. A new pre-request signing operation produces the assertion from a key supplied as a chain parameter (never stored in the chain). This lets scans authenticate against identity providers that require public/private-key client authentication, and lets customers move off symmetric secrets to key-pair credentials whose private key never leaves their control.

Why this matters​

  • Asymmetric client credentials, not shared secrets. private_key_jwt (RFC 7523) is a major OAuth client-authentication method — the client proves itself with a signed JWT instead of a client secret, matching providers that mandate key-pair client authentication.

Configuration: The Custom Authentication Guide covers setting up private-key JWT client authentication via a Custom Authentication Chain.

Global Viewer Role​

A new Global Viewer role provides read-only access across all applications in the tenant. Unlike the standard Viewer and User roles, which are limited to applications shared directly or through teams, Global Viewers can view applications across the organization without edit permissions.

Why this matters​

  • Provides organization-wide visibility without granting modification access
  • Simplifies access for auditors and other read-only stakeholders
  • Maintains separation between visibility and application management

SSO setup: mapping a group to the Global Viewer role is documented for Azure Entra ID — see Azure Entra SSO configuratio. Okta and Ping guides will follow soon.

Bulk Update — Endpoint's Authentication Requirement​

You can now enable or disable Require Authentication for multiple endpoints at once from the Endpoints tab. Bulk changes are recorded in the user activity report. Existing onboarding behavior remains unchanged.

Why this matters​

  • Reduces the effort required to configure authentication requirements across large APIs
  • Makes endpoint-level authentication configuration faster and more consistent
  • Provides an audit trail for bulk configuration changes

Improvements​

Azure DevOps and Jira Ticket Synchronization on Host URL Changes​

Updating an instance's host URL now closes tickets associated with the previous host and recreates them against the new host.

Impact​

  • Keeps external issue trackers synchronized with the updated API environment
  • Prevents tickets from remaining associated with an outdated host URL

Dry Runs Use the Instance's Known-Good Hosted Agent​

Dry Runs now execute through the instance's healthy configured Hosted Agent instead of falling back to another agent.

Impact​

  • Improves Dry Run reliability for Private Hosted Agent deployments
  • Ensures validation uses the same trusted scan environment configured for the instance

Clearer Dry Run Failures​

Dry Run results now provide actionable failure messages when an agent returns a non-success response with an error message. Responses that return a success status but indicate that the request was rejected are now correctly classified as Not Testable.

Impact​

  • Makes Dry Run failures easier to diagnose
  • Improves the accuracy of endpoint testability results

More Reliable Report Generation​

Report generation now retrieves detection data more efficiently and provides an actionable reason when it can't generate a report. Impact

  • Improves report-generation reliability
  • Provides clearer guidance when report generation fails

NG Production Release Update - APIsec_cloud_7.9.2.0 ( September 18, 2026 )​

This release expands Automated Authentication Discovery to support additional enterprise identity providers, introduces the next-generation Browser Bolt v2 with social login support, and adds Jira Story creation for vulnerability tickets. It also delivers reliability and security improvements for Private Hosted Agents, along with GraphQL scanning and reporting enhancements.

What's New​

More Identity Providers for Automated Authentication Discovery​

Automated Authentication Discovery now supports AWS Cognito, Keycloak, Duende IdentityServer, and WSO2 Identity Server, in addition to the existing Auth0, Okta, PingOne, and IBM identity providers.

APIsec can identify these providers even when they are not explicitly named in the API specification and build the authentication flow by following the application's redirect.

Why this matters

  • Enables authenticated scanning across more enterprise identity platforms
  • Reduces manual authentication configuration during API onboarding
  • Helps customers get authenticated scans running with less setup

Note: For WSO2 Identity Server, APIsec uses the opaque access token issued for the target API rather than the identity token.

Browser Bolt v2​

Browser Bolt v2 improves browser-based API onboarding, including support for capturing authenticated sessions through social login.

Why this matters

  • Makes it easier to onboard APIs that require browser-based authentication
  • Supports applications using social login during authentication
  • Improves the capture experience for authenticated APIs

Availability: Browser Bolt v2 is ready for publication to the Chrome Web Store and will be available for installation once the store review is complete.

Create Jira Issues as Stories​

Jira integrations now support Story as an issue type in addition to Bug and Task. The selected issue type is validated against the target Jira project when testing the connection.

Why this matters

  • Gives teams more flexibility to align APIsec tickets with their Jira workflow
  • Prevents ticket-creation failures caused by unsupported issue types
  • Confirms that the selected issue type can be created before vulnerabilities are reported

Improvements​

New Private Hosted Agent Image — Reliability & Security Updates​

A new Private Hosted Agent image includes reliability and security improvements. Hosted-agent work can now be automatically reclaimed and redelivered when a backend instance becomes unresponsive during a scan, preventing scans from failing due to this type of backend interruption.

Why this matters

  • Improves scan reliability for Private Hosted Agent deployments
  • Helps scans continue through backend instance interruptions
  • Includes the latest security and reliability updates

Note: Customers using Private Hosted Agents should upgrade to the latest image.

OWASP Coverage Report Improvements​

Problem

The Percentage of Endpoints at Risk chart in the OWASP Coverage report could show incorrect endpoint counts and percentages, with inconsistencies between the UI and generated PDF.

Solution

Endpoint counts and percentages are now calculated consistently, and the report visualization and vulnerability-category legend have been corrected.

Impact

  • Improves the accuracy of OWASP Coverage reporting
  • Ensures the UI and PDF present consistent results
  • Provides clearer vulnerability-category visualization

GraphQL Scan Improvements​

Problem

GraphQL scans could encounter an internal APIsec error during the OIDC/JWKS authentication discovery step, and the discovery-JWKS test was missing its description.

Solution

The authentication discovery workflow has been corrected for GraphQL APIs.

Impact

  • GraphQL authentication discovery now completes successfully
  • Improves the consistency of GraphQL security testing

NG Production Release Update - APIsec_cloud_7.9.1.0 ( September 11, 2026 )​

This release expands APIsec’s security testing and enterprise workflow capabilities with new Numeric Bound Fuzzing and Monetary Integrity tests, automated authentication discovery, enhanced Jira integrations, and new FedRAMP and HIPAA/HITRUST compliance reports. It also adds read-back validation for Mass Assignment findings and improves the accuracy and reliability of authentication, parameter hydration, BOLA testing, reporting, and private Hosted Agent scan improvements.

What's New​

Automated Authentication Discovery​

When you onboard an application, APIsec now automatically determines which identity provider the API uses and builds a login for it — discovery starts automatically as soon as the spec registers, with nothing to click. The Configure Credentials card on the App Model panel drives the flow: while discovery runs, the card shows no action, and once a login is ready, the button reads Provide Credentials. Enter the account and the card moves to Completed, attaching a "Discovered login" auth set as the instance default so your next scan can run authenticated.

APIsec recognizes a provider named in the spec or discovers it by probing when the spec doesn't name one — supporting common identity providers such as Auth0, Okta, PingOne, and IBM, plus browser-based login flows. If a provider is found but no login can be built, or the credentials are wrong, the card falls back to the normal Add Authentication drawer without error — you're never left retrying.

Why this matters

  • Removes most of the manual work of configuring authentication
  • Gets scans running authenticated against common enterprise identity providers
  • Falls back cleanly to manual setup when a login can't be discovered

What to expect

  • No scan starts automatically — discovery only configures the login; running a scan is still a deliberate action.
  • Passwords are masked wherever they're shown.
  • A pending credentials prompt won't expire — respond whenever it's convenient.

New Security Test Categories — Numeric Bound Fuzzing & Monetary Integrity​

APIsec now introduces two new security tests for identifying input-validation and business-logic vulnerabilities in numeric and monetary fields.

Numeric Bound Fuzzing tests numeric fields with values outside expected boundaries to identify missing input validation.

Monetary Integrity extends this approach to financial workflows, testing whether APIs enforce valid monetary amounts and, where possible, confirming that unexpected values do not affect the underlying system.

Why this matters​

  • Identifies vulnerabilities caused by missing numeric and monetary validation
  • Helps uncover business-logic flaws that can lead to financial impact
  • Provides stronger validation of findings by confirming whether unexpected values actually affect system state

Mass Assignment — Read-Back Confirmation​

Mass Assignment testing now confirms whether an unauthorized or unexpected field actually changed system state after the request is submitted.

Why this matters​

  • Increases confidence in Mass Assignment findings
  • Distinguishes exploitable behavior from requests that are merely accepted
  • Provides stronger evidence for remediation

Choose the Jira Issue Type​

Jira connections now support Task in addition to the existing Bug issue type. You can select the issue type to create when reporting vulnerabilities, and APIsec validates the selected type against the target project during connection testing.

Why this matters​

  • Aligns vulnerability tickets with your existing Jira workflow
  • Gives teams flexibility to use Bug or Task based on their process
  • Existing Jira connections continue to use Bug by default

Note: Support for Story is coming in an upcoming release.

Map Vulnerability Metadata to Jira Custom Fields​

Jira connections now support mapping APIsec vulnerability metadata, constants, and labels to your Jira custom fields.

Why this matters​

  • Automatically populates tickets with the information your teams need
  • Aligns APIsec tickets with existing Jira workflows
  • Reduces manual ticket updates

Linking or unlinking an issue tracker from an application instance is now recorded in Activity Logs, including the connection, user, and timestamp.

Why this matters​

  • Provides an audit trail for issue-tracker configuration changes
  • Improves visibility into where and when ticketing integrations were changed

Sign in with Google​

Users can now sign in to APIsec using Google Social Login, including linking a Google account to an existing email/password account.

Availability: Live on cloud.apisecapps.com

FedRAMP & HIPAA/HITRUST Compliance Reports​

FedRAMP and HIPAA/HITRUST compliance reports are now available in production, providing the appropriate control mappings and reporting templates. Generate them alongside your other reports.

Why this matters​

  • Simplifies compliance reporting for regulated organizations
  • Presents security findings in the context of applicable FedRAMP / HIPAA-HITRUST controls

Improvements​

Comments on Jira Bulk Updates​

When APIsec updates multiple Jira issues in a single action — for example, bulk-closing findings that are resolved or bulk-changing their disposition — it now also posts the corresponding comment to each issue (the reason the finding was closed, the disposition applied, and so on).

Why it works this way — a Jira limitation: Jira's bulk update and bulk transition APIs do not allow a comment to be attached as part of the bulk operation. To make sure your issues still get that context, APIsec applies the comments as a follow-up step, adding them to each issue individually after the bulk update completes. For very large batches, this means the comment appears shortly after the status change, not at the exact same instant.

Impact​

  • Keeps Jira issues annotated with the reason behind each APIsec-driven change, even during bulk operations
  • Restores the comment context that Jira's bulk API otherwise omits
  • The earlier warning that bulk updates would not include comments has been removed

Clearer Test Credentials & Dry Run Results​

Test Credentials and Endpoint Dry Run now provide more accurate and actionable results for connectivity, authentication, and path-placeholder scenarios.

Impact​

  • Makes authentication and connectivity issues easier to diagnose
  • Reduces false reports of invalid credentials or unreachable endpoints
  • Provides clearer guidance when rate limiting is encountered

More Accurate Parameter Hydration​

APIsec now handles arrays, JSON-encoded examples, and object-schema path parameters more accurately during specification hydration. Impact

  • Reduces malformed request values
  • Improves endpoint testability and scan coverage
  • Better preserves values defined in API specifications

More Precise BOLA Testing​

Basic BOLA scenarios now use the object ID configured for each individual operation instead of reusing an ID from another operation.

Impact​

  • Improves accuracy of multi-step BOLA testing
  • Ensures each operation is tested against its intended resource

Endpoint Values Are Sent as Configured​

Values configured directly on an endpoint request body now take precedence over an instance-level Global Parameter with the same field name.

Impact​

  • Ensures endpoint-specific configurations are respected during scans
  • Provides more predictable request generation

Penetration Testing Report Downloads​

Penetration Testing Reports now generate and download more reliably for applications with large numbers of findings, with clearer feedback when generation fails.

  • Consistent "No Longer Detected" Terminology
    • Findings that are no longer observed are now consistently labeled No Longer Detected across the Dashboard, Security Hub, Developer Report, and Proof of Test.
  • Compliance reports continue to use Resolved.

Impact​

  • Provides consistent terminology across security workflows
  • Makes finding lifecycle states easier to understand

New Private Hosted Agent — Faster Scans​

A new Private Hosted Agent version is now available that runs scans faster and more reliably. It combines increased scan parallelism with memory and I/O tuning, so large, long-running scans complete substantially faster. Update your Private Hosted Agents to the latest version to benefit.

Impact​

  • Faster scan completion, especially on large or long-running scans
  • Improved reliability under heavy load
  • No configuration change required — simply update the hosted-agent image

External Ticket Closure Reasons​

When APIsec automatically closes an external ticket because a finding is resolved or marked out of scope, the ticket now includes the resolution reason.

Impact​

  • Provides better context in external issue trackers
  • Improves traceability between APIsec findings and ticket lifecycle changes

Azure DevOps — Risk-Accepted Revoke​

Revoking a "Risk Accepted" disposition now adds a comment to the linked Azure DevOps work item identifying the action, without changing the work-item state.

Browser Bolt Onboarding Improvements​

Browser Bolt onboarding now preserves custom application names, correctly identifies path parameters, and retains all endpoints from single-domain captures.

Activity Log — Vulnerability Ticket Filter​

A new Log Vuln Tickets filter is now available in Activity Logs and Task Logs. We also removed a stale Jira bulk-close warning.