> ## Documentation Index > Fetch the complete documentation index at: https://docs.nx1cloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Non-web portal users > nx1-deployer `v1.16.1` release notes for non-web portal users, covering new API endpoints, an OpenAI-compatible model backend, Gravitino consolidation, Grafana and Airflow monitoring changes, and NX1 component image upgrades. nx1-deployer image `v1.16.1` The September 2026 release for non-web portal users adds API endpoints for audit search, business rules, and crew PDF export. It also adds the Keycloak roles that gate audit search and business rules. NexusOne's AI features can now run against any OpenAI-compatible model backend. Gravitino runs as a single instance, and a slow Hive metastore no longer fails Spark jobs. This release also fixes Grafana SSO on shared services, makes the built-in Grafana alerts optional, and lets you send Grafana alerts to BigPanda. Airflow's metrics now follow your `monitoring_type` setting, and you can point them at your own collector. It also upgrades several NX1 component images. ## New features This section contains new features recently added to the NexusOne platform. ### Audit [Audit](/release-notes/september-2026/web-portal-users#audit) is a new NexusOne feature. Its new API endpoints are: * [List audit streams and their searchable fields](/api-reference/endpoints/audit/list-audit-streams-and-their-searchable-fields) * [Search one audit stream](/api-reference/endpoints/audit/search-one-audit-stream) ### Business rules [Business rules](/release-notes/september-2026/web-portal-users#business-rules) is a new NexusOne feature. Its new API endpoints are: * [Approve a submitted version](/api-reference/endpoints/decisions/approve-a-submitted-version) * [Check what importing a bundle would do](/api-reference/endpoints/decisions/check-what-importing-a-bundle-would-do) * [Create a decision](/api-reference/endpoints/decisions/create-a-decision) * [Create a decision workspace](/api-reference/endpoints/decisions/create-a-decision-workspace) * [Create a draft version](/api-reference/endpoints/decisions/create-a-draft-version) * [Diff two versions structurally](/api-reference/endpoints/decisions/diff-two-versions-structurally) * [Evaluate a decision](/api-reference/endpoints/decisions/evaluate-a-decision) * [Evaluate a decision against many contexts](/api-reference/endpoints/decisions/evaluate-a-decision-against-many-contexts) * [Export decisions as a signed bundle](/api-reference/endpoints/decisions/export-decisions-as-a-signed-bundle) * [Get a decision](/api-reference/endpoints/decisions/get-a-decision) * [Get one version with its rule content](/api-reference/endpoints/decisions/get-one-version-with-its-jdm-content) * [Get publication history for a decision](/api-reference/endpoints/decisions/get-publication-history-for-a-decision) * [Import a bundle of decisions](/api-reference/endpoints/decisions/import-a-bundle-of-decisions) * [List decision workspaces](/api-reference/endpoints/decisions/list-decision-workspaces) * [List decisions in a workspace](/api-reference/endpoints/decisions/list-decisions-in-a-workspace) * [List versions awaiting your approval](/api-reference/endpoints/decisions/list-versions-awaiting-your-approval) * [List versions of a decision](/api-reference/endpoints/decisions/list-versions-of-a-decision) * [List published versions in a workspace](/api-reference/endpoints/decisions/list-what-is-published-in-a-workspace) * [List workspace members](/api-reference/endpoints/decisions/list-workspace-members) * [Publish a version](/api-reference/endpoints/decisions/publish-a-version) * [Reject a submitted version](/api-reference/endpoints/decisions/reject-a-submitted-version) * [Search a workspace's audit stream](/api-reference/endpoints/decisions/search-a-workspaces-audit-stream) * [Search the audit stream across all workspaces](/api-reference/endpoints/decisions/search-the-audit-stream-across-all-workspaces) * [Set a member's workspace roles](/api-reference/endpoints/decisions/set-a-members-workspace-roles) * [Simulate a decision with a trace](/api-reference/endpoints/decisions/simulate-a-decision-with-a-trace) * [Submit a version for approval](/api-reference/endpoints/decisions/submit-a-version-for-approval) ### Export a crew run or result You can now download a finished crew run or crew result as a PDF, for sharing or record keeping. The new API endpoints are: * [Export crew result as PDF](/api-reference/endpoints/crews/export-crew-result-as-pdf) * [Export run as PDF](/api-reference/endpoints/crew-runs/export-run-as-pdf) ### Machine-to-machine Iceberg catalog config A new [Get unredacted Iceberg REST catalog config](/api-reference/endpoints/metastore/get-unredacted-iceberg-rest-catalog-config-machine-to-machine) endpoint returns a catalog's Iceberg REST config with credentials included. ### New Keycloak roles The following roles are now available in NexusOne and you can assign them to users: * **Business rules roles**: * `nx1_decisions_user`: Reach the business rules API * `nx1_decisions_admin`: Manage every business rules workspace in NexusOne, including creating new workspaces * **Audit role**: `nx1_audit_viewer` searches the Ranger access, API, and business rule audit trails ## Bug fixes This section contains fixes for issues affecting apps or features on the NexusOne platform. ### Airflow now only exports metrics when a collector is running Airflow sent its metrics and traces to a collector no matter how you set `monitoring_type`, even though a collector only runs when the value is `embedded`. When you set `monitoring_type` to `none`, each scheduler and worker pod kept retrying against a dead collector address for its whole life. That wasted effort and filled the logs with errors. In this release, Airflow's exporters are active and send metrics and traces to a collector only when you set `monitoring_type` to `embedded`. ### Grafana SSO now uses its own Keycloak roles On shared services, the Grafana in NexusOne's built-in monitoring put every SSO user on Viewer. There was no way to sign in with the Admin or Editor role. This release gives Grafana its own Keycloak roles, `nx1_grafana_admin` for the Admin role and `nx1_grafana_ops` for the Editor role. On upgrade, on shared services and tenants alike, assign these to anyone who needs more than Viewer. The local Grafana administrator login still works. ### Gravitino catalog name on hyphenated tenants Each tenant has its own Iceberg catalog, and NexusOne names it after the tenant. Spark and Trino always write that tenant name with underscores when they call Gravitino. If a tenant's name has a hyphen, then a query for `my_tenant` finds nothing, because Gravitino registered the catalog as `my-tenant`. In this release, Gravitino registers the catalog with underscores, matching what Spark and Trino ask for. For example, on a tenant named `my-tenant`, a query against `my_tenant.sales.orders` succeeds. ## Enhancements This section contains enhancements to existing app features on the NexusOne platform. ### A slow metastore no longer fails Spark jobs Spark queries ask the Hive metastore where a table's data lives. A brief metastore slowdown or a stale connection used to fail the whole job. Now Spark retries up to five times, ten seconds apart, and waits up to ten minutes for each response. ### Grafana This release lets you turn off the built-in alert rules and adds a BigPanda contact point for routing alerts. #### Built-in alert rules are now optional NexusOne ships a standard set of Grafana alert rules for the platform. Teams running their own alerting had no way to turn them off, so they ended up with two sets of alerts. In this release, you can turn the built-in rules off. Set `grafana_alerts_enabled` to `false` and NexusOne skips them. It defaults to `true`, so nothing changes unless you ask. Set it in your shared services config to drop the shared alerts, such as Keycloak and the monitoring stack. Set it in a tenant config to drop that tenant's alerts, such as Airflow, Trino, and Spark. There is no single switch for both. #### Send alerts to BigPanda If you use BigPanda for incident management, then NexusOne can now forward Grafana alerts to it. Set these keys in your config: * `bigpanda_enabled`: `true` to send alerts to BigPanda * `bigpanda_webhook_url`: Your BigPanda webhook URL * `bigpanda_webhook_token`: The webhook's auth token * `bigpanda_auth_scheme`: The token's scheme, `Bearer` by default * `bigpanda_ca_pem`: Optional CA chain for BigPanda's TLS certificate, defaulting to your platform CA Setting the keys creates a Grafana contact point named BigPanda-AIOps-integration. To actually send alerts, attach it to a notification policy in Grafana. Set it in the shared services config for the shared alerts, or in a tenant config for that tenant's alerts. ### Gravitino now runs as a single instance NexusOne previously ran two Gravitino instances, one for the per-tenant Iceberg catalog and one for the Hive catalog. Gravitino now serves both catalogs from a single instance. NexusOne components such as Trino and Spark call Gravitino over the Iceberg REST protocol to resolve tables and record writes. With the move to one instance, the in-cluster address for those calls changed from `http://gravitino-shared:9001/iceberg` to `http://gravitino-rest:9001/iceberg`. NexusOne repoints Trino and Spark automatically. ### OpenAI-compatible model backend NexusOne's AI features, such as natural-language SQL and AI crews, run against a large language model, such as Anthropic Claude or a self-hosted Ollama model. In this release, the AI features can now run against any OpenAI-compatible endpoint, such as vLLM, Baseten, or OpenRouter. In your tenant Terraform variables, set: * `llm_provider`: `openai` * `llm_endpoint`: The backend's base URL, including the `/v1` path, for example `https://inference.baseten.co/v1` * `llm_api_token`: The endpoint's bearer token * `llm_model`: The model to request The deploy fails with a clear error if `llm_provider` is `openai` and `llm_endpoint` is empty or doesn't end in `/v1`. For the existing LLM providers, leave `llm_endpoint` empty. ### Point Airflow's metrics at your own collector Airflow used to lose track of a self-managed metrics collector and drop all its metrics. Two new tenant variables point Airflow at your collector: * `otel_metrics_service`: Your collector's Service name. Leave it unset to keep the built-in collector. * `otel_metrics_port`: Your collector's port. Defaults to `4318`. ## Upgrades This section contains version upgrades to existing apps on the NexusOne platform. ### Gravitino `v1.3.0` upgrade Upgraded Gravitino from `v1.2.9` to `v1.3.0`. As described in the [Gravitino now runs as a single instance](#gravitino-now-runs-as-a-single-instance) section, this upgrade lets a single Gravitino instance serve both the Iceberg and Hive catalogs. ### JupyterHub hub image `v4.4` upgrade Upgraded the `jupyterhub-k8s-hub` image from `v4.2.0.1` to `v4.4`, a hardened image. ### Kyuubi etcd `v3.6` upgrade Upgraded the etcd image that backs Kyuubi from `v3.5.21` to `v3.6`, a hardened image. ### Metastore `v3.1.8` upgrade Upgraded Metastore from `v3.1.7` to `v3.1.8`, a CVE-patched image. ### S3 Gateway and Ranger-Authz-API `v0.21` upgrade Upgraded the S3 Gateway and Ranger-Authz-API from `v0.17` to `v0.21`. Ranger-Authz-API is a workload in each tenant that the S3 Gateway and Gravitino call to check a request against Ranger policy. ### Spark `v3.5.6-nx1.33` upgrade Upgraded the Spark image from `v3.5.6-nx1.32` to `v3.5.6-nx1.33`. The new image no longer bundles the MongoDB Spark Connector JAR.