What's New in Grooper 2026: Difference between revisions

From Grooper Wiki
 
(19 intermediate revisions by the same user not shown)
Line 14: Line 14:
'''What Grooper tools are accessible using MCP?''' There are 100+ tools in the Grooper tool catalog. These tools allow agents to create Batches, configure nodes, test extraction, review documents, query statistics and more, all through natural language.
'''What Grooper tools are accessible using MCP?''' There are 100+ tools in the Grooper tool catalog. These tools allow agents to create Batches, configure nodes, test extraction, review documents, query statistics and more, all through natural language.


=== New Node Types ===
=== New MCP Node Types ===
 
There are two new Node Types related to MCP functionality:
* '''MCP Server'''
* '''MCP Registry'''
 


'''MCP Server''': With the new '''MCP Server''' node, Grooper can now publish its own tools, resources, and prompts to any MCP-compatible client — Claude Code, OpenCode Copilot, or your own agent apps.
'''MCP Server''': With the new '''MCP Server''' node, Grooper can now publish its own tools, resources, and prompts to any MCP-compatible client — Claude Code, OpenCode Copilot, or your own agent apps.
Line 53: Line 58:
== Upgrade Notes for 2026 ==
== Upgrade Notes for 2026 ==


Review these behavior changes we observed in testing before upgrading to version 2026. They may affect existing Projects, so we recommend testing your own documents after the upgrade.
Review these behavior changes before upgrading to version 2026. They may affect existing Projects, so we recommend testing your own documents after the upgrade.


=== New .NET Libraries ===
=== New .NET Libraries ===


Grooper 2026 is built on a newer version of .NET. This required us to replace many of the libraries the platform uses. '''In most cases, this improves security and functionality.''' However, a different library can occasionally produce different results. The differences we observed in testing are listed below.
Grooper 2026 is built on a newer version of .NET. This required us to replace many of the libraries the platform uses. '''In most cases, this improves security and functionality.''' However, a different library can occasionally produce different results. The differences we observed in testing are listed below.
==== Image generation ====
Grooper creates page images in various different ways:
* When pages are scanned into a Batch
* When the Split Pages activity creates a page
* When an IP Profile runs, including during the Image Processing and Recognize activities
The library we use to encode image files when Grooper creates them changed slightly. The end result is the images also change slightly. However, even '''slight''' pixel changes can yield different results for certain image-based activities. This is most recognizable during Recognize, using traditional OCR engines such as Transym and Tesseract. During regression testing, we observed this sometimes results in better results and sometimes worse results overall.
We have confirmed differences in the following areas in one or more regression test:
* Transym 4 OCR - Predominately character level differences in OCR characters, such as a previously recognized "6" character recognizing as a "0".
* Transym 5 OCR - Similar differences as Transym 4
* Tesseract OCR - Somewhat larger differences observed than Transym 4 and Transym 5. See the bellow section on "Tesseract OCR" for more information.
* OCR Synthesis - Observed a handful of differences in how pitch detection determined character spacing.


==== Tesseract OCR ====
==== Tesseract OCR ====
Line 80: Line 100:
* '''Lower the "Minimum Confidence" value when Tesseract is selected.''' The second pass only runs when the first pass falls below the minimum confidence, so a lower value means it runs less often. However, a lower value can also cause more false positives. Test any change thoroughly.
* '''Lower the "Minimum Confidence" value when Tesseract is selected.''' The second pass only runs when the first pass falls below the minimum confidence, so a lower value means it runs less often. However, a lower value can also cause more false positives. Test any change thoroughly.
* '''Use Transym as the OCR Engine.''' We have not observed any differences in Transym's orientation results.
* '''Use Transym as the OCR Engine.''' We have not observed any differences in Transym's orientation results.
=== Settings moved from web.config to appsettings.json (action required) ===
*<li class="attn-bullet"> '''Action required if you configured Entra ID, Content Security Policy, or cookie settings in <code>web.config</code>.''' These values are not migrated on upgrade and must be re-entered in <code>appsettings.json</code>. Otherwise, no action is needed.
Both the Grooper and GWS sites now have an <code>appsettings.json</code> file for application-level configuration.
In previous versions of the Grooper web client, certain settings were stored in the site's <code>web.config</code> file, including:
* Entra ID OAuth configuration settings
* Security settings, including the Content Security Policy
* Cookie settings, including the <code>RequireSsl</code> flag
This had one major downside. Every time the application was uninstalled and reinstalled, <code>web.config</code> was replaced with the default file. This wiped out any configuration and required users to re-enter the values.
Grooper 2026 removes this limitation in two ways:
# The 2026 Grooper installer can now perform an upgrade without requiring the user to uninstall Grooper first.
# The <code>appsettings.json</code> file is not removed or overwritten when the application is '''upgraded'''.
#*<li class="attn-bullet"> Be aware, the <code>appsettings.json</code> file is still removed when Grooper is uninstalled.
'''File locations'''
* Grooper: <code>C:\inetpub\wwwroot\Grooper\appsettings.json</code>
* GWS: <code>C:\inetpub\wwwroot\GWS\appsettings.json</code>
Paths may differ if the sites were installed to a non-default location.
'''After upgrading to Grooper 2026'''
# Open <code>appsettings.json</code> for the Grooper site.
# Re-enter your Entra ID values in the <code>Authentication:AzureAd</code> section (<code>TenantId</code>, <code>ClientId</code>, <code>ClientSecret</code>).
#*<li class="fyi-bullet"> Microsoft renamed Azure AD to Entra ID. The section is still named <code>AzureAd</code> in the file because that is the name the underlying Microsoft library expects.
#*<li class="attn-bullet"> <code>ClientSecret</code> is stored in plain text in <code>appsettings.json</code>, just as it was in <code>web.config</code>. Make sure NTFS permissions on the site folder limit who can read the file.
# Re-apply any custom Content Security Policy or cookie settings in the <code>Grooper:Security</code> and <code>Grooper:Cookies</code> sections.
# If you use GWS, open its <code>appsettings.json</code> and re-enter the values in the <code>OAuthConnection</code> section.
# Restart IIS (or recycle the application pool). Changes to <code>appsettings.json</code> take effect only after the application restarts.
<big>Default Grooper appsettings.json</big>
<pre>
{
  "Grooper": {
    "Session": {
      // Idle period, in minutes, used for both the Grooper authentication ticket and Grooper's server-side working state.
      // An idle browser is not notified immediately. On the next request, an expired authentication ticket returns the user to Sign in.
      // The separate "server session expired" message is only for the unusual case where server-side Grooper state is gone while authentication is still valid.
      "IdleTimeoutMinutes": 60
    },
    "Cookies": {
      // Requires HTTPS for Grooper's authentication and server-session cookies. Leave true for IIS production deployments.
      // Set false only for an intentionally HTTP local-development site; this setting does not enable HTTPS or perform the redirect itself.
      "RequireSsl": true,
      // Set true only where browser-close is not intended to sign out the user.
      // False keeps the authentication cookie only for the current browser session. This is the safer default for shared workstations.
      "PersistAuthentication": false
    },
    "ScanViewer": {
      "PortNumber": 13950
    },
    "UI": {
      "PreferSvgIcons": true
    },
    "Features": {
      "HelpOnly": false
    },
    "Diagnostics": {
      "EndpointLogging": false
    },
    "Security": {
      "ContentSecurity": {
        // Content Security Policy (CSP) is one browser response header. It controls which resources Grooper may load and use.
        // Changes to every setting below take effect only after the application restarts.
        // "off" does not emit a generated CSP header. Use only for temporary troubleshooting; Override still takes precedence.
        // "low" permits external images, styles, and fonts. Document HTML is not sandboxed, so use only for legacy compatibility.
        // "medium" permits Grooper-hosted images, styles, and fonts, and sandboxes document HTML. This is the normal default.
        // "high" has the same resource restrictions as medium, prevents the app from being framed, and disables HTML/mail display.
        "Level": "medium",
        // Leave empty to use the selected Profiles entry. A nonempty value replaces only the CSP header;
        // Level still controls document sandboxing and whether HTML/mail display is available.
        // Override example: "default-src 'self'; connect-src 'self' http://localhost:{ScanViewerPort}; form-action 'self' {OpenIdConnectOrigin};"
        // {ScanViewerPort} becomes ScanViewer:PortNumber. {OpenIdConnectOrigin} becomes the configured Entra authority host, or empty for Windows authentication.
        "Override": "",
        "Profiles": {
          // These templates are the complete CSP header for each level. Keep the documented placeholders when the related feature is used.
          "low": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; style-src * 'unsafe-inline'; img-src * blob:; font-src *; connect-src 'self' http://localhost:{ScanViewerPort}; object-src 'none'; frame-ancestors 'self'; base-uri *; form-action 'self' {OpenIdConnectOrigin}",
          "medium": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' blob:; font-src 'self'; connect-src 'self' http://localhost:{ScanViewerPort}; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; form-action 'self' {OpenIdConnectOrigin}",
          "high": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' blob:; font-src 'self'; connect-src 'self' http://localhost:{ScanViewerPort}; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' {OpenIdConnectOrigin}"
        }
      },
      "Hsts": {
        // HTTP Strict Transport Security (HSTS) tells browsers to use HTTPS for this host after they have first reached it over HTTPS.
        // It is sent only outside Development and covers the host, not merely the /Grooper IIS subapplication.
        "MaxAgeDays": 365,
        // True also forces HTTPS for every subdomain. Enable only after every subdomain is HTTPS-ready.
        "IncludeSubDomains": false
      },
      "ResponseHeaders": {
        // Set a value to emit the header; leave it empty only when IIS or another trusted deployment layer intentionally manages it.
        // X-Content-Type-Options prevents the browser from guessing a response's file type. "nosniff" is its only standard value.
        "XContentTypeOptions": "nosniff",
        // X-Frame-Options prevents another site from embedding Grooper in a frame. "DENY" is the normal safe value.
        "XFrameOptions": "DENY",
        // Used only for Grooper's own document iframe at off, low, and medium CSP levels. "SAMEORIGIN" permits Grooper itself to display it.
        "EmbeddedFileXFrameOptions": "SAMEORIGIN",
        // Permissions-Policy disables or limits browser capabilities. This policy disables camera, geolocation, payment, and USB;
        // it permits microphone access only from Grooper itself because the voice input features (the AI Helper Talk button and the Chat Console dictate button) use browser speech recognition.
        "PermissionsPolicy": "camera=(), microphone=(self), geolocation=(), payment=(), usb=()"
      }
    }
  },
  "Authentication": {
    "AzureAd": {
      "Instance": "https://login.microsoftonline.com/",
      "TenantId": "",
      "ClientId": "",
      "ClientSecret": "",
      "CallbackPath": "/Auth/Callback",
      "SignedOutCallbackPath": "/Auth/SignedOutCallback",
      "GraphScope": "https://graph.microsoft.com/.default"
    }
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*"
}
</pre>
<big>Default GWS appsettings.json</big>
<pre>
{
  "OAuthConnection": {
    "AADInstance": "https://login.microsoftonline.com/",
    "ClientId": "",
    "TenantId": ""
  },
  "BotConnection": {
    "Authority": "https://api.botframework.com",
    "ClientIds": []
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  }
}
</pre>
=== AppXtender and FileBound connections moved to Object Libraries (action required) ===
*<li class="attn-bullet"> '''Action required if you use AppXtender or FileBound CMIS Connections.''' Otherwise, no action is needed.
We have removed the following CMIS Bindings from the core Grooper application.
* '''AppXtender''' - This implementation uses SOAP services. OpenText is deprecating the SOAP services AppEnhancer (formerly AppXtender) relies on. A REST-based replacement will be released as an Object Library in a future update.
* '''FileBound''' - Removed from the core application due to limited usage.
'''Do not worry! Both are available as Object Libraries. Your existing connections and settings are preserved and will work again once you install the Object Library.'''
You can download these 2026 Object Libraries directly here:
* [https://bisok.com/resources/downloads/object-libraries/2026/CMIS/2026AppXtender.zip AppXtender]
* [https://bisok.com/resources/downloads/object-libraries/2026/CMIS/2026FileBound.zip FileBound]
To keep your system running:
# Download the '''Object Library'''.
# '''Upload''' the Object Library to any '''Project''' of your choice in the Grooper Repository.
# Go to the Object Library's '''Scripting''' tab.
# Press the '''Compile''' button ({{IconName|move_down}})
#*<li class="fyi-bullet"> If multiple Grooper Repositories are using one of these connections, you will need to upload the Object Library and compile it for each one.
# '''Restart''' IIS and Grooper services.
<big>Example</big>
[[File:Whats-new-2026-01.png|right|800px]]
After installing Grooper 2026, a previously working AppXtender connection will look like this.
* The node will be flagged.
* The Connection Settings will appear to be missing. They are not. These settings are still saved and will reappear once the Object Library is uploaded and compiled.
* A validation message will warn you about a deserialization error. This is because the object <code>Grooper.Service.CMIS.AxBinding</code> is no longer present in the core application.
<br clear=all>
[[File:Whats-new-2026-02.png|right|800px]]
After uploading and compiling the AppXtender Object Library and restarting IIS, the previously stored settings will reappear and the CMIS Connection and CMIS Repositories will behave as they did previously. You will also be able to create new CMIS Connections and CMIS Repositories for these connections, just as you did in Grooper 2025.
<br clear = all>
=== GWS URL format change (action required) ===
*<li class="attn-bullet"> '''Action required if you use GWS, Grooper's REST API.''' Otherwise, no action is needed.
The GWS API URL format has changed. Previously, the Grooper Repository ID was a required query string parameter at the end of the URL. Now it is a required part of the URL path. All GWS endpoints use the following format:
<pre>https://{hostname}/GWS/{repositoryId}/{endpoint}</pre>
<big>Example</big>
The <code>GET batches</code> endpoint returns a list of Batches in the Grooper Repository.
* '''Before 2026:''' <pre>https://{hostname}/GWS/batches?repositoryId={repositoryId}</pre>
* '''2026 and later:''' <pre>https://{hostname}/GWS/{repositoryId}/batches</pre>
'''Action required:''' If you have applications or scripts that call the GWS API, update their URLs to the new format upon upgrading.

Latest revision as of 08:04, 2 November 2026

2026 BETA

This article covers new or changed functionality in the current or upcoming beta version of Grooper. Features are subject to change before version 2026's GA release. Configuration and functionality may differ from later beta builds and the final 2026 release.

This is a placeholder for the Grooper 2026 release. Consider this a work in progress.

Grooper MCP

Click here for a full article on Grooper MCP.

Grooper 2026 introduces native support for the Model Context Protocol (MCP). This is the bridge between Grooper and the world of AI agents.

What is an "agent"? An agent is an AI system that can look at a situation, decide what to do next and take action, rather than just answering a single question. Agents call tools to get real work done. Furthermore, it pursues a goal across many steps, deciding its own next moves, checking results and adjusting course as needed.

What are "tools"? A tool is one specific action an agent is allowed to call, such as searching a database, reading a document, or running a calculation. MCP is the common language that lets an agent discover and call tools, including those inside Grooper.

What Grooper tools are accessible using MCP? There are 100+ tools in the Grooper tool catalog. These tools allow agents to create Batches, configure nodes, test extraction, review documents, query statistics and more, all through natural language.

New MCP Node Types

There are two new Node Types related to MCP functionality:

  • MCP Server
  • MCP Registry


MCP Server: With the new MCP Server node, Grooper can now publish its own tools, resources, and prompts to any MCP-compatible client — Claude Code, OpenCode Copilot, or your own agent apps.

  • There is also a "default" MCP Server exposed by the GWS API installed on the Grooper web server. This MCP Server has access to all tools in the Grooper tools category. MCP Server nodes provide more customization: removing tool categories, adding custom instructions, creating prompt templates, and adding resource files to the MCP server.

MCP Registry: The MCP Registry works in the other direction, aggregating connections to external MCP servers and remote registries so agents and the Agent Planner can reuse third-party capabilities across your repository. Together, these features let you both expose Grooper as a tool for AI assistants and extend Grooper's AI workflows with tools from the broader MCP ecosystem.

Action Schedulers

Action Scheduler is a new service type in Grooper 2026. It schedules and runs background tasks called Actions. A single Action Scheduler service can hold one or more Actions, and each Action can run at specific times of day or on a polling loop. The following Action types are available:

  • Import Action - Performs automated file imports using a configured Import Provider.
  • Agent Action - Starts a scheduled conversation with an AI Assistant to automate a task. AI Assistants are Grooper's internal AI agent and have access to MCP-based tools.
  • Maintenance Action - Performs a set of system maintenance actions on a set schedule, including cleaning up old stats and log records Grooper database, purging Batches and rebuilding indexes to improve performance.


Action Scheduler simplifies Grooper's service architecture for tasks that run on a set schedule, such as imports and system maintenance. Upon upgrading to version 2026, existing services will be upgraded to match the new architecture.

  • Import Watchers will be upgraded to Action Schedulers with one or more Import Actions, depending on how many Import Schedulers were defined.
  • System Maintenace Services will be upgraded to Action Schedulers with a Maintenance Action.

Other Enhancements

Grooper ZIP compatibility with 2025

Grooper ZIPs can now be shared between Grooper 2025 and Grooper 2026. You can upload a ZIP downloaded from a 2025 Repository into a 2026 Repository. You can also upload a 2026 ZIP into a 2025 Repository, as long as it is version 25.0.0058 or later. Previously, ZIPs could not be shared between major versions in either direction.

Batches, Projects, and anything that can go into a Project can be moved between versions using the Download Grooper ZIP and Upload Grooper ZIP buttons on the Design page. This makes it easier to develop and test across versions. For example, you can build a solution in 2025 and move it into 2026, or bring 2026 content back into a 2025 environment.

Limitations:

  • If the ZIP contains objects that do not exist in the version you are importing into, the entire import fails and nothing is imported. This happens when you import a 2026 ZIP containing 2026-only objects (such as MCP Server nodes) into Grooper 2025.
  • Scripts and Object Libraries are not compatible between versions. They may import, but they will need to be edited, or possibly recreated, before they compile.

SMTP Mail Repository Option

SMTP Mail is a new Repository Option in Grooper 2026. It lets you set a single SMTP mail server connection for the whole Repository. Once it is set on the root node, any Grooper feature that sends outbound email uses these settings:

  • Agent Actions use it to send notification emails when their "Notify List" is configured.
  • The Send Mail activity uses it by default. You can override it by configuring the activity's own connection settings.

Upgrade Notes for 2026

Review these behavior changes before upgrading to version 2026. They may affect existing Projects, so we recommend testing your own documents after the upgrade.

New .NET Libraries

Grooper 2026 is built on a newer version of .NET. This required us to replace many of the libraries the platform uses. In most cases, this improves security and functionality. However, a different library can occasionally produce different results. The differences we observed in testing are listed below.

Image generation

Grooper creates page images in various different ways:

  • When pages are scanned into a Batch
  • When the Split Pages activity creates a page
  • When an IP Profile runs, including during the Image Processing and Recognize activities

The library we use to encode image files when Grooper creates them changed slightly. The end result is the images also change slightly. However, even slight pixel changes can yield different results for certain image-based activities. This is most recognizable during Recognize, using traditional OCR engines such as Transym and Tesseract. During regression testing, we observed this sometimes results in better results and sometimes worse results overall.

We have confirmed differences in the following areas in one or more regression test:

  • Transym 4 OCR - Predominately character level differences in OCR characters, such as a previously recognized "6" character recognizing as a "0".
  • Transym 5 OCR - Similar differences as Transym 4
  • Tesseract OCR - Somewhat larger differences observed than Transym 4 and Transym 5. See the bellow section on "Tesseract OCR" for more information.
  • OCR Synthesis - Observed a handful of differences in how pitch detection determined character spacing.

Tesseract OCR

If you use the Tesseract OCR Engine, you may see slight differences in OCR results. Results are generally improved overall. However, in some of our regression tests, these differences occasionally reduced field extraction when a regex or lexicon-based Extractor was used. Because the overall improvement outweighed these minor differences, we chose not to make additional changes.

If you rely on regex or lexicon-based Extractors with Tesseract, retest them after upgrading.

Auto Orient

The Auto Orient IP Command can use either Tesseract or Transym as the OCR Engine that evaluates page orientation. With the new Tesseract library, we saw differences in how Auto Orient rotated pages.

Tesseract was often less confident in its page orientation assessment when using an orientation-specific model. To address this, we added a fallback mechanism. If the first pass produces a result below Auto Orient's confidence threshold, Tesseract runs a second pass with a different model. If the two passes agree on the orientation, the page is rotated. If they disagree, the page is not rotated.

This approach has trade-offs:

  • Pro: Auto Orient should be more accurate than it was before the change.
  • Con: The second pass takes additional time, which can slow down an IP Profile that uses Auto Orient. The more pages that require the second pass, the longer Auto Orient takes to run.

Alternatives

If you want to avoid the second pass, you have two options:

  • Lower the "Minimum Confidence" value when Tesseract is selected. The second pass only runs when the first pass falls below the minimum confidence, so a lower value means it runs less often. However, a lower value can also cause more false positives. Test any change thoroughly.
  • Use Transym as the OCR Engine. We have not observed any differences in Transym's orientation results.

Settings moved from web.config to appsettings.json (action required)

  • Action required if you configured Entra ID, Content Security Policy, or cookie settings in web.config. These values are not migrated on upgrade and must be re-entered in appsettings.json. Otherwise, no action is needed.

Both the Grooper and GWS sites now have an appsettings.json file for application-level configuration.

In previous versions of the Grooper web client, certain settings were stored in the site's web.config file, including:

  • Entra ID OAuth configuration settings
  • Security settings, including the Content Security Policy
  • Cookie settings, including the RequireSsl flag

This had one major downside. Every time the application was uninstalled and reinstalled, web.config was replaced with the default file. This wiped out any configuration and required users to re-enter the values.

Grooper 2026 removes this limitation in two ways:

  1. The 2026 Grooper installer can now perform an upgrade without requiring the user to uninstall Grooper first.
  2. The appsettings.json file is not removed or overwritten when the application is upgraded.
    • Be aware, the appsettings.json file is still removed when Grooper is uninstalled.

File locations

  • Grooper: C:\inetpub\wwwroot\Grooper\appsettings.json
  • GWS: C:\inetpub\wwwroot\GWS\appsettings.json

Paths may differ if the sites were installed to a non-default location.

After upgrading to Grooper 2026

  1. Open appsettings.json for the Grooper site.
  2. Re-enter your Entra ID values in the Authentication:AzureAd section (TenantId, ClientId, ClientSecret).
    • Microsoft renamed Azure AD to Entra ID. The section is still named AzureAd in the file because that is the name the underlying Microsoft library expects.
    • ClientSecret is stored in plain text in appsettings.json, just as it was in web.config. Make sure NTFS permissions on the site folder limit who can read the file.
  3. Re-apply any custom Content Security Policy or cookie settings in the Grooper:Security and Grooper:Cookies sections.
  4. If you use GWS, open its appsettings.json and re-enter the values in the OAuthConnection section.
  5. Restart IIS (or recycle the application pool). Changes to appsettings.json take effect only after the application restarts.

Default Grooper appsettings.json

{
  "Grooper": {
    "Session": {
      // Idle period, in minutes, used for both the Grooper authentication ticket and Grooper's server-side working state.
      // An idle browser is not notified immediately. On the next request, an expired authentication ticket returns the user to Sign in.
      // The separate "server session expired" message is only for the unusual case where server-side Grooper state is gone while authentication is still valid.
      "IdleTimeoutMinutes": 60
    },
    "Cookies": {
      // Requires HTTPS for Grooper's authentication and server-session cookies. Leave true for IIS production deployments.
      // Set false only for an intentionally HTTP local-development site; this setting does not enable HTTPS or perform the redirect itself.
      "RequireSsl": true,
      // Set true only where browser-close is not intended to sign out the user. 
      // False keeps the authentication cookie only for the current browser session. This is the safer default for shared workstations.
      "PersistAuthentication": false
    },
    "ScanViewer": {
      "PortNumber": 13950
    },
    "UI": {
      "PreferSvgIcons": true
    },
    "Features": {
      "HelpOnly": false
    },
    "Diagnostics": {
      "EndpointLogging": false
    },
    "Security": {
      "ContentSecurity": {
        // Content Security Policy (CSP) is one browser response header. It controls which resources Grooper may load and use.
        // Changes to every setting below take effect only after the application restarts.
        // "off" does not emit a generated CSP header. Use only for temporary troubleshooting; Override still takes precedence.
        // "low" permits external images, styles, and fonts. Document HTML is not sandboxed, so use only for legacy compatibility.
        // "medium" permits Grooper-hosted images, styles, and fonts, and sandboxes document HTML. This is the normal default.
        // "high" has the same resource restrictions as medium, prevents the app from being framed, and disables HTML/mail display.
        "Level": "medium",
        // Leave empty to use the selected Profiles entry. A nonempty value replaces only the CSP header;
        // Level still controls document sandboxing and whether HTML/mail display is available.
        // Override example: "default-src 'self'; connect-src 'self' http://localhost:{ScanViewerPort}; form-action 'self' {OpenIdConnectOrigin};"
        // {ScanViewerPort} becomes ScanViewer:PortNumber. {OpenIdConnectOrigin} becomes the configured Entra authority host, or empty for Windows authentication.
        "Override": "",
        "Profiles": {
          // These templates are the complete CSP header for each level. Keep the documented placeholders when the related feature is used.
          "low": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; style-src * 'unsafe-inline'; img-src * blob:; font-src *; connect-src 'self' http://localhost:{ScanViewerPort}; object-src 'none'; frame-ancestors 'self'; base-uri *; form-action 'self' {OpenIdConnectOrigin}",
          "medium": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' blob:; font-src 'self'; connect-src 'self' http://localhost:{ScanViewerPort}; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; form-action 'self' {OpenIdConnectOrigin}",
          "high": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' blob:; font-src 'self'; connect-src 'self' http://localhost:{ScanViewerPort}; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' {OpenIdConnectOrigin}"
        }
      },
      "Hsts": {
        // HTTP Strict Transport Security (HSTS) tells browsers to use HTTPS for this host after they have first reached it over HTTPS.
        // It is sent only outside Development and covers the host, not merely the /Grooper IIS subapplication.
        "MaxAgeDays": 365,
        // True also forces HTTPS for every subdomain. Enable only after every subdomain is HTTPS-ready.
        "IncludeSubDomains": false
      },
      "ResponseHeaders": {
        // Set a value to emit the header; leave it empty only when IIS or another trusted deployment layer intentionally manages it.
        // X-Content-Type-Options prevents the browser from guessing a response's file type. "nosniff" is its only standard value.
        "XContentTypeOptions": "nosniff",
        // X-Frame-Options prevents another site from embedding Grooper in a frame. "DENY" is the normal safe value.
        "XFrameOptions": "DENY",
        // Used only for Grooper's own document iframe at off, low, and medium CSP levels. "SAMEORIGIN" permits Grooper itself to display it.
        "EmbeddedFileXFrameOptions": "SAMEORIGIN",
        // Permissions-Policy disables or limits browser capabilities. This policy disables camera, geolocation, payment, and USB;
        // it permits microphone access only from Grooper itself because the voice input features (the AI Helper Talk button and the Chat Console dictate button) use browser speech recognition.
        "PermissionsPolicy": "camera=(), microphone=(self), geolocation=(), payment=(), usb=()"
      }
    }
  },
  "Authentication": {
    "AzureAd": {
      "Instance": "https://login.microsoftonline.com/",
      "TenantId": "",
      "ClientId": "",
      "ClientSecret": "",
      "CallbackPath": "/Auth/Callback",
      "SignedOutCallbackPath": "/Auth/SignedOutCallback",
      "GraphScope": "https://graph.microsoft.com/.default"
    }
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*"
}

Default GWS appsettings.json

{
  "OAuthConnection": {
    "AADInstance": "https://login.microsoftonline.com/",
    "ClientId": "",
    "TenantId": ""
  },
  "BotConnection": {
    "Authority": "https://api.botframework.com",
    "ClientIds": []
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  }
}

AppXtender and FileBound connections moved to Object Libraries (action required)

  • Action required if you use AppXtender or FileBound CMIS Connections. Otherwise, no action is needed.


We have removed the following CMIS Bindings from the core Grooper application.

  • AppXtender - This implementation uses SOAP services. OpenText is deprecating the SOAP services AppEnhancer (formerly AppXtender) relies on. A REST-based replacement will be released as an Object Library in a future update.
  • FileBound - Removed from the core application due to limited usage.

Do not worry! Both are available as Object Libraries. Your existing connections and settings are preserved and will work again once you install the Object Library.

You can download these 2026 Object Libraries directly here:

To keep your system running:

  1. Download the Object Library.
  2. Upload the Object Library to any Project of your choice in the Grooper Repository.
  3. Go to the Object Library's Scripting tab.
  4. Press the Compile button (move_down)
    • If multiple Grooper Repositories are using one of these connections, you will need to upload the Object Library and compile it for each one.
  5. Restart IIS and Grooper services.


Example

After installing Grooper 2026, a previously working AppXtender connection will look like this.

  • The node will be flagged.
  • The Connection Settings will appear to be missing. They are not. These settings are still saved and will reappear once the Object Library is uploaded and compiled.
  • A validation message will warn you about a deserialization error. This is because the object Grooper.Service.CMIS.AxBinding is no longer present in the core application.


After uploading and compiling the AppXtender Object Library and restarting IIS, the previously stored settings will reappear and the CMIS Connection and CMIS Repositories will behave as they did previously. You will also be able to create new CMIS Connections and CMIS Repositories for these connections, just as you did in Grooper 2025.

GWS URL format change (action required)

  • Action required if you use GWS, Grooper's REST API. Otherwise, no action is needed.


The GWS API URL format has changed. Previously, the Grooper Repository ID was a required query string parameter at the end of the URL. Now it is a required part of the URL path. All GWS endpoints use the following format:

https://{hostname}/GWS/{repositoryId}/{endpoint}

Example

The GET batches endpoint returns a list of Batches in the Grooper Repository.

  • Before 2026:
    https://{hostname}/GWS/batches?repositoryId={repositoryId}
  • 2026 and later:
    https://{hostname}/GWS/{repositoryId}/batches

Action required: If you have applications or scripts that call the GWS API, update their URLs to the new format upon upgrading.