While January is nobody's favourite month, it's the only one to receive two Alloy updates! The update was originally scheduled for 30th January but was delayed until the evening of the 27th February. For a full list of changes in v2.67, please visit the Alloy Changelog.

Street Manager v5 🚧

The optional Street Manager module enables Alloy to interact with the government's Street Manager service, making it possible to view and apply for work permits on streets and roads, and record when work starts/stops.

Street Manager v4 is due to be decommissioned on 17th February 2025. Therefore, Alloy Web, Alloy Mobile and the Alloy API have all been updated to support the latest Street Manager v5.

Compared to the v4 upgrade, only a few of the changes affect Alloy this time around:

• A new permit status named Under Assessment.
• At the Condition Details stage, the maximum length of comments has increased from 500 to 1500 characters.
• New private street notices for USRNs representing partial or fully private streets. These may be supported in a future Alloy update.
• With the introduction of private street notices, it's no longer possible to issue work permits to private streets. When applying for a permit, Alloy now checks the entered USRN. If it represents a private street, another USRN must be entered.

For full details, see the Key Differences between V4 and V5 article by the Department for Transport.

JSON attribute schema ✔️❌

Designs and interfaces can have JSON attributes, which can store code written in JSON or GeoJSON format.

It's now possible to specify the Schema of a JSON attribute. A JSON Schema defines the structure of the expected JSON data and validates it against a set of rules and constraints. This gives you total control over what can be stored in the attribute.

While this is useful by itself, the real power of this new feature is unlocked with item forms!

With the new Json Form Editor control, you can display a dropdown list of custom data fields! Each data field is defined by the schema and can be configured to accept one or more text, number or date values, with various constraints applied (e.g. required, min/max limits). You can even define a bank of multiple text choices!

This adds another layer of flexibility to item forms and makes it possible to capture and display data values tailored to exact specifications. We're already using it to enhance Alloy in a number of ways. Stay tuned… 🚀

Optional workflow computations 🤔❔

Using the Alloy API, you can perform advanced computations when defining the parameters/variables of a workflow action. This can involve referencing the output of other actions in the workflow.

Previously, if a workflow computation referenced an action that ultimately wasn't performed (e.g the workflow has conditional branching paths), the workflow would fail due the lack of output.

Now, actions are guaranteed to always provide an output. If an action is skipped, it will output an empty attribute value. This makes workflows more reliable and makes it possible to define "optional" computations that may or may not be performed.

Welcome back! 👋 It's going to be a pivotal year for Alloy, with some truly groundbreaking new experiences and features heading your way very soon! In the meantime, there have been some significant changes in this month's release, along with the usual assortment of fixes and improvements.

The update took place during the evening of the 9th January. For a full list of changes in v2.66, please visit the Alloy Changelog.

New standard paths ➡️ ↘️ ↗️ ⚡

We've introduced the concept of standard paths to the Pathfinder. These are predefined shortcuts to attributes on connected designs or interfaces.

The Pathfinder lets you browse and select the attributes of a design/interface, plus the attributes of any others that are connected to it via a Link attribute. You can follow a Link attribute to visit a child design/interface, or navigate to a parent design/interface that links to the current one. You can repeat this in either direction for any number of "hops", enabling you to select attributes across multiple designs/interfaces where a path exists between them.

A standard path provides a handy shortcut to a connected attribute. Selecting it adds the attribute to your query in one go, saving you the time and effort of navigating to the relevant design/interface (potentially over many hops). Not only does this bring the connected attribute within easy reach, it also surfaces the attribute to users that may be unaware of its availability!

Standard paths can be defined on individual designs or interfaces. Currently, this can only be done via the API using the Design and DesignInterface endpoints (see Swagger or ReDoc).

However, it will soon be possible to define your own standard paths, as part of a whole new way of accessing Alloy! Stay tuned… 😉

Item form Link attribute filtering on Mobile 🛂

Item forms let you customise the visibility and order of attributes when creating/editing items of a particular design.

On a Link attribute control, it's possible to set a query that filters and sorts the linked items stored in the attribute. This provides a way to customise the lookup list shown to users when they select that control on the form.

For example, it can be used to limit the available choices for the Status Link attribute on task items.

This functionality is now available on Alloy Mobile on iOS and will be available on Android next month. When creating/editing an item of a design with an item form, if you select a Link attribute control that has a query set, the contents of the lookup list will now be filtered accordingly on Alloy Mobile.

Please note that item form expressions are not yet available on Alloy Mobile and will go unprocessed if present. Additionally, some of the less common control types don't currently display on Alloy Mobile. To see which are compatible, see Item form controls in Alloy Help.

API authentication 🔑

As previously announced, we can confirm that Alloy's API authentication has now been updated to only accept bearer tokens for enhanced security. Therefore, any tools or implementations that still supply tokens as headers or URL parameters will no longer be able to authenticate. If this causes any problems for you, please reach out to our Support team for assistance.

Congratulations for making it to the finish line of 2024! 🏁

It's been a more conservative year for Alloy, with a focus on behind-the-scenes improvements to Alloy's engine. While not too exciting, this has resulted in increased performance and reliability that everyone can benefit from.

In particular, Alloy Mobile iOS has seen numerous changes in the second half of the year, as part of a concentrated effort to significantly improve the user experience.

With that said, there have still been plenty of new features this year:

• A handsome new logo
• Cloud malware protection for uploaded files
• Exclude specific Text attributes from being searched
• Reports: new edit mode for Table controls, making it easier to configure headers, reorder columns and populate static/dynamic values
• Reports: new summary rows in Table controls for displaying calculated data values
• Routing: a more robust Routing Editor with reworked fastest/shortest optimisations
• Gateway: reconfigure validated imports without starting from scratch
• Gateway: clone validated imports
• Workflows: use encrypted secrets in Http Request actions
• Workflows: multi-instance Message and Output actions
• Access Policies: new expressions for building more complex rules
• Mobile: use item forms offline
• Mobile: add parent links to items
• Mobile: optimised Filters screen that excludes components and inaccessible designs

Alongside all this, work has continued throughout the year on an exciting project that we've hinted at a few times. It's taken a bit longer than we first anticipated – doesn't it always? – but as it represents the future of Alloy, we wanted to give it sufficient time to grow and evolve beyond our initial plans.

Fortunately, we're getting close to the point where we can finally reveal what we've been working on. Please bear with us a little longer, the Alloy revolution is almost here! ⚡

On behalf of the Alloy team, thank you for being with us in 2024. Enjoy the winter holidays and see you all in January! 👋

As we reach the end of 2024, there's a few things we want to let you know about before the holidays start.

API authentication deprecation 🌇

Back in July, we announced that Alloy's API authentication will only accept bearer tokens starting from next year. Therefore, this is one last reminder that token headers and token URL parameters will no longer work as of early January 2025.

If you haven't already, please update any integrations or tools you use accordingly!

Mobile developer account transfer 📲

As part of some new year housekeeping, we'll be transferring ownership of the Alloy Mobile app to new Causeway developer accounts on both the App Store and Google Play Store.

Don't worry, this won't affect Alloy Mobile's availability on either store! You won't need to reinstall the app and any unsynced data should be unaffected.

However, there may be some minor side effects:

• If you use your fingerprint to sign in, or rely on saved passwords, you may need enter your account details again.
• You may need to re-grant permission for Alloy Mobile to access your device's camera, gallery and location.

The developer transfer will be performed in January 2025. In the unlikely event that this causes any issues, please contact Support for assistance.

Alloy Mobile iOS map behaviour 🗺️

We will be improving the behaviour of the map in Alloy Mobile iOS:

• When selecting an item, the transition will be smoothly animated instead of abruptly jumping to the item.
• Selecting any part of an item's geometry will select the item. The map will pan and zoom so that the item's entire geometry is visible.
• With an item selected, selecting a marker on that item will zoom the map to that marker.
• If multiple item geometries overlap a location, selecting that location will cycle through those items.

Nothing too drastic but just so you know what to expect! These changes will be implemented in Alloy Mobile v2.66 on 9th January 2025. If you experience any issues with the new behaviour, please contact Support.

This month, we've been on a bug fixing mission 🐛. A plethora of issues have been identified and addressed to improve your overall Alloy experience.

For example: the Turn off all layers button no longer hides route geometry, NSG/NLPG imports can now be cloned successfully, and it's no longer possible to (eventually) scroll to a negative year in the calendar picker!

The update took place during the evening of the 28th November. For a full list of changes in v2.65, please visit the Alloy Changelog.

Check Link attributes in item form expressions 🔗 ⁉️

Expressions make your item forms dynamic and responsive to user input. Each control on the item form has properties such as Required, Read-only and Hidden. By targeting the output of an expression, these can change depending on the current state of the form.

You can build an expression by adding nodes and joining their inputs and outputs together. The Is Null conditional node outputs true or false depending on whether its input is empty or not. It's commonly joined onto a global node that fetches the value of an attribute control on the form.

Previously, the Is Null node didn't work with Alloy ID Array inputs. It therefore wasn't possible to check the contents of a Link attribute on the item being created/edited.

This has been now remedied, so you can build expressions like the one below, which fetches the value of the item's Defects attribute, checks it and outputs the result. This could be used to control the visibility of an attribute control that's only relevant for items with defects.

Please note: item form expressions aren't currently supported on Alloy Mobile. To learn more about them, check out Alloy Help.

We hope you like the new look of the Alloy Announcements page! 🎨

It's been a month of modest improvements to Alloy. No ground-breaking new features, just quiet optimisations and bug fixes to make your Alloy experience even better ✅. The update took place during the evening of the 31st October. For a full list of changes in v2.64, please visit the Alloy Changelog.

Cloud malware protection ⚠️

When uploading files to Alloy, they can now be scanned for malware.

Given Alloy's role in storing and processing lots of potentially sensitive data, we've always taken security very seriously. As a result, the attack surface of Alloy itself is fairly low, with no significant vulnerabilities detected during our annual third-party security tests. As a precaution, Alloy blocks the same file extensions as Microsoft Outlook by default, to prevent the storage of dangerous file types with well-known vulnerabilities.

However, it remains possible for a file containing malicious code to be uploaded and stored in Alloy. While it would effectively be dormant and unlikely to cause direct harm, bad actors could potentially utilise Alloy as a method of distribution for infected files (e.g. sent via workflow emails).

Therefore, files uploaded to Alloy can now be scanned using Amazon's GuardDuty Malware Protection. All files are quarantined by default until they pass the security checks. If malicious code is detected in a file, it remains inaccessible and can't be used for any purpose. Attempting to download it will display an error message, explaining why and recommending deletion.

If you wish to enable this extra layer of security on your customer project, please contact Support to opt in.

Most of this month's improvements are behind the scenes 🛠️. While there aren't any visible changes or new features to speak of, there have been significant improvements to Alloy's underlying engine.

In particular, Alloy's Task Executor has been worked on for over three weeks! The Task Executor monitors and juggles all the queued tasks (e.g. workflows, imports, bulk actions) to ensure they're performed efficiently, and that problematic tasks don't bring things to a standstill.

With more people using Alloy than ever before, the number and size of tasks has grown considerably, especially during peak times! 🥵

Therefore, the Task Executor has been upgraded to dynamically scale itself up and down in response to the current workload. Extra workers can be made available when things get busy. When things quieten down, workers can be shut down gracefully without interrupting any tasks in progress.

Bottom line: you should see increased reliability and performance in Alloy going forward!

The update took place during the evening of the 26th September. For a full list of changes in v2.63, please visit the Alloy Changelog.

This month, we’ve added a couple of handy new features and continued to focus on boosting the reliability of Alloy Mobile iOS 📱.

The update took place during the evening of the 29th August. For a full list of changes in v2.62, please visit the Alloy Changelog.

Use encrypted secrets in HTTP requests 🔐

When building a workflow, the Http Request action lets you send a web request to a specific URL. The method, URL, body and headers can be configured with static values or populated dynamically (based on the output of other actions in the workflow).

If a request requires authentication details or other sensitive data, this can now be stored securely within a Text attribute on an item of any design. To make the attribute secure, it must be configured with a custom tag named Secret. When the attribute is populated on an item, the value will now be saved as an encrypted text string. The original text won't be viewable to anyone!

To reference a secret in a Http Request action, enter a dollar sign $ plus the attribute’s code when configuring the relevant property. The item containing the desired value must also be added to the action’s Key Items.

In the example below, $attributes_credentialsPassword_66ceecb95527bff1c0a108c8 is included in the action’s Url and Http Headers properties. The decrypted value will be used in the request:

GET /test?pass=mypassword1234 HTTP/1.1
Host: alloytest.requestcatcher.com
Authorization: Bearer mypassword1234
Connection: Keep-Alive

Clone imports 🧬

To import data using Gateway, you need to create and configure an import item, validate its configuration, and then commit its data to Alloy.

If an import item’s Status is Validated or Processed, you now have the ability to clone it! When cloning an import, you can view the existing configuration and make changes to any step, or just create an exact duplicate.

This provides a handy way to redo a committed import (possibly with different data files), or experiment with alternative import configurations, without having to configure a new import from scratch.

To clone the current import item, select More in the action bar and choose Clone import.

Offline item forms in Alloy Mobile 📶

Item forms let you customise the order and appearance of attributes when users create or edit items of a particular design/interface.

In Alloy Mobile, item forms were previously loaded on demand. While this ensured they were up-to-date, they would unfortunately be skipped if your device happened to be offline at that precise moment.

Therefore, item forms are now downloaded when the app synchronises, and will be displayed regardless of your device’s connectivity.

To interact with Alloy’s API, you must include your personal API key in every request you send. Currently, there are three possible methods for doing this. However, two of these methods can potentially expose your API key to attackers.

Therefore, we’re announcing the deprecation of these insecure methods, which will be blocked entirely from January 2025.

Going forward, please use the bearer authentication scheme to communicate with Alloy.

Who will be affected?

All users and implementations that don’t use Bearer authentication to access the Alloy API.

Details

The following authentication methods are now deprecated. They continue to work for now, but will no longer be accepted in the near future:

• A token URL parameter:
  https://uk.alloyapp.io/api/session/me?token={value}

• A token header:
  Token: {value}

From now on, the only supported method is to use the Authorization header with the bearer scheme (RFC 6750):
Authorization: Bearer {token}

Expected release

January 2025

This month brings an assortment of behind-the-scenes improvements and fixes. Whilst these won’t be directly noticeable, you should find that various Alloy features are operating more robustly than before.

In particular, we’ve been focusing our efforts on Alloy Mobile, resulting in wide range of issues being identified and fixed (some of which were released as v2.60.1 and v2.60.2).

We’re also continuing to lay the foundations for the exciting new changes coming later this year 😎.

The update took place during the evening of the 25th July. For a full list of changes in v2.61, please visit the Alloy Changelog.