https://cybertoolchain.io/tools/infisical New releases and features in infisical, tracked by The Cyber Toolchain. en Tue, 03 Nov 2026 18:00:18 GMT https://github.com/Infisical/infisical/releases/tag/v0.167.6 https://github.com/Infisical/infisical/releases/tag/v0.167.6 Tue, 03 Nov 2026 18:00:18 GMT Infisical adds CockroachDB dynamic secrets, MCP tool allowlists, project soft-delete with restore, and IdP MFA trust for SAML and OIDC⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Add an MCP tool allowlist for MCP services in agent-vault, letting operators restrict which tools an MCP service may call.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Support CockroachDB through the existing PostgreSQL SQL database dynamic secret provider. • Add a grace period and restore capability for deleted secret manager projects, so accidental deletions can be recovered. • Trust identity provider MFA for SAML and OIDC logins, so users who already completed MFA at their IdP are not prompted again. • Link resource rows in secret scanning to their filtered findings for faster triage. • Add descriptions to agent-vault proxies. • Add a confirmation prompt before disabling or narrowing cross-project secret sharing to prevent accidental scope reductions. • Support rotation on discovery import in PAM. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.167.5 https://github.com/Infisical/infisical/releases/tag/v0.167.5 Mon, 02 Nov 2026 16:30:22 GMT Infisical adds an OIDC issuer API, ServiceNow integration, ML-DSA HSM key support, Windows Server PKI discovery, Agent Vault MCP server, and delegated-approval policies⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Infisical now acts as an OIDC issuer, letting other systems verify tokens against Infisical's identity.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds GitHub secret sync targets for Codespaces (`codespace`) and Dependabot (`dependabot`) secrets alongside the existing repository sync. • Agent Vault now exposes an MCP server, letting AI agents and MCP-compatible clients access vaulted credentials. • Agent Vault UI improvements add optional labels on sessions to identify and filter sessions by name, plus a guided setup checklist and sample session to walk through first-time configuration. • Adds delegated-approval policies so teams can define who may approve external access requests and implement an approval mechanism for those requests. • Adds Windows Server discovery to PKI, allowing certificate inventory scans of Windows Server hosts. • Adds support for ML-DSA keys on HSM-backed internal certificate authorities. • Secrets, folder, and import events now emit through the outbox for downstream consumption. • Adds an audit-log improvement that normalizes free text in audit events for consistent querying. • Adds an Insights view for unused secret access and secret read activity. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Wed, 28 Oct 2026 08:04:19 GMT API surface changed: +10 endpoints, 39 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new Jira app connection endpoints: `DELETE /api/v1/app-connections/jira/{connectionId}`, `GET /api/v1/app-connections/jira`, `GET /api/v1/app-connections/jira/available`, `GET /api/v1/app-connections/jira/connection-name/{connectionName}`, `GET /api/v1/app-connections/jira/{connectionId}`, `PATCH /api/v1/app-connections/jira/{connectionId}`, `POST /api/v1/app-connections/jira`, and `POST /api/v1/app-connections/jira/{connectionId}/rotate-credentials`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v1/projects/{projectId}/memberships/available-users • New endpoint PATCH /api/v1/agent-vault/sessions/{sessionId} Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.167.4 https://github.com/Infisical/infisical/releases/tag/v0.167.4 Mon, 26 Oct 2026 20:03:31 GMT Infisical v0.167.4 makes batched secret changes always-on in Secrets Overview and moves the quick-add row to the top of the table.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables batched secret changes as always-on behavior in the Secrets Overview, removing the need to opt in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Moves the quick-add row to the top of the Secrets Overview table for faster secret entry. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.167.3 https://github.com/Infisical/infisical/releases/tag/v0.167.3 Mon, 26 Oct 2026 16:00:54 GMT Infisical v0.167.3 adds a batch commit API, bulk secret-approval reviews, PAM auto-approvals, and Cloudflare variable-type selection for syncs.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a private v2 batch commit API route (`/api/v2/…`) for atomically committing batched secret and folder changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds bulk review of change requests in secret approvals, letting reviewers approve or reject multiple requests at once. • Adds auto-approvals for PAM (Privileged Access Management) workflows. • Adds member-provided credential fields with personal values and variables in Agent Vault. • Adds variable-type selection (plaintext vs. JSON) for Cloudflare Workers and Pages secret syncs. • Shows group access in the organization users table. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Sun, 25 Oct 2026 08:00:12 GMT API surface changed: +3 endpoints, −1 endpoint, 111 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}/personal-values⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId}/personal-values • GET /api/v1/agent-vault/access-bundles: param granted (query) added; param requiresSetup (query) added • GET /api/v1/agent-vault/variables: param scope (query) added Breaking changes: • Removed endpoint POST /api/v1/agent-vault/proxies/{proxyId}/token-auth/enrollment-token Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.167.2 https://github.com/Infisical/infisical/releases/tag/v0.167.2 Fri, 23 Oct 2026 20:34:25 GMT Infisical v0.167.2 adds secret scanning audit events, proxy-token-based vault agent start, default session-log storage, and PKI admin code-signing config.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds audit events for secret scanning activity tracking, giving operators a log trail for scanning operations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables vault agent proxies to start using a proxy token via `agent-vault` proxy token support. • Adds default storage configuration for vault agent session logs. • Allows PKI admins to configure signer-specific code signing settings. • Enables granting folder access directly from the Manage Permissions search UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.167.1 https://github.com/Infisical/infisical/releases/tag/v0.167.1 Thu, 22 Oct 2026 21:38:16 GMT Infisical v0.167.1 adds Linux Server certificate discovery to PKI capabilities.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Linux Server certificate discovery to the PKI certificate management surface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Thu, 22 Oct 2026 07:59:37 GMT API surface changed: +3 endpoints, 9 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v1/cert-manager/hsm-connectors/{connectorId}/keys⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint POST /api/v1/cert-manager/certificates/{id}/pkcs12 • New endpoint POST /api/v1/cert-manager/signers/{signerId}/certificate/import Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.167.0 https://github.com/Infisical/infisical/releases/tag/v0.167.0 Wed, 21 Oct 2026 19:42:12 GMT Infisical v0.167.0 adds DigiCert HSM-backed code signing, Copy ID for cert policies, and last-edited timestamps on secrets.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports using an existing DigiCert certificate and its HSM key as a signer in the code-signing workflow.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds 'Copy ID' to alert and approval policy row menus in the certificate manager. • Shows last-edited time for secrets in the single-environment overview. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.166.9 https://github.com/Infisical/infisical/releases/tag/v0.166.9 Tue, 20 Oct 2026 19:53:39 GMT Infisical v0.166.9 adds S3-backed PAM session recordings, AWS KMS signing for internal CAs, Agent Vault variable scoping, and a revamped findings/data-store UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds AWS KMS-backed signing keys for internal CAs in the PKI module, enabling hardware-protected certificate issuance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds S3-compatible storage backend for PAM session recordings. • Moves variables from access bundles to Agent Vault scope as a whole, broadening where vault-level variables apply. • Adds `audit_log_streams` table to the sanitized database schema for audit log stream support. • Revamps the findings UI with a redesigned findings view. • Revamps the data store list and redesigns the data source flow. • Shows offline license usage on the unified billing page. • Adds page breadcrumbs to the top navigation on every route. • Suggests names for secret syncs, app connections, honey tokens, certificate authorities, approval policies, and certificate policies from their context during creation. • Opens the chosen plan's trial automatically after signup from the pricing page, and shows the pricing trial prompt for already-signed-in users. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Mon, 19 Oct 2026 07:57:05 GMT API surface changed: +30 endpoints, −5 endpoints, 12 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Agent Vault variable management endpoints: `GET /api/v1/agent-vault/variables`, `POST /api/v1/agent-vault/variables`, `GET /api/v1/agent-vault/variables/{variableId}/value`, `PATCH /api/v1/agent-vault/variables/{variableId}`, and `DELETE /api/v1/agent-vault/variables/{variableId}`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Portainer app connection endpoints: `GET /api/v1/app-connections/portainer`, `GET /api/v1/app-connections/portainer/available`, `GET /api/v1/app-connections/portainer/connection-name/{connectionName}`, `GET /api/v1/app-connections/portainer/{connectionId}`, `POST /api/v1/app-connections/portainer`, `PATCH /api/v1/app-connections/portainer/{connectionId}`, `DELETE /api/v1/app-connections/portainer/{connectionId}`, and `POST /api/v1/app-connections/portainer/{connectionId}/rotate-credentials`. • Adds S3-compatible app connection endpoints: `GET /api/v1/app-connections/s3-compatible`, `GET /api/v1/app-connections/s3-compatible/available`, `GET /api/v1/app-connections/s3-compatible/connection-name/{connectionName}`, `GET /api/v1/app-connections/s3-compatible/{connectionId}`, `POST /api/v1/app-connections/s3-compatible`, `PATCH /api/v1/app-connections/s3-compatible/{connectionId}`, `DELETE /api/v1/app-connections/s3-compatible/{connectionId}`, and `POST /api/v1/app-connections/s3-compatible/{connectionId}/rotate-credentials`. • Adds Portainer secret sync endpoints: `GET /api/v1/secret-syncs/portainer`, `GET /api/v1/secret-syncs/portainer/sync-name/{syncName}`, `GET /api/v1/secret-syncs/portainer/{syncId}`, `POST /api/v1/secret-syncs/portainer`, `PATCH /api/v1/secret-syncs/portainer/{syncId}`, `DELETE /api/v1/secret-syncs/portainer/{syncId}`, `POST /api/v1/secret-syncs/portainer/{syncId}/import-secrets`, `POST /api/v1/secret-syncs/portainer/{syncId}/remove-secrets`, and `POST /api/v1/secret-syncs/portainer/{syncId}/sync-secrets`. Breaking changes: • Removed endpoint DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} • Removed endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables • Removed endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}/value • Removed endpoint PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} • Removed endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/variables Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.166.8 https://github.com/Infisical/infisical/releases/tag/v0.166.8 Thu, 15 Oct 2026 17:55:46 GMT Infisical v0.166.8 adds Portainer secret sync, webhook authentication with custom headers, and audit-log-stream drop alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds authentication and custom headers support to webhook alert channels.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an alert when an audit log stream starts dropping logs. • Adds Portainer as a supported secret sync app connection target. • Returns all tags during secret query evaluation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Thu, 15 Oct 2026 07:58:25 GMT API surface changed: +65 endpoints, −3 endpoints, 39 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Agent Vault member management endpoints: `DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/members`, `DELETE /api/v1/agent-vault/members`, and `PATCH /api/v1/agent-vault/members`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Keeper app connection integration with endpoints `GET /api/v1/app-connections/keeper`, `GET /api/v1/app-connections/keeper/available`, `GET /api/v1/app-connections/keeper/connection-name/{connectionName}`, `GET /api/v1/app-connections/keeper/{connectionId}`, `POST /api/v1/app-connections/keeper`, `POST /api/v1/app-connections/keeper/{connectionId}/rotate-credentials`, `PATCH /api/v1/app-connections/keeper/{connectionId}`, and `DELETE /api/v1/app-connections/keeper/{connectionId}`. • Adds a Palo Alto Networks app connection integration with endpoints `GET /api/v1/app-connections/palo-alto-networks`, `GET /api/v1/app-connections/palo-alto-networks/available`, `GET /api/v1/app-connections/palo-alto-networks/connection-name/{connectionName}`, `GET /api/v1/app-connections/palo-alto-networks/{connectionId}`, `POST /api/v1/app-connections/palo-alto-networks`, `POST /api/v1/app-connections/palo-alto-networks/{connectionId}/rotate-credentials`, `PATCH /api/v1/app-connections/palo-alto-networks/{connectionId}`, and `DELETE /api/v1/app-connections/palo-alto-networks/{connectionId}`. • Adds Palo Alto Networks PKI sync support, covering both the plain and SSL/TLS profile sync types, mirrored under the `cert-manager` and `pki` API namespaces: listing via `GET /api/v1/cert-manager/syncs/palo-alto-networks`, `GET /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile`, `GET /api/v1/pki/syncs/palo-alto-networks`, `GET /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile`, and their by-id variants `GET /api/v1/cert-manager/syncs/palo-alto-networks/{pkiSyncId}`, `GET /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}`, `GET /api/v1/pki/syncs/palo-alto-networks/{pkiSyncId}`, `GET /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}`; creation via `POST /api/v1/cert-manager/syncs/palo-alto-networks`, `POST /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile`, `POST /api/v1/pki/syncs/palo-alto-networks`, `POST /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile`; sync and removal actions via `POST /api/v1/cert-manager/syncs/palo-alto-networks/{pkiSyncId}/sync`, `POST /api/v1/cert-manager/syncs/palo-alto-networks/{pkiSyncId}/remove-certificates`, `POST /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}/sync`, `POST /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}/remove-certificates`, `POST /api/v1/pki/syncs/palo-alto-networks/{pkiSyncId}/sync`, `POST /api/v1/pki/syncs/palo-alto-networks/{pkiSyncId}/remove-certificates`, `POST /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}/sync`, `POST /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}/remove-certificates`; updates via `PATCH /api/v1/cert-manager/syncs/palo-alto-networks/{pkiSyncId}`, `PATCH /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}`, `PATCH /api/v1/pki/syncs/palo-alto-networks/{pkiSyncId}`, `PATCH /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}`; and deletion via `DELETE /api/v1/cert-manager/syncs/palo-alto-networks/{pkiSyncId}`, `DELETE /api/v1/cert-manager/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}`, `DELETE /api/v1/pki/syncs/palo-alto-networks/{pkiSyncId}`, `DELETE /api/v1/pki/syncs/palo-alto-networks-ssl-tls-profile/{pkiSyncId}`. • Adds a Cloudflare Secrets Store secret sync with endpoints `GET /api/v1/secret-syncs/cloudflare-secrets-store`, `GET /api/v1/secret-syncs/cloudflare-secrets-store/sync-name/{syncName}`, `GET /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}`, `POST /api/v1/secret-syncs/cloudflare-secrets-store`, `POST /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}/import-secrets`, `POST /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}/remove-secrets`, `POST /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}/sync-secrets`, `PATCH /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}`, and `DELETE /api/v1/secret-syncs/cloudflare-secrets-store/{syncId}`. • Adds a Keeper Password Manager secret sync with endpoints `GET /api/v1/secret-syncs/keeper-password-manager`, `GET /api/v1/secret-syncs/keeper-password-manager/sync-name/{syncName}`, `GET /api/v1/secret-syncs/keeper-password-manager/{syncId}`, `POST /api/v1/secret-syncs/keeper-password-manager`, `POST /api/v1/secret-syncs/keeper-password-manager/{syncId}/import-secrets`, `POST /api/v1/secret-syncs/keeper-password-manager/{syncId}/remove-secrets`, `POST /api/v1/secret-syncs/keeper-password-manager/{syncId}/sync-secrets`, `PATCH /api/v1/secret-syncs/keeper-password-manager/{syncId}`, and `DELETE /api/v1/secret-syncs/keeper-password-manager/{syncId}`. Breaking changes: • Removed endpoint PATCH /api/v1/agent-vault/members/{actorType}/{actorId} • Removed endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/members/revoke • Removed endpoint POST /api/v1/agent-vault/members/revoke • GET /api/v1/agent-vault/sessions/{sessionId}/logs: param limit (query) removed; response schema changed • GET /api/v1/agent-vault/sessions/{sessionId}/logs/tail: param limit (query) removed; response schema changed Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.166.7 https://github.com/Infisical/infisical/releases/tag/v0.166.7 Wed, 14 Oct 2026 17:27:32 GMT Infisical v0.166.7 adds Kafka dynamic secrets, a PAM alerting module, and an edit sheet for single-environment secret views.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Kafka support to dynamic secrets, enabling short-lived Kafka credentials to be generated on demand.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Moves PAM to a dedicated alerting module. • Adds an edit secret sheet and comment preview in the single-environment secrets view. • Requires a cancellation reason when cancelling a subscription via the Billing V2 cancel dialogs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.166.6 https://github.com/Infisical/infisical/releases/tag/v0.166.6 Tue, 13 Oct 2026 22:35:32 GMT Infisical v0.166.6 adds MSSQL PAM discovery, Palo Alto Networks cert sync, OpenRouter workspace support, and Chef encrypted data bag sync.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds MSSQL discovery for Privileged Access Management (PAM), enabling automated detection of MSSQL database credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Palo Alto Networks app connection and certificate syncs via the PKI sync subsystem. • Adds workspace support for OpenRouter secret rotation. • Supports encrypted data bags in the Chef secret sync integration. • Splits project templates by product type in the UI for clearer onboarding. Breaking changes: • Agent/Vault member revocation now uses DELETE (previously a different method); roles can now only be changed in bulk — existing single-member role-change workflows may break. • Agent/Vault: every variable is now treated as a secret — previously non-secret variables will be reclassified on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.166.5 https://github.com/Infisical/infisical/releases/tag/v0.166.5 Mon, 12 Oct 2026 20:28:28 GMT Infisical v0.166.5 moves secret scanning to project-level, adds global secret-change approvals, and supports nested JSON import as folders.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Moves secret scanning to a single-project product scope, scoping all scanning operations and results to individual projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports importing nested JSON objects as folder hierarchies when importing secrets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Sun, 11 Oct 2026 10:04:34 GMT API surface changed: +18 endpoints, 21 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/app-connections/hpe-ilo/{connectionId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v2/secret-rotations/gcp-service-account-key/{rotationId} • New endpoint GET /api/v1/app-connections/hpe-ilo • New endpoint GET /api/v1/app-connections/hpe-ilo/available • New endpoint GET /api/v1/app-connections/hpe-ilo/connection-name/{connectionName} • New endpoint GET /api/v1/app-connections/hpe-ilo/{connectionId} • New endpoint GET /api/v2/secret-rotations/gcp-service-account-key • New endpoint GET /api/v2/secret-rotations/gcp-service-account-key/rotation-name/{rotationName} • New endpoint GET /api/v2/secret-rotations/gcp-service-account-key/{rotationId} • New endpoint GET /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/generated-credentials • New endpoint PATCH /api/v1/app-connections/hpe-ilo/{connectionId} • New endpoint PATCH /api/v2/secret-rotations/gcp-service-account-key/{rotationId} • New endpoint POST /api/v1/app-connections/hpe-ilo • New endpoint POST /api/v1/app-connections/hpe-ilo/{connectionId}/rotate-credentials • New endpoint POST /api/v2/secret-rotations/gcp-service-account-key • New endpoint POST /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/check-credentials • New endpoint POST /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/move • New endpoint POST /api/v2/secret-rotations/gcp-service-account-key/{rotationId}/rotate-secrets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.166.3 https://github.com/Infisical/infisical/releases/tag/v0.166.3 Thu, 08 Oct 2026 21:26:59 GMT Infisical v0.166.3 adds UltraDNS and Google Cloud DNS ACME providers, Ed25519 sign/verify KMS keys, GCP service account key rotation, HPE iLO Redfish integration, and multi-c⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds UltraDNS as an ACME DNS-01 challenge provider for PKI certificate automation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Google Cloud DNS as an ACME DNS-01 challenge provider for PKI certificate automation. • Adds Ed25519 sign/verify key support in KMS, enabling elliptic-curve signing operations. • Adds HPE iLO Redfish app connection, enabling secrets management for out-of-band server management interfaces. • Adds Redfish API implementation backing the HPE iLO app connection. • Adds support for multiple connections in a single secret rotation configuration. • Warns users before moving or copying secrets into a synced path, preventing unintended sync overwrites. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.17 https://github.com/Infisical/infisical/releases/tag/v0.165.17 Mon, 05 Oct 2026 20:53:18 GMT Infisical v0.165.17 adds OCSP responder for internal CAs, Stripe secret rotation, agent-vault session logs, and Terraform gateway support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `members/available` API endpoint on agent-vault so add-member dialogs surface only unassigned actors.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds an OCSP responder for internal certificate authorities. • Adds Stripe app connection and API key rotation to secret-rotation. • Adds access bundle variables to agent-vault. • Adds an agent-friendly API (`feat(api): agent friendly api`). • Records external CA issued values and drops issuer-written extensions on renewal. • Adds token-auth credential expiry and support for multiple alerts per machine identity. • Terminates PAM sessions automatically when a user is removed from an org. • Moves application alerts to the shared alerting module. • Adds resizable columns to the secrets table. • Adds opt-in sticky header to tables. • Redesigns the move-destination picker for secrets. • Adds environment-scoped recency sorting for secrets. • Overhauled secret-sharing UX across surfaces. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Mon, 05 Oct 2026 08:05:39 GMT Breaking changes: • Deprecated endpoint DELETE /api/v1/cert-manager/alerts/{alertId} (still works) • Deprecated endpoint DELETE /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works) • Deprecated endpoint GET /api/v1/cert-manager/alerts (still works) • Deprecated endpoint GET /api/v1/cert-manager/alerts/{alertId} (still works) • Deprecated endpoint GET /api/v1/cert-manager/applications/{applicationId}/alerts (still works) • Deprecated endpoint PATCH /api/v1/cert-manager/alerts/{alertId} (still works) • Deprecated endpoint PATCH /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works) • Deprecated endpoint POST /api/v1/cert-manager/alerts (still works) • Deprecated endpoint POST /api/v1/cert-manager/applications/{applicationId}/alerts (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Sun, 04 Oct 2026 13:54:34 GMT Breaking changes: • Deprecated endpoint DELETE /api/v1/cert-manager/alerts/{alertId} (still works) • Deprecated endpoint DELETE /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works) • Deprecated endpoint GET /api/v1/cert-manager/alerts (still works) • Deprecated endpoint GET /api/v1/cert-manager/alerts/{alertId} (still works) • Deprecated endpoint GET /api/v1/cert-manager/applications/{applicationId}/alerts (still works) • Deprecated endpoint PATCH /api/v1/cert-manager/alerts/{alertId} (still works) • Deprecated endpoint PATCH /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works) • Deprecated endpoint POST /api/v1/cert-manager/alerts (still works) • Deprecated endpoint POST /api/v1/cert-manager/applications/{applicationId}/alerts (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Sat, 03 Oct 2026 13:03:45 GMT API surface changed: +15 endpoints, 16 modified, 9 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/agent-vault/app-connections/aws/{connectionId} • New endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables • New endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId}/value • New endpoint GET /api/v1/agent-vault/app-connections/aws • New endpoint GET /api/v1/agent-vault/app-connections/aws/{connectionId} • New endpoint GET /api/v1/agent-vault/sessions/{sessionId} • New endpoint GET /api/v1/agent-vault/sessions/{sessionId}/logs • New endpoint GET /api/v1/agent-vault/sessions/{sessionId}/logs/tail • New endpoint GET /api/v1/agent-vault/settings/session-logs • New endpoint PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/variables/{variableId} • New endpoint PATCH /api/v1/agent-vault/app-connections/aws/{connectionId} • New endpoint PATCH /api/v1/agent-vault/settings/session-logs • New endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/variables • New endpoint POST /api/v1/agent-vault/app-connections/aws Breaking changes: • Deprecated endpoint DELETE /api/v1/cert-manager/alerts/{alertId} (still works) • Deprecated endpoint DELETE /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works) • Deprecated endpoint GET /api/v1/cert-manager/alerts (still works) • Deprecated endpoint GET /api/v1/cert-manager/alerts/{alertId} (still works) • Deprecated endpoint GET /api/v1/cert-manager/applications/{applicationId}/alerts (still works) • Deprecated endpoint PATCH /api/v1/cert-manager/alerts/{alertId} (still works) • Deprecated endpoint PATCH /api/v1/cert-manager/applications/{applicationId}/alerts/{alertId} (still works) • Deprecated endpoint POST /api/v1/cert-manager/alerts (still works) • Deprecated endpoint POST /api/v1/cert-manager/applications/{applicationId}/alerts (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Tue, 29 Sep 2026 14:32:56 GMT API surface changed: +19 endpoints, −37 endpoints, 19 modified, 12 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/app-connections/stripe/{connectionId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v2/secret-rotations/stripe-api-key/{rotationId} • New endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/members/available • New endpoint GET /api/v1/app-connections/stripe • New endpoint GET /api/v1/app-connections/stripe/available • New endpoint GET /api/v1/app-connections/stripe/connection-name/{connectionName} • New endpoint GET /api/v1/app-connections/stripe/{connectionId} • New endpoint GET /api/v2/secret-rotations/stripe-api-key • New endpoint GET /api/v2/secret-rotations/stripe-api-key/rotation-name/{rotationName} • New endpoint GET /api/v2/secret-rotations/stripe-api-key/{rotationId} • New endpoint GET /api/v2/secret-rotations/stripe-api-key/{rotationId}/generated-credentials • New endpoint PATCH /api/v1/app-connections/stripe/{connectionId} • New endpoint PATCH /api/v2/secret-rotations/stripe-api-key/{rotationId} • New endpoint POST /api/v1/app-connections/stripe • New endpoint POST /api/v1/app-connections/stripe/{connectionId}/rotate-credentials • New endpoint POST /api/v2/secret-rotations/stripe-api-key • New endpoint POST /api/v2/secret-rotations/stripe-api-key/{rotationId}/check-credentials • New endpoint POST /api/v2/secret-rotations/stripe-api-key/{rotationId}/move • New endpoint POST /api/v2/secret-rotations/stripe-api-key/{rotationId}/rotate-secrets Breaking changes: • Removed endpoint DELETE /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId} • Removed endpoint DELETE /api/v2/secret-scanning/data-sources/github/{dataSourceId} • Removed endpoint DELETE /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId} • Removed endpoint GET /api/v2/secret-scanning/configs • Removed endpoint GET /api/v2/secret-scanning/data-sources • Removed endpoint GET /api/v2/secret-scanning/data-sources/bitbucket • Removed endpoint GET /api/v2/secret-scanning/data-sources/bitbucket/data-source-name/{sourceName} • Removed endpoint GET /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId} • Removed endpoint GET /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/resources • Removed endpoint GET /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/scans • Removed endpoint GET /api/v2/secret-scanning/data-sources/github • Removed endpoint GET /api/v2/secret-scanning/data-sources/github/data-source-name/{sourceName} • Removed endpoint GET /api/v2/secret-scanning/data-sources/github/{dataSourceId} • Removed endpoint GET /api/v2/secret-scanning/data-sources/github/{dataSourceId}/resources • Removed endpoint GET /api/v2/secret-scanning/data-sources/github/{dataSourceId}/scans • Removed endpoint GET /api/v2/secret-scanning/data-sources/gitlab • Removed endpoint GET /api/v2/secret-scanning/data-sources/gitlab/data-source-name/{sourceName} • Removed endpoint GET /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId} • Removed endpoint GET /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/resources • Removed endpoint GET /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/scans • Removed endpoint GET /api/v2/secret-scanning/data-sources/options • Removed endpoint GET /api/v2/secret-scanning/findings • Removed endpoint PATCH /api/v2/secret-scanning/configs • Removed endpoint PATCH /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId} • Removed endpoint PATCH /api/v2/secret-scanning/data-sources/github/{dataSourceId} • Removed endpoint PATCH /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId} • Removed endpoint PATCH /api/v2/secret-scanning/findings • Removed endpoint PATCH /api/v2/secret-scanning/findings/{findingId} • Removed endpoint POST /api/v2/secret-scanning/data-sources/bitbucket • Removed endpoint POST /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/resources/{resourceId}/scan • Removed endpoint POST /api/v2/secret-scanning/data-sources/bitbucket/{dataSourceId}/scan • Removed endpoint POST /api/v2/secret-scanning/data-sources/github • Removed endpoint POST /api/v2/secret-scanning/data-sources/github/{dataSourceId}/resources/{resourceId}/scan • Removed endpoint POST /api/v2/secret-scanning/data-sources/github/{dataSourceId}/scan • Removed endpoint POST /api/v2/secret-scanning/data-sources/gitlab • Removed endpoint POST /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/resources/{resourceId}/scan • Removed endpoint POST /api/v2/secret-scanning/data-sources/gitlab/{dataSourceId}/scan • Deprecated endpoint DELETE /api/v3/secrets/batch/raw (still works) • Deprecated endpoint DELETE /api/v3/secrets/raw/{secretName} (still works) • Deprecated endpoint DELETE /api/v3/secrets/tags/{secretName} (still works) • Deprecated endpoint GET /api/v3/secrets/raw (still works) • Deprecated endpoint GET /api/v3/secrets/raw/id/{secretId} (still works) • Deprecated endpoint GET /api/v3/secrets/raw/{secretName} (still works) • Deprecated endpoint PATCH /api/v3/secrets/batch/raw (still works) • Deprecated endpoint PATCH /api/v3/secrets/raw/{secretName} (still works) • Deprecated endpoint POST /api/v3/secrets/batch/raw (still works) • Deprecated endpoint POST /api/v3/secrets/move (still works) • Deprecated endpoint POST /api/v3/secrets/raw/{secretName} (still works) • Deprecated endpoint POST /api/v3/secrets/tags/{secretName} (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Sat, 26 Sep 2026 12:55:12 GMT Breaking changes: • Deprecated endpoint DELETE /api/v1/pki/certificate-templates/{certificateTemplateId} (still works) • Deprecated endpoint DELETE /api/v1/pki/subscribers/{subscriberName} (still works) • Deprecated endpoint DELETE /api/v2/pki/certificate-templates/{templateName} (still works) • Deprecated endpoint GET /api/v1/pki/certificate-templates/{certificateTemplateId} (still works) • Deprecated endpoint GET /api/v1/pki/certificate-templates/{certificateTemplateId}/est-config (still works) • Deprecated endpoint GET /api/v1/pki/subscribers/{subscriberName} (still works) • Deprecated endpoint GET /api/v1/pki/subscribers/{subscriberName}/certificates (still works) • Deprecated endpoint GET /api/v1/pki/subscribers/{subscriberName}/latest-certificate-bundle (still works) • Deprecated endpoint GET /api/v2/pki/certificate-templates (still works) • Deprecated endpoint GET /api/v2/pki/certificate-templates/{templateName} (still works) • Deprecated endpoint PATCH /api/v1/pki/certificate-templates/{certificateTemplateId} (still works) • Deprecated endpoint PATCH /api/v1/pki/certificate-templates/{certificateTemplateId}/est-config (still works) • Deprecated endpoint PATCH /api/v1/pki/subscribers/{subscriberName} (still works) • Deprecated endpoint PATCH /api/v2/pki/certificate-templates/{templateName} (still works) • Deprecated endpoint POST /api/v1/pki/certificate-templates (still works) • Deprecated endpoint POST /api/v1/pki/certificate-templates/{certificateTemplateId}/est-config (still works) • Deprecated endpoint POST /api/v1/pki/subscribers (still works) • Deprecated endpoint POST /api/v1/pki/subscribers/{subscriberName}/issue-certificate (still works) • Deprecated endpoint POST /api/v1/pki/subscribers/{subscriberName}/order-certificate (still works) • Deprecated endpoint POST /api/v1/pki/subscribers/{subscriberName}/sign-certificate (still works) • Deprecated endpoint POST /api/v2/pki/certificate-templates (still works) • Deprecated endpoint POST /api/v2/pki/certificate-templates/{templateName}/issue-certificate (still works) • Deprecated endpoint POST /api/v2/pki/certificate-templates/{templateName}/sign-certificate (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Fri, 25 Sep 2026 13:22:33 GMT API surface changed: +27 endpoints, 3 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId} • New endpoint DELETE /api/v1/agent-vault/proxies/{proxyId} • New endpoint GET /api/status • New endpoint GET /api/v1/agent-vault/access-bundles • New endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId} • New endpoint GET /api/v1/agent-vault/access-bundles/{accessBundleId}/members • New endpoint GET /api/v1/agent-vault/members • New endpoint GET /api/v1/agent-vault/members/available • New endpoint GET /api/v1/agent-vault/proxies • New endpoint GET /api/v1/agent-vault/sessions • New endpoint GET /api/v1/identities/details • New endpoint PATCH /api/v1/agent-vault/access-bundles/{accessBundleId} • New endpoint PATCH /api/v1/agent-vault/access-bundles/{accessBundleId}/services/{serviceId} • New endpoint PATCH /api/v1/agent-vault/members/{actorType}/{actorId} • New endpoint PATCH /api/v1/agent-vault/proxies/{proxyId} • New endpoint POST /api/v1/agent-vault/access-bundles • New endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/members • New endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/members/revoke • New endpoint POST /api/v1/agent-vault/access-bundles/{accessBundleId}/services • New endpoint POST /api/v1/agent-vault/members • New endpoint POST /api/v1/agent-vault/members/revoke • New endpoint POST /api/v1/agent-vault/proxies • New endpoint POST /api/v1/agent-vault/proxies/{proxyId}/revoke • New endpoint POST /api/v1/agent-vault/proxies/{proxyId}/token-auth/enrollment-token • New endpoint POST /api/v1/agent-vault/sessions • New endpoint POST /api/v1/agent-vault/sessions/{sessionId}/revoke Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.16 https://github.com/Infisical/infisical/releases/tag/v0.165.16 Wed, 23 Sep 2026 15:44:50 GMT Infisical v0.165.16 adds GCP gateway enrollment, ClickHouse PAM support, secret scanning batching, and certificate deletion blocking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds GCP enrollment support for the Infisical Gateway, enabling GCP-based infrastructure to join the gateway network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds ClickHouse as a supported target for Privileged Access Management (PAM), enabling dynamic credential management for ClickHouse databases. • Blocks certificate deletion until the certificate has expired, preventing premature removal of active certificates. • Adds batching to secret scanning, improving throughput for large-scale secret scan operations. • Surfaces the 'Include All Subfolders' option for secret sync in the UI, making subfolder sync behavior configurable without API access. • Simplifies the resource creation menu in the secrets UI, reducing the steps needed to add new resources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.15 https://github.com/Infisical/infisical/releases/tag/v0.165.15 Tue, 22 Sep 2026 14:12:05 GMT Infisical v0.165.15 adds built-in PAM masking, a navbar theme toggle, and a stuck-timeout env var removal.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds built-in PAM masking to protect privileged access credentials from being exposed in the UI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a navbar theme toggle so users can switch themes directly from the navigation bar. • Removes the stuck timeout environment variable, eliminating a previously required workaround. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Mon, 21 Sep 2026 14:37:29 GMT API surface changed: +8 endpoints, 470 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/app-connections/powerdns/{connectionId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint GET /api/v1/app-connections/powerdns • New endpoint GET /api/v1/app-connections/powerdns/available • New endpoint GET /api/v1/app-connections/powerdns/connection-name/{connectionName} • New endpoint GET /api/v1/app-connections/powerdns/{connectionId} • New endpoint PATCH /api/v1/app-connections/powerdns/{connectionId} • New endpoint POST /api/v1/app-connections/powerdns • New endpoint POST /api/v1/app-connections/powerdns/{connectionId}/rotate-credentials Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.14 https://github.com/Infisical/infisical/releases/tag/v0.165.14 Mon, 21 Sep 2026 12:54:30 GMT Infisical v0.165.14 adds PowerDNS DNS-01 support, Agent Vault routing rules, and event-triggered alerts⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds PowerDNS as a DNS-01 provider for ACME certificate authorities, enabling automated certificate issuance via PowerDNS-managed zones.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds method and path rules, custom headers, and substitutions to Agent Vault for fine-grained request routing and transformation control. • Adds a transactional event outbox and event-triggered alerts for automated notifications on secret or infrastructure events. • Adds billing v2 usage breakdown and organization listing via a new API implementation. • Simplifies bulk secret selection and adds clipboard copying to the secrets UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.13 https://github.com/Infisical/infisical/releases/tag/v0.165.13 Fri, 18 Sep 2026 21:07:08 GMT Infisical v0.165.13 adds light mode, recursive secret syncs, per-org secret scanning limits, PKI sync certificate filters, and a unique-values validation rule.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a 'unique values across the whole project' validation rule to enforce that a secret value is not duplicated in any other secret within the project.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds recursive secret syncs (stage one), enabling secret sync jobs to traverse nested folder structures. • Adds the ability to filter which certificates are chosen when configuring PKI syncs. • Limits secret scanning to one project per organization. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Fri, 18 Sep 2026 07:41:36 GMT API surface changed: +4 endpoints, 175 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint POST /api/v1/cert-manager/syncs/certificate-orders/search⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint POST /api/v1/cert-manager/syncs/certificates/search • New endpoint POST /api/v1/pki/syncs/certificate-orders/search • New endpoint POST /api/v1/pki/syncs/certificates/search Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.12 https://github.com/Infisical/infisical/releases/tag/v0.165.12 Wed, 16 Sep 2026 18:58:37 GMT Restores Oracle Database PAM support, adds AWS US ISO/ISOB regions for external KMS, and introduces certificate audit log details for PKI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports AWS US ISO and ISOB regions for external KMS key management. • Adds audit log details for PKI certificate events. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.11 https://github.com/Infisical/infisical/releases/tag/v0.165.11 Tue, 15 Sep 2026 23:44:38 GMT Infisical v0.165.11 adds credential-free agents, Snowflake PAM, custom X.509 extensions, self-serve upgrades, and secret-scanning time-unit env vars.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds time-unit support for secret scanning environment variables, enabling human-readable duration configuration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Snowflake account support to the PAM (Privileged Access Management) module. • Supports custom X.509 extensions on certificate policies and profiles. • Introduces agent vault: Infisical agents that run without credentials (preview). • Makes the relay optional for gateways, reducing infrastructure requirements for gateway deployments. • Adds self-serve plan upgrade capability directly from the product UI. • Implements a copy secrets workflow in the secrets UI, enabling bulk secret copying across environments or projects. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Sat, 12 Sep 2026 13:30:08 GMT API surface changed: +16 endpoints, 11 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/secret-validation-rules/dynamic-secrets/{ruleId}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New endpoint DELETE /api/v1/secret-validation-rules/secret-rotations/{ruleId} • New endpoint DELETE /api/v1/secret-validation-rules/static-secrets/{ruleId} • New endpoint GET /api/v1/secret-validation-rules • New endpoint GET /api/v1/secret-validation-rules/dynamic-secrets • New endpoint GET /api/v1/secret-validation-rules/dynamic-secrets/{ruleId} • New endpoint GET /api/v1/secret-validation-rules/secret-rotations • New endpoint GET /api/v1/secret-validation-rules/secret-rotations/{ruleId} • New endpoint GET /api/v1/secret-validation-rules/static-secrets • New endpoint GET /api/v1/secret-validation-rules/static-secrets/{ruleId} • New endpoint PATCH /api/v1/secret-validation-rules/dynamic-secrets/{ruleId} • New endpoint PATCH /api/v1/secret-validation-rules/secret-rotations/{ruleId} • New endpoint PATCH /api/v1/secret-validation-rules/static-secrets/{ruleId} • New endpoint POST /api/v1/secret-validation-rules/dynamic-secrets • New endpoint POST /api/v1/secret-validation-rules/secret-rotations • New endpoint POST /api/v1/secret-validation-rules/static-secrets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.10 https://github.com/Infisical/infisical/releases/tag/v0.165.10 Fri, 11 Sep 2026 14:21:48 GMT Infisical v0.165.10 adds validation rule API revamp, certificate profile attachment for imported certs, and folder creation in vault migration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Revamps the validation rule API, enabling updated programmatic control over secret validation rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports attaching a certificate profile to imported certificates in PKI, enabling policy-driven management of externally sourced certs. • Adds folder creation support to the vault migration feature, allowing secrets to be migrated into a structured folder hierarchy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.9 https://github.com/Infisical/infisical/releases/tag/v0.165.9 Thu, 10 Sep 2026 00:33:12 GMT Infisical v0.165.9 adds a global command menu, INFISICAL_RUN_MODES env var, Daytona duplicate-sync detection, and PKI license gating.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces `INFISICAL_RUN_MODES` environment variable to control which operational modes the Infisical server runs in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a global command menu to the UI for fast keyboard-driven navigation across the platform. • Adds PKI license gating to enforce feature access based on license tier. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.7 https://github.com/Infisical/infisical/releases/tag/v0.165.7 Mon, 07 Sep 2026 19:27:56 GMT Infisical v0.165.7 adds break-glass emergency access for PAM requests and multi-sync LDAP connections. • Adds break-glass emergency access capability for PAM access requests, enabling out-of-band approval bypass in critical situations. • Allows a single LDAP connection to back multiple Linux and Windows syncs simultaneously, reducing connection overhead for directory-integrated environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Sun, 06 Sep 2026 11:51:53 GMT API surface changed: +17 endpoints, 31 modified • Adds Daytona app-connection APIs for availability and name lookup, lifecycle management, and credential rotation. • Adds Daytona secret-sync APIs for name lookup, lifecycle management, and importing, removing, or synchronizing secrets. • Updates request or response schemas across OIDC authentication identity endpoints, including create, retrieve, update, and delete operations. • Updates request or response schemas across Linux and Windows Certificate Manager and PKI sync APIs, including sync options and health checks. • Updates the request body for `PATCH /api/v1/identity-templates/{templateId}`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.3 https://github.com/Infisical/infisical/releases/tag/v0.165.3 Thu, 03 Sep 2026 19:43:42 GMT Infisical v0.165.3 adds Daytona secret sync, OIDC auth templates for Machine Identities, PAM heartbeats, and IdP-authoritative member sync. • Adds Daytona app connection and secret sync integration, enabling secrets stored in Infisical to be synced to Daytona environments. • Adds OIDC auth template support for Machine Identities, allowing reusable OIDC authentication configurations across MIs. • Adds PAM account password viewing gated behind access requests, so privileged account credentials require an approval workflow before being revealed. • Adds PAM heartbeats to track liveness of privileged access sessions. • Syncs member email and name from the identity provider when the IdP is configured as authoritative, keeping user profiles consistent with the upstream directory. • Removes plan-tier restriction from the policy delete endpoint, making policy deletion available regardless of subscription level. • Approval UI now shows human-readable names instead of UUIDs in the approvals list. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://infisical.com/openapi.json https://infisical.com/openapi.json Thu, 03 Sep 2026 07:40:00 GMT infisical now publishes an API — 2300 endpoints across 67 areas: App Connections, Secret Syncs, Secret Rotations, … • App Connections (666 endpoints) — create, read, update, delete • Secret Syncs (434 endpoints) — create, read, update, delete • Secret Rotations (285 endpoints) — create, read, update, delete • Pki Syncs (200 endpoints) — create, read, update, delete • Pki Certificate Authorities (93 endpoints) — create, read, update, delete • Pki Applications (37 endpoints) — create, read, update, delete • Secret Scanning (37 endpoints) — create, read, update, delete • Pki Signers (34 endpoints) — create, read, update, delete • 59 more areas: Pki Certificates, Folders, Secrets, Api, Groups, Pki Certificate Profiles, Pki Certificate Templates, Project Groups, Integrations, Project Identities, Identities, Pki Acme, Project Users, Projects, Secret Imports, Universal Auth, Dynamic Secrets, Environments, Pki Subscribers, Project Roles, Kms Keys, Pki Alerting, Pki Certificate Collections, Pki Discovery, Token Auth, Hsm Connectors, Identity Specific Privileges, Identity Specific Privileges V2, Kms Signing, Ldap Auth, Organization Roles, Organizations, Proxied Services, Spiffe Auth, Aws Auth, Alibaba Cloud Auth, Azure Auth, Gcp Auth, Jwt Auth, Kubernetes Auth, Oci Auth, Oidc Auth, Pki Certificate Policies, Project Templates, Secret Sharing, Sub Organizations, Tls Certificate Auth, Gateways, Pki Installations, Ldap Sso, Oidc Sso, Project Identity Membership, Saml Sso, Kms Encryption, Scim, Audit Logs, Event Subscriptions, Organization Identity Membership, Service Tokens Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.165.1 https://github.com/Infisical/infisical/releases/tag/v0.165.1 Tue, 01 Sep 2026 21:02:34 GMT Infisical v0.165.1 adds folder RBAC, GCP Certificate Manager sync, approval webhooks, and Kubernetes MI auth templates. • Adds GCP Certificate Manager Sync for PKI, enabling certificates managed in Infisical to be synced to Google Cloud Certificate Manager. • Adds folder RBAC, allowing role-based access control to be scoped at the folder level within projects. • Adds webhook events for approval and change request workflows, enabling external systems to react to secret approval lifecycle events. • Adds Kubernetes Managed Identity (MI) auth template support for machine identity authentication. • Adds `trim suffix` function to ABAC (attribute-based access control) policy expressions. • Adds pre-fetch commands for PKI sync agents on Windows and Linux platforms. • Exposes the latest renewal of a certificate via the PKI agent so agents can detect and follow certificate renewals. • Adds port number configuration to the Splunk dynamic secrets provider. • Sets project-level secret retention limits. • Revamps the replicate secrets workflow in the secret manager UI. • Adds helper text for DigiCert profiles during certificate issuance. • Defaults SSH access to an interactive shell in Privileged Access Management (PAM). • Adds a 'select all' option for the Vault import secret path Combobox in the UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.164.1 https://github.com/Infisical/infisical/releases/tag/v0.164.1 Thu, 27 Aug 2026 04:00:00 GMT Infisical v0.164.1 adds PostgreSQL account discovery for PAM, gateway pool load balancing, and LDAP/SQL/Linux validation rules. • Requires `config.siteUrl` in the `infisical-nkp` Helm chart configuration. • Adds PostgreSQL account discovery for Privileged Access Management (PAM). • Adds load balancing support for gateway pools. • Migrates identity and access provider forms for dynamic secrets to an updated UI. • Migrates data-service and protocol provider forms for dynamic secrets to an updated UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.164.0 https://github.com/Infisical/infisical/releases/tag/v0.164.0 Wed, 26 Aug 2026 19:50:24 GMT Infisical v0.164.0 adds cert profile creation inside applications and root encryption key rotation. • Allows creation of certificate profiles from directly inside applications, streamlining PKI workflows without leaving the app context. • Implements root encryption key rotation, enabling operators to rotate the platform's root encryption key. • Gates cross-project secret sharing actions by settings, giving admins finer control over which projects can share secrets. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.163.0 https://github.com/Infisical/infisical/releases/tag/v0.163.0 Wed, 26 Aug 2026 14:07:43 GMT Infisical v0.163.0 adds IAM auth for Postgres, RFC 8693 token exchange, KMS delete protection, and change policies for machine identities. • Adds IAM authentication for Postgres in the PAM (Privileged Access Management) module, enabling passwordless database credential management. • Adds RFC 8693 token exchange grant support for OAuth/OIDC flows. • Adds delete protection for KMS keys, preventing accidental key removal. • Extends change/approval policies to apply to machine identities, not just human users. • Adds dedicated folder views for PAM secrets. • Adds project tag editing under project settings. • Allows editing certificate details during manual certificate renewals. • Shows renewed certificates with a 'Renewed' status indicator in the certificate manager UI. • Migrates project roles access control UI to the v3 design. • Migrates dynamic secrets relational, warehouse, and managed-store provider forms to the v3 UI. • Adds clock skew handling for gateway and relay connections. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.162.23 https://github.com/Infisical/infisical/releases/tag/v0.162.23 Fri, 21 Aug 2026 17:36:59 GMT Infisical v0.162.23 adds PKCS#12 keystore import to certificate manager and raises the PKI post-sync command limit to 8192 characters. • Raises the PKI post-sync command character limit to 8192 characters, enabling longer post-sync scripts. • Adds PKCS#12 keystore import support to the certificate manager. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.162.22 https://github.com/Infisical/infisical/releases/tag/v0.162.22 Thu, 20 Aug 2026 22:43:48 GMT Infisical v0.162.22 adds Kubernetes auth for gateway enrollment, code-signing approval scoping, and a secret manager insights view. • Adds Kubernetes auth for gateway enrollment, enabling Kubernetes-native authentication when enrolling gateways. • Scopes code-signing approvals to a specific signing situation, allowing more granular control over approval workflows. • Adds a Secret Manager product insights view for visibility into secret manager usage and activity. • Bumps `infisical-nkp` Helm chart to 0.2.0 with Valkey support and `extraEnv` configuration. • Migrates machine identities access control to the v3 UI in the Access Control section. • Migrates project access control groups to v3 UI. • Migrates secret rotations setup flow to v3 UI. • Migrates project users access control to v3 UI. • Adds deprecation banners and email notifications for native integrations being deprecated. • Revamps commit history UI for improved auditability of secret changes. • Uses Cloudflare's bulk update endpoint for worker secrets, improving sync performance. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.162.20 https://github.com/Infisical/infisical/releases/tag/v0.162.20 Mon, 17 Aug 2026 19:16:39 GMT Infisical v0.162.20 adds KMIP auto certificate renewal and a shared provider form for dynamic secrets. • Adds KMIP auto certificate renewal, reducing manual overhead for certificate lifecycle management. • Adds a shared provider form contract for dynamic secrets, standardizing how dynamic secret providers are configured. • Adds dismiss of selected actions via the Escape key in the UI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.162.19 https://github.com/Infisical/infisical/releases/tag/v0.162.19 Mon, 10 Aug 2026 23:18:12 GMT Infisical v0.162.19 adds machine identity support for PAM access controls. • Adds machine identity (MI) support to PAM access, enabling non-human identities to be granted privileged access management permissions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical https://github.com/Infisical/infisical/releases/tag/v0.162.18 https://github.com/Infisical/infisical/releases/tag/v0.162.18 Fri, 07 Aug 2026 18:43:05 GMT Infisical v0.162.18 adds gateway support for Chef app connections and a new Modify Role action for project members. • Adds gateway support to the Chef app connection, enabling Chef integrations to route through Infisical gateways. • Adds a **Modify Role** action directly on project member role rows in the UI, allowing inline role changes without navigating away. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/infisical