Published Release Notes

Improvements to OAuth 2.0 Services with Token Introspection Service and Token Denylist Service

Increase the security of user sessions by using the newly supported Token Introspection and Denylist services for OAuth 2.0.

Token Introspection service

Use the Token Introspection service to validate JSON Web Tokens (JWT). The Token Introspection service requires authentication. 

Pega now uses OAuth 2.0 access tokens called Authorized Access Tokens (AAT). 

Token Introspection service endpoint

The Token Introspection service endpoint provides the information about the status of access token and refresh token. Token introspection can be used to validate if a given token is still active or inactive. The token introspection endpoint determines whether the token is valid. The status indicates whether an access token or refresh token is valid or invalid: 

• Valid tokens have the “active”:true status
• Invalid tokens have the “active” :false status.

The inactive status can also be due to revocation. 

Token Denylist service

You can add tokens to the deny list in cases where suspicious activity might have occurred. The Token Denylist service provides a method for denying user access to the application by revoking the user's access token. This service can prevent a token from being used more than the specified number of times, which can be helpful in preventing replay attacks. Stolen tokens should be revoked using this service. A GET API is also available to get the list of denied tokens.

Keys endpoint

Pega Platform™ is changing from using opaque tokens to JSON Web (JWT) tokens. If this JWT is used by any other system, the public key is needed for signature verification. A new endpoint is exposed to provide these public keys in JWK format: https://host:port/prweb/api/oauth2/v1/token/keys.

For more information, see OAuth 2.0 Management Services.

Define function input parameters on the Create or Save As forms

When creating or updating a Rule-Utility-Function ruleset in Designer Studio, use the Create or Save As forms to define or change parameters as a part of the form. The Parameters section on either of these forms allows you to set the function's name and Java type before opening the function.

Previously, you updated these fields on the Parameters tab for the function after the form was created. Moving these fields to the Create and Save As forms helps to proactively detect functions with the same signature in the same ruleset before saving the function.

For more information, see Defining function input parameters on the Create or Save As forms.

Quickly attach a file to a case directly on a user form

In form configuration, the Attachment field type allows users to attach files directly to the form rather than performing an additional action.

For example, an insurance adjuster can take a photo of a vehicle and add the photo directly to the form. When the field type is configured as an attachment, at run time a new section is auto-generated with an attachment control that includes a read-only text input field and a browse button.

Search and Reporting does not index large items

When using the Search and Reporting (SRS) microservice in Pega Platform™ 8.5, you might encounter problems with indexing large out-of-the-box rules. The issue is not visible in Queue Processors, but you can access logs to verify which items the system does not index.

Simplified creation of case types

A wizard is now available in the Case Type Explorer that walks you through the process of creating a case type. Helper text and default values gradually introduce you to stage-based case types to facilitate your transition from the wizard to Case Designer. To run the wizard, click Add a case type or select Add a child case type from the menu of an existing case type in the Case Type Explorer.

For more information about this wizard, see Case type wizard in the Case Type Explorer. 

Improved identification and handling of code assembly errors

Code assembly error logs are now more meaningful and help you identify root causes with better accuracy. Pega Platform™ now also invalidates erroneous assembly to facilitate successful reassembly when the code is accessed again. For example, if a section is not correctly assembled when a user first signs in to the system, the application attempts to reassemble that section the next time a user signs in. In this way, you can avoid lingering issues and improve stability.

Enhanced tables in Cosmos React UI

The Pega Platform™ Cosmos React UI environment now includes improved tables. The updated tables use a revamped graphic design and support a number of new run-time behaviors, including column freezing and advanced filtering. The added features improve the user experience by giving case workers more control over data in tables, while the revised architecture enhances efficiency and reliability.

Convert data instances into decision parameter rules

The Convert groups wizard is available in the Hierarchy landing page when the list of your propositions include decision data records.

Click Convert groups at the top of the landing page to use the wizard and to convert data instances into decision parameter rules. This conversion is necessary to make the existing proposition data instances available for revision management.

Response timeout configuration for predictions

You can now set a response timeout for your predictions in Prediction Studio. By setting a response timeout, you control how Prediction Studio registers customer responses that later serve as feedback data for your predictions.

For more information, see Customizing predictions.

Full-screen menus improve mobile navigation

A new full-screen menu setting for enhanced mobile functionality provides a smooth and seamless mobile navigation experience. Previously, regular drop-down menus were difficult to navigate on a mobile device. Select Component styles > Menus > Menu Bar > Display "Show Menu" as full screen menu to enable and configure this setting in a Skin form.