--- title: Regular channel changelog description: Version 22883.8 component: pingoneaic page_id: pingoneaic:release-notes:regular-channel/version-22883.8 canonical_url: https://docs.pingidentity.com/pingoneaic/release-notes/regular-channel/version-22883.8.html llms_txt: https://docs.pingidentity.com/pingoneaic/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md page_aliases: ["release-notes:regular-channel/version-22883.7.adoc"] section_ids: 07_aug_2026: 07 Aug 2026 key_features: Key features enhancements: Enhancements fixes: Fixes --- # Regular channel changelog | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | This is a changelog entry for version 22883.8. You can review the changelog for all versions in [Regular channel changelog](../regular-channel-changelog.html). | ## 07 Aug 2026 **Version 22883.8** ### Key features * Send email from next-generation scripts (OPENAM-25617) Advanced Identity Cloud now provides a next-generation script binding, `emailService`, that lets you send email directly from a script. ### Enhancements * AME-33978: The **Enable Connection via Credential** toggle for the PingOne Worker service now automatically enables or disables the relevant connection fields based on your selection. * AME-35088: You can now use a new `validate` action on the `secrets` endpoint to validate whether a secret mapping resolves to a valid secret in the configured secret store. * FRAAS-33591: The promotions API now returns report metadata ordered by creation date, with the most recent first. * IAM-3954, IAM-10782: Improved accessibility of numeric input fields and list fields throughout the admin console. * IAM-10610: You can now mark parameters in custom reports as optional, giving you more flexibility when running reports. * IAM-10764: Journey annotation notes now display multi-line formatting in view mode, matching how they appear when editing. * IAM-10917: The deferred release environment message displayed in a modal during promotions now uses clearer language and explains that updating your production release version during promotion is standard practice. * IGA-4435\[[1](#_footnotedef_1 "View footnote.")]\[[2](#_footnotedef_2 "View footnote.")]: Added an **Object Types** tab to the unmanaged application edit view, enabling administrators to define, manage, and reorder object type properties and import schemas. * IGA-4453\[[1](#_footnotedef_1 "View footnote.")]\[[2](#_footnotedef_2 "View footnote.")]: Added an **Activity** tab to the account detail view, giving administrators visibility into activity history for individual accounts. * IGA-4461\[[1](#_footnotedef_1 "View footnote.")]\[[2](#_footnotedef_2 "View footnote.")]: Improved the **My Requests** list view to display approval status, fulfillment status, and errors for each request. * IGA-4510\[[1](#_footnotedef_1 "View footnote.")]\[[2](#_footnotedef_2 "View footnote.")]: Improved the approval task view to display the name of the approver when the task was assigned to a role and has been completed. * OPENAM-26326, OPENAM-26452\[[3](#_footnotedef_3 "View footnote.")]: A new realm-level OAuth2 Provider setting, **Enable Rich Authorization Requests with RCS**, lets Advanced Identity Cloud process `authorization_details` requests when an RCS is configured. This setting also controls whether `authorization_details_types_supported` is advertised on Advanced Identity Cloud's well-known endpoint. * OPENAM-26458\[[3](#_footnotedef_3 "View footnote.")]: You can now configure **Authorization Detail Type(s)** on individual OAuth 2.0 clients to control which authorization detail types, as defined in RFC 9396 Rich Authorization Requests, each client can request. * OPENAM-26470\[[3](#_footnotedef_3 "View footnote.")]: Dynamic client registration requests can now include `authorization_details_types` to register the authorization detail types an OAuth 2.0 client supports. * OPENAM-26721: You can now skip signature verification when importing SAML metadata. * OPENAM-26073: Advanced Identity Cloud now includes v2.0 of the Patch Object node. This new version removes the **Patch as Object** configuration option and always updates the managed identity object as Advanced Identity Cloud. The v1.0 node is deprecated but continues to work in existing journeys. * OPENAM-27493\[[2](#_footnotedef_2 "View footnote.")]: You can now configure OAuth2 Provider settings, including scripted JWT issuers, in the Advanced Identity Cloud admin console under **Authorization > OAuth2 Provider**. * OPENAM-27494\[[2](#_footnotedef_2 "View footnote.")]: You can now configure Android Key Attestation, Jumio, and OneSpan identity verification settings in the Advanced Identity Cloud admin console. * OPENAM-27495\[[2](#_footnotedef_2 "View footnote.")]: You can now configure push authentication, push notification delivery, TOTP, WebAuthn, and device binding settings in the Advanced Identity Cloud admin console under **Authentication > Authentication Methods**. * OPENAM-27496\[[2](#_footnotedef_2 "View footnote.")]: You can now configure the Remote Consent Service in the Advanced Identity Cloud admin console under **Authorization > Remote Consent Service**. ### Fixes * AME-34781: Fixed an issue where the **Add AI Agent** button in the AM native admin console caused an error for Advanced Identity Cloud tenants. This button is now hidden but you can still add agents through the Advanced Identity Cloud admin console. * AME-34898: Fixed an issue where SAML SSO flows could use a circle of trust set to **Inactive**. * ANALYTICS-1557\[[4](#_footnotedef_4 "View footnote.")]: Optimised analytics query execution to resolve a processing issue affecting dashboards and internal metrics. * FRAAS-32040: Fixed a deadlock where the `/environment/startup` endpoint became unresponsive when Advanced Identity Cloud services failed to start because of bad configuration. * IAM-6882: Fixed an issue where the admin console displayed the incorrect product name. * IAM-7788: Fixed an issue where the Next Generation scripts editor displayed unpublished environment secrets and variables. * IAM-8343: Fixed an issue where the delete button for ESVs was not disabled for tenant auditors. * IGA-3972\[[1](#_footnotedef_1 "View footnote.")]\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where the selected filter value in the requests view reset to the default when navigating to a record or switching tabs. * IGA-4363\[[1](#_footnotedef_1 "View footnote.")]\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where applying a date or text multivalued glossary field filter in the hosted account pages returned an error instead of filtered results. * IGA-4393\[[1](#_footnotedef_1 "View footnote.")]\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where a boolean glossary attribute set to `false` was omitted from the entitlement API response instead of returning the correct value. * IGA-4598\[[1](#_footnotedef_1 "View footnote.")]\[[2](#_footnotedef_2 "View footnote.")]: Fixed an error in the **Approval Task** workflow node that caused the task to fail when an expiration notification was configured. * IGA-4651\[[1](#_footnotedef_1 "View footnote.")]\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where account create, update, and delete events from connected applications were missing from IGA audit data. * IGA-4654\[[1](#_footnotedef_1 "View footnote.")]\[[2](#_footnotedef_2 "View footnote.")]: Fixed a form validation error in the new certification template wizard that prevented users from navigating past the first section. * IGA-4662\[[1](#_footnotedef_1 "View footnote.")]: Fixed an issue where entitlement mappings used application display names instead of stable connector IDs, which could cause incorrect behavior if application names changed or contained special characters. * IAM-10686: Fixed an issue where navigation labels in the hosted pages editor wrapped inconsistently compared to the hosted account pages. * IAM-10728: Fixed a pagination issue where organization administrators with a limited user scope saw a `no users found` error after navigating past the last page of the user list. * IAM-10780: Fixed an issue where exporting a journey containing a Device Profile node with a custom matching script did not include the script, causing import failures. * IAM-10812: Fixed an issue where the edit icon in the Inner Tree Node and Scripted Decision Node opened an intermediate list instead of navigating directly to the linked resource. * OPENAM-23079\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where the Apple social provider failed on Android devices. During native authentication flows, Advanced Identity Cloud was not including the `code_verifier` in requests to Apple's token endpoint, which caused an `invalid_grant` error. * OPENAM-25429: The default **Minimum Secret Key Length** on the OATH Registration and Combined MFA Registration nodes has increased from 32 to 40 characters, for compatibility with Google Authenticator. * OPENAM-25556\[[2](#_footnotedef_2 "View footnote.")]: Advanced Identity Cloud now honors the `pubKeyCredParams` sequence in WebAuthn credential creation requests. * OPENAM-25801: Fixed an issue where the SAML SP adapter returned the wrong failure code when it couldn't map an assertion to a user profile. * OPENAM-26086: Advanced Identity Cloud no longer relies on an oversized browser cookie to carry the full OAuth 2.0 `/authorize` request through the login flow. Instead, it stores that request state securely in CTS (Core Token Service) and restores it after authentication. This prevents large requests, such as ones with a big `id_token_hint`, from failing with missing `client_id` after the user successfully sign on. * OPENAM-26106: Resolved an issue where the IdP account mapper could return the `NameID` value from the wrong SAML entity when a remote SP was used in multiple circles of trust with different `NameID` value mappings. * OPENAM-26180: Fixed an issue where ETag assertion was causing noisy CTS session assertion failures. * OPENAM-26834\[[2](#_footnotedef_2 "View footnote.")]: Hardened realm path handling for API requests to prevent potential security bypass. * OPENAM-28330\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where CDNs cached transient 404 errors for static assets during rolling deployments for up to 30 days, instead of treating them as non-cacheable. * OPENDJ-12269\[[2](#_footnotedef_2 "View footnote.")]: Fixed an issue where the password substring check rejected passwords containing attribute values shorter than the minimum substring length, such as a two-character surname. Attribute values shorter than the minimum substring length are no longer checked for substrings by default. *** [1](#_footnoteref_1). This change applies to a feature only available in PingOne Identity Governance, which is an [add-on capability](../../product-information/add-on-capabilities.html) and must be purchased separately.[2](#_footnoteref_2). This issue was inadvertently excluded from the rapid changelog.[3](#_footnoteref_3). These updates add foundational support for Rich Authorization Requests (RAR). Comprehensive RAR functionality will be available in a future release.[4](#_footnoteref_4). This issue is a hotfix so has been expedited across both release channels, reaching the regular channel before, or at the same time as, the rapid channel.