Changelog
Release 2026.43
Every change this release brought to the product.
Released
- New
Owners can let Costfluent support read their organization
Under “Settings”, “Organization”, an Owner can allow Costfluent support to read the organization for 1, 3 or 7 days, and revoke it at any time. Support reads only, each entry is in the audit log as Costfluent support, and the Owners get an email when support first enters.
Read more: Owners can let Costfluent support read their organization - New
Sign in with a Microsoft account
Continue with Microsoft sits beside GitHub and Google on the sign-in and sign-up pages for work and school accounts. An account whose organization verified its email domain with Microsoft signs in to the Costfluent account with that address, or opens one; Microsoft accounts it does not vouch for, personal ones included, sign up with a password instead.
Read more: Sign in with a Microsoft account - New
See and end your sessions, change your password in the app
Security lists every device signed in to your account and signs out one or all the others. You change your password there and generate new recovery codes. An Owner sees who has an authenticator app and can sign a member out everywhere. A session unused for 7 days ends, and the sign-in page says why a session ended.
Read more: See and end your sessions, change your password in the app - New
Single sign-on works with any OpenID Connect provider, across several domains
Microsoft Entra ID, Keycloak and other providers that do not mark addresses as verified now sign people in, because the domain you proved is what counts. An organization can add a connection per identity provider, give each several domains, and choose the claim groups are read from.
Read more: Single sign-on works with any OpenID Connect provider, across several domains - New
The custom costs API can replace a resubmitted line
Send replaceLines with a request and each line sent again under its line id replaces everything it held before, so a corrected period or description no longer counts the line twice.
Read more: The custom costs API can replace a resubmitted line - New
Set up an authenticator app from the Security page
“Security” now sets up, confirms and removes an authenticator app, so a partner's manager can enter a customer organization that requires two-factor authentication. Adding one asks for a recent sign-in.
Read more: Set up an authenticator app from the Security page - New
Retrying an API create no longer creates twice
Every create in the Public API, and a batch of costs sent to a custom integration, takes an Idempotency-Key header. A retry of the same request under the same key within 24 hours answers the first response instead of creating again, and the same key with another request is refused. The Go SDK and the Terraform provider send a key with every create.
Read more: Retrying an API create no longer creates twice - New
Require two-factor authentication for your organization
An owner can turn on Require two-factor authentication. Members without an authenticator app set one up at their next sign-in and keep ten recovery codes; single sign-on is exempt for its own organization, and so are passkeys that check who you are, with a PIN, a fingerprint or your face.
Read more: Require two-factor authentication for your organization - New
Terraform stops instead of overwriting a change made in Costfluent
Apps, budgets, business metrics, cost alerts, cost reports, dashboards and widgets, folders, saved filters, teams, virtual tags and workspaces carry an ETag in the API, and a write sent with If-Match is refused when someone changed the object since. The Terraform provider sends it on every update and deletion.
Read more: Terraform stops instead of overwriting a change made in Costfluent - New
Unit costs can count chosen labels only
A report's unit cost can divide by the business metric's values with chosen labels, such as the pro customers of two regions, instead of the whole metric. Set it under "Count only these labels", through the API, or in Terraform.
Read more: Unit costs can count chosen labels only - New
Hear about a commitment 30 days before it ends
When a reservation or Savings Plan comes within 30 days of its end, every workspace that lists it under Commitments gets one notification, once per term.
Read more: Hear about a commitment 30 days before it ends - New
Choose the workspace you open first
Preferences has a default workspace for each organization you belong to. The console opens it first, falls back to the oldest workspace you can view, and the Public API names it in /v1/me.
Read more: Choose the workspace you open first - New
Anomaly settings in the API and Terraform
A workspace's anomaly settings, leaving out marketplace charges or commitment fees and the smallest increase that is notified, can now be read and set through the Public API and the costfluent_workspace Terraform resource.
Read more: Anomaly settings in the API and Terraform - New
Commitments lists the AWS reservations and Savings Plans you hold
Commitments now lists each reservation and Savings Plan your AWS connections hold, with its utilization and unused cost over the last 30 days and how many days are left before it ends.
Read more: Commitments lists the AWS reservations and Savings Plans you hold - New
Savings findings from Google Cloud Recommender
Every day, Savings lists Google Cloud Recommender's cost recommendations for the projects your Google Cloud connections spend in: machine type changes, idle virtual machines, disks, IP addresses and images, committed use discounts, and idle or overprovisioned Cloud SQL instances.
Read more: Savings findings from Google Cloud Recommender - New
Create API tokens for one workspace
The Create API token dialog has an Access field: keep Whole organization, or choose one workspace so the token reaches nothing else. Give an AI assistant or a script only the workspace it needs.
Read more: Create API tokens for one workspace - New
Commitment coverage, savings rate and unused commitment
Commitments, under Optimization, shows for the last three months how much eligible usage your AWS, Azure and Google Cloud commitments covered and what they saved against on-demand prices, and for AWS and Azure what you paid for and did not use.
Read more: Commitment coverage, savings rate and unused commitment - New
Dashboards with text, a shared filter and scheduled email
Build a dashboard from saved cost reports shown as a chart, table or KPI, add text widgets, and read every widget through one saved filter. Share a dashboard by link, have it emailed on a schedule, and pick your own default dashboard.
Read more: Dashboards with text, a shared filter and scheduled email - New
A Get started checklist, and alerts on from the first day
The Overview shows a Get started checklist from connecting a cloud provider to inviting a teammate, each step linking to where it is done. A new workspace notifies you of cost anomalies and carries a tag coverage alert from the start.
Read more: A Get started checklist, and alerts on from the first day - New
Kubernetes idle cost and efficiency by namespace and workload
Kubernetes, under Optimization, shows each cluster's cost and idle capacity over the last 30 days, and how much of the CPU and memory its namespaces and workloads requested they actually used.
Read more: Kubernetes idle cost and efficiency by namespace and workload - New
Ask your AI assistant about your cloud spend
The Costfluent MCP server lets an AI assistant read your costs, cost reports, budgets and anomalies with a read-only API token. It runs on your machine and changes nothing in Costfluent.
Read more: Ask your AI assistant about your cloud spend - New
Savings findings from AWS and Azure recommendations
Every day, Savings lists the recommendations of AWS Cost Optimization Hub and Azure Advisor as open findings: rightsizing, idle resources, newer generations, storage and commitment purchases. A finding the provider stops recommending is marked Withdrawn.
Read more: Savings findings from AWS and Azure recommendations - New
Scheduled reports in Slack and Microsoft Teams
A scheduled cost report can post to Slack and Microsoft Teams as well as email. Each delivery shows the total, its change against the previous period, the day its data runs through and, when a budget measures the report, how the budget stands.
Read more: Scheduled reports in Slack and Microsoft Teams - New
A notice when a connection's data falls behind
When a connection's data runs two days behind its sync schedule, your notification channels hear it, again at seven days, with the last day its data covers and why the last sync failed. The person who added the connection also gets an email.
Read more: A notice when a connection's data falls behind - New
Top movers on the Overview
The Overview's Top movers card lists the services and accounts whose cost rose most over the last 30 days against the 30 days before. A scheduled report whose total rose by at least the workspace's anomaly notification amount lists its largest increases too.
Read more: Top movers on the Overview - New
Unit costs from your business metrics
Import a business metric such as customers or transactions by CSV or through the Public API, and a saved cost report charts its cost per unit beside its cost.
Read more: Unit costs from your business metrics - New
Chart usage and resource counts, not only cost
Measure in the explorer and in saved reports switches between Cost, Usage in each provider's own unit, such as hours, GB-months or requests, and Count of distinct resources, so you can tell using more from paying more.
Read more: Chart usage and resource counts, not only cost - New
Virtual tag templates for common tag keys
A new workspace offers templates for environment, team, service and customer that merge the usual spellings of each key, such as env, Env and ENVIRONMENT. Preview one, see which of its keys your data carries, and enable it with one click.
Read more: Virtual tag templates for common tag keys - Improved
One organization's heavy cost reads no longer slow down others
Each organization now runs a bounded number of cost data reads at once, so heavy reporting in one organization cannot take the capacity another needs. A Public API cost read past your organization's bound answers 429 with a Retry-After header saying when to try again.
Read more: One organization's heavy cost reads no longer slow down others - Improved
The audit log names Costfluent on changes its staff make
An entry made by Costfluent's staff now reads "Costfluent" with the person's name, in the audit log and in its CSV export, so it can no longer be mistaken for a change by one of your members or by the system.
Read more: The audit log names Costfluent on changes its staff make - Improved
Partner-managed organizations can be handed back to their Owners
Costfluent can end a partner's management of your organization: the partner's staff lose access, billing moves to your first Owner and the partner's paid period is not renewed. To keep a paid plan, an Owner checks out a higher plan on their own payment method. Owners are emailed when the partner asks to delete the organization.
Read more: Partner-managed organizations can be handed back to their Owners - Improved
Audit log names withdrawn invitations, leaving and SSO changes
The audit log now records a withdrawn invitation as user.invite_revoked, a member leaving as membership.left, and single sign-on enforcement and break-glass changes under their own names. Inviting an address with a pending invitation says to resend it instead.
Read more: Audit log names withdrawn invitations, leaving and SSO changes - Improved
Single sign-on keeps working after a move to a lower plan
A connection set up on a plan with single sign-on keeps signing people in and enforcing after a downgrade. Settings, Single sign-on still lets you turn enforcement on or off, rotate the secret, change break-glass owners, switch a connection off and on again and remove a domain or connection. New connections or domains, domain verification, a first switch-on and group mapping changes need the plan.
Read more: Single sign-on keeps working after a move to a lower plan - Improved
Each Kubernetes cluster reports with its own token
Add a cluster on the Clusters tab and Costfluent shows a token that reports for that cluster alone, so a leaked token cannot post for your other clusters. The install needs only that token. Agents installed with an organization API token stop reporting until they get their cluster's token.
Read more: Each Kubernetes cluster reports with its own token - Improved
Passphrases welcome, and email changes need your password
A password now needs 12 to 128 characters and no mix of capitals, digits or symbols, so a few unrelated words make a strong one; known breached passwords are still refused. Changing your email asks for your password, an authenticator code or a passkey, and your current address hears of the request straight away. Setting up an authenticator app at sign-in is confirmed by email.
Read more: Passphrases welcome, and email changes need your password - Improved
Terraform, the Kubernetes agent and the MCP server check their token first
terraform plan stops before anything changes when a resource needs a capability the API token lacks, and names it. The Kubernetes agent exits at start when every report would be refused and warns about a token carrying more than Report Kubernetes usage. The MCP server stops when its token serves no tool. /v1/me lists only what a token can use now.
Read more: Terraform, the Kubernetes agent and the MCP server check their token first - Improved
API tokens expire by default and are recognisable to secret scanners
A new API token expires after 90 days unless you pick a date within a year; only an Owner can make one that never expires. Tokens end in a checksum, so a leaked one is easier to spot, and stop working when their creator's account is disabled or deleted. Existing tokens no longer work: create new ones in Settings, API tokens.
Read more: API tokens expire by default and are recognisable to secret scanners - Improved
The audit log records channels, subscriptions and changes made by Costfluent
Creating or changing a notification channel or a report subscription, creating or exporting the organization, and each change Costfluent's staff make to your organization, such as a plan change or a sync, now appear in the audit log. Entries by Costfluent's staff show no IP address.
Read more: The audit log records channels, subscriptions and changes made by Costfluent - Improved
The API reference names the capability every operation needs
Each Public API operation now says which capability and which kind of token it needs, and a request refused for a missing capability names it in the error, so you know what the next token must carry. The Terraform provider says the same when it is refused.
Read more: The API reference names the capability every operation needs - Improved
Each role sees only the actions it can take
Buttons a role cannot use, such as inviting people, creating teams or workspaces, or changing budgets, dashboards and reports as a viewer, are no longer offered. Settings sections a role cannot open are not listed, and a link to one says so. A refused request now explains itself in your language.
Read more: Each role sees only the actions it can take - Improved
The API token dialog offers only what you may grant
Create API token shows only the capabilities you may grant for the chosen access, and Read and write now adds integrations to workspaces. Editors and Integration owners revoke the tokens they created, the list shows who created each token and whether they left the organization, and /v1/me names capabilities as the dialog does, such as viewCosts.
Read more: The API token dialog offers only what you may grant - Improved
API tokens and roles grant only what Costfluent enforces
Reading members, teams and notification channels is its own capability, View members, so a read-only token lists no people. Owners and Integration owners manage tag keys, Viewers no longer list API tokens, and the access model shows each role's capabilities as the product checks them.
Read more: API tokens and roles grant only what Costfluent enforces - Improved
Team roles are bounded by the organization role
A Viewer stays read-only on every team, workspaces are created, renamed and deleted by Owners, and an Owner can be lowered while another remains. Restrict all workspaces closes every workspace to Everyone at once, and Workspace access shows what each member reaches and which team grants it.
Read more: Team roles are bounded by the organization role - Improved
Change any cost report on its own page
Cost reports opens on your workspace's default report. Change its date range, grouping, filter or chart on the page, then select “Save changes”, “Save as new” or “Discard”; the title switches between reports.
Read more: Change any cost report on its own page - Improved
Sessions end 30 days after sign-in, and a day after single sign-on
Staying active no longer keeps you signed in for good: a session renews for 30 days after sign-in, or 24 hours when it began through single sign-on, then asks you to sign in again. Group changes at your identity provider apply at that sign-in, and where Require single sign-on is on, someone removed there cannot sign back in unless they are a break-glass Owner.
Read more: Sessions end 30 days after sign-in, and a day after single sign-on - Improved
Resource ID groupings show each resource's name
A report or the explorer grouped by Resource ID now shows each resource's name beside its id, such as checkout-api (i-0abc), in the table and the chart legend, on dashboards and share links too.
Read more: Resource ID groupings show each resource's name - Improved
Cost API reads say how far their data reaches
The Public API's cost and cost summary reads name the latest day their connections have data for. A read too large for one request now answers 422 asking for a narrower one, instead of a 503 that invited the same request again.
- Improved
Dashboard widget types read the way they are written
The API and the Terraform provider answer a dashboard widget's type as costReport or text, the same spelling a create sends, instead of CostReport or Text.
- Improved
Deleting a channel tells you what used it
A notification channel that cost alerts, budgets or a workspace's anomaly notifications use can now be deleted. It is taken out of each of them, and the console and the API say how many need another channel.
- Improved
Two-step verification after Google and GitHub sign-in
When your account has an authenticator app set up, signing in with Google or GitHub now asks for its code too, as signing in with a password does.
- Improved
Google Cloud Marketplace charges name their seller
A Google Cloud Marketplace charge now shows the company that sold it under Provider name, as AWS and Azure Marketplace charges already do, so you can group and filter third-party spend by seller.
Read more: Google Cloud Marketplace charges name their seller - Fixed
Signing out can no longer be undone by a refresh already in progress
If the app was renewing your session at the moment you signed out, in the same tab or another one, the tab could come back signed in until that session expired. A tab now stays signed out once you sign out.
- Fixed
The last break-glass owner keeps their second factor while SSO is enforced
While single sign-on is required, the last break-glass owner can no longer remove the authenticator app or a passkey when neither would be left, which would have ended their way past single sign-on. Removing one while another remains still works.
Read more: The last break-glass owner keeps their second factor while SSO is enforced - Fixed
A throttled Azure subscription keeps collecting costs
When Azure briefly refused or failed to answer for one subscription of a connection during its health check, that subscription stopped collecting costs until a later check got through. It now keeps collecting; a subscription Azure actually denies access to is still marked unavailable.
- Fixed
Deleting a Kubernetes cluster updates workspace counts at once
After a Kubernetes cluster was deleted, the workspace list and workspace pages could keep counting it under “Integrations” until the page was reloaded. They now update as soon as the cluster is gone.
- Fixed
Only Owners and Integration owners add providers to workspaces
A team Editor could add a connection to a workspace or widen the accounts it reads, and so see the cost of accounts kept for another workspace. Adding a provider and choosing its accounts now also need the Owner or Integration owner organization role, and through the API or Terraform an organization token with Manage integrations.
Read more: Only Owners and Integration owners add providers to workspaces - Fixed
Signing out clears your organization and data from the browser
After you signed out, or your session ended because it could not be renewed, the browser kept the organization you last had open and the data already loaded, so the next person to sign in there started in your organization. Both are now cleared. A dropped connection or a briefly unavailable service still keeps you signed in.
- Fixed
The organization export includes every setting
Download configuration under Export your data now also carries single sign-on, API tokens, Kubernetes clusters, upload records, each team's members and workspace access, a partner's team grants, and per workspace share links, exchange rate policy, business metrics and the savings findings your team wrote or answered. Each team lists its members in place of memberCount. Secrets stay out.
Read more: The organization export includes every setting - Fixed
Payment reminders ask for what is still owed
When part of an unpaid invoice is credited, payment reminders now state the amount still due instead of the original total. An invoice credited in full no longer sends reminders or pauses your account.
Read more: Payment reminders ask for what is still owed - Fixed
The cost trend draws each currency on its own line
With Currency conversion off and costs in several currencies, the Overview's Cost trend added euros and dollars into one line, and service shares were measured against that sum. The trend now draws one line per currency, and a service's or report row's share is of the total in its own currency. The Public API cost summary's percentage is now of the whole range, not of its top ten.
Read more: The cost trend draws each currency on its own line - Fixed
Invitations from your partner carry the partner's name
When your partner's staff invite someone to your organization, the email is signed with the partner's name rather than the person's, as everywhere else you see partner activity.
- Fixed
Budgets and tag coverage stay within your plan's history
A budget period before your plan's history now reads “Before your plan's history” instead of 0% used, and a period reaching before it says it is “Counted from” the day the history begins. Segment budgets and tag coverage no longer count cost from before it, and the suggested amount averages only the days it measured.
Read more: Budgets and tag coverage stay within your plan's history - Fixed
Cost report updates through the API answer the folder the report is in
An API update that leaves out folderId answered no folder although the report stayed filed. It now answers the folder the report keeps, and clearFolder takes a report out of its folder.
Read more: Cost report updates through the API answer the folder the report is in - Fixed
Terraform keeps a dashboard when the default dashboard moves
When another dashboard became the workspace default, the next Terraform apply deleted and recreated a dashboard that sets is_default, losing its widgets, digests and share links. It now changes the default in place, and the API can set or clear a dashboard's default directly.
Read more: Terraform keeps a dashboard when the default dashboard moves - Fixed
Dashboard updates through the API refuse an unknown date range
Updating a dashboard through the Public API with a date range or granularity the API does not know used to succeed without changing anything, and some values left the dashboard unreadable. Such an update now answers 400 and leaves the dashboard as it was.
- Fixed
Group mapping changes no longer undo someone else's
Saving the group to team mapping from an outdated screen removed a mapping someone else had just added, and its members lost that team at their next single sign-on. Such a save is now refused, and the screen shows the current mappings so you can make your change again.
Read more: Group mapping changes no longer undo someone else's - Fixed
Forecasts no longer read low while provider data is still arriving
Cloud providers deliver the last day or two of cost late, and the forecast counted those days as costing nothing, so a month's forecast could read about a tenth low. Days still arriving now count at the larger of their cost so far and the forecast, in reports and in the Public API forecast.
Read more: Forecasts no longer read low while provider data is still arriving - Fixed
Unpaid invoices no longer show as canceled
An invoice that is no longer being collected showed as “Canceled” in your invoice history, and stayed that way after you paid it. It now shows as “Unpaid”, and paying it later marks it “Paid”.
- Fixed
Credit notes show their own amounts
A partial credit note now shows the amount it credits instead of the whole invoice, a second credit note on the same invoice appears too, and each one downloads as its own PDF. An invoice reads Refunded only once it is paid and credited in full.
- Fixed
Deleting a connection, organization or account always erases its data
A deletion interrupted at the wrong moment could report an error, stay deleted and leave its data in place. The data of every deleted connection, organization or account is now always removed.
- Fixed
Connection changes made during a sync are kept
Editing a connection or replacing its credentials while it was syncing could leave it showing Syncing for good, or the sync could undo the edit. The edit and the sync's result are now both kept.
- Fixed
Kubernetes cluster rates you save are kept
Rates and a display name saved for a Kubernetes cluster while its nightly cost run or an agent report was in progress could fall back to their earlier values. They are now kept.
Read more: Kubernetes cluster rates you save are kept - Fixed
Kubernetes costs include billing that arrives after the first night
When a cloud's billing for a day was only partly in by the next morning, namespaces on AWS, Azure or GCP nodes kept that partial cost for good. Such a day is now processed again two days later, from the billing that has arrived by then.
Read more: Kubernetes costs include billing that arrives after the first night - Fixed
Sign-in and password reset no longer reveal who has an account
A locked account now answers like a wrong password, and an email tells its owner when the lock starts. Sign-up and password reset answer the same whether or not the address has an account, and a mail outage no longer makes them fail.
- Fixed
Custom cost lines with different line ids add up
Two lines sent to the custom costs API with different line ids but the same day and details are both kept, instead of the later one replacing the earlier.
Read more: Custom cost lines with different line ids add up - Fixed
Organization tokens reach only workspaces their creator can access
An Editor or Integration owner could create an organization API token that read and changed workspaces they were not given access to. Only Owners now give an organization token workspace capabilities, and each use reaches only what its creator can access and the Owner rights they still hold, so a token of an Owner later removed or given another role is limited too.
Read more: Organization tokens reach only workspaces their creator can access - Fixed
Verification links ask for the account password
Someone who signed up with your address could keep signing in after you verified it. Now the link asks for the account's password; if you do not know it, your email is still verified, every earlier way to sign in is removed, and you set a new password.
Read more: Verification links ask for the account password - Fixed
A second checkout no longer leaves two subscriptions billing
Completing a second checkout while your subscription was already active or its payment overdue left two subscriptions billing. Now the second subscription is cancelled at once and you are not charged for it: a payment already made is refunded.
- Fixed
Removed and suspended users stop receiving email channel messages
A user removed from or suspended in your organization kept receiving the notifications of an email channel that still listed their address. The address they held then is now left out of each message, even after they change it or delete their account, until an active member holds it again. Every other address on the channel, including addresses outside the organization, still receives it.
Read more: Removed and suspended users stop receiving email channel messages - Fixed
Paging through Public API lists returns each item exactly once
Paging through segments, folders or a connection's sync history in the Public API could repeat some items and miss others when one changed between pages. In a workspace with more than 100 segments, Terraform could then drop a costfluent_segment from state and fail to create it again. These lists now keep a fixed order.
Read more: Paging through Public API lists returns each item exactly once - Fixed
Upgrading while a payment is overdue keeps the reminder until it is paid
Moving to a higher plan while an invoice is overdue now changes your plan at once but no longer marks the account as paid. Collection that was paused for non-payment resumes when the invoice is paid.
- Fixed
Rule preview shows segments that lose all their cost
Previewing an allocation rule now lists a segment the rule would take all of its cost from, falling to zero, instead of leaving it out and showing only the gain.
Read more: Rule preview shows segments that lose all their cost - Fixed
Spend in the Scale band brings a call from sales, not an automatic upgrade
Two months of spend in the Scale band no longer schedule a move to Scale that could not be charged. Your plan stays as it is, nothing is blocked, and the notice says our sales team will be in touch.
- Fixed
The alerts page stays current and shows spend thresholds in their currency
The "Alerts" page updates as soon as you add, change, pause, resume or delete a budget, cost alert or report schedule. A spend threshold shows its currency, and a list that fails to load says so and offers "Retry" instead of showing "No alerts configured".
Read more: The alerts page stays current and shows spend thresholds in their currency - Fixed
A role change also applies to teams mapped from SSO groups
Demoting a member now also lowers their role in the teams single sign-on placed them in, so they no longer keep edit rights there. Teams they were added to by hand keep the role they were given.
Read more: A role change also applies to teams mapped from SSO groups - Fixed
Replace an SSO client secret without switching single sign-on off
Each single sign-on connection now has Replace secret. Rotating your provider's client secret no longer means saving the connection again, which switched single sign-on off and cleared enforcement and the domain verification.
Read more: Replace an SSO client secret without switching single sign-on off - Fixed
Pausing, resuming or deleting a cost alert that fails now says why
When a cost alert could not be paused, resumed or deleted, nothing on screen changed and nothing said so. Each now reports the failure, with the reason when the server gives one. An alert name longer than 200 characters is refused at the field instead of failing on save.
Read more: Pausing, resuming or deleting a cost alert that fails now says why - Fixed
Workspace currency and time zone accept any letter case
Creating a workspace through the API no longer refuses a lowercase currency such as eur, and a time zone written in another case, such as europe/berlin, is always accepted and saved as Europe/Berlin.
Read more: Workspace currency and time zone accept any letter case - Fixed
Long windows convert at the transaction-date rate
A workspace converting at the "Transaction-date rate" can read a year or more of costs, with its comparison, in several billing currencies. Cost summaries, charts and tag coverage over such a window used to fail with an error; each day now converts at its own rate.
Read more: Long windows convert at the transaction-date rate - Fixed
Connections sync as often as their frequency says
A connection set to sync more often than every six hours now does: scheduled syncs start every hour, and each connection runs at its own frequency, from hourly to daily.
- Fixed
Allocation rule previews cover at most one year
A rule preview through the API now refuses a window longer than 366 days, as allocation coverage already does, and both read only the history your plan includes.
- Fixed
An email channel holds at most 25 addresses
Creating or editing an email notification channel with more than 25 addresses is now refused with a message saying so. A channel saved with more addresses before this change keeps sending to all of them until it is next edited.
Read more: An email channel holds at most 25 addresses - Fixed
Allocation rule changes made by Costfluent appear in the audit log
When the Costfluent team creates, changes or deletes an allocation rule for you, the change now appears in your audit log and its export, with the rule before and after. The log shows System as the actor.
- Fixed
Everyone team roles always follow the organization role
A member's role on the Everyone team can no longer be changed by hand. Before, it could drift from their organization role and give them more rights than that role allows. Change the member's organization role instead.
Read more: Everyone team roles always follow the organization role - Fixed
Cost alert updates refuse a value that names no threshold type or period
Updating a cost alert through the API with a combined value that names no threshold type or comparison period now answers 400 and leaves the alert as it was. Before, the update was accepted and the alert could fail to load or show a numeric comparison period.
- Fixed
Teams messages show names as typed instead of as links or formatting
A name in a Microsoft Teams alert or scheduled report, such as a budget, a cost alert or a channel, that contained text like [Reset password](https://…) or **bold** showed as a link or as formatted text. Names and message text now appear exactly as written.
- Fixed
Segments keep their team's name when the team is deleted
Deleting a team left its segments without a team, so their cost appeared as "Unallocated" in Coverage and the rule preview while still counting as allocated. The team's name now stays on each segment as its Team, unless another segment already has that team, product and cost centre.
- Fixed
Creating a folder that fails now says why
When a new folder could not be created, the dialog stayed open without a word. It now reports the failure, with the reason when the server gives one, and keeps the title you typed. A title of only spaces can no longer be submitted, and the title field stops at 200 characters.
Read more: Creating a folder that fails now says why - Fixed
Duplicating a report or marking notifications read now says when it fails
Choosing “Duplicate” in the cost report list, opening an unread notification or choosing “Mark all read” did nothing visible when the request failed. Each now reports the failure, with the reason when the server gives one.
Read more: Duplicating a report or marking notifications read now says when it fails - Fixed
Resent invitations appear in the audit log
Resending an invitation now appears in the audit log and its export. An invitation can only be resent to someone who has not accepted it yet; suspended and removed members no longer receive an invitation link that cannot work.
- Fixed
Editing a workspace opens again and says when its name is taken
“Edit workspace” in the workspace list showed an error instead of its dialog, and a rename to a name another workspace already has was refused without a word. The dialog opens again, says when the name is taken, reports any other failure, and keeps what you typed.
Read more: Editing a workspace opens again and says when its name is taken - Fixed
Creating or editing a dashboard that fails now says why
When a new dashboard could not be created, or a change to a dashboard's title, date range or granularity could not be saved, the dialog stayed open without a word. It now reports the failure, with the reason when the server gives one, and keeps what you entered so you can try again.
Read more: Creating or editing a dashboard that fails now says why - Fixed
Public API refuses a dashboard widget without a position
Creating a dashboard widget through the Public API with an empty position failed with a server error. It is now refused with an error that points to the position, and nothing is added.
- Fixed
Filtering Public API tag keys by provider ignores capitalization
Listing tag keys with a provider filter such as providerKey=aws, the documented spelling, returned an empty list. The filter now matches the provider whatever the capitalization.
- Fixed
Changing an allocation rule someone else just deleted says so
Editing or deleting an allocation rule that someone else deleted a moment earlier no longer fails with an unexpected error. You are told that someone else changed it, the rule stays deleted, and nothing is saved.
- Fixed
A workspace that reads a thousand or more chosen accounts loads its costs
A workspace set to Chosen accounts on its connections could not load its costs once it read about a thousand accounts or more: cost reports and the other views of its cost failed with an error. They now load, and still count only the accounts the workspace reads.
Read more: A workspace that reads a thousand or more chosen accounts loads its costs - Fixed
Terraform accepts workspace account IDs in any case or spacing
An account in the account_ids of a costfluent_workspace_provider written with surrounding spaces or in another letter case, such as an Azure subscription ID in capitals, made the apply fail with an inconsistent result. The apply now succeeds, and Terraform keeps the spelling you wrote.
Read more: Terraform accepts workspace account IDs in any case or spacing - Fixed
The Kubernetes agent lists namespaces only when it sends their labels
The agent's Helm chart gave it permission to list every namespace in the cluster, even though it reads namespaces only to send their labels, which is off by default. The chart now grants that permission only when agent.collectNamespaceLabels is true.
Read more: The Kubernetes agent lists namespaces only when it sends their labels - Fixed
Audit log times and date filter agree on the day
The audit log showed entries in your workspace's time zone while From and To picked UTC days, so an entry near midnight could fall outside the day it appeared on. Every time now shows in UTC, and the date fields read From (UTC) and To (UTC).
Read more: Audit log times and date filter agree on the day - Fixed
Anomaly severity filter matches whatever the case
Filtering anomalies by severity in the Public API and the Terraform data source used to return nothing for High or CRITICAL. It now matches the severity whatever its case, and the data source refuses a severity that does not exist instead of returning an empty list.
- Fixed
Teams, channels, workspace connections and saved filters list each item once
Paging through teams, notification channels, a workspace's connections or its saved filters could repeat some and miss others when an item on an earlier page changed in between, most often when items share a name or a connection was removed and re-enabled. These lists now keep a fixed order, so every page lists each item once.
Read more: Teams, channels, workspace connections and saved filters list each item once - Fixed
Allocation rule updates keep the priority and state they leave out
Updating an allocation rule through the API without its priority or its enabled state no longer moves the rule back to priority 100 or turns a disabled rule back on; both stay as they were. An update without a segment is now refused as invalid instead of failing with a server error.
- Fixed
Revoke is shown only to owners, who can use it
Revoking an API token needs the Owner organization role. "Revoke token" in the API tokens list is now shown only to owners, so editors and integration owners no longer see an option that ends in an error.
Read more: Revoke is shown only to owners, who can use it - Fixed
A refused API call no longer uses up your other limits
A Public API call refused with 429 by one limit, such as the per-minute limit on cost data, still counted against the token's other limits, so calling cost data too often could use up the hourly budget for every other operation. A refused call now counts against none of them.
Read more: A refused API call no longer uses up your other limits - Fixed
Deleting a connection updates workspaces and clusters at once
After a cloud connection was deleted, the workspace list and workspace pages, “Workspace providers” and Kubernetes clusters could keep showing it for a while. They now update as soon as the connection is gone.
- Fixed
A theme that cannot be saved is reported in your language
When a theme change could not be saved, the error appeared in English and the theme switched to light or dark instead of the one you had, losing “System”. The message now follows your language and your previous theme comes back.
- Fixed
Organization settings offer every supported default currency
An organization whose default currency was CHF, INR or BRL could not load its settings, and “Default currency” offered only six currencies. Every supported currency now loads, shows and saves there.
- Fixed
Reordering allocation rules applies the whole order or none of it
When someone else changed or deleted a rule while you moved rules up or down, some rules could already have moved before the change was refused, leaving your reports in an order nobody chose. Now no rule moves, and you can reorder again from the current list.
Read more: Reordering allocation rules applies the whole order or none of it - Fixed
A deleted notification channel is refused as a destination
A cost alert, a budget or a workspace's anomaly routing saved through the API with a notification channel that had been deleted was accepted, and nothing was ever sent to it. It is now refused as not found, and nothing is saved. A scheduled report naming a deleted channel now answers 404 instead of 400.
- Fixed
Listing a team's workspace access returns each grant exactly once
Paging through a team's workspace access in the Public API could repeat some grants and miss others when a grant on an earlier page was removed and given again in between, so the costfluent_team_workspace_access Terraform resource could lose a grant and create it again. Grants now keep a fixed order, so every page lists each one once.
Read more: Listing a team's workspace access returns each grant exactly once - Fixed
The last break-glass owner is kept while any connection requires single sign-on
While any of your connections has Require single sign-on on, the last break-glass owner can no longer lose that access: unmarking them under a connection without Require single sign-on, or suspending them, is refused until another owner has break-glass access. An owner who no longer has a password and a second factor or passkey can now be unmarked, even while one other break-glass owner remains.
Read more: The last break-glass owner is kept while any connection requires single sign-on - Fixed
Cost insights compare services and regions with their previous cost
In a workspace with more than 50 services or regions, one that was small in the previous period showed under Fastest growing services as new, grown by 100%, and a region could show a drop to zero it never had. Each is now compared with what it actually cost in both periods.
- Fixed
Scheduled deliveries in their own time zone report the period that ended there
A scheduled delivery of a report or a dashboard set to a time zone other than the workspace's now reads a range such as "Last month" or "Last 7 days" from the date in its own zone. A monthly delivery at 08:00 on the 1st set to Tokyo time in a workspace on UTC, for example, reports the month that just ended instead of the month before it.
Read more: Scheduled deliveries in their own time zone report the period that ended there - Fixed
An organization always keeps an active owner when members are suspended
Suspending the last active owner of an organization, or suspending yourself, is now refused, so nobody can lock an organization out of its own administration by mistake.
- Fixed
Slack messages show names as typed instead of pinging or linking
A name in a Slack alert or scheduled report, such as a cost alert, a service, a resource or a report subscription, that contained <!channel> or <https://…|text> notified the whole channel or showed as a link. Names now appear exactly as written.
- Fixed
Listing exchange rates up to a past date returns that day's rates
Asking the API's exchange-rate list for rates up to a date before the latest publication, with no start date, returned an empty page whose start came after its end. It now returns the rates published on that date.
- Fixed
AWS export prefixes containing '..' are refused when you connect or update
An AWS connection whose export_prefix contained '..' was accepted, then failed on every collection. Connecting or updating with such a prefix is now refused straight away with an error naming export_prefix.
- Fixed
Scheduled emails show the time in the schedule's time zone
A report or dashboard sent by scheduled delivery gave its time in UTC, even for a schedule set to another time zone. It now states the time in the schedule's own zone and names it, such as 09:00 Europe/Berlin. A cost anomaly email gives the anomaly's day as a date, no longer as midnight UTC.
Read more: Scheduled emails show the time in the schedule's time zone - Fixed
Slack alert buttons open the right page
The button on a budget alert or cost anomaly posted to Slack pointed at an address that did not open Costfluent. It now opens Budgets or Insights in the alert's workspace, as the email does.
- Fixed
Slack alerts with long names are delivered
A budget alert or cost anomaly whose budget or service name made the message title longer than Slack accepts was refused by Slack and never arrived. The title is now shortened to fit, and the alert is posted.
- Fixed
Scheduled reports no longer arrive twice after an edit
Saving a scheduled report just as it became due could send it a second time. It is now sent once.
Read more: Scheduled reports no longer arrive twice after an edit - Fixed
A downgrade survives reactivating a cancelled subscription in the billing portal
After a downgrade, cancelling the subscription in the billing portal opened from Manage payment method and then reactivating it there removed the Moving to notice, and the plan stayed on the higher tier for another period while the lower price was billed. The downgrade now stays scheduled and takes effect at the end of the paid period.
- Fixed
Payment overdue stays until every overdue invoice is paid
Paying one overdue invoice set the subscription back to Active while another invoice was still overdue. The subscription now shows Payment overdue until every overdue invoice is paid, and returns to Active with the last payment.
- Fixed
API tokens need View report schedules to read report schedules
An API token that could view cost reports could also list and read their scheduled deliveries. Reading them now needs the View report schedules capability, so create a token that includes it, and revoke the old one, for any integration that reads report schedules.
Read more: API tokens need View report schedules to read report schedules - Fixed
SSO group mappings no longer fail after a team is deleted
Deleting a team now removes its mappings from “Group to team mapping”, and a save refused because a team was deleted elsewhere refreshes the list, so the next “Add mapping” works.
Read more: SSO group mappings no longer fail after a team is deleted - Fixed
Your only passkey can no longer be removed
Removing a passkey that is the only way to sign in to your account is refused, so you can no longer lock yourself out. Add another passkey or connect a GitHub or Google account first.
Read more: Your only passkey can no longer be removed - Fixed
A connection's 30-day cost shows only to members who can see all of it
Any member could open Manage connection and read what a connection cost over the last 30 days, even when it feeds workspaces they cannot view. Owners and integration owners still see it; anyone else sees it only when they can view a workspace that reads the whole connection, not just some of its accounts.
Read more: A connection's 30-day cost shows only to members who can see all of it - Fixed
Savings totals count every finding in the queue
The pipeline totals and finding counts on the Savings page covered only the 50 newest findings. They now cover every finding your filters select, the list shows up to 200, and when there are more it says how many it shows.
Read more: Savings totals count every finding in the queue - Fixed
Days of an interrupted sync are collected again instead of staying empty
A sync that stopped while saving its costs, and was only finished more than 30 days later, could mark its days as collected with some or all of their costs missing. Those days are now collected again on the next sync.
- Fixed
AWS connections list the export bucket they collect from
Replacing an AWS connection's role without naming the export no longer drops its Export bucket from the integrations list, and changing only the bucket now shows the new one instead of the old.
- Fixed
Support can accept a removal of last month's charges early in the month
When a provider redelivered last month with fewer charges during the first half of a month, Costfluent kept the imported charges but support could not accept the change, because the sync of the current month that followed replaced the refusal. Support can now accept it, and last month's costs then no longer include the removed charges.
- Fixed
The daily read no longer withdraws a savings finding you accepted
If you accepted a finding while the daily read of your provider's recommendations was running, and the provider had stopped recommending it, the read could change its status from Accepted to Withdrawn. Your answer now stands. Changing a finding that was retired at the same moment no longer fails with a server error.
Read more: The daily read no longer withdraws a savings finding you accepted - Fixed
A busy processing queue no longer restarts or stops a connection's sync
When processing was busy, a sync whose cost data had already been collected was started again, and after repeated restarts the connection showed the status Error with "Collection failed repeatedly and has been stopped." Collected data now waits up to 24 hours to be processed.
- Fixed
Deleting a connection also erases its uploaded files and cluster reports
Deleting a custom provider left its uploaded cost files and their upload records stored, and deleting a Kubernetes cluster left its stored metric reports, until the whole organization was deleted. Both are now erased with the connection's cost data.
- Fixed
A Costfluent update during a sync no longer shows a sync error on the connection
When a Costfluent update stopped a sync while it was importing data, a working connection showed the status Error and asked you to check its credentials. The interrupted sync is now retried and the connection shows no error.
- Fixed
Paying an overdue invoice during a reminder run no longer leaves it overdue
An invoice paid while payment reminders were going out could be set back to Overdue. You could then get another reminder, see your plan as Payment overdue and later see Cost ingestion is paused. A paid invoice now stays Paid, and each invoice is checked again before a reminder is sent or the plan is marked Payment overdue.
- Fixed
Tag coverage is measured in one currency
With costs billed in more than one currency, the Tag coverage card on Insights and Low tag coverage alerts added the amounts together as if they were one currency. With Currency conversion on, every cost is now converted first; with it off, coverage is measured in one billing currency, which the card names.
Read more: Tag coverage is measured in one currency - Fixed
A cancellation made in the billing portal shows when the subscription ends
Cancelling a subscription in the billing portal opened from Manage payment method could leave the plan card without the Subscription ending notice and its date. The notice now appears with the day the subscription ends, the subscription ends that day, and reactivating it in the portal removes the notice.
- Fixed
Rule, segment and savings forms say what to correct
An allocation rule or segment that could not be saved now says under each field what is missing or out of range, and savings findings say it in German too. A refused “Preview” shows the reason, and a preview disappears once the rule's priority, segment or filter changes.
Read more: Rule, segment and savings forms say what to correct - Fixed
Kubernetes costs of a night that was not processed are filled in the next night
When the nightly Kubernetes cost run failed or did not run, the day it should have processed stayed without costs for good, and a day still waiting for its cloud bill could miss its second pricing. The next night now processes every day it missed, up to a week back, each only once.
Read more: Kubernetes costs of a night that was not processed are filled in the next night - Fixed
“Author finding” opens an empty form after a finding was revised
After revising a savings finding, “Author finding” opened with that finding's values already filled in, so saving it created a duplicate. The form now opens empty every time, and editing a finding always shows that finding.
Read more: “Author finding” opens an empty form after a finding was revised - Fixed
A Kubernetes node replaced under the same name is priced as its own machine
When a cloud replaced a node with a new machine under the same name on the same day, as AWS does when it reuses a private IP, both machines were priced as one: only the newer machine's bill or rate counted. Each machine now carries its own bill or rate, and the workloads that ran on it share its cost.
Read more: A Kubernetes node replaced under the same name is priced as its own machine - Fixed
A plan change or an unmeasured month restarts the count toward an upgrade
Months above your plan's spend band counted toward an automatic upgrade even after you changed plans, or with a month between them that could not be measured, so an upgrade could be scheduled without the first-month notice. Now only consecutive months on your current plan count, and you always get that notice first.
- Fixed
A budget starting after 2100 is refused instead of failing
Creating a budget, or asking for its suggested amount, with a start date far in the future, such as in the year 9999, failed with an unexpected error. A budget and each of its periods now start on or before 31 December 2100, and a later start date is refused as invalid.
Read more: A budget starting after 2100 is refused instead of failing - Fixed
Invoices with a discount appear at the amount charged
An invoice lowered by a discount or a tax-inclusive price could be missing from Invoices and from payment reminders. It now appears with its net, tax and total as charged, and a reminder asks for that total.
- Fixed
Alert thresholds and savings estimates that do not fit are refused
Saving a cost alert's threshold or “Minimum increase”, the anomaly detection's “Notify from”, or a savings finding's “Estimated monthly saving” with a value too large to store could fail with an unexpected error, and one with more than 8 decimal places was quietly rounded. Such a value is now refused with a message naming the field.
Read more: Alert thresholds and savings estimates that do not fit are refused - Fixed
A dashboard can no longer be saved with a range that ends before it starts
Changing only the start or the end date of a dashboard's custom range through the API could leave the range ending before it began, and its widgets then failed to load. Such a change is now refused with an error, and the dashboard keeps its range.
- Fixed
Invoices show the period they bill
The Invoices list showed some invoices with the month before the one billed, or with a single day, and ended each period a day late. It now shows the month the invoice bills, up to its last day. Renews on and the date a plan change or cancellation takes effect are no longer a day late either.
Read more: Invoices show the period they bill - Fixed
A sync that times out shows as failed, not cancelled
A sync that timed out while importing its data said it was cancelled and was missing from the connection's sync history. It now appears there as a failed sync that timed out. A Kubernetes cluster whose nightly run times out no longer stops the clusters after it from being processed that night.
- Fixed
An Azure service principal connects only once, even when added twice at once
Adding the same Azure service principal twice at the same moment, for example from two browser tabs, could create two connections for it. The second attempt is now refused because the principal is already connected.
- Fixed
Dashboard cards count their widgets
A dashboard's card in the dashboards list could show no widgets, and making a dashboard the default answered without its widgets. Both now carry every widget the dashboard holds.
- Fixed
Settings lists show every item
Lists of members, budgets, virtual tags, folders, connections, alerts, API keys, share links, report subscriptions and notification channels showed only their first 20 items, and the pickers built on them did too, so the rest could not be found or managed. They now show every item.
- Fixed
Cost alert messages state amounts in their currency and percentages with a sign
Cost alert emails, Slack, Teams and webhook messages and in-product notifications no longer show the alert type's internal name and bare, unrounded numbers. They name the type as the Alerts page does, give amounts in the alert's currency rounded to the currency's smallest unit, percentages with a % sign, and say which period the cost was compared with.
Read more: Cost alert messages state amounts in their currency and percentages with a sign - Fixed
A partner is deleted only once it manages no organizations
A partner organization's deletion checked for managed organizations only when it was requested, so one created before the emailed link was followed could be left without its partner. Following the link now checks again and says which organizations to delete first; the same link works once they are gone.
- Fixed
Get started steps stay ticked
When two steps of the Get started checklist completed at the same moment, for example a connection finishing while a teammate created a budget, one could be un-ticked again. Every completed step now stays ticked.
- Fixed
Every report and dashboard appears in lists and pickers
Only the first 20 reports and dashboards of a workspace showed in the reports and dashboards lists, the budget scope and widget pickers, the command palette and the onboarding checklist. They now show every report and dashboard.
- Fixed
Connecting an account twice says it is already connected
Connecting a provider, or changing a connection's account ID, to an account another connection in your organization already uses now answers that it is already connected instead of an unexpected error. The same holds when two requests connect one account at the same moment.
- Fixed
Removing a widget twice at once answers a conflict
When two people or scripts removed or changed the same dashboard widget at the same moment, the later request could fail with a server error. It now answers 409 concurrency_conflict and changes nothing, in the app and in the Public API, so a client can read the dashboard again and retry.
- Fixed
Syncing a Kubernetes cluster no longer leaves it stuck
A sync requested through the API for a Kubernetes cluster, or another connection Costfluent does not collect, is now refused with the reason instead of leaving the connection marked as syncing for good. A cluster's cost arrives with each report from the agent.
Read more: Syncing a Kubernetes cluster no longer leaves it stuck - Fixed
Sign-up finishes for invited and former members
Finishing sign-up failed, or returned an organization you could not open, when your only membership was an invitation you had not accepted yet or belonged to a deleted organization. Sign-up now creates your own organization in those cases, and a pending invitation can still be accepted afterwards.
- Fixed
The API names each exchange-rate method a window across a policy change used
When the months of a cost window were converted by different exchange-rate methods, the API described the whole window by its first month's method. Its description now names each method with the months it converted, its method field and the console name the latest month's method, and a cost summary describes its own window, not its comparison period.
Read more: The API names each exchange-rate method a window across a policy change used - Fixed
Report and alert links open in their workspace
A link in a scheduled report, digest or alert email opened the console in the workspace you last used, so a report from another workspace showed the wrong data. Links now open the workspace they were sent from, when you have access to it, and budget, cost and anomaly alert emails carry their workspace too.
- Fixed
A budget alert fires only once spend has reached its threshold
A budget whose spend was just short of its amount, such as 999.95 of 1000, could send its 100% alert and read as 100% used. Each threshold now fires only once the spend has reached it, and the share used on budgets, their “Spending trend”, the API and alert emails and messages is rounded down to match.
Read more: A budget alert fires only once spend has reached its threshold - Fixed
Month-over-month alerts no longer fire on flat spend after a shorter month
A cost alert comparing with the previous month could fire on unchanged daily spend because the month so far had more days than the month before, such as 31 days of March against 28 of February. It now compares the two at their daily averages, so only a real rise in spend fires.
Read more: Month-over-month alerts no longer fire on flat spend after a shorter month - Fixed
Data through dates wait for every Azure subscription a connection collects
When one subscription of an Azure connection stopped collecting, "Data through" still showed the date of the most current one, so days missing for that subscription looked complete. It now shows the date every collected subscription has reached. A subscription that was removed or moved to another connection no longer holds it back.
- Fixed
Every connection is checked each day
The daily check of connection credentials stopped after 50 connections, so a connection's Integration status could go days without updating, and one saved while its cloud provider could not be reached could wait days before collecting. The check now reaches every connection due for it, once a day.
Read more: Every connection is checked each day - Fixed
Exchange rates below one keep their precision
A rate stated with a converted figure, and the “Current market rate” preview, were cut to four decimal places, so 1 JPY read as 0.0067 USD and 1 IDR as 0 GBP. Rates now keep five significant digits, such as 1 JPY = 0.0066624 USD, in the app and in the API's conversion description.
Read more: Exchange rates below one keep their precision - Fixed
Notification channels say why a save or delete failed
Renaming or deleting a notification channel that fails now says why and keeps the dialog open, and a channel that cannot be loaded offers a retry.
- Fixed
Reconciliation and savings work in every currency your costs arrive in
Monthly reconciliation and savings verification now work for accounts billed in currencies such as SEK, KWD or KRW, using each currency's own decimal places, instead of failing.
- Fixed
The audit log records deleted channels, savings items and tag keys
Deleting a notification channel, a savings item or a tag key now appears in the audit log and its export.
- Fixed
A budget alert threshold given twice is refused
Creating a budget through the API or with Terraform with the same alert threshold twice failed with an unexpected error. It is now refused with a message saying each threshold can be given only once, and nothing is saved.
Read more: A budget alert threshold given twice is refused - Fixed
A cost alert no longer notifies twice for one increase
When the period a triggered Absolute or Percentage increase alert compares with could not be measured, for example because it was billed in another currency with currency conversion off, the alert reset and notified again about the same increase once the comparison read again. It now stays triggered until spend actually drops back under its threshold.
Read more: A cost alert no longer notifies twice for one increase - Fixed
Spend band notices reach every owner when one address bounces
When one owner's address refused the email about spend above your plan's band, the owners after it got no email and the notice never appeared in the app. Now every other owner is mailed and the in-app notice is always posted, once.
- Fixed
An export that fails partway fails as a download
A cost or audit log export that fails after the download has started now ends as a failed download instead of saving a file that looks complete but is cut short.
- Fixed
Organizations with more than 20 workspaces see all of them
Only the first 20 workspaces appeared in the workspace switcher, the workspace settings and the workspace pickers, and a workspace past them could not stay selected: the console switched back to the first one. Every workspace now appears and stays selected.
- Fixed
A virtual tag in use cannot be deleted
Deleting a virtual tag that a report, cost alert or saved filter still filters or groups by is now refused, naming each of them, instead of leaving them reading a tag that no longer exists and an alert silently no longer firing.
Read more: A virtual tag in use cannot be deleted - Fixed
Cost exports over 250,000 rows are refused instead of cut short
A CSV export from the cost explorer with more than 250,000 rows downloaded a file that silently stopped at 250,000 rows. Such an export is now refused before anything downloads, with a message to narrow the date range, filters or grouping, so a file you download always holds every row.
Read more: Cost exports over 250,000 rows are refused instead of cut short - Fixed
Charts name the right day and month in every time zone
West of UTC, the Cost trend on the dashboard and the charts of cost reports, shared reports and dashboards labelled each point with the day or month before it, and the Change view on Insights ended the previous period a day early. They now name the dates the costs belong to.
- Fixed
Report comparisons no longer set a full period against a shorter one
A report with a fixed comparison range, shown on a dashboard with its own range, compared the dashboard's dates with that fixed range; it now compares with the period just before them. When the report's range or the period it is compared with reaches past your plan's cost history, the report now shows no comparison instead of setting a shortened or empty period against a full one.
Read more: Report comparisons no longer set a full period against a shorter one - Fixed
Lists that fail to load say so and offer a retry
When virtual tags, saved reports, connections or a workspace's providers could not be loaded, the page looked empty and offered to create one. It now says the list could not be loaded and offers “Retry”. “Add provider” no longer offers a provider the workspace already has, and a refused change to a workspace provider or a virtual tag now says why, and its dialog stays open.
- Fixed
Signing out ends the session in every open tab
Signing out in one browser tab left the console usable in your other open tabs for up to 15 minutes. Signing out, a timed-out session, a deleted account and a confirmed email change now end the session in every tab at once and take each one to the sign-in page.
- Fixed
Date range presets stay current
A preset such as Last 7 days or Last month now follows the calendar: Overview, Insights and the Tags settings open on the period as of today, not on the dates it covered on the day it was picked. A range picked before this change keeps its dates until you pick the preset again; a range picked on the calendar always keeps its dates.
- Fixed
Insights no longer subtract costs in different currencies
With currency conversion off, two periods billed in different currencies now show no comparison instead of a change that subtracted one currency from the other.
- Fixed
Report comparisons and forecasts no longer mix currencies
With Currency conversion off, Compare to previous period set a period billed in one currency against one billed in another, or added several currencies into one line, and Show forecast projected weeks that mixed currencies as one. A report now shows no comparison or forecast unless both periods are in the report's one currency.
Read more: Report comparisons and forecasts no longer mix currencies - Fixed
Email channels reach every recipient when one address is refused
When an email channel names several recipients and the mail server permanently refuses one address, the others still get the notification, once. Before, the refused address stopped the send, later recipients got nothing and earlier ones got the message again on every retry.
- Fixed
Insights no longer compare against a shortened period
When a period reaches back before the history your plan keeps, insights now show no comparison instead of growth measured against a shortened earlier period.
- Fixed
FOCUS exports show the billed cost as BilledCost
A CSV (FOCUS 1.4) export's BilledCost now shows the billed cost under every cost view. Under the default amortized view it showed the effective cost.
Read more: FOCUS exports show the billed cost as BilledCost - Fixed
A budget amount finer than one cent is refused
Saving a budget, or one of its periods, with an amount finer than one cent or too large to store could fail with an unexpected error or quietly store a rounded amount. Such an amount is now refused, and when a budget cannot be saved the message says why instead of only that it failed.
Read more: A budget amount finer than one cent is refused - Fixed
A plan bought at checkout starts once its payment clears
A checkout whose first payment was still outstanding switched to the new plan straight away. A plan bought at checkout now starts once that payment clears, and if the payment expires you can check out again.
- Fixed
Malformed IDs no longer cause a server error
An API request with an ID that had the right prefix and length but a character IDs never contain, such as an exclamation mark, was answered with a server error. It is now refused like any other invalid ID.
- Fixed
The exchange rate preview shows a rate on weekends and for any pair
Current market rate in Settings always read Rate unavailable for USD to EUR, and the exchange rate API answered not found on weekends, holidays and before the day's rates arrived. A rate now comes from the latest publication on or before the day, names that day, and works for any pair through the euro.
Read more: The exchange rate preview shows a rate on weekends and for any pair - Fixed
Each SSO connection shows its own domain verification record
With several single sign-on connections, the TXT record requested for one domain showed under every unverified connection, and verifying one cleared the record shown for another. Each connection now shows only its own record.
Read more: Each SSO connection shows its own domain verification record - Fixed
Entra ID users in more than 200 groups keep their mapped teams
Microsoft Entra ID leaves the groups out of the sign-in for a person in more than 200 groups, and single sign-on then took that person out of every team the group to team mapping had put them in. Those teams now stay, and only a team whose mapping you deleted or changed is removed.
Read more: Entra ID users in more than 200 groups keep their mapped teams - Fixed
Invitation emails name the person who invited you
An invitation email, and a resent one, named the invited person as the one sending the invitation. It now names the person who sent it, or the organization when the invitation comes through an API token.
Read more: Invitation emails name the person who invited you - Fixed
Invited members who sign in with SSO join the Everyone team
A person who accepted an invitation by signing in through single sign-on became a member without joining the Everyone team, and could still get in after the invitation had expired. They now join Everyone as an accepted invitation does, and an expired invitation is refused.
Read more: Invited members who sign in with SSO join the Everyone team - Fixed
Requiring single sign-on ends only the sessions it refuses
Turning on Require single sign-on also signed out removed members, people at other email domains and people already signed in through your provider. It now ends only the other sessions of active members it applies to, and the number of ended sessions it reports is the true count.
Read more: Requiring single sign-on ends only the sessions it refuses - Fixed
Exchange rate policies set for a later month wait for that month
A policy scheduled to start in a later month no longer changes your presentation currency, or turns conversion on, before it starts. Until then, Exchange rate policy in settings shows the policy in force today.
Read more: Exchange rate policies set for a later month wait for that month - Fixed
Budgets listed through the API show their alert thresholds
Listing budgets through the Public API without a workspace filter returned every budget with an empty alerts list. Each budget now carries its alert thresholds, as it does when you list one workspace or read a single budget.
Read more: Budgets listed through the API show their alert thresholds - Fixed
A deleted organization's name can be used again
Creating an organization, at sign-up or later, or a managed organization, with the name of one that was deleted no longer fails with an unexpected error.
- Fixed
A sync whose cost data was imported no longer shows as Failed
When a last bookkeeping step went wrong after a sync had already imported its cost data, the connection's Sync history could list that sync as Failed and the connection showed a sync error. Such a sync now counts as finished, the connection shows no error for it, and its imported costs stay as they are.
- Fixed
Measured savings count only the workspace's own accounts and leave out credits
Measuring a finding read every account of a connection, including accounts assigned to another workspace, and counted credits, refunds and corrections, so cost moving elsewhere could mark a finding Verified with a saving it never made. A measurement now reads only the workspace's own accounts and leaves out credits, refunds and corrections, as its reports do by default.
Read more: Measured savings count only the workspace's own accounts and leave out credits - Fixed
One unrecordable invoice no longer holds up everyone else's invoices
When a single invoice from our payment provider could not be recorded, our regular billing run stopped there, so later invoices could stay missing from Invoices and their documents could stay unavailable for download. That invoice is now set aside for us to resolve, and every other invoice is recorded and archived as usual.
- Fixed
Virtual tags take at most 50 rules and 50 conditions
A virtual tag now takes at most 50 rules with 50 conditions across them, down from 100 and 200, so a report that uses a large virtual tag no longer fails for lack of memory. A tag saved above these limits keeps working in reports, and an edit to it is saved once it fits.
Read more: Virtual tags take at most 50 rules and 50 conditions - Fixed
Measured savings no longer count days whose cost has not arrived
A measurement whose later window reached today, or past the last day the measured cost had arrived for, counted the missing days as days without cost, and could mark a finding Verified with a saving that never happened. A measurement now counts only days whose cost has arrived.
Read more: Measured savings no longer count days whose cost has not arrived - Fixed
Savings page opens even when a finding has a malformed currency
A finding saved with an invalid currency code, such as E1R, no longer stops the Savings page from loading; its amount is shown with the code beside it. A finding you add or revise now takes its currency from the supported list, so a code like that can no longer be saved.
Read more: Savings page opens even when a finding has a malformed currency - Fixed
Node rate annotations with a decimal comma no longer inflate costs
A Kubernetes node annotated with a rate such as 0,021 was priced at 21 per hour. A rate annotation must now be a plain number with a decimal point; any other value leaves the node without a price, and the cluster shows it among its nodes that have no price.
Read more: Node rate annotations with a decimal comma no longer inflate costs - Fixed
Listing connections returns each one exactly once
Paging through your connections in the Public API, or reading them with the costfluent_providers Terraform data source, could repeat some connections and miss others when several shared a name and one synced or ran its checks between pages. Connections now keep a fixed order, so every page lists each one once.
Read more: Listing connections returns each one exactly once - Fixed
A connection whose cloud refuses its credentials says why at once
When Microsoft Entra rejects an Azure connection's client secret, AWS refuses to let Costfluent assume the connection's role, or a GCP, Anthropic or OpenAI connection is stored in an old shape, the sync now stops at once and the connection shows the reason and how to fix it, instead of retrying and then reporting only a repeated failure.
- Fixed
Conflicting custom cost lines are no longer counted as imported
Lines that describe the same charge but disagree, for example on the currency, are held back from your reports. An upload still counted them as imported and added them to its billed amount, and an API batch counted them as accepted. They are now left out, so they no longer count toward the upload's imported lines and billed amount or the batch's accepted lines.
Read more: Conflicting custom cost lines are no longer counted as imported - Fixed
A refused redelivery notifies once
When a provider redelivers a subscription's or account's period with far fewer charges than were imported, Costfluent keeps the imported charges and tells your organization once. Further short deliveries of that period no longer notify at every sync, even while other periods or subscriptions sync normally. Once support accepts one or the full period arrives, a new refusal notifies again.
- Fixed
Alert notifications open the budget or alerts they are about
A budget alert in your notifications now opens that budget instead of a page that failed to load, and budget alerts received before this fix open “Budgets”. A cost alert opens “Alerts” instead of the cost reports.
- Fixed
Allocation coverage answers on the amortized cost basis
Asking the Public API for allocation coverage with costBasis=AmortizedCost returned an empty breakdown. It now allocates amortized (effective) cost.
Read more: Allocation coverage answers on the amortized cost basis - Fixed
A budget in a lower-case currency code counts all its spend
A budget created with a currency written in lower case, such as usd, counted spend billed in that currency as zero, so its alerts could stay silent. The code is now stored in capitals, and budgets created that way before count their full spend.
Read more: A budget in a lower-case currency code counts all its spend - Fixed
A failed upload no longer leaves some of its days in your reports
An upload that failed while its costs were being imported could keep the days imported before the failure in your reports, while it showed no rows and no days. A failed upload now removes those days, and one whose removal could not finish is processed again.
- Fixed
Kubernetes cluster cost is no longer counted twice in segments
When a workspace connects both a cluster and the cloud it runs on, segment coverage, segment budgets, cost change explanations and savings verification no longer add the cluster's cost on top of its nodes. Cluster cost counts only where a rule or scope names a cluster, a namespace, a Kubernetes label or the Kubernetes provider.
- Fixed
A briefly throttled connection keeps collecting
When a cloud provider throttled or briefly failed a collection, every retry followed within minutes, so the connection could stop with "Collection failed repeatedly and has been stopped." before the provider recovered. Retries now wait longer each time and are spread over about half an hour.
- Fixed
Google Cloud syncs retry when BigQuery rate-limits them
A Google Cloud connection no longer goes into error when BigQuery briefly refuses a sync for sending too many requests. Costfluent tries the sync again later. A missing permission or an exhausted quota is still reported as an error.
Read more: Google Cloud syncs retry when BigQuery rate-limits them - Fixed
Updating an AWS or GCP connection keeps it on its verified account
Changing an AWS or GCP connection's account ID, or replacing its credentials with ones for another AWS account or GCP billing account, is now refused and changes nothing. Before, the connection could end up showing one account while collecting another, or an account already connected could be connected twice.
- Fixed
Daily connection checks keep their results when a sync runs alongside
When a collection or an edit changed one connection while the daily check was running, the check could lose its results for the other connections too, and a connection saved while its provider could not be reached waited another day to start collecting. Each connection's result is now kept on its own.
- Fixed
Deleting an upload while it is processed removes all its costs
An upload deleted while its costs were still being imported could leave the days imported after the delete in your reports. The import now stops and removes those days too.
- Fixed
Large Google Cloud billing exports sync instead of timing out
A Google Cloud sync no longer fails when BigQuery takes more than a minute to read the billing export. Costfluent now waits for that query to finish.
Read more: Large Google Cloud billing exports sync instead of timing out - Fixed
Three-year custom charges over a leap day are accepted
A custom cost spread over three full years was refused when those years included 29 February, because it then ran one day longer than 1,095 days. The limit is now three calendar years, so such a charge is spread over all its days.
Read more: Three-year custom charges over a leap day are accepted - Fixed
Spend converts before the month's first ECB rate is published
Spend in a month the ECB has not yet published a rate for is no longer left out of converted totals and budgets: it converts at the last rate published before the month.
Read more: Spend converts before the month's first ECB rate is published - Fixed
Cost alerts with a filter that cannot be read are refused
Creating or updating a cost alert with a filter that does not read now fails with a message naming what is wrong and where. Before, the alert was saved and never fired.
Read more: Cost alerts with a filter that cannot be read are refused - Fixed
API tokens follow your current plan
When your organization moves to a plan without API tokens, its tokens are refused with an error naming the plan that includes them, and they work again after an upgrade. The Kubernetes agent's token keeps reporting on every plan.
Read more: API tokens follow your current plan - Fixed
Credits in custom uploads spread evenly across their days
A multi-day credit or refund in a custom cost upload now spreads evenly over its days, and no day shows a cost of the opposite sign. Small charges are spread across the period instead of landing on its last day, and yen amounts are spread in whole yen.
- Fixed
A cancelled subscription ends on Free after a later downgrade
Choosing Free and then a cheaper paid plan before the paid period ran out left the organization on that paid plan once the subscription ended. It now ends on Free, as the Subscription ending notice says.
Read more: A cancelled subscription ends on Free after a later downgrade - Fixed
Cost alerts are measured in their own currency
A cost alert held its threshold, set in the currency it was created in, against spend in the workspace's current currency, or with Currency conversion off against charges billed in another currency. Alerts are now measured in their own currency and no longer fire on figures in another one.
Read more: Cost alerts are measured in their own currency - Fixed
Reverse-charge invoices are no longer listed as outside the scope of VAT
The Invoices card could treat a verified EU VAT ID as unverified, so an invoice charged under the reverse charge showed "Outside the scope of VAT" under VAT. The VAT ID's verification is now read correctly and the invoice names the reverse charge.
Read more: Reverse-charge invoices are no longer listed as outside the scope of VAT - Fixed
Segment budgets convert each charge at its own day's rate
With Exchange rate dates set to Transaction-date rate, a segment budget period starting after the 1st of a month left out that month's spend billed in another currency, and later months converted at the rate of their 1st. Each day's spend now converts at that day's rate.
Read more: Segment budgets convert each charge at its own day's rate - Fixed
Tag coverage counts the last day of its range
The Tag coverage card on Insights and Low tag coverage alerts left out the last day of their date range, which is today by default. That day now counts toward the coverage.
Read more: Tag coverage counts the last day of its range - Fixed
Budgets deleted through the Public API appear in the audit log
Deleting a budget with an API token now records the deletion in your organization's audit log, with the budget as it was, just as a deletion in the app does.
- Fixed
Workspace API tokens stop working when their workspace is deleted
An API token created for one workspace could keep reading that workspace's costs, budgets, integrations and anomalies after the workspace was deleted. It is now refused as unauthenticated from the moment the workspace is deleted.
Read more: Workspace API tokens stop working when their workspace is deleted - Fixed
Webhook channels stay signed when their configuration is updated
Updating a webhook channel through the API without its signing secret, or with the *** the API returns for it, no longer removes the secret or makes *** the signing key. The secret stays until you replace it or send null; in Terraform, removing secret from config still removes it.
Read more: Webhook channels stay signed when their configuration is updated - Fixed
New budgets start in the workspace's current month
A new budget's Start date now follows the workspace's time zone, so it no longer suggests the wrong month around midnight at the turn of a month.
Read more: New budgets start in the workspace's current month - Fixed
Cluster rates accept a decimal comma
Editing a Kubernetes cluster in the German interface now accepts default rates such as 0,05 instead of refusing them.
Read more: Cluster rates accept a decimal comma - Fixed
Moving a custom report date past the other end is refused clearly
Updating only the start or end date of a custom range so that it ends before it starts now returns a validation error naming endDate, instead of an unexpected server error. The report is left unchanged.
Read more: Moving a custom report date past the other end is refused clearly - Fixed
Microsoft Teams channels accept Workflows webhook URLs
A Microsoft Teams channel can now be added with the webhook URL of a Teams Workflows webhook, which Microsoft hosts on powerplatform.com. Adding one was refused before, because only office.com, microsoft.com and azure.com addresses were accepted.
Read more: Microsoft Teams channels accept Workflows webhook URLs - Fixed
Channel tests are limited to 5 an hour per organization
Test on a notification channel now sends at most 5 test messages in any hour for each organization, across all its channels and members, so repeated tests can no longer flood a channel's recipients. A further test fails until the first of those 5 is an hour old.
Read more: Channel tests are limited to 5 an hour per organization - Fixed
Idempotency keys stay with the custom provider they were first used for
A cost batch sent to one custom provider under an Idempotency-Key already used for another provider is now refused with a 400. Before, it was answered with the other batch's result and its costs were never stored.
- Fixed
Newer Google Cloud regions keep their own names
Costs in Berlin (europe-west10) and Turin (europe-west12) were shown as Belgium (europe-west1). These and the other recent Google Cloud regions, such as Milan, Paris, Stockholm and Bangkok, now show under their own name for newly imported costs.
Read more: Newer Google Cloud regions keep their own names - Fixed
Include refunds off leaves out Azure and Google Cloud refunds
With Include refunds off, Azure refunds and Google Cloud corrections were still counted in totals, reports, budgets and exports. They are now left out like every other refund.
Read more: Include refunds off leaves out Azure and Google Cloud refunds
Try the latest version on your own costs
Start with the permanent Free plan and a read-only connection.
Permanent Free plan with no time limit