<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A
# Checklist for submitter
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Summary
Moves the `POST
/api/v1/fleet/device/{token}/software/install/{software_title_id}`
("Install self-service software") endpoint out of the contributor-only
API reference (`docs/Contributing/reference/api-for-contributors.md`)
and into the public REST API docs (`docs/REST API/rest-api.md`), nested
under the existing `## Software` section.
- Added `### Install self-service software` to `docs/REST
API/rest-api.md`, right after `### Uninstall software`, with a TOC entry
and a note that it uses the device's authentication token instead of the
usual Fleet API token.
- Removed the TOC entry and body section for this endpoint from
`docs/Contributing/reference/api-for-contributors.md`. Sibling
device-authenticated self-service endpoints were left in place there
since only this one endpoint was moved.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an API route allowing Fleet Desktop users to initiate
self-service software installations using a device token and software
title.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44954
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Custom Host Vitals management (create/edit/delete, search) with
copyable variable tokens and per-host values.
* Show Custom Host Vitals on host details, including role-based editing.
* Enabled Custom Host Vitals in host-vitals labels and the activity
feed.
* Extended GitOps to manage global Custom Host Vitals declaratively
(including dry-run behavior).
* Split Controls → Variables into Global Variables and Custom Host
Vitals, including routing updates.
* **Bug Fixes**
* Improved validation and expansion of Custom Host Vital references
across scripts, profiles, installers, and deployments, with clearer
failures when values are missing or invalid.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#44348
**Base branch:** `docs-v4.86.0` (not `main`) per the docs release
process.
## What this PR does
Updates four customer-facing guides and adds a release-notes entry for
Phase 2's opt-in cert renewal feature (shipped via #45696). Frames the
marker as an opt-in enhancement: profiles without it continue to work as
in 4.85; profiles with it activate auto-renewal.
| Guide | Change |
|-------|--------|
| `connect-end-user-to-wifi-with-certificate.md` | Migrated 11 legacy
`\$FLEET_VAR_SCEP_RENEWAL_ID` refs to the preferred name; added
back-compat callout. |
| `okta-conditional-access-integration.md` | Removed "Automatic renewal
coming soon" line; added one-time upgrade-redeploy callout for existing
customers. |
| `enable-okta-verify-on-macOS-with-configuration-profile.md` | Added
marker to example profile OU; added opt-in note and CA-side
OU-preservation verification step. Coordinated with the earlier
example-profile update from #43293 already on `docs-v4.86.0`. |
| `enable-okta-verify-on-windows-using-a-scep-configuration-profile.md`
| Replaced manual-redeployment narrative with auto-renewal guidance.
Kept the policy-based expiry-monitoring SQL as an optional safeguard. |
Release-notes entry (`changes/40639-non-proxied-cert-renewal`)
consolidates Phase 2 customer-visible behavior in three bullets.
## Dependencies
The Conditional Access guide's "new setups: no extra action needed"
framing assumes #45662 (the Fleet-side template marker addition) has
landed — it has, merged into the feature branch and onward into main via
#45696.
# Checklist for submitter
- [x] Changes file added for user-visible changes
## Testing
- [x] Doc review only — no code changes
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Automatic certificate renewal is now supported for SCEP and ACME
certificates from external certificate authorities, enabled by default
for new deployments with an opt-in path for existing customers
* macOS devices with ACME-bearing configuration profiles will now
surface hardware-bound certificates in device vitals
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
Co-authored-by: kilo-code-bot[bot] <240665456+kilo-code-bot[bot]@users.noreply.github.com>
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: melpike <79950145+melpike@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Jonathan Katz <44128041+jkatz01@users.noreply.github.com>
Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
Co-authored-by: Scott Gress <scottmgress@gmail.com>
- @noahtalerman: For the following quick win:
- https://github.com/fleetdm/fleet/issues/23737
## Summary
Adds a "Targeted platforms" column and a platform filter dropdown to the
Policies page (`/policies/manage`), matching the pattern already used on
the Reports page (`/queries/manage`, `ManageQueriesPage`).
### Frontend
- New non-sortable **Targeted platforms** column rendered via
`PlatformCell`, sourced from each policy's comma-separated `platform`
field.
- New platform filter dropdown (All / macOS / Windows / Linux /
ChromeOS) wired as a `customControl` on the Policies table, alongside
the existing automation filter. Selecting a value pushes a new URL (not
a replace), resets `page` to 0, and updates the `platform` query param.
- `ManagePoliciesPage` reads `location.query.platform` and threads it
through to both `globalPoliciesAPI.loadAll` / `teamPoliciesAPI.loadAll`
and the react-query keys, plus the count endpoints. The
automation-filter and count "hide" conditions now include the platform
filter so they remain visible when only a platform filter is active.
- `frontend/services/entities/global_policies.ts` and `team_policies.ts`
accept an optional `platform` param (with `"all"` normalized to
`undefined`).
- Added tests for the new column and dropdown in
`PoliciesTable.tests.tsx`.
### Backend
- Added `Platform string ` + `` `query:"platform,optional"` `` to
`ListGlobalPoliciesRequest`, `CountGlobalPoliciesRequest`,
`ListTeamPoliciesRequest`, `CountTeamPoliciesRequest`.
- Extended datastore and service signatures (`ListGlobalPolicies`,
`ListTeamPolicies`, `ListMergedTeamPolicies`, `CountPolicies`,
`CountMergedTeamPolicies`, `ListGlobalPolicies`/`ListTeamPolicies` on
the service) to accept a `platform string` arg. Mocks and all call sites
updated.
- Platform filtering in SQL uses a new helper `platformFilterClause`:
```sql
AND (p.platforms = '' OR FIND_IN_SET(?, p.platforms))
```
so policies targeting "all platforms" (empty `platforms` field) always
match regardless of the selected filter. `FIND_IN_SET` uses a bound
parameter (no injection risk).
- Added a new MySQL integration test `testPoliciesPlatformFilter`
covering empty-platform (match-all), per-platform filter, and
team/merged paths.
### Docs
- REST API docs for `GET /api/v1/fleet/global/policies`, `GET
/api/v1/fleet/fleets/:id/policies`, and the corresponding `/count`
endpoints now document the `platform` query param.
- Added `changes/policies-targeted-platforms-filter`.
## Behavior
- `platform=all` (or missing) returns all policies.
- Selecting a specific platform returns policies whose `platforms`
column is empty OR contains the selected token.
- The dropdown only renders when the table is searchable (results exist
OR any filter is active).
- Changing the filter pushes a new URL and resets the page.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
Local verification:
- `go build ./...` — clean
- `go vet ./server/... ./cmd/... ./ee/...` — clean
- `make lint-go-incremental` — 0 issues
- Go service-level policy tests pass. MySQL integration tests compile
but could not be run locally (no Docker); CI will exercise the new
`testPoliciesPlatformFilter` test.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a "Targeted platforms" column with platform icons and an "All
platforms" option.
* Added a platform filter dropdown to scope policy lists; counts,
last-updated, and controls adapt when a platform filter is active.
Backend now honors an optional platform query parameter so filtering
returns matching policies.
* **Tests**
* Added and updated unit and integration tests covering the new column,
filter UI, and platform-filtered policy listings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: nulmete <nicoulmete1@gmail.com>
- Update the best practice is to create an API-only user w/ the admin
role and access only to necessary SCIM API endpoints
- These doc updates require [this
bug](https://github.com/fleetdm/fleet/issues/48062) to be fixed because
the `/scim/*` API endpoints aren't exposed as API endpoints one can pick
when creating an API only user
- Document the `/scim/*` API endpoints
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added SCIM API endpoints for managing users and groups.
* Supported actions include listing, creating, viewing, replacing,
updating, and deleting SCIM users and groups.
* Added read-only endpoints for SCIM schemas, service provider
configuration, and resource types.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
A bunch of little things I found while working on an unrelated PR awhile
back (handled here to reduce API design diff):
+ Fix broken link formatting
+ Finish up incomplete "Cancel batch script docs"
+ Fix ordering of "Get vulnerability" sections
+ Remove note about feature being GitOps-only (no longer true)
+ Add missing link to section contents
+ Add missing endpoint to `api_endpoints.yml`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added ability to cancel running batch script executions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **`api_endpoints.yml`**
* Added new Fleet API documentation entries for creating configuration
profiles and updating setup experience.
* Added documentation for creating Android web apps.
* Expanded Android Enterprise coverage by adding a new “Get Android
Enterprise” entry (kept disabled).
* Added complete documentation for certificate authority management,
including list, retrieve, update, and delete.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fix the Fleet-maintained apps list being cut off by adding server-side
pagination and applying platform / "hide added apps" filters across the
full library. Introduces MaintainedAppListOptions (with Platform and
AvailableOnly) and changes the ListAvailableFleetMaintainedApps /
ListFleetMaintainedApps signatures. Datastore now paginates and counts
by distinct app name, fetches all platform rows for apps on a page, and
returns a count and pagination metadata; default client page size set to
500. Frontend no longer performs client-side filtering or local
status/platform state; it relies on the API and uses data.count for
totals. Docs, tests, mocks, and various call sites updated (including a
new test that verifies pagination, platform and availability filters).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fleet-maintained apps listing now paginates server-side (100 per page)
so entries near the end of the alphabet are reachable.
* Platform and “Hide added apps” filters are applied across the entire
library, not just the currently loaded subset.
* The displayed count now matches results by counting macOS and Windows
versions separately.
* **New Features**
* Listing now supports URL-driven platform and “available” filtering,
and the UI consistently reflects the active filter state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
For #32765
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Fleet software package management (add/update) and download for
software titles.
* Added Apple App Store app management, including listing, adding, and
linking apps to titles.
* Added Fleet-maintained app support for titles.
* Enabled host software uninstalls and retrieval of install/uninstall
results via `install_uuid`.
* Added ability to remove a title’s “available for install” status.
* **Bug Fixes**
* Updated software title icon labeling to indicate download.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds a `macos_applications` boolean query parameter to the list host
software endpoint (`GET /api/_version_/fleet/hosts/{id}/software`). When
true, results are restricted to apps installed at the top level of the
macOS /Applications folder, hiding helper apps, system apps,
command-line tools, and user-local apps. The filter applies only to
macOS hosts and is ignored on other platforms.
The filter is applied by pruning the in-memory software maps in
ListHostSoftware down to the title IDs that have a top-level
`/Applications` bundle, so the count and paginated queries stay
consistent and the filter applies uniformly across regular, VPP, and
in-house apps. Top-level is determined from
`host_software_installed_paths` via
`installed_path LIKE '/Applications/%' AND NOT LIKE '/Applications/%/%'
on source 'apps'`.
**Related issue:** Resolves#39017
Closes#45969
## Summary
The `List certificate templates` API endpoint returned `null` for
certificates because the **API docs documented the wrong query parameter
name**. The docs said `fleet` but the code accepts `fleet_id` (or the
deprecated `team_id`). Customers following the docs used `?fleet=11`,
which was silently ignored, causing the endpoint to default to team 0
(unassigned) -- which typically has no certificates.
- **Docs fix**: Changed the parameter name from `fleet` (string) to
`fleet_id` (integer) in the REST API docs, matching how all other list
endpoints document this parameter.
- **API quality fix**: Initialize the `templates` slice in
`GetCertificateTemplatesByTeamID` so that when no templates exist, the
JSON response returns `"certificates": []` instead of `"certificates":
null`.
## Root cause
In `docs/REST API/rest-api.md`, the "List certificate templates"
endpoint documented the query parameter as `fleet` (string), but the
request struct accepts `fleet_id` or `team_id`:
```go
type listCertificateTemplatesRequest struct {
TeamID uint `query:"team_id,optional" renameto:"fleet_id"`
}
```
When the customer used `?fleet=11` (as documented), the parameter was
unrecognized and silently ignored. The endpoint defaulted to `team_id=0`
(unassigned), which had no certificates. The nil Go slice then
serialized to JSON `null`.
Credit to Andrey Kizimenko for identifying the docs mismatch.
## Changes
- `docs/REST API/rest-api.md` -- Fix parameter name from `fleet`
(string) to `fleet_id` (integer)
- `server/datastore/mysql/certificate_templates.go:174` -- Initialize
slice to avoid `null` in JSON
- `server/datastore/mysql/certificate_templates_test.go:489` -- Add
`require.NotNil` regression test
## Testing
All tests run locally against a real MySQL (Docker) and Redis instance:
| Test suite | Command | Result |
|---|---|---|
| Datastore integration (all certificate tests) | `MYSQL_TEST=1 go test
-run TestCertificates ./server/datastore/mysql/...` | 11 suites, 33
subtests, all PASS |
| Service unit tests | `go test -run
"TestCreateCertificateTemplate\|TestApplyCertificateTemplateSpecs\|..."`
| 4 suites, all PASS |
| Enterprise integration (full HTTP) | `MYSQL_TEST=1 REDIS_TEST=1 go
test -run "TestIntegrationsEnterprise/TestCertificatesSpecs"` | PASS |
| Enterprise integration (team delete) | `MYSQL_TEST=1 REDIS_TEST=1 go
test -run
"TestIntegrationsEnterprise/TestDeleteTeamCertificateTemplates"` | PASS
|
| Static analysis | `go build`, `go vet` | Clean |
Andrey's reproduction confirmed via screenshots:
- `?fleet_id=11` returns certificates correctly
- `?fleet=11` (the documented param) returns `null` -- the bug
- No param returns results when "unassigned" team has certificates
## QA steps
1. Follow the API docs to list certificate templates using
`?fleet_id=<id>`
2. Verify the response contains `"certificates": [...]` with the correct
data
3. Call without `fleet_id` and verify `"certificates": []` (not `null`)
for a team with no templates
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed the "List certificate templates" API documentation with the
correct query parameter name, enabling proper filtering of results.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45978?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- @noahtalerman: For the following story:
- https://github.com/fleetdm/fleet/issues/43557
## Summary
- Adds `bundle_identifier` as a top-level field on
`HostSoftwareWithInstaller` struct, which is the response type for all
host software API endpoints (`GET /api/v1/fleet/hosts/{id}/software`,
`GET /api/v1/fleet/device/{token}/software`, etc.)
- The value is sourced directly from `software_titles.bundle_identifier`
via the SQL query, so it is always present even when
`installed_versions` is empty (e.g., software that has never been
installed on a host)
- Falls back to `installed_versions[0].bundle_identifier` if the
title-level value is not available
- The field is retained inside `installed_versions` for full backwards
compatibility
## Changes
### `server/fleet/software_installer.go`
- Added `BundleIdentifier string` field with
`json:"bundle_identifier,omitempty" db:"-"` tag to
`HostSoftwareWithInstaller` struct
### `server/datastore/mysql/software.go`
- Added `TitleBundleIdentifier` field to internal `hostSoftware` struct
mapped to `title_bundle_identifier` DB column
- Added `software_titles.bundle_identifier AS title_bundle_identifier`
to all four SQL query branches:
- Software installers SELECT
- VPP apps SELECT
- In-house apps SELECT
- Available-for-install SELECT (`stmtAvailable`)
- Added `software_titles.bundle_identifier` to GROUP BY clauses for
software installers and VPP apps
- In the return path, populates `BundleIdentifier` from
`TitleBundleIdentifier` (with fallback to first installed version)
### `server/datastore/mysql/software_test.go`
- Added `BundleIdentifier` assertion to both `compareResults` helper
functions (macOS/Linux and iOS/iPadOS test suites)
- Added explicit top-level `BundleIdentifier` assertions in
`testListHostSoftwareWithVPPApps` where the installed version bundle
identifier is already verified
## Example response shape
```json
{
"id": 121,
"name": "Google Chrome.app",
"bundle_identifier": "com.google.Chrome",
"icon_url": null,
"software_package": { ... },
"app_store_app": null,
"source": "apps",
"status": "failed_install",
"installed_versions": [
{
"version": "121.0",
"bundle_identifier": "com.google.Chrome",
...
}
]
}
```
Built for
[ntalerman](https://fleetdm.slack.com/archives/D0AEA6U4SM9/p1774036621198819?thread_ts=1774035719.384099&cid=D0AEA6U4SM9)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Kilo Code <kilo@kilo.ai>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Co-authored-by: jkatz01 <yehonatankatz@gmail.com>
+ Remove unused `conditional_access_bypass_enabled` parameter that was
still documented
+ Rename "fleet policy" endpoints to "fleet-level policy" for clarity
