Published Release Notes

Easy access to proposition-related rules when creating change requests in revision management

When selecting propositions for change requests in Decision Strategy Manager, you can view the proposition filter, strategy, and when rules that are associated with the decision data the selected propositions belong to. In addition, you can include those rules in change requests. To view and add any associated rules to a change request, the rules must be part of the application overlay. With the ability to view and select all proposition-related data, you can consistently revise not only propositions themselves but also all associated rules.

For more information, see Proposition-centric revision management functionality.

PegaWAI ruleset deprecated in 8.5

Accessibility functions that were contained in the PegaWAI ruleset are now integrated into the main Pega Platform™. Consequently, the user interface in your applications now features accessibility functions out of the box, so you no longer need to use the PegaWAI ruleset to ensure accessible behavior in your application.

For more information, see Building an accessible UI.

Support for application-specific REST API calls

You can now call an authenticated REST API in the context of any application that is listed on an operator record by using the application alias URL. With the application alias URL, you can also develop REST services without changing the access group in the service package. REST services run in the context of the access group that points to the provided application, instead of the access group that is specified in the service package.

For more information, see Invoking a REST service rule.

Tamper-proof Pega Web Mashup loading

To protect your application from hackers, Pega Web Mashup is now loaded in a more secure way. The system generates a channel ID in the mashup code for validation on the server, before passing the mashup request. 

For more information, see Creating a mashup.

Upgrade impact

After an upgrade to Pega Platform 8.5, existing mashups, which do not have the channel ID parameter in their code, cannot load and users see the access control warning.

What steps are required to update the application to be compatible with this change?

If you need to maintain full availability of the mashup during the upgrade of the production environment, perform the steps in Migrating existing mashups.

Enhancements to email approvals in a case

The following enhancements have been made to email approvals in a case:

• In Designer Studio, you can quickly access the correspondence rule to customize the email template by clicking the Configure email template link on an approval step.
• In Designer Studio, you can add or remove the fields that are displayed in the approval email by customizing the associated Review view.
• In Case Designer, you can now quickly enable email approval when you click an approval step and route it to another user without having to switch to Process Modeler if you are working Designer Studio or switching to Designer Studio if you are working in express mode.
• Recipients of email approvals can quickly open cases by clicking the links to the related cases that are provided in the emails.

For more information, see Email approval enhancements in a case type.

Automatic separation of date input

Date fields in Date Time controls now automatically divide strings of input into days, months, and years. In single fields, the system adds slashes (/) as the user types the value. For example, an input string of 10102020 becomes 10/10/2020. In separate day/month/year fields, the system automatically switches from one field to the next as the user types the value. This enhancement improves the user experience by helping to users provide input in a more convenient and time-efficient manner.

For more information, see Configuring a Date Time control.

Improvements to OAuth 2.0 Services with Token Introspection Service and Token Denylist Service

Increase the security of user sessions by using the newly supported Token Introspection and Denylist services for OAuth 2.0.

Token Introspection service

Use the Token Introspection service to validate JSON Web Tokens (JWT). The Token Introspection service requires authentication. 

Pega now uses OAuth 2.0 access tokens called Authorized Access Tokens (AAT). 

Token Introspection service endpoint

The Token Introspection service endpoint provides the information about the status of access token and refresh token. Token introspection can be used to validate if a given token is still active or inactive. The token introspection endpoint determines whether the token is valid. The status indicates whether an access token or refresh token is valid or invalid: 

• Valid tokens have the “active”:true status
• Invalid tokens have the “active” :false status.

The inactive status can also be due to revocation. 

Token Denylist service

You can add tokens to the deny list in cases where suspicious activity might have occurred. The Token Denylist service provides a method for denying user access to the application by revoking the user's access token. This service can prevent a token from being used more than the specified number of times, which can be helpful in preventing replay attacks. Stolen tokens should be revoked using this service. A GET API is also available to get the list of denied tokens.

Keys endpoint

Pega Platform™ is changing from using opaque tokens to JSON Web (JWT) tokens. If this JWT is used by any other system, the public key is needed for signature verification. A new endpoint is exposed to provide these public keys in JWK format: https://host:port/prweb/api/oauth2/v1/token/keys.

For more information, see OAuth 2.0 Management Services.

Usability improvements in Pega Express

The following enhancements have been made in Pega Express to improve your development experience:

• Case Designer now has an option to create a case so that you can quickly test changes to the configuration of your case types.
• There are fewer steps in the process for configuring a dynamic view.
• Some controls on the screen have been repositioned for easier access and support for users who are not using a mouse.
• Some elements on the Life cycle tab of Case Designer support keyboard navigation when you use the Tab, Enter, Right Arrow, or Left Arrow keys.
• The status of a case can be set at the assignment level.

For more information about these changes, see:

• Creating a case
• Configuring a dynamic view
• Configuring a case at run time
• Adding an assignment to a process

Search and Reporting does not index large items

When using the Search and Reporting (SRS) microservice in Pega Platform™ 8.5, you might encounter problems with indexing large out-of-the-box rules. The issue is not visible in Queue Processors, but you can access logs to verify which items the system does not index.

Escalation actions removed from case-wide goals and deadlines

The option to define an escalation action for a case-wide goal and deadline has been removed from Case Designer because the standard actions, Notify assignee and Notify manager, apply to assignments, not cases. You can still define escalation actions for goals and deadlines that apply to an assignment.

For more information, see Defining an escalation action for an assignment.