LDAP setup checks now appear at startup and in Observe diagnostics — Startup now checks whether the configured LDAP bind mode and account can read the attributes needed for reliable transcription. Fatal problems stop startup with remediation, while non-fatal warnings appear in startup output and Observe diagnostics without changing Kubernetes readiness. This helps operators distinguish empty data from authentication or directory permission problems.
Download a redacted setup report for support — The Operator UI dashboard can prepare a setup report to attach to a support ticket for first-run problems such as a missing REST API, a UI that shows no entries, documentation that does not load, or directory data that never appears. The report captures which APIs are enabled and where they are served, sockets and runtime ports, sign-in state, documentation availability, and whether the service can read your directory, with each check labeled passed, failed, skipped, or unavailable. Passwords, tokens, URL credentials, and other secrets are removed before download. See Reporting to support.
Changed
Exported traces no longer carry raw directory identity by default — With trace export enabled (monitoring.traces.enabled = true), exported spans previously included raw distinguished names, usernames, subject identifiers, entry UOID and UUID, and request URLs, which reached whichever collector or APM you export to. These identity values are now removed by default; enumerations, counts, durations, request outcome, and query shape are still sent unchanged, and internal wide logs keep full detail. To send specific identifiers to a collector you trust, set per-key strategies under monitoring.traces.redaction — for example "scribe.entry_uoid" = identity to correlate spans by entry, or "auth.effective_dn" = hash to group by subject without the name. Distinguished names, usernames, and URLs accept hash but are never sent raw.
Fixed
Wide logs apply the configured per-key redaction rules — Wide logs now redact attribute values according to monitoring.log.redaction, including the built-in defaults that hash distinguished names (*dn*) and truncate email addresses (*email*). Previously, glob patterns and dotted attribute keys in this setting were silently skipped, so distinguished names and email addresses could appear in wide logs in full despite the configuration. The always-on secret redaction (passwords, tokens, credentials, cookies) and trace export redaction were unaffected.
The Inbox groups repeated recommendations into one card per fix — When the same coverage recommendation (for example, missing sortable, value-match, or partial-match coverage on an attribute) is observed across many searches, the Inbox now shows a single card for each distinct fix instead of one card per observation. Each card shows how many observations support it and when it was last seen, and snooze, apply, and dismiss act on the whole group at once. The full evidence behind a card stays available from its detail view. Previously, a handful of real fixes could appear as hundreds of duplicate cards, and acting on one card did not affect the others.
The Operator UI works when public API documentation is private — With production defaults, the REST data API remains available while the public API reference is off. The Entries view now loads its type information without depending on the public /api page, and dashboards and startup output no longer present documentation links that would return 404. Previously, a secure first-run setup could make the UI look empty or point operators to /api.
LDAP search responses preserve requested attribute-name casing — When an LDAP client requests objectClass, ENTRYUUID, or another explicit spelling, IdentityScribe returns the attribute using that requested spelling while matching stays case-insensitive. Previously, local LDAP responses could return the configured spelling instead, which surprised clients that compare response attribute names.
Observe API documentation matches the channel status response — The OpenAPI document now describes the REST, GraphQL, MCP, and authentication availability fields returned by /observe/channels, so clients that validate Observe responses against the spec no longer reject the channel status response. Previously, the response was valid at runtime but missing from the generated API contract.
Observe API documentation matches doctor status responses — The OpenAPI document now includes the noisy status returned by /observe/doctor for informational checks, so clients that validate Observe responses against the spec no longer reject a valid doctor response. Health and readiness behavior are unchanged.
The API catalog lists only documentation links that are served — /.well-known/api-catalog no longer advertises REST or GraphQL reference, schema, or playground URLs that return 404 when public API documentation is turned off (the production default). Each enabled channel’s base URL stays listed so the data API stays discoverable, and the documentation, schema, and UI links reappear once you enable them. Previously, the catalog could send API discovery clients to /api.json, the /api reference page, or the GraphQL schema even when those endpoints were disabled.
Searches on attributes from older databases are repaired automatically on upgrade — On databases first created by earlier versions, searches filtering on certain attributes (for example objectClass) could fail at runtime. Upgrading now reconciles the affected databases automatically, so those searches succeed with no change to your attribute configuration — keep objectClass spelled as objectClass. No manual steps are required.
