TestRail 10.8.0: Govern API access and reduce integration load

OAuth 2.0 API authorization gives release owners centralized visibility and immediate revocation options for external TestRail integrations, reducing the exposure created by long-lived shared credentials.

TestRail 10.8.0 is available on the Early Access track from 10 September 2026 and the Default track from 21 September 2026. The release combines access controls, integration efficiency, and targeted scale improvements that matter most where test data feeds CI/CD, reporting, defect management, and AI-assisted workflows.

Control API access without disrupting current integrations

OAuth 2.0 is now available alongside existing API keys. External tools can authenticate through a browser-based sign-in flow and request clearly declared scopes for test data, file attachments, and user-profile access.

For security and platform owners, the practical value is more precise control:

• Short-lived tokens limit the duration of access.
• Scoped permissions limit an integration to the data it requires.
• Users can review requested permissions before approval.
• Existing API keys remain supported during a phased migration.

This supports a more defensible integration model than unmanaged, long-lived credentials. Teams can adopt OAuth in stages, which avoids forcing changes across working pipelines at once.

Centralize token oversight and revocation

The new Access Management dashboard in Site Settings provides an instance-wide view of active tokens and API keys. Administrators can see who created a credential, when it was last used, and how many API calls it has made.

This changes the operational response to staff changes, vendor transitions, suspected credential exposure, and integration retirement. An administrator can revoke a token immediately without depending on its creator. A new role-based permission also restricts who may generate API access tokens.

For regulated delivery environments, this makes access review more practical. Security and QA governance teams can identify dormant credentials, verify accountable owners, and retain clearer evidence of access decisions.

Reduce API traffic with targeted data retrieval

Integration teams can now retrieve less data and perform fewer comparisons. The updated_after parameter is available on supported bulk list endpoints, allowing sync jobs to request records modified after a specified timestamp.

Supported endpoints include:

• get_cases
• get_runs
• get_results
• get_results_for_case
• get_results_for_run
• get_plans
• get_bdd
• get_bdds

Instead of repeatedly exporting an entire case library, a reporting warehouse or synchronization service can collect only changed records. This reduces API traffic, processing time, and the risk of integration jobs falling behind during periods of high activity.

Server-side filtering adds further control. Major list endpoints now support standard filters such as status, priority, section, assignee, label, creator, updater, and milestone. Because filtering occurs at the database level, clients do not need to retrieve broad datasets and discard unwanted records locally.

Field selection completes the pattern. The fields parameter lets an integration request only the attributes it needs, such as identifiers, titles, timestamps, or priorities. This is useful for BI feeds and control-plane reporting where full test objects and custom-field payloads are unnecessary.

Bulk-update execution results with fewer calls

The new update_results endpoint updates multiple existing test results in a single request. Previously, a workflow updating hundreds of results needed hundreds of calls and careful handling of rate limits.

The endpoint supports standard result fields and custom fields, including status, comments, elapsed time, defects, assignee, and custom_* values. Its partial-success model applies valid updates while returning specific errors for invalid records.

That behavior is important for automation design. Integration owners can retry only failed items rather than rerunning an entire batch, improving traceability and reducing duplicate updates. Common uses include post-processing automated runs, importing framework results, bulk defect assignment, and correcting execution data after a controlled validation step.

Improve responsiveness for large-scale test operations

TestRail 10.8.0 includes several focused performance changes for high-volume instances:

• Dashboard charts load from cached results by default and refresh in the background.
• A Refresh button allows users to request current dashboard data when needed.
• Dynamic-run filter changes process faster on runs containing thousands of tests.
• Large-suite get_cases API calls use batch data retrieval to avoid per-case database queries.
• Project activity reporting benefits from improved query indexing.
• Attachment metadata logging uses more efficient audit-trail queries during bulk operations.

These changes address a familiar enterprise trade-off: leaders need current operational visibility, but uncontrolled reporting and broad data retrieval can increase database contention. Cached charts and on-demand refresh create a clearer balance between timely information and stable shared-system performance.

Fixes that support administration and integration reliability

The release also resolves issues affecting user administration, integrations, reporting, test case editing, test plans, AI-generated test steps, and API-rendered result content.

Notable corrections include:

• Restored reliability for user access-permission updates.
• Corrected Jira add-on configuration behavior after project-setting changes.
• Fixed Pivotal Tracker project opening errors in the plugin.
• Preserved Markdown line breaks in API-submitted result comments.
• Prevented raw HTML tags from appearing in API-submitted result summaries.
• Fixed failures in the AI Test Case Generator's test-step generation stage.
• Improved printing and display behavior for assigned-test fields and custom case fields.

For release governance, these fixes matter because administrative controls and integration output are part of the evidence chain. Incorrect access settings or malformed API content can create avoidable review work and weaken confidence in execution reporting.

Adoption priorities for QA, DevOps, and security leaders

Start by inventorying API keys, service accounts, external tools, and data flows connected to TestRail. Identify integrations that access broad datasets, use shared credentials, or run frequent full synchronizations.

Then establish an adoption sequence:

• Define approved OAuth scopes by integration type.
• Assign business and technical owners to every active credential.
• Restrict API-token creation to accountable roles.
• Move high-risk external integrations to OAuth first.
• Replace full extraction jobs with incremental sync, filters, and selected fields.
• Update high-volume result processors to use update_results with item-level retry handling.
• Measure dashboard, dynamic-run, and API behavior after deployment.

The technical changes are useful on their own, but their value increases when access ownership, migration criteria, and operational metrics are documented. This prevents the new capabilities from becoming another set of unmanaged integration options.

How Merito helps

Merito helps enterprises assess TestRail integration risk, design OAuth and token-governance standards, and plan controlled migrations from legacy API-key usage. Our teams can also tune CI/CD and reporting integrations around incremental sync, field selection, bulk updates, audit requirements, and measurable performance outcomes.

The result is a TestRail operating model that gives QA, engineering, and security teams clearer accountability without interrupting active delivery workflows.

Merito is an authorized TestRail reseller and services partner, listed as a Platinum Verified Partner in the TestRail partner directory. Our TestRail team can scope licensing, sizing, and rollout for 10.8.0, and our enterprise upgrade services help you plan and validate the upgrade with minimal disruption to release schedules.