Release period: v1.2.135.0 → v1.2.135.1

This release lets security teams tune API security testing per application, puts test-run cleanup under role-based control with bulk delete, and introduces a Beta Service Graph in the API catalog. It also broadens test coverage to form-encoded APIs and unauthenticated-access probes, produces cleaner OpenAPI specs for strict gateway imports, and makes on-prem component health alerts far less noisy.

• Per-application security-test configuration — Override security-test settings for a single application from a new Configuration tab, with every setting clearly marked as inherited from the environment or overridden for that application. Test runs and the Run Test dialog use each application's effective settings.
• Bulk delete for API scans, governed by roles — Select and delete API scans in bulk. Cancelling or deleting a test run is now permission-controlled, and Admin holds every delete permission across the platform.
• Service Graph (Beta) in the API catalog — Visualize how your services call one another. Enabled per workspace from admin settings.
• Broader API test coverage — Endpoints that accept URL-encoded form bodies are now correlated and tested like any other structured body, and Broken User Authentication tests probe for unauthenticated access even when no authenticated baseline is available.
• Cleaner OpenAPI specs for strict importers — Specs generated from captured traffic no longer contain an invalid field type, so they import cleanly into strict external tools such as WSO2 gateways. Previously generated specs are corrected automatically on export.
• Quieter, more accurate on-prem health alerts — Component-health alerts for large fleets arrive as one consolidated email, and a new Active / Stale / Down filter on the On-Prem Deployments screen shows component status at a glance.

API Discovery & Cataloging

• Service Graph (Beta) — The API catalog gains a Service Graph showing call relationships between your services. It is enabled per workspace from admin settings and marked Beta. Node labels are now readable in dark mode.
• OpenAPI specs generated from captured traffic no longer contain an invalid field type. Fields observed only as null now default to string, and specs generated before this release are healed automatically on export, with no re-scan needed. This unblocks pushing APIs to strict gateways such as WSO2.
• Discovering a new API endpoint that collides with an existing one no longer discards the other newly discovered endpoints in the same catalog update, so endpoints no longer go missing from the API inventory.
• An endpoint's OpenAPI spec update is no longer silently dropped during ingestion, and a transient read failure no longer reports a spec as changed when it had not.

API Security Testing

• Per-application configuration overrides — Security-test settings can now be overridden per application from a new Configuration tab on the application's Security Testing page. Each setting is marked as inherited from the environment or overridden for the application, and test runs and the Run Test dialog use the application's effective settings. The rate-limit setting now shows its unit (requests per minute) with a tooltip explaining the per-second conversion.
• Bulk delete for API scans — API scans can be selected and deleted in bulk from the API Scans list. Bulk selection is available in workspaces with roles enabled, where the Test Runs delete permission governs it, or with a Levo account. The "rows selected" banner is now consistent across the API, Issues, Traces, Scans and Sensitive Data lists.
• Form-encoded request bodies are now tested — Endpoints that send URL-encoded form bodies are no longer excluded from correlation and security-test generation, so their parameters are tested like any other structured body. Producer bindings that use indexed paths such as $.data[0] match correctly, and required nested fields that cannot be URL-encoded are reported as contract violations instead of failing silently.
• Unauthenticated probe in Broken User Authentication tests — When no successful authenticated baseline is available, the test now still attempts a credential-stripped request. If the endpoint returns a genuine resource-shaped response, it is reported as a Medium, low-confidence "unconfirmed" finding. Single-page-app shells, public-by-design endpoints and status or error envelopes are suppressed, and harness or setup failures continue to skip rather than probe.
• A single CORS misconfiguration is now reported as one finding with the full probe matrix as evidence, instead of one finding per probe origin plus a duplicate preflight finding. Endpoint finding counts now reflect the number of misconfigurations rather than the number of probes.
• Test runs no longer receive a truncated or empty OpenAPI spec for an endpoint whose specification is being updated at the same time, so tests are generated against the correct request shape, authentication schemes and tags.
• Test runs no longer seed authentication from a masked or redacted trace, which previously caused the run to fail authentication from the first request.

Vulnerabilities & Findings

• The CreateFinding API now supports an opt-in synchronous mode that returns event IDs on completion. The default asynchronous behavior is unchanged.
• Findings are no longer marked resolved when the test that found them stops running. A finding now clears only when its own check runs again and passes, so a check dropping out of a test suite can no longer read as a fix.

Sensors & Deployment

• Status filter on On-Prem Deployments — Filter Satellites, Taggers, Sensors, DAST Runners and AI Gateways by Active, Stale or Down status, alongside the existing lifecycle filter.
• Consolidated component-health alerts — Alerts for a large fleet now arrive as a single consolidated email instead of one per detection wave. The attached CSV lists components oldest-heartbeat first, and the organization name is shown again.
• The Taggers tab on On-Prem Deployments now offers the Install Satellite action, so you can install from whichever tab you land on. The permanent-delete confirmation dialog wording is also corrected.
• Decommissioning a component no longer sends a false "component recovered" alert.
• Newly deployed sensors now appear on the Components dashboard within minutes of their first heartbeat, instead of sometimes waiting far longer.
• Sensor and tracer configuration fetches no longer hang when the platform is under load. A configuration read is now bounded by a single overall time limit, so it returns promptly rather than timing out.

Reporting & Compliance

• The Sensitive Data report's Endpoint Details section, and the Web App Scan report's vulnerability and finding lists, no longer silently truncate results and now return the complete data set.

Integrations

• SSO login no longer fails when an identity-provider tenant's domain list is empty, and a tenant with no SAML or OIDC connection configured now returns a clear error naming the missing configuration instead of a generic server error.
• Setting up SSO for an organization no longer fails when its identity-provider tenant already exists. When the provider's tenant limit is reached, the error now states clearly that an administrator must raise it.

Platform, Administration & Access

• Role-based control of test-run cancel and delete — Cancelling and deleting test runs are now governed by explicit Test Runs update and delete permissions. Owner and Admin hold them by default; other roles need them granted explicitly.
• Expanded delete permissions — Admin now holds every delete permission across the platform, and Security Engineer can delete endpoints.
• Role changes in the audit log — Role and permission changes now appear under their own Role resource type, with the role's identifier and permission set recorded. Assigning a role to a user is recorded as a distinct action.
• Hardened account security for Keycloak-backed deployments — Signup no longer bypasses email verification, verification links use a signed expiring token instead of a guessable identifier, disabling or deleting an account or changing its password revokes existing sessions, and password-reset responses no longer reveal whether an account exists.