Ver. 18.1.0: Select-type Data Items Support Optional Properties

Ver. 18.1.0 introduces optional properties for choices in Select-type Data Items and includes changes for workflow users, app developers, system administrators, and REST API developers. This page organizes the Ver. 18.1.0 details from the Ver. 18.1 article as a separate version post. For environment-specific rollout dates and status, see Updates by Environment.

Release information

Release date: October 13, 2026
Ver. 18.1.0: scheduled for October 26, 2026 (JST)
Target: workflow platforms applying immediate updates

Notable changes

App archives (the app export/import format) transition to YAML.
For Throwing Message Intermediate Events (HTTP), configurations that use legacy URL or parameter formats scheduled for deprecation in April 2027 become app configuration errors. They do not cause runtime errors.
Some request headers beginning with X- are no longer allowed in Throwing Message Intermediate Events (HTTP) and Script Tasks.
When a user is deleted, it is no longer necessary to forcibly reassign that user’s tasks. Tasks in progress follow the Human Task settings.
Unsupported role and leader parameters that caused 400 errors in Ver. 18.0 are now ignored.

Details for Version 18.1.0

Changes for all users

On workflow diagrams in Case details, flows executed multiple times are shown with thicker lines (#10246). Line thickness represents the relative number of times the flow was executed in that Case.
The graph selection UI for Case aggregation on the dashboard has been improved (#11010).
Display-only Table-type Data Items now use the same display method as editable ones (#11155), including Case details (also when opened in a new window) and task-processing screens.
The vertical scroll range and the position of the Back button have been adjusted on screens associated with Apps, such as App details (#11349).
The logo has been updated (#11545).

Changes for workflow designers (app developers)

App archives and app editing

App archives transition to YAML (#11179). In principle, an archive is a single YAML file. When it includes template PDFs for PDF generation, it is a ZIP file containing the YAML and PDF files.
Users with Control privileges are notified when a Case terminates abnormally because it exceeds the maximum number of node instances per Case (#11737).
The category input UI on screens such as the New App creation screen has been improved (#11346).
When App settings are changed through another route, such as MCP tools, the App editing screen reloads the settings (#11796).

Select-type Data Items

Choices can include optional properties in addition to the choice ID and label (#11724). This applies to fixed choices and app-specific or shared choice masters. Values can be referenced from data-update SpEL templates and Script Task scripts.
A setting copies an optional property from a selected choice into a String-type Data Item on the form (#11732).
Expressions for Numeric-type Data Items can reference Select-type Data Items (#5102), including the selected choice’s ID, label, or optional property.
Expressions used to update Numeric-type Data Items in data-update steps can reference Select-type Data Items (#11980).
Choice-master updates can include optional property values (#11807).
The Form JavaScript API can retrieve optional properties of the selected choice (#11844).

File-type Data Items

An option validates duplicate file names (#11733). When enabled, files with the same name cause a runtime validation error; capitalization is ignored when comparing names.

Deadlines and failure notifications

The simplified deadline UI supports more combinations for Human Tasks and Receive Tasks (Form) (#11697). Date-type items can use year-month or year in addition to year-month-day. DateTime-type items can use either the specified time or 00:00 on that date.
Failure notification emails for start events such as Gmail: On receiving an email and kintone: On record creation are now HTML emails (#10317).
When a failed step’s name is blank, its item name (for example, Box: File upload) is shown in the failure notification email (#11644). This also applies to the start events above.

HTTP events and headers

For a Throwing Message Intermediate Event (HTTP), using the legacy Receive Task (HTTP) URL scheduled for deprecation in April 2027 causes an app configuration error (#10165). Legacy URL: /System/Event/IntermediateMessage/{App_ID}/{Node_Number}/receive.
Requests to Message Start Events or Receive Tasks (HTTP) using legacy parameters cause an app configuration error (#11414). The destination continues to accept legacy formats, so this does not cause a runtime error. The upgrade to Ver. 18.1 migrates some configurations automatically; unmigrated ones become app configuration errors.
Some request headers beginning with X- are prohibited for Throwing Message Intermediate Events (HTTP) and Script Tasks (#11736): reverse-proxy headers beginning with X-Forwarded- and X-Real-IP, and method-override headers X-Http-Method, X-Http-Method-Override, and X-Method-Override. Method-override headers are prohibited only when their value is CONNECT, TRACE, or TRACK; values such as PUT remain allowed.
Error codes returned by the main request and file pre-upload for Message Start Events (HTTP) are now unified (#11922).

Changes for system administrators

Deleting a user no longer requires forcibly reassigning their tasks (#8955). Offered tasks are assigned automatically if one candidate remains and stay unassigned if two or more remain. In-progress tasks, including team tasks with no remaining assignee, enter the error list or proceed through boundary error events according to the Human Task setting.
System Settings can control the scope of Basic authentication (#11753): prohibit it entirely; allow it only from workflow apps in the environment and reject external requests; or leave system-level access unrestricted and follow per-user settings. Existing environments keep the prior behavior. The recommended setting is to allow access only from workflow apps in the environment.
Case logs and system logs distinguish OAuth2 from Basic authentication and record OAuth2 client IDs (#11752). Operations through MCP servers are recorded as OAuth2 access.
Navigation such as “Back to List” is shown on the details screen for System Settings > App External Integration > Throwing Message Intermediate Event (HTTP) (#11633).

OAuth2 and API Client

API Client supports CIMD (Client ID Metadata Document) (#11653, #11678), allowing OAuth2 clients without advance API Client registration and simplifying setup with MCP clients such as claude.ai and chatgpt.com. CIMD client details and related authorizations can be managed in System Settings.
Authorizations for registered clients can be managed in API Client (#11750), including the number of users, issued tokens, and last token issuance time. “Revoke All Authorizations” invalidates all tokens for that client.
Refresh tokens are issued for clients without client authentication (PKCE), with refresh-token rotation (#11657).
Different port numbers are accepted when the redirect URI host is localhost for native-app OAuth2 clients (#11739).

MCP Server

Tools were added for starting Cases, processing tasks, finding startable Apps, and uploading files to File-type Data Items (#11622, #11623, #11755, #11921). Large files cannot be uploaded through these tools; use the REST API.
Search tools were added for users, organizations, titles, and roles (#11798).
App administrator tools were added for creating Apps, editing App properties and Apps, starting debug Cases, retrieving and updating Version Notes, and listing add-ons and authentication settings available to Apps (#11775, #11797, #11668, #11902, #11924, #11936, #11942).
MCP-specific OAuth2 scopes mcp:any and mcp:read were separated (#11740). These scopes cannot access the REST API; REST API scopes any and read can still access MCP tools.
A bug that exposed App administrator notes to general users in the App list tool was fixed (#11879).

Changes for Questetra REST API developers

The role parameter in /API/UGA/Membership/add and /API/UGA/Membership/update is ignored without an error (#11332); it caused a 400 error in Ver. 18.0.
The leader parameter in /API/Admin/SystemAuthority/addToQgroup and /API/Admin/ProcessAuthority/addToQgroup is ignored without an error (#11711); it caused a 400 error in Ver. 18.0.
Users can issue Personal Access Tokens with specified expiration times and scopes (#11754). The maximum expiration is 24 hours.
Users can view and invalidate their issued access and refresh tokens under Account Settings > Connected Apps (#11679).
REST API authentication with Personal Access Tokens (Bearer) is supported and reflected in the REST API Reference (#11800).
A bug that exposed App administrator notes to general users in /API/OR/ProcessModel/list was fixed (#11879).

App editing, release, and task processing APIs

The YAML format specification for App archives was published (#11628).
APIs were added to retrieve and fully replace settings for draft App versions under development (#11788).
APIs were added to retrieve and update Version Notes (#11878), start debug Cases (#11896), retrieve add-ons available to Apps (#11926), and retrieve authentication settings available to Apps (#11937).
App releases can check for simultaneous editing by specifying a revision number (#7149). A mismatch causes the release to fail; without a revision number, release proceeds without this check as before.
When the note is omitted during App release, Version Notes edited in the draft are no longer erased (#11925).
An API was added to search Select-type Data Item choices (#11840).
APIs were added to pre-upload files for File-type Data Items and use them in task-processing APIs (#11841, #11892). Multiple files totaling more than 100 MB can be attached, and removing only some attached files is easier.

For future changes that are not tied to a specific Version, see Planned Changes to Specifications. This post follows the one-Version-per-post format used for staged verification.