v1.20.5WebsiteLatest
•2 min read

Sub-Pages for Web App, Security, and CI/CD Documentation

The remaining long documentation pages are now split into dedicated sub-pages for collaborative workspaces, real-time audit logs, account settings, zero-knowledge encryption, authentication, GitHub Actions, and container deployments.

#What's Changed

  • [Improvement] Web App documentation is split into three focused sub-pages: Projects & RBAC (/docs/web-app/projects), Audit logs & Event Stream (/docs/web-app/logs), and User Settings & Connections (/docs/web-app/settings). The main Web App page focuses on the dashboard, service auto-detection, and browser pairing flows.
  • [Improvement] Security documentation is split into dedicated guides: Zero-Knowledge Encryption (/docs/security/encryption) detailing AES-256-GCM and salted key derivation, and Authentication & Limits (/docs/security/authentication) covering passkeys, TOTP, and sign-in throttling.
  • [Improvement] CI/CD documentation now features standalone recipes: GitHub Actions (/docs/ci-cd/github-actions) for automated secret injection and custom vault keys, and Docker, Kubernetes & REST (/docs/ci-cd/docker-kubernetes) for container runtimes and headless HTTP calls.
  • [Improvement] The MCP page's Available tools, OAuth scopes and Error codes sections, including the vault-key attempt limits, moved to a Tools & scopes page (/docs/mcp/tools). The MCP page keeps setup, the agent skill, how connections work, workflows and security practices.
  • [Improvement] Updated sidebar navigation, breadcrumbs, search index keywords, and social preview cards for all new documentation sub-pages.
  • [Fix] The CI/CD reference keeps the details the split had dropped: a key outside a token's environment pin returns 404, the expiry badges, the owner and admin alert when a token exports a whole environment, the flag on tokens whose creator has left, why APIVAULT_TOKEN wins over a device token, and how keys add, keys update, keys delete and logs get behave in a pipeline. The Security page has its Service tokens section back.
  • [Fix] Corrected the new pages where they disagreed with ApiVault: they no longer name IP_NOT_ALLOWED and 403 FORBIDDEN refusals that ApiVault never returns, each value is encrypted with a random 128-bit IV (not 96-bit), service tokens start with av_live_, and audit log exports are files you download rather than a feed into a SIEM.