Congratulations for making it to the finish line of 2024! 🏁

It's been a more conservative year for Alloy, with a focus on behind-the-scenes improvements to Alloy's engine. While not too exciting, this has resulted in increased performance and reliability that everyone can benefit from.

In particular, Alloy Mobile iOS has seen numerous changes in the second half of the year, as part of a concentrated effort to significantly improve the user experience.

With that said, there have still been plenty of new features this year:

• A handsome new logo
• Cloud malware protection for uploaded files
• Exclude specific Text attributes from being searched
• Reports: new edit mode for Table controls, making it easier to configure headers, reorder columns and populate static/dynamic values
• Reports: new summary rows in Table controls for displaying calculated data values
• Routing: a more robust Routing Editor with reworked fastest/shortest optimisations
• Gateway: reconfigure validated imports without starting from scratch
• Gateway: clone validated imports
• Workflows: use encrypted secrets in Http Request actions
• Workflows: multi-instance Message and Output actions
• Access Policies: new expressions for building more complex rules
• Mobile: use item forms offline
• Mobile: add parent links to items
• Mobile: optimised Filters screen that excludes components and inaccessible designs

Alongside all this, work has continued throughout the year on an exciting project that we've hinted at a few times. It's taken a bit longer than we first anticipated – doesn't it always? – but as it represents the future of Alloy, we wanted to give it sufficient time to grow and evolve beyond our initial plans.

Fortunately, we're getting close to the point where we can finally reveal what we've been working on. Please bear with us a little longer, the Alloy revolution is almost here! ⚡

On behalf of the Alloy team, thank you for being with us in 2024. Enjoy the winter holidays and see you all in January! 👋

As we reach the end of 2024, there's a few things we want to let you know about before the holidays start.

API authorisation deprecation 🌇

Back in July, we announced that Alloy's API authentication will only accept bearer tokens starting from next year. Therefore, this is one last reminder that token headers and token URL parameters will no longer work as of early January 2025.

If you haven't already, please update any integrations or tools you use accordingly!

Mobile developer account transfer 📲

As part of some new year housekeeping, we'll be transferring ownership of the Alloy Mobile app to new Causeway developer accounts on both the App Store and Google Play Store.

Don't worry, this won't affect Alloy Mobile's availability on either store! You won't need to reinstall the app and any unsynced data should be unaffected.

However, there may be some minor side effects:

• If you use your fingerprint to sign in, or rely on saved passwords, you may need enter your account details again.
• You may need to re-grant permission for Alloy Mobile to access your device's camera, gallery and location.

The developer transfer will be performed in January 2025. In the unlikely event that this causes any issues, please contact Support for assistance.

Alloy Mobile iOS map behaviour 🗺️

We will be improving the behaviour of the map in Alloy Mobile iOS:

• When selecting an item, the transition will be smoothly animated instead of abruptly jumping to the item.
• Selecting any part of an item's geometry will select the item. The map will pan and zoom so that the item's entire geometry is visible.
• With an item selected, selecting a marker on that item will zoom the map to that marker.
• If multiple item geometries overlap a location, selecting that location will cycle through those items.

Nothing too drastic but just so you know what to expect! These changes will be implemented in Alloy Mobile v2.66 on 9th January 2025. If you experience any issues with the new behaviour, please contact Support.

This month, we've been on a bug fixing mission 🐛. A plethora of issues have been identified and addressed to improve your overall Alloy experience.

For example: the Turn off all layers button no longer hides route geometry, NSG/NLPG imports can now be cloned successfully, and it's no longer possible to (eventually) scroll to a negative year in the calendar picker!

The update took place during the evening of the 28th November. For a full list of changes in v2.65, please visit the Alloy Changelog.

Check Link attributes in item form expressions 🔗 ⁉️

Expressions make your item forms dynamic and responsive to user input. Each control on the item form has properties such as Required, Read-only and Hidden. By targeting the output of an expression, these can change depending on the current state of the form.

You can build an expression by adding nodes and joining their inputs and outputs together. The Is Null conditional node outputs true or false depending on whether its input is empty or not. It's commonly joined onto a global node that fetches the value of an attribute control on the form.

Previously, the Is Null node didn't work with Alloy ID Array inputs. It therefore wasn't possible to check the contents of a Link attribute on the item being created/edited.

This has been now remedied, so you can build expressions like the one below, which fetches the value of the item's Defects attribute, checks it and outputs the result. This could be used to control the visibility of an attribute control that's only relevant for items with defects.

Please note: item form expressions aren't currently supported on Alloy Mobile. To learn more about them, check out Alloy Help.

We hope you like the new look of the Alloy Announcements page! 🎨

It's been a month of modest improvements to Alloy. No ground-breaking new features, just quiet optimisations and bug fixes to make your Alloy experience even better ✅. The update took place during the evening of the 31st October. For a full list of changes in v2.64, please visit the Alloy Changelog.

Cloud malware protection ⚠️

When uploading files to Alloy, they can now be scanned for malware.

Given Alloy's role in storing and processing lots of potentially sensitive data, we've always taken security very seriously. As a result, the attack surface of Alloy itself is fairly low, with no significant vulnerabilities detected during our annual third-party security tests. As a precaution, Alloy blocks the same file extensions as Microsoft Outlook by default, to prevent the storage of dangerous file types with well-known vulnerabilities.

However, it remains possible for a file containing malicious code to be uploaded and stored in Alloy. While it would effectively be dormant and unlikely to cause direct harm, bad actors could potentially utilise Alloy as a method of distribution for infected files (e.g. sent via workflow emails).

Therefore, files uploaded to Alloy can now be scanned using Amazon's GuardDuty Malware Protection. All files are quarantined by default until they pass the security checks. If malicious code is detected in a file, it remains inaccessible and can't be used for any purpose. Attempting to download it will display an error message, explaining why and recommending deletion.

If you wish to enable this extra layer of security on your customer project, please contact Support to opt in.

Most of this month's improvements are behind the scenes 🛠️. While there aren't any visible changes or new features to speak of, there have been significant improvements to Alloy's underlying engine.

In particular, Alloy's Task Executor has been worked on for over three weeks! The Task Executor monitors and juggles all the queued tasks (e.g. workflows, imports, bulk actions) to ensure they're performed efficiently, and that problematic tasks don't bring things to a standstill.

With more people using Alloy than ever before, the number and size of tasks has grown considerably, especially during peak times! 🥵

Therefore, the Task Executor has been upgraded to dynamically scale itself up and down in response to the current workload. Extra workers can be made available when things get busy. When things quieten down, workers can be shut down gracefully without interrupting any tasks in progress.

Bottom line: you should see increased reliability and performance in Alloy going forward!

The update took place during the evening of the 26th September. For a full list of changes in v2.63, please visit the Alloy Changelog.

This month, we’ve added a couple of handy new features and continued to focus on boosting the reliability of Alloy Mobile iOS 📱.

The update took place during the evening of the 29th August. For a full list of changes in v2.62, please visit the Alloy Changelog.

Use encrypted secrets in HTTP requests 🔐

When building a workflow, the Http Request action lets you send a web request to a specific URL. The method, URL, body and headers can be configured with static values or populated dynamically (based on the output of other actions in the workflow).

If a request requires authentication details or other sensitive data, this can now be stored securely within a Text attribute on an item of any design. To make the attribute secure, it must be configured with a custom tag named Secret. When the attribute is populated on an item, the value will now be saved as an encrypted text string. The original text won't be viewable to anyone!

To reference a secret in a Http Request action, enter a dollar sign $ plus the attribute’s code when configuring the relevant property. The item containing the desired value must also be added to the action’s Key Items.

In the example below, $attributes_credentialsPassword_66ceecb95527bff1c0a108c8 is included in the action’s Url and Http Headers properties. The decrypted value will be used in the request:

GET /test?pass=mypassword1234 HTTP/1.1
Host: alloytest.requestcatcher.com
Authorization: Bearer mypassword1234
Connection: Keep-Alive

Clone imports 🧬

To import data using Gateway, you need to create and configure an import item, validate its configuration, and then commit its data to Alloy.

If an import item’s Status is Validated or Processed, you now have the ability to clone it! When cloning an import, you can view the existing configuration and make changes to any step, or just create an exact duplicate.

This provides a handy way to redo a committed import (possibly with different data files), or experiment with alternative import configurations, without having to configure a new import from scratch.

To clone the current import item, select More in the action bar and choose Clone import.

Offline item forms in Alloy Mobile 📶

Item forms let you customise the order and appearance of attributes when users create or edit items of a particular design/interface.

In Alloy Mobile, item forms were previously loaded on demand. While this ensured they were up-to-date, they would unfortunately be skipped if your device happened to be offline at that precise moment.

Therefore, item forms are now downloaded when the app synchronises, and will be displayed regardless of your device’s connectivity.

To interact with Alloy’s API, you must include your personal API key in every request you send. Currently, there are three possible methods for doing this. However, two of these methods can potentially expose your API key to attackers.

Therefore, we’re announcing the deprecation of these insecure methods, which will be blocked entirely from January 2025.

Going forward, please use the bearer authentication scheme to communicate with Alloy.

Who will be affected?

All users and implementations that don’t use Bearer authentication to access the Alloy API.

Details

The following authentication methods are now deprecated. They continue to work for now, but will no longer be accepted in the near future:

• A token URL parameter:
  https://uk.alloyapp.io/api/session/me?token={value}

• A token header:
  Token: {value}

From now on, the only supported method is to use the Authorization header with the bearer scheme (RFC 6750):
Authorization: Bearer {token}

Expected release

January 2025

This month brings an assortment of behind-the-scenes improvements and fixes. Whilst these won’t be directly noticeable, you should find that various Alloy features are operating more robustly than before.

In particular, we’ve been focusing our efforts on Alloy Mobile, resulting in wide range of issues being identified and fixed (some of which were released as v2.60.1 and v2.60.2).

We’re also continuing to lay the foundations for the exciting new changes coming later this year 😎.

The update took place during the evening of the 25th July. For a full list of changes in v2.61, please visit the Alloy Changelog.

The ApplicableTypes API endpoint (Swagger, ReDoc) can add and remove associations between specific activity designs and asset designs.

We’re updating this endpoint so that you can perform multiple “Applies to” operations in one go. This’ll make it possible to associate multiple work items with multiple jobs in a single API call!

However, the update will introduce a minor breaking change to prepare for.

Who will be affected?

Users and implementations that add or remove applicable types via the Alloy API.

Details

The following endpoints have a from parameter that currently accepts a single ApplicableFromWebModelBase model:

• Add applicable types – POST /api/applicable-type
• Remove applicable types – DELETE /api/applicable-type

After the release date, the from parameter will require an array of ApplicableFromWebModelBase models, even if you’re only supplying one.

Expected release

25th July 2024 as part of the Alloy v2.61 release.

This month’s update brings several quality-of-life improvements to make using Alloy easier. The update took place during the evening of the 27th June. For a full list of changes in v2.60, please visit the Alloy Changelog.

Improved Routing Editor 📍

We’ve made several behind-the-scenes improvements to the Routing Editor, which lets you plan routes between the tasks of a project and any added waypoints.

The Routing Editor now behaves more robustly when switching between the fastest route (quickest time to visit all waypoints in the current order) and the shortest route (reorder waypoints for shortest travel distance). The current route type is now indicated by a new attribute on the route’s General tab. The route’s Geometry tab is also updated accordingly.

System DoDIs are now hidden 🙈

Alloy includes many core designs and interfaces that underpin its system features. These get listed alongside all the other designs/interfaces in your customer project, in places such as the Search panel, Data Explorer and Permissions Manager.

To help simplify things a bit, we’ve gone through these system designs/interfaces and hidden the ones that no one realistically needs to access. This includes:

• All workflow action designs, e.g. Add Links, Message
• The Applicable To and Applicable Filter designs
• The Counters design
• Many designs/interfaces related to reports:
  • Reports
  • Report Types
  • Report Documents
  • File Report Documents
  • Custom Report
  • Item Level Report
  • Summary Level Report
  • The designs of all your custom reports

This should make it easier to find what you want going forward!

In the unlikely event that you need to view items of hidden designs/interfaces, you can still use the Search panel to search within them. Start typing its name and choose the design/interface when it appears. To view the resulting items in the Data Explorer, select the highlighted button.

Reconfigure validated imports 🗂️

Using Gateway, you can create and configure data imports. After an import’s configuration has been successfully validated, you can choose to Reconfigure it as needed.

While this was always possible, you originally had to redefine the configuration from scratch. Now, the existing configuration is loaded, making it far easier to tweak a property or attribute!

Multi-instance Message and Output actions 📧

When building a workflow, you can add various actions to its branches. The Message action can send an email/SMS and the Output action can fetch specific items for the workflow to act on.

Previously, both actions operated only in single instance mode. This means that the action is always performed one time only, regardless of the number of input items.

Now, both actions have a new Single Instance property, which is disabled by default. This means the action will be performed for each input item. If there are no input items, the action isn’t performed.

For example, imagine a Message action that receives three input items. If its Single Instance property is enabled, one message will be sent containing 3 items. If not, three messages will be sent containing one item each.