Changelog — June 15, 2026 - Essal Developer Docs

What’s New

Essal Access — Conditional MFA Policies

Admins can now configure MFA requirements that apply conditionally based on IP address, time of day, or user group. Users from trusted office networks can bypass MFA while remote access always requires it:

{
  "mfa_required": true,
  "exemptions": [
    { "type": "ip_range", "cidr": "203.0.113.0/24" }
  ]
}

Essal Careers — Scorecard Aggregation

When multiple interviewers submit scorecards for the same application, the platform now calculates a weighted aggregate score and displays a recommendation summary. The aggregate is exposed via the applications API:

GET /v1/careers/applications/{id}/scorecard-summary

Essal Guard — Impossible Travel Detection Template

A new built-in alert rule template (impossible_travel) is now available. It detects when a user authenticates from two geographically distant locations within a configurable time window and triggers a high-severity alert. Enable with:

POST /v1/guard/alert-rules/from-template
{ "template": "impossible_travel", "window_minutes": 60 }

Essal Project — Roadmap API

The Project app now exposes a roadmap endpoint that returns all projects and their milestones in a timeline-compatible format — useful for building custom roadmap views in internal dashboards.

Bug Fixes

Fixed an issue where SCIM deprovisioning did not revoke active OAuth sessions immediately
Corrected an off-by-one error in the Guard audit log pagination cursor
Resolved a display issue in the Office export job status response where size_bytes was occasionally missing