Backend API 18.1.6

Released on July 21, 2026

New Features

• We've increased the limit for the number of WebAuthn / Yubikey devices that can be registered to a single account to 50 devices.
• New ARAM event revealed_hidden_field tracks when a hidden field value is revealed, providing enhanced visibility into sensitive data access
• Recovery Phrase is now prompted daily to accelerate user adoption and improve account recovery readiness
• New CSPM risk-management REST API available for cloud security posture monitoring
• Domain reservation is now available through the Commander CLI
• MC transfer between MSP tenants is now available. Open a support ticket to receive instructions and assistance.

Improvements

• KA-8982: Record Removal After Ownership Change. Fixed an issue where removing a record after an ownership transfer could fail due to a data length constraint.
• KA-8953: Post-Rotation Script Allowlist Enforcement. The system now passes the configured scripts allowlist to Gateways during rotation, enabling gateway-side enforcement of permitted post-rotation scripts.
• KA-8897: Updated Email Templates for Managed Company Transfer. Improved email communication templates sent during Managed Company transfer operations for clearer messaging to administrators.
• KA-8794: MC Migration Capacity Improvements. Addressed capacity limitations in the Managed Company migration process to handle larger enterprise environments.
• KA-8793: CNAPP Capacity Improvements. Addressed capacity limitations in the CNAPP integration to handle larger workloads.
• KA-8785: Access Reduction Event Signaling. The system now signals the Router when access-reduction events occur, enabling downstream enforcement of permission changes in real time.
• KA-8682: Updated KSM Device and Gateway Value Calculation. Improved the value calculation logic for Keeper Secrets Manager devices and Gateways to ensure accurate reporting.
• KA-7848: CSPM Risk-Management API. Introduced new Admin REST API commands for Cloud Security Posture Management risk-management operations, enabling automated risk assessment workflows. See documentation.
• KA-7575: Domain Reservation for Enterprise. Added the ability for enterprise administrators to reserve domains, preventing unauthorized account creation under managed domains. The Commander CLI command for domain reservation is documented here.

Bugs

• KA-9026: MC Migration Email Routing Fix. Fixed an issue where Managed Company migrations out of an MSP sent duplicate emails to the MC admin and no notification to the MSP admin.
• KA-8942: Notification Trimming Fix. Fixed an issue where notification trimming was not functioning correctly, potentially causing notification buildup.
• KA-8847: SCIM Provisioning Cleanup on License Exhaustion. Fixed an issue where SCIM provisioning attempts when out of licenses could leave behind orphaned username history records.
• KA-8836: Scheduled Enterprise-to-MSP Migration Execution Fix. Fixed an issue where approved and scheduled Enterprise-to-MSP migrations failed to execute at their scheduled time.
• KA-8767: Audit Events for MC Migration from MSP. Fixed an issue where no audit events were created when a Managed Company migrated out of an MSP, ensuring proper audit trail coverage.
• KA-8717: Region Transfer: Automator URL Fix. Fixed an issue where the Automator URL could be null after a Region Transfer operation.
• KA-8716: Region Transfer: Enterprise User Data Fix. Fixed an issue where enterprise user encrypted data could be missing after a Region Transfer operation.
• KA-8706: Alias Conflict Prevention on Account Creation. Ensured that account creation is properly blocked when an alias already exists for the requested identifier.
• KA-8691: Account Creation Duplicate Protection. Prevented a scenario where creating a user could silently overwrite an existing active account association.
• KA-8662: MSP MC Migration Username Normalization. Fixed MSP Managed Company migration APIs to properly normalize account usernames, preventing lookup failures due to case or formatting differences.
• KA-8657: User Verification Code Failure Cleanup. Fixed a partial-failure scenario during user verification code creation that could leave behind orphaned account data.
• KA-8652: Username Normalization for Lookups. Fixed two endpoints that were not normalizing username input, causing user lookups to fail for certain account formats.
• KA-8650: Enterprise Invite Decline Cleanup. Fixed an issue where declining an enterprise invitation left behind orphaned user data that could interfere with future operations.
• KA-8645: Region Transfer: Pending User Data Fix. Fixed an issue where pending enterprise users could have missing identifiers after a Region Transfer operation.
• KA-8598: Role Key Access Restriction. Restricted enterprise data key retrieval to only return role keys for roles the requesting admin has management permissions over.
• KA-8594: Reports Access Enforcement. Enforced proper privilege requirements for report generation endpoints and restricted enterprise private-key access to authorized roles only.
• KA-8591: Webhook URL Validation Hardening. Strengthened URL validation for audit alert webhooks.
• KA-8187: Automator Team Assignment Fix. Fixed an issue where users were not being added to Teams after Automator approved the provisioning operation.