> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/release-notes/backend/backend-api/backend-api-18.1.7.md). # Backend API 18.1.7 ### **New Features**​ * ​**NSF Shared Folder Enforcement Refinements** - The "Restrict Create Shared Folder" enforcement now correctly separates folder creation from folder sharing, allowing users to create folders anywhere while only blocking the act of sharing a not-already-shared folder. * ​**Restrict Folder Creation to Shared Folders Enforcement** - A new enforcement rule prevents users from creating non-inheriting subfolders within shared folder hierarchies, closing a loophole that allowed personal folders inside shared trees. * ​**Team Restrictions in Nested Shared Folders** - Team-level restrictions (disable re-share, disable edits) are now enforced at runtime within Nested Shared Folders, giving admins dynamic control over team resource access. * ​**KeeperDB ARAM Audit Events** - New audit/reporting events for KeeperDB sessions (start, stop, terminate, recording start, recording stop) are now generated for compliance visibility. * ​**Shared Folder Notifications** - Users now receive a sharing notification when a folder is shared with them via Nested Shared Folders. * ​**NSF Trashcan Restore Key Support** - Record keys are now preserved in an owner-decryptable form, enabling reliable decryption and restore of trashed items from shared folder hierarchies. ### **Improvements** * ​**KA-8535:** Added a sharing notification (NT\_SHARED) when a folder is shared with a user via Nested Shared Folders. Affected users and team members now receive a push notification upon being granted folder access. * ​**KA-8867:** Integrated team-level restrictions (disable re-share, disable record edits) into Nested Shared Folders. Restrictions are enforced at runtime and override a member's role on a resource when the member's only access is through the team. Gives enterprise admins dynamic control over team access without requiring re-provisioning. * ​**KA-8906:** Refined the "Restrict Create Shared Folder" enforcement so that folder creation is always permitted; only the act of sharing a not-already-shared folder is blocked. Users subject to this enforcement can create folders anywhere, including under shared parents, but cannot initiate new sharing on an unshared folder.Resolves inconsistent enforcement behavior that incorrectly blocked or bypassed folder operations depending on parent sharing state. * ​**KA-8941:** Added enforcement logic to block creation of non-inheriting subfolders under shared or inheriting parents when the "Restrict Folder Creation to Only Shared Folders" policy is active. Prevents users from creating personal (non-inheriting) folders within shared folder hierarchies, which previously circumvented the enforcement intent. Inheriting subfolder creation within shared trees remains allowed * ​**KA-8943:** Added new audit (ARAM) events for KeeperDB sessions: session started, session stopped, session terminated, recording started, and recording stopped. Provides enterprise administrators with full visibility into KeeperDB session activity in the reporting and alerting console. * **​KA-8946:** Added owner-encrypted record key fields to the record add and removal protocols to support trashcan restore. Ensures that records deleted from shared folder hierarchies can always be decrypted and restored by the record owner. * ​**KA-9094:** Hardening of the Security Posture reporting endpoint. * ​**KA-9225:** Upgraded the jsoup library to version 1.22.1 to resolve an SBOM-flagged vulnerability. * **​KA-9227:** Sanitized API error responses to prevent raw exception messages from being returned to clients. * **​KA-9229:** Improved error handling so that enterprise API requests with invalid or null enterprise context now return a proper error response instead of a silent HTTP 200. Provides clearer feedback to API consumers when enterprise context is missing. * **KA-9242:** Hardened SAML XML parsing * **KA-9244:** Upgraded the random number generator to a FIPS-compliant implementation in the commercial environment. Ensures all cryptographic random values conform to federal security standards. ### **Bugs** * ​**KA-8577:** Fixed an error that prevented users from creating a Bank Account record type with a linked payment card in Nested Shared Folders. Record type creation with associated linked record references now works as expected. * ​**KA-8680:** Fixed incorrect HTTP 500 error when a folder update request contained a malformed folder identifier. The server now returns a proper HTTP 400 bad request with a clear error message instead of an internal server error. * **​KA-8813:** Fixed an issue where Android devices did not receive a sharing notification push when a Nested Shared Folder record was shared directly. Android users now receive real-time push notifications for direct record shares.' * **​KA-8816:** Fixed a bug where folder access grants were silently dropped when access already existed for the target user. Duplicate access scenarios are now handled correctly, ensuring access state remains consistent. * **​KA-8846:** Fixed an issue that occurred during time-limited access (TLA) expiration processing when the accessor user could not be found. TLA expiration now gracefully handles deleted or removed users without causing service errors. * ​**KA-8852:** Fixed a bug where password rotation settings applied to a Nested Shared Folder record failed to sync down to clients. Rotation configuration changes now persist correctly and are delivered to all connected clients on sync. * **​KA-8855:** Fixed an issue where the content of trashed folders could not be decrypted because the necessary keys were not included in the sync-down payload. Trashed folder records now include the required key material so users can view and restore them. * ​**KA-8859:** Fixed a bug where shared objects belonging to a deleted team were still being sent to former team members during sync. Deleted team resources are now properly excluded from sync-down responses. * ​**KA-8864:** Fixed a sync issue where deleting a folder's original parent after a move operation would incorrectly remove the moved subtree from its new location. Folder moves are now independent of the lifecycle of the original parent folder. * ​**KA-8865:** Fixed a compliance reporting issue where deleted (trashed) Nested Shared Folder records were incorrectly included in compliance data results. Trashed records are now excluded from compliance reporting queries. * **​KA-8866:** Fixed an issue where Nested Shared Folder records were missing from compliance data when the request originated from the Enterprise Console. Compliance data now returns complete results regardless of the calling context. * **KA-8869:** Fixed a localization issue where users restricted from sharing saw a raw untranslated key instead of a properly localized error message. The sharing restriction message is now displayed in the user's configured language. * **KA-8877:** Fixed a folder restore issue that produced duplicate folder key associations, causing the restored folder tree to appear incorrectly in the user's vault. Folder restore now cleanly reinstates the correct parent-child relationships without orphaned entries. * **KA-8910:** Fixed an inconsistency in the "Restrict Create Shared Folder" enforcement where folder update and move operations incorrectly counted denial records, causing false enforcement blocks. Folder moves and updates now use the same consistent logic as the share path. * **KA-8938:** Fixed a bug where sharing a Nested Shared Folder to a team did not propagate inherited access to child folders created after the parent was shared. All child folders now correctly inherit team access regardless of creation order. * **KA-8948:** Fixed a test infrastructure issue where enterprise provisioning conflicts occurred when multiple end-to-end test scenarios ran in a single execution. Improves test isolation and reliability for the automated test suite. * **KA-8960:** Completed the Remove & Restore use case matrix investigation, cataloging all expected behaviors for folder and record deletion and restoration scenarios in Nested Shared Folders. Results inform the correctness validation of trash and restore operations in this release. * **KA-9157:** Fixed multiple encryption-related information issues where decryption failures returned distinguishable error responses. * **KA-9173:** Fixed a bug where Commander requests for general enterprise data failed with a bad request response. Enterprise data retrieval via Commander now processes correctly and returns the expected results. * **KA-9174:** Fixed a bug where vault sync continued to deliver decryptable record revisions after explicit child-access revocation in a Nested Shared Folder. Access revocation now immediately and fully prevents the revoked user from receiving new record data on sync. * **KA-9176:** Fixed a bug where a non-inheriting subfolder created under a shared parent was still readable by the parent's accessors. Non-inheriting subfolders now correctly isolate their content from the parent folder's shared access list. * **KA-9177:** Fixed a bug where sharing a folder did not properly deny new accessors on existing non-inheriting children. When a folder is shared, non-inheriting child folders now correctly enforce deny rules for the new accessor. * **KA-9246:** Fixed an issue where raw internal exception messages were returned to API clients in error responses. Error responses now contain only sanitized, generic messages. * **KA-9247:** Fixed an issue where request body values were exposed in HTTP 400 error responses. Client-supplied input is no longer reflected back in error messages. * **KA-9410:** Fixed a bug where the translation lookup service sometimes returned the translation key as both the key and the value instead of the actual translated text. Localized strings now resolve correctly in all cases. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.keeper.io/release-notes/backend/backend-api/backend-api-18.1.7.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.