Ory Network, Ory Kratos v26.2.14 released

Ory Network

Add OAuth2 token stats to the OAuth2 clients page

The OAuth2 clients page now shows a stats bar with token activity for the last 24 hours: tokens issued, refresh tokens issued, and token exchange errors. Each stat card links to the Events page with the relevant event filter and time window pre-applied, making it easier to investigate token activity.

The Events page now accepts event_name and time_window URL parameters to pre-apply filters when navigating from stat card links.

Add courier message delivery stats to the email delivery page

The email delivery page now shows the number of messages delivered and abandoned in the last 24 hours.

The Combined activity chart on the Activity page now includes "Messages delivered" and "Messages abandoned" as optional filters, enabling date range selection for courier metrics.

Courier analytics events (CourierMessageDispatched, CourierMessageAbandoned) now correctly include the project ID so stats are attributed per project.

Case-insensitive domain filter on /organizations

GET /projects/{id}/organizations?domain=... now matches organization domains case-insensitively. Previously, an organization stored with the domain foo.bar was only returned for the exact-case query ?domain=foo.bar; lookups such as ?domain=FOO.bar returned an empty list.

DNS domains are case-insensitive per RFC 4343, so the API now normalizes both the stored values and the query parameter before comparing.

See why a custom domain isn't working

The Custom Domains page now shows the detailed status of each domain and lists any errors directly in the table, so you can see what needs fixing without opening the details dialog.

This is now available on Ory Network.

Ory Kratos

Add courier message delivery stats to the email delivery page

The email delivery page now shows the number of messages delivered and abandoned in the last 24 hours.

The Combined activity chart on the Activity page now includes "Messages delivered" and "Messages abandoned" as optional filters, enabling date range selection for courier metrics.

Courier analytics events (CourierMessageDispatched, CourierMessageAbandoned) now correctly include the project ID so stats are attributed per project.

Fix SCIM group memberships showing different results on /Groups and /Users

For identities that belong to many SCIM groups, group changes could leave reads disagreeing with each other. GET /Groups/{id} listed the user as a member, but GET /Users/{id} did not — or vice versa.

This is fixed. Group membership changes on /scim/{client}/v2/Groups/{id} (PATCH, PUT, DELETE) now either fully succeed or fully fail. A failed request returns a clear error and leaves no partial state behind, so you can safely retry. Identities with hundreds of group memberships are also fully supported.

verify_new_address hook rejects duplicate email addresses

The verify_new_address settings hook now checks whether the proposed new address is already owned by another identity before starting a verification flow.

Previously, a user could initiate an email change to an address that was already registered. The hook would send a verification code, and only at the point of code submission would the conflict surface. In the worst case — a race where another identity claimed the address between code generation and submission — the error was shown only on the verification page, with no way to recover without restarting the settings flow.

The hook now rejects the change immediately on settings submission if the address is taken, returning a duplicate credentials error on the settings page. If the race still occurs (address claimed after the hook runs but before the code is submitted), the duplicate credentials error is also shown on the verification page. Clicking "Resend code" after that error re-checks uniqueness and shows the same error rather than sending another code.

This is now available on Ory Network, for the Ory Enterprise License, and will be part of the next Ory Open Source release.

Ory Hydra, Ory Keto, Ory Oathkeeper, Ory Polis, Ory Elements, and Ory Terraform

No significant changes in this release.