Skip to main content

October

· 15 min read

NG Production Release Update - APIsec_cloud_7.10.5.0 ( October 21, 2026 )​

Search and information retrieval infrastructure​

Our customer-facing views and APIs now use a formal search service. As we onboard applications at higher volumes across almost all customers, the existing large-volume data-retrieval mechanism has reached its limits. So we added a traditional index-based search service to our product to deliver faster results and keep data response SLAs on track. This is a foundational optimization for how data flows from the database to customers.

Azure APIM - Full inventory onboarding​

Previously, our Azure APIM integrations pulled new APIs in batches of 50 per week. We have now scaled it out by removing that limit. We built this to ensure the quickest path for a new API that becomes available in Azure APIM to get onboarded into our platform, along with delta detection. Next, we'll do the same for other API gateway integrations in the coming days.

Other improvements :​

  1. Special character handling for Azure APIs: Azure API specification exports now handle download links containing special characters correctly, preventing failures caused by incorrectly parsing these links.
  2. Cleaner Scan Results for Endpoints with Unresolvable Schemas: Endpoints with schemas that cannot be resolved, for example, due to a broken $ref, are now intelligently skipped for injection and SSRF checks.
  3. More Reliable Header-Based Authentication: When an API defines an API-key-in-header security scheme, APIsec now processes it and seeds the specified header into instance requests.
  4. Clearer Scan Notification: Scan notification emails now include a scan-results summary (scan duration and start time with a clear Time zone marker), and we removed duplicate completion notifications for scheduled scans to reduce noise.

NG Production Release Update - APIsec_cloud_7.10.4.0 ( October 15, 2026 )​

This release supports per-request proof-of-possession authentication in custom authentication chains. It also strengthens private hosted agent security with a Java 21 upgrade and dependency updates, improves scan result clarity, and improves the consistency of shared dynamic values. It also improves scan visibility and operational reliability with scan completion notifications and hosted-agent downtime alerts.

What's New​

Per-Request (DPoP) Authentication for Custom Authentication Chains​

Custom authentication chains can now generate a fresh signed proof for every request, supporting APIs that require per-request proof-of-possession (DPoP-style) authentication, including certain OAuth/OIDC and signed-request configurations. A chain can generate a key during login and encrypt credential values for the target. Each scan request then carries its own signed proof.

Impact​

  • Enables scans against APIs requiring a unique signed proof per request that could not previously be authenticated
  • Binds the proof to the individual request's method, path, and access token
  • Supports multi-line sensitive chain parameters, such as private keys, with masking in the UI

Private Hosted Agent — Java 21 and Security Update​

The private hosted agent now runs on Java 21 LTS and includes dependency updates. The broker protocol has also been upgraded to v3.2. Existing connection behavior is preserved, including TLS connectivity to modern and legacy hosts using TLS 1.1/1.2, private certificate authorities, mutual TLS, and certificate matching.

Impact​

  • Moves the agent to a supported Java LTS version with updated security dependencies
  • Preserves existing TLS connectivity, certificate handling, and agent behavior
  • The update reaches each customer when they pull and redeploy the latest agent image

Hosted-Agent Down Alerts​

APIsec now sends a notification when a private hosted agent remains down beyond the configured alert threshold. The alert identifies the affected agent so an unexpected stoppage doesn't go unnoticed.

Impact​

  • Identify stopped hosted agents before they silently prevent scans from running
  • Receive one alert per downtime incident, avoiding repeated notifications for the same incident
  • Alerts clear once the agent is running again

Fixes & Improvements​

Clearer Reasons When a Test Is Skipped​

When all test vectors for an endpoint are filtered out, the scan result now explicitly shows SKIPPED and the reason instead of showing a result without an explanation.

Impact​

  • Makes it clear why an endpoint's tests were skipped
  • Helps users distinguish skipped tests from tests that failed or did not execute as expected
  • Simplifies investigation of scan results and test coverage gaps

Consistent Shared Values Across a Scan​

Shared dynamic values, such as @random.val.*, that are inherited by multiple endpoints are now resolved once per scan and reused consistently across those endpoints.

Impact​

  • Ensures related requests within the same scan use the same shared value
  • Prevents the same shared variable from resolving differently across endpoints
  • Improves consistency when testing workflows involving related API operations

NG Production Release Update - APIsec_cloud_7.10.3.0 ( October 12, 2026 )​

This release expands APIsec's authentication capabilities with support for AWS Signature Version 4 (SigV4), enabling security scans against APIs that use AWS IAM authorization. It also improves private hosted agent certificate management with wildcard and port-aware matching, while strengthening scan reliability, activity tracking, account recovery, and credential security.

What's New​

AWS Signature Version 4 (SigV4) Authentication​

You can now authenticate scans against APIs that require AWS Signature Version 4 (SigV4) signing. Configure the access key, secret key, region, and service name, and APIsec computes a valid signature for each request.

Impact​

  • Enables scanning of AWS-signed endpoints, such as API Gateway endpoints protected by IAM authorization, that previously could not be authenticated
  • Computes signatures for individual requests, accounting for query parameters and headers
  • Allows credentials to be configured once through the authentication form, validated, and stored securely

Wildcard and Port-Aware Certificate Matching for Hosted Agents​

Private hosted agents using custom certificates for mutual TLS or private certificate authorities can now match certificate mappings by domain wildcard (for example, *.example.com ) and optional port, in addition to exact host matching.

Impact​

  • A single wildcard mapping can cover multiple subdomains without requiring a separate entry for each host
  • Supports port-specific certificates, such as a distinct certificate for example.com:8443
  • Applies predictable certificate selection precedence: exact host first, followed by the most specific wildcard, with port-specific mappings preferred
  • Preserves existing behavior for exact-host configurations, requiring no changes to current setups

Fixes & Improvements​

Credentials in the Request Body No Longer Cause Scan Errors on Endpoints Without a Declared Body​

When an authentication credential is configured to be sent in the request body, and an endpoint declares no request body — for example, a POST, PUT, PATCH endpoint with no body defined — APIsec now places the credential into the request, and the scan proceeds normally, instead of causing the scan to error. For methods that cannot carry a body (such as GET or DELETE), the body credential is skipped rather than failing the scan. When a test genuinely cannot run, the result is reported clearly instead of showing a stale status.

Impact​

  • Scans now complete on POST/PUT/PATCH endpoints that declare no request body, instead of erroring
  • Body-placed credentials are applied where the method supports a body, and safely skipped where it does not (GET, DELETE)
  • When a test cannot run, it is clearly reported in the results rather than silently showing an outdated status

Application and Instance Deletions Now Appear in the Activity Log​

Application and instance deletions are now recorded under dedicated, clearly labeled entries — Application Deletion and Instance Deletion — that you can view and filter directly. Previously, application deletions didn't appear in the activity log at all, and instance deletions showed only under a generic management label. Each deletion is now recorded as a completed action.

Impact​

  • Application deletions are now visible in the activity log for the first time
  • Instance deletions are shown under a dedicated label instead of a generic management action
  • Deletion events can be filtered directly and are recorded as completed, making them easier to audit

If an account activation or password-reset link has expired, users can now request a new link directly from the link page without raising a support ticket. A confirmation message appears once the new link has been sent.

Impact​

  • Allows users to recover from expired links independently
  • Reduces reliance on support for routine account activation and password-reset requests
  • Provides confirmation that the new link has been sent

HMAC and SigV4 Secret Keys Are Masked When Viewing Saved Authentication​

Secret keys configured for HMAC and SigV4 authentication are now masked when viewing saved authentication details, consistent with the handling of other credential fields. When users save an authentication configuration without changing the secret key, the existing stored value is preserved.

Impact​

  • Prevents saved secret keys from being displayed in plain text
  • Maintains consistent credential-masking behavior across authentication methods
  • Prevents existing secret values from being unintentionally overwritten when saving unrelated configuration changes

NG Production Release Update - APIsec_cloud_7.10.2.0 ( October 08, 2026 )​

This release expands authentication and onboarding flexibility by supporting authentication tokens in query parameters and smarter parameter hydration with seed-value recommendations. It also improves scan reliability and troubleshooting by handling large numeric values more accurately, making Test Authentication execution deterministic, providing clearer credential failure messages, and fixing issues across Zendesk, BOLA, Activity Log, and Discover experiences.

What's New​

Place the Authentication Token in a Query Parameter​

You can now configure an authentication token to be sent as a query parameter under a key of your choosing, instead of only in a request header. You can configure the key for Bearer Token and OAuth2 authentication, and the token is applied to the request using that key.

Impact​

  • Supports APIs that expect authentication tokens in the URL, such as ?authorization=<token> instead of a request header
  • Automatically appends the token correctly, including when the endpoint already contains a query string
  • Existing header-based authentication remains unchanged — instances without a configured query-parameter key continue to send the token in the Authorization header

Smarter Parameter Hydration with Seed Recommendations​

The parameter hydration view now provides seed-value recommendations and lets you apply a suggestion with a single action. APIsec automatically places the suggested value at the correct parameter location — query, path, body, or header.

Impact​

  • Makes parameter setup faster and more accurate during onboarding and hydration
  • Automatically places the recommended value in the appropriate location
  • Prevents duplicate values when applying a recommendation
  • Existing hydrated values remain unchanged

Fixes & Improvements​

Large Numeric Values Are No Longer Sent as Scientific Notation​

Large integer parameters, such as 20260707000000 , are now stored and sent to the target exactly as defined instead of being converted to scientific notation, such as 2.0260707E+13. Previously, this conversion could cause requests to fail or endpoints to be marked as not testable because the target received an invalid value.

Impact​

  • Large numeric parameters are preserved accurately in scan requests
  • Endpoints that previously failed or were marked not testable because of malformed numeric values can now scan correctly
  • Already-onboarded endpoints are fixed automatically during the next scan or Dry Run — no re-onboarding is required
  • Smaller numeric values and non-numeric parameters are unaffected

Test Authentication Now Uses the Default Hosted Agent​

When an instance has a default hosted agent configured, Test Authentication / Test Credentials now runs deterministically on that agent instead of using whichever agent happens to be reachable first.

The test result also identifies which hosted agent ran the test, in both the result panel and the global authentication test modal. If the default agent is inactive or unavailable, APIsec reports the issue clearly and identifies the affected agent.

Impact​

  • Authentication test results are more consistent and predictable
  • Makes it clear which hosted agent was used for the test
  • Helps identify issues caused by an inactive or unavailable default hosted agent
  • Eliminates inconsistent results caused by different reachable agents being selected

Clearer Test Credentials Failure Messages​

When a hosted agent encounters a connectivity or TLS/certificate problem while reaching the target, Test Credentials now surfaces the underlying, actionable reason instead of displaying a generic error such as “An unexpected error occurred” or an HTTP 500 response.

Impact​

  • Provides the actual connectivity or certificate error encountered by the hosted agent
  • Makes troubleshooting faster by identifying the likely cause
  • Reduces the need to contact support for issues that can be diagnosed from the error message

Zendesk Connection Flow Improvements​

The Zendesk OAuth connection flow now handles cases where the authorization popup is closed before the authorization process completes. The integration form also includes field-level tooltips to provide additional guidance during configuration.

Impact​

  • Provides a cleaner recovery experience when the authorization window is closed prematurely
  • Makes Zendesk configuration easier to understand
  • Reduces confusion during the connection setup process

Accurate BOLA Finding Counts and UI Fixes​

The BOLA finding count badge now accurately reflects the number of findings displayed in the findings list. Additional fixes improve the Activity Log and Discover views.

Impact​

  • Keeps the BOLA count aligned with the findings actually displayed
  • Provides a more consistent experience when reviewing BOLA findings
  • Improves usability and reliability of the Activity Log and Discover views

NG Production Release Update - APIsec_cloud_7.10.1.0 ( October 05, 2026 )​

This release expands APIsec’s support for modern API request and authentication patterns, including form-encoded and multipart requests, while improving the accuracy of sensitive-data classification. It also adds CVSS score change history and export capabilities and improves scan reliability, endpoint coverage, specification reloads, and scan startup performance.

What's New​

Multipart file-upload support​

APIsec now sends multipart/form-data request bodies for endpoints whose spec declares them, such as file uploads. Previously, these requests were sent as JSON and rejected by the target. No configuration change is needed.

Impact​

  • File-upload (multipart) endpoints are exercised correctly
  • No configuration changes are required — the appropriate encoding and signing are applied automatically

Improvements​

Improved Data Sensitivity Classification​

APIsec now identifies sensitive parameters, including personal data (PII) and payment data (PCI), more accurately and applies sensitivity levels more consistently across all APIs. Parameter and endpoint sensitivity labels help the platform focus on sensitive-data findings, so improved classification means more relevant results.

Impact​

  • More reliable detection of sensitive fields, such as identifiers, card data, and credentials, based on parameter names
  • More consistent High/Critical sensitivity labeling across endpoints
  • Some parameters may have different sensitivity labels after this release as we reassess them. This is expected and reflects the improved classification. No action is required.

Complex Header Parameters Are No Longer Added as Instance Headers​

When an API specification defines a header parameter with a non-scalar schema, such as an object or array, APIsec no longer creates it as an instance-level header. Simple (scalar) header parameters continue to work as before. More granular, per-endpoint header customization is coming up next.

Impact​

  • Prevents complex header parameters from being incorrectly configured as instance-level headers
  • Preserves the existing behavior for simple header parameters

Blank Headers Are No Longer Sent​

An instance header configured without a value is now omitted from requests instead of being sent with an empty or null value.

Impact​

  • Prevents empty headers from being included in scan requests
  • Produces cleaner requests when optional header values are not configured
  • Reduces unexpected behavior caused by blank header values

More Accurate Request Bodies During Scans​

Request fields constrained by a pattern now receive a valid value matching that pattern instead of being left empty. This allows more requests to pass validation and reach the behavior under test.

Impact​

  • More generated requests comply with the API's defined validation rules
  • Reduces requests being rejected before the intended test can execute
  • Improves scan coverage for APIs that use pattern-constrained fields

Reliable Specification Reloads on Older Instances​

Reloading an API specification on long-standing instances now completes reliably.

Impact​

  • Improves the reliability of specification reloads on existing instances
  • Helps keep long-standing instances aligned with the latest API specification
  • Reduces the need to retry specification reload operations

Faster Scan Setup​

Part of the pre-scan analysis now runs in the background, reducing the time required to begin a scan without affecting scan coverage.

Impact​

  • Scans can begin sooner
  • Reduces the time spent waiting during scan initialization
  • Maintains existing scan coverage while improving scan startup performance