TestRail 10.8.0: OAuth Controls and Faster API Sync
TestRail
TestRail 10.8.0: Govern API access and reduce integration load
TestRail 10.8.0 introduces OAuth 2.0 authorization for API integrations, with scoped short-lived tokens and an Access Management dashboard for centralized token and API key oversight. Integration teams can use incremental sync, server-side filtering, field selection, and bulk result updates to reduce data transfer and API-call volume. The release also improves responsiveness for large TestRail instances through targeted dashboard, dynamic-run, reporting, and audit-query performance changes.
OAuth 2.0 API authorization gives release owners centralized visibility and immediate revocation options for external TestRail integrations, reducing the exposure created by long-lived shared credentials.
TestRail 10.8.0 is available on the Early Access track from 10 September 2026 and the Default track from 21 September 2026. The release combines access controls, integration efficiency, and targeted scale improvements that matter most where test data feeds CI/CD, reporting, defect management, and AI-assisted workflows.
Control API access without disrupting current integrations
OAuth 2.0 is now available alongside existing API keys. External tools can authenticate through a browser-based sign-in flow and request clearly declared scopes for test data, file attachments, and user-profile access.
For security and platform owners, the practical value is more precise control:
Short-lived tokens limit the duration of access.
Scoped permissions limit an integration to the data it requires.
Users can review requested permissions before approval.
Existing API keys remain supported during a phased migration.
This supports a more defensible integration model than unmanaged, long-lived credentials. Teams can adopt OAuth in stages, which avoids forcing changes across working pipelines at once.
Centralize token oversight and revocation
The new Access Management dashboard in Site Settings provides an instance-wide view of active tokens and API keys. Administrators can see who created a credential, when it was last used, and how many API calls it has made.
September 10, 2026
By Chris Carpenter
Test Management
Enterprise Testing
QA
This changes the operational response to staff changes, vendor transitions, suspected credential exposure, and integration retirement. An administrator can revoke a token immediately without depending on its creator. A new role-based permission also restricts who may generate API access tokens.
For regulated delivery environments, this makes access review more practical. Security and QA governance teams can identify dormant credentials, verify accountable owners, and retain clearer evidence of access decisions.
Reduce API traffic with targeted data retrieval
Integration teams can now retrieve less data and perform fewer comparisons. The updated_after parameter is available on supported bulk list endpoints, allowing sync jobs to request records modified after a specified timestamp.
Supported endpoints include:
get_cases
get_runs
get_results
get_results_for_case
get_results_for_run
get_plans
get_bdd
get_bdds
Instead of repeatedly exporting an entire case library, a reporting warehouse or synchronization service can collect only changed records. This reduces API traffic, processing time, and the risk of integration jobs falling behind during periods of high activity.
Server-side filtering adds further control. Major list endpoints now support standard filters such as status, priority, section, assignee, label, creator, updater, and milestone. Because filtering occurs at the database level, clients do not need to retrieve broad datasets and discard unwanted records locally.
Field selection completes the pattern. The fields parameter lets an integration request only the attributes it needs, such as identifiers, titles, timestamps, or priorities. This is useful for BI feeds and control-plane reporting where full test objects and custom-field payloads are unnecessary.
Bulk-update execution results with fewer calls
The new update_results endpoint updates multiple existing test results in a single request. Previously, a workflow updating hundreds of results needed hundreds of calls and careful handling of rate limits.
The endpoint supports standard result fields and custom fields, including status, comments, elapsed time, defects, assignee, and custom_* values. Its partial-success model applies valid updates while returning specific errors for invalid records.
That behavior is important for automation design. Integration owners can retry only failed items rather than rerunning an entire batch, improving traceability and reducing duplicate updates. Common uses include post-processing automated runs, importing framework results, bulk defect assignment, and correcting execution data after a controlled validation step.
Improve responsiveness for large-scale test operations
TestRail 10.8.0 includes several focused performance changes for high-volume instances:
Dashboard charts load from cached results by default and refresh in the background.
A Refresh button allows users to request current dashboard data when needed.
Dynamic-run filter changes process faster on runs containing thousands of tests.
Large-suite get_cases API calls use batch data retrieval to avoid per-case database queries.
Project activity reporting benefits from improved query indexing.
Attachment metadata logging uses more efficient audit-trail queries during bulk operations.
These changes address a familiar enterprise trade-off: leaders need current operational visibility, but uncontrolled reporting and broad data retrieval can increase database contention. Cached charts and on-demand refresh create a clearer balance between timely information and stable shared-system performance.
Fixes that support administration and integration reliability
The release also resolves issues affecting user administration, integrations, reporting, test case editing, test plans, AI-generated test steps, and API-rendered result content.
Notable corrections include:
Restored reliability for user access-permission updates.
Corrected Jira add-on configuration behavior after project-setting changes.
Fixed Pivotal Tracker project opening errors in the plugin.
Preserved Markdown line breaks in API-submitted result comments.
Prevented raw HTML tags from appearing in API-submitted result summaries.
Fixed failures in the AI Test Case Generator's test-step generation stage.
Improved printing and display behavior for assigned-test fields and custom case fields.
For release governance, these fixes matter because administrative controls and integration output are part of the evidence chain. Incorrect access settings or malformed API content can create avoidable review work and weaken confidence in execution reporting.
Adoption priorities for QA, DevOps, and security leaders
Start by inventorying API keys, service accounts, external tools, and data flows connected to TestRail. Identify integrations that access broad datasets, use shared credentials, or run frequent full synchronizations.
Then establish an adoption sequence:
Define approved OAuth scopes by integration type.
Assign business and technical owners to every active credential.
Restrict API-token creation to accountable roles.
Move high-risk external integrations to OAuth first.
Replace full extraction jobs with incremental sync, filters, and selected fields.
Update high-volume result processors to use update_results with item-level retry handling.
Measure dashboard, dynamic-run, and API behavior after deployment.
The technical changes are useful on their own, but their value increases when access ownership, migration criteria, and operational metrics are documented. This prevents the new capabilities from becoming another set of unmanaged integration options.
How Merito helps
Merito helps enterprises assess TestRail integration risk, design OAuth and token-governance standards, and plan controlled migrations from legacy API-key usage. Our teams can also tune CI/CD and reporting integrations around incremental sync, field selection, bulk updates, audit requirements, and measurable performance outcomes.
The result is a TestRail operating model that gives QA, engineering, and security teams clearer accountability without interrupting active delivery workflows.
Merito is a TestRail partner. Our TestRail team can scope licensing, sizing, and rollout for 10.8.0, and our enterprise upgrade services help you plan and validate the upgrade with minimal disruption to release schedules.
No. Existing API keys continue to work, and OAuth 2.0 is an additional authentication option. Enterprises can move integrations in phases, prioritizing higher-risk or externally connected tools first while preserving current automation.
OAuth 2.0 supports browser-based authorization, declared permission scopes, and short-lived tokens. The Access Management dashboard gives administrators a central view of active tokens and API keys, including creator, last-use information, and API-call activity, while allowing immediate revocation. Merito can help define token ownership, approval workflows, scope standards, and periodic access reviews.
The updated_after parameter allows bulk endpoints to return records changed since a specified timestamp, rather than requiring a full extraction and comparison. Server-side filters and fields selection further reduce the records and payload data returned. The new update_results endpoint also lets integrations update multiple results per request, lowering call volume and rate-limit pressure.
Teams with large suites, high-volume dynamic runs, shared dashboards, and extensive activity or audit reporting should see the clearest benefit. Cached dashboard chart loading reduces concurrent database pressure, while batch retrieval and query improvements target known large-instance workloads. Merito can assess the highest-cost workflows and establish before-and-after performance measures.
Keep Reading
Related Product Release Updates
Explore a few more Merito release updates that align with the themes in this article.
