Skip to main content

FormKiQ v1.19.2 — API & Backend

This release covers the API, backend services, infrastructure, and technical modules. It bundles FormKiQ Web v4.3.8; subsequent web releases are documented independently in the changelog.

Release Summary​

FormKiQ 1.19.2 expands document search, metadata, and access control. Core adds multi-attribute searches without composite keys, count-only search responses, JSON attributes with nested-field filtering, custom API key claims, and content-only deletion that preserves the document record. More specific API permissions give applications greater control over individual operations.

The commercial platform adds usage-limited short links, configurable document-review completion criteria, policy testing, and text watermark substitutions. Optional modules add JSON attribute searches in OpenSearch, more DocuSign recipient fields and envelope audit events, faster antivirus scanning, and updated document-generation and policy runtimes. Infrastructure improvements include optional access logging, stronger VPC defaults, and Secrets Manager storage for Typesense API keys.

FormKiQ Core​

Expanded Document Search and Metadata​

Applications can search across multiple document attributes without defining a composite key for every combination. POST /search?projection=COUNT returns a count and a truncated flag instead of document records. Counts are capped at 10,000; searches that exceed their processing budget also indicate truncation.

The new JSON attribute data type stores structured objects. Searches can compare nested object fields and explicit array positions using a JSON path. DynamoDB applies these JSON predicates after reading candidate records; storing a JSON attribute does not automatically create indexes for every nested field.

More Specific Access Control​

Fine-grained API permissions extend authorization across documents, attributes, entities, folders, configuration, and platform operations. Applications can discover available permissions through GET /permissions/catalog and assign more specific grants to site roles and API keys.

API keys can also carry custom claims, allowing application-specific identity information to participate in authorization without requiring a separate user sign-in.

Document Content and Transfer Options​

DELETE /documents/{documentId}?deleteType=CONTENT_ONLY removes the current document content while retaining its metadata and associated records. Existing soft-delete behavior remains supported. The DELETE document action also supports the new deletion modes.

Optional S3 Transfer Acceleration allows supported upload and download URLs to use accelerated S3 endpoints when enabled for the deployment and request.

Standard Commercial Platform​

Usage-limited short links add a maxUses option for controlled document downloads. Document reviews can specify which decision types count toward completion, and text watermarks can substitute document values using the shared template-substitution support.

Administrators can evaluate a saved or draft OPA policy against simulated user and request data without saving the policy or executing a document operation. OPA-authorized attribute writes also allow a policy to approve specific submitted values without requiring broad governance permissions.

Optional Modules and Operations​

Enhanced Search adds JSON attribute indexing and nested-field queries in OpenSearch. E-Signature expands DocuSign field placement to initials, signing dates, date fields, and text fields, and adds an envelope audit-events endpoint.

Antivirus reuses a persistent ClamAV engine in warm Lambda environments and updates the engine to 1.4.6 LTS. Document Generation updates LibreOffice to 26.2.6, and OPA updates to 1.21.0.

Paid editions can independently enable CloudFront console access logs and S3 server access logs. VPC improvements include disabling automatic public IP assignment, encrypting flow logs, logging access to the flow-log bucket, and allowing two or three subnets in the VPC import template.

Upgrade Notes​

Certificates Template Requirements​

If you are currently using certificates, update your FormKiQ CloudFormation stack with /1.19.2/template-upgrade.yaml first, then apply /1.19.2/template.yaml.

FormKiQ Core (v1.19.2)​

Feature​

  • #559 Added multi-attribute DynamoDB searches without requiring composite keys, including pagination and bounded search processing
  • #447 Added the COUNT projection to POST /search, returning count and truncated without document records
  • #563 Added the JSON attribute data type, structured JSON values, and nested-field search predicates
  • #565 Added fine-grained API permissions, permission catalog discovery, custom roles, and operation-specific endpoint authorization
  • #568 Added custom claims to API keys
  • #561 Added opt-in S3 Transfer Acceleration for document transfer URLs
  • #575 Added content-only deletion that preserves document metadata, with explicit deletion modes for the document API and DELETE actions
  • Added insertedDate and lastModifiedDate to attribute definitions and document attributes
  • Added shared template substitution and document-value resolution for use by platform modules

Updates​

  • Bundled FormKiQ Web v4.3.8, including the Document Console and configured Business Solutions
  • #577 Moved Typesense API keys into AWS Secrets Manager and changed deployment configuration to use TypesenseApiKeySecretArn
  • #580 Disabled automatic public IP assignment in VPC subnets
  • Added optional CloudFront and S3 access-log configuration to component templates
  • Added KMS encryption for VPC flow logs and S3 server access logging for their destination bucket
  • Added support for selecting two or three subnets in the VPC import template
  • Improved AWS partition compatibility through partition-aware ARNs and regional service endpoints
  • Updated the local Keycloak image to 26.8.2, Gradle to 9.8.2, and application dependencies
  • Hardened VPC traffic rules, Typesense NFS access, deployment workflows, and AWS resource configuration

Bug Fixes​

  • #569 Prevented changes to existing PRESET entity type names
  • #571 Preserved entity type insertedDate when updating an existing type
  • Fixed attribute exports to omit generated insertedDate and lastModifiedDate values
  • Fixed CloudFormation deployment failures caused by null values in JSON attribute schemas
  • Fixed numeric API key claims in authorizer context
  • Restored caller authorization when generating S3 upload URLs and watermarked downloads
  • Fixed the CloudFront access-log prefix to avoid a leading slash that caused deployment failures

FormKiQ Platform (v1.10.2)​

Feature​

  • #281 Added usage-limited document short links through maxUses
  • #282 Added configurable countedDecisionTypes for document-review completion, defaulting to APPROVAL
  • #287 Added document-value substitution in text watermarks
  • #254 Added OPA-authorized writes for document attribute values that satisfy the access policy
  • #255 Added admin-only POST /sites/{siteId}/opa/accessPolicy/test for testing saved or draft policies against simulated input
  • #293 Added independent EnableCloudFrontAccessLogs and EnableS3AccessLogs deployment options with dedicated logging destinations

Updates​

  • Extended fine-grained API permissions across platform modules, including retention and reminder policies and preset-specific entity operations
  • Added the Encryption module 1.5.0 for shared KMS encryption configuration
  • Added CloudFormation configuration for S3 Transfer Acceleration
  • Improved AWS partition compatibility and added installation IAM policies
  • Updated the bundled OPA runtime to 1.21.0

Bug Fixes​

  • Preserved caller authorization when resolving watermarked document downloads
  • Fixed missing document IDs in user activity records for failed requests
  • Improved the error returned by GET /userNotifications when notifications are not configured
  • Fixed packaging of OPA CloudFormation templates

Enhanced Search (v1.11.0)​

Feature​

  • #283 Added JSON attribute storage, indexing, and nested-field searches in OpenSearch

Updates​

  • Renamed Typesense key configuration to TypesenseApiKeySecretArn
  • Encrypted OpenSearch alarm notifications with the existing KMS key

Bug Fixes​

  • Fixed the security-group list passed to the full-text installer
  • Closed HTTP clients after fetching full-text content

Antivirus (v1.8.0)​

Updates​

  • #268 Updated the ClamAV Lambda layer to 1.4.6 LTS
  • #229 Reduced repeat scan overhead by reusing a persistent ClamAV engine in warm Lambda environments, with daemon health checks, recovery, and refresh when definitions change

Bug Fixes​

  • Fixed the scheduled ClamAV execution configuration

Document Generation Module (v1.3.0)​

Updates​

  • #269 Updated LibreOffice to 26.2.6, pinned to build 26.2.6.3, with archive checksum verification and a writable runtime profile
  • Updated document generation to use the current document-record model

E-Signature Module (v1.3.0)​

Feature​

  • #277 Expanded DocuSign recipient fields to support signatures, initials, signing dates, date fields, and text fields, including multiline text and validation of supported placement options
  • #292 Added GET /esignature/docusign/{documentId}/envelopes/{envelopeId}/auditEvents to retrieve envelope audit events

Bug Fixes​

  • Improved handling of DocuSign document-content lookup errors