Skip to main content

Mambo 8

8.7.2​

Released on: 17 December 2025

Engine​

Added

  • Endpoint to retrieve all wallets by site: This new endpoint simplifies data export by returning all wallets for all users in a single request.

Documentation​

Fixed

  • API explorer CORS issue: A CORS misconfiguration caused HTTP requests from the documentation domain to be blocked, preventing the API explorer from functioning correctly. The issue has now been fixed.

8.7.1​

Released on: 3 December 2025

Engine​

Changed

  • Improved database performance: A number of database queries were optimized, leading to better performance and lower database load.

Fixed

  • Inactive users not appearing in leaderboards: Under conditions of high-load and high-concurrency, some inactive users could occasionally be omitted from a leaderboard even if the leaderboard was configured as "Include Inactive Users". The underlying issue has now been fixed.

  • Progress reset of expiring achievements: Due to a bug, the progress of expiring achievements could fail to be reset to 0 after reaching the expiration date. The issue has been fixed and now achievement progress is now reset as expected.

SDKs​

Added

  • Node.js SDK released: Our SDK ecosystem now includes Node.js in addition to Java, PHP, and C#. This enables Node.js developers to fully integrate with Mambo using an officially supported platform.

Fixed

  • Missing balance field in Point analytics data model: The PointDataPoint data model classes in Mambo SDKs were missing the balanceByPointId field. The field is now included in all SDKs.

8.7.0​

Released on: 7 November 2025

Important note: This version of Mambo fixes a problem in the points system that may have caused some users to have incorrect point totals. The upgrade migration recalculates point wallets for all users and applies corrections if necessary, which may result in changes to users’ point totals. By default, the migration only logs the required changes without applying them. To proceed with wallet corrections, set migration.v870.recalculate_wallets=true in mambo.properties. For assistance, contact support@mambo.io.

Engine​

Added

  • Analytics reports for total and unspent expired points: We added new reports to track total circulating points and points that expired without being spent.

  • Support broader format for Idempotency keys: Prior to this release, Idempotency keys had to be in the UUID v4 format. We have now relaxed this requirement, adding support for any non-empty string.

Fixed

  • Leaderboard points incorrectly updated on rejected transactions: Due to a bug, under certain circumstances the points tracked by a leaderboard could changes upon rejection of redeem/refund activities. The underlying bug has been fixed so that leaderboards remain accurate.

  • Missing point transactions for coupon activities: Due to a bug in the database migration for version 7.6.0, some coupon buy/redeem activities might lack a corresponding point transaction. The underlying issue has been fixed and any missing historical transaction has been created.

  • Duplicate point transactions: Under conditions of high load and concurrency, a bug might have caused the same transaction to be saved multiple times. This has been corrected and any duplicate transactions have been removed.

  • Rejected increment transactions could re-spend points: Under rare circumstances, rejecting an activity could lead to a wrong point balance. This bug would be triggered when rejecting an activity with associated points if those points had already been redeemed and the redeem had already been rejected. The underlying bug has now been fixed and any errors in point wallets have been corrected.

8.6.5​

Released on: 03 November 2025

Engine​

Fixed

  • Upgrade jquery version in Mambo widgets: Mambo widgets have been upgraded to the latest JQuery version.

  • Unexpected behaviour of reputation levels: Configuring a level both the "reputation" and "multi-unlock" flags, might lead to unexpected effects when a user unlocked it. Then underlying issue has now been fixed and reputation levels work as expected.

  • Unexpected behaviour of levels tracking expiring points: Creating a reputation level that tracks expiring points could prevent it from being unlocked again after points expired and were re-earned. The logic has now been corrected, ensuring that levels tracking expiring points can be unlocked again once the required points are re-earned after expiration.

8.6.4​

Released on: 16 October 2025

Documentation​

Added

  • Specify valid image type and size for image endpoints: The documentation of endpoints to upload images now specify the image type and maximum size that are supported.

  • Missing field in ActivityBehaviourAttributesData data model: The data model for ActivityBehaviourAttributesData was missing the 'metadata' field. This has now been added.

Engine​

Fixed

  • Rejection of Coupon activities could trigger an error: Under certain circumstances, rejecting a Coupon activity could trigger an internal error, resulting in a response with a 400 status code. The underlying issue has been resolved, and rejecting Coupon activities no longer returns exceptions.

Admin Panel​

Fixed

  • Error rendering pop-up to create Custom Fields: When opening the modal to create a new Custom Field from the modal to create a new tag, the former would appear behind the latter, making it impossible to interact with it.

  • Hidden password fields automatically filled by password managers: Certain password managers would automatically fill the hidden password field in the Create/Update users page, leading to passwords mismatch error. This bug fix prevents the hidden password field from being auto-filled.

8.6.3​

Released on: 10 October 2025

Documentation​

Changed

  • Integration Guide relocated to Getting Started: The Integration Guide was previously listed under the On-Premise Platform section. It has now been moved to the Getting Started section for improved clarity and navigation.

  • Documentation portal migrated to dedicated site: The documentation portal is now hosted at https://docs.mambo.io instead of being embedded into the Mambo application.

Engine​

Changed

  • MongoDB must be configured as a ReplicaSet: Starting from this version, MongoDB installations must use a ReplicaSet configuration. This requirement applies even to test or development environments with a single MongoDB server. For more details, please refer to the Installation Guide.

Fixed

  • Repository Transactions not applied correctly to certain point wallet operations: Due to a bug, certain point wallet operations could be applied without starting a MongoDB transaction. The issue has now been fixed, and all wallet operations are applied transactionally to ensure the point wallets are always in a consistent state.

  • Validation exception when changing coupon purchase points from 0: Changing the number of points required to buy a coupon from 0 to any other value caused a validation exception. The issue has been resolved, and such updates are now correctly validated.

  • Profile widget shows undefined for points to unlock level: The sidebar widget incorrectly displayed “undefined” for points required to unlock a level. This issue has been corrected.

  • Admin panel missing duplicate Coupon Code validation error: When creating coupons with duplicate codes, the validation error was not displayed in the admin panel. This issue has now been fixed.

  • Rollback pinned version button clickable after expiry: The button to rollback a pinned version remained clickable after the rollback window expired. This issue has been resolved, and the button is now disabled once the window expires.

8.6.2​

Released on: 09 October 2025

Engine​

Fixed

  • Coupon API responses include code.assignedCodes when empty: Previously, coupon endpoints omitted the code.assignedCodes field from JSON responses if no codes were assigned. This issue has been fixed, and the field now always appears, set to an empty list when no codes exist.

8.6.1​

Released on: 25 September 2025

Engine​

Fixed

  • Spent points are subtracted from user balances upon expiration: due to a bug in the database migration from Mambo 8.3.1 to 8.4.0, under certain conditions expired points are subtracted from user balances even if they have already been spent, thus breaking the FIFO point spending logic. The bug has now been fixed.

8.6.0​

Released on: 23 September 2025

Engine​

Added

  • Add configuration property to define the maximum number of days after creation during which an activity can be rejected: Previously, activities could only be rejected if created within the last 30 days; this change introduces a new configuration property so administrators can set a different rejection window after which activities can no longer be rejected.

8.5.0​

Released on: 12 September 2025

Engine​

Fixed

  • Administrators created via SAML have no permissions on first login: due to a bug, when an administrator created from a remote directory via SAML authentication logged in for the first time, they had no permissions to perform any action. The issue has been resolved, and new administrators now correctly receive permissions based on the groups they are assigned to.

Admin panel​

Added

  • Unintuitive private key display when creating a new OAuth key: when creating a new OAuth key, the private key was only shown in the table of keys below the public one. This made it easy to miss and to forget to copy for safekeeping. Now, the private key is shown in a pop-up. Once the pop-up is closed, the key can no longer be viewed.

  • New documentation portal: our documentation, previously scattered across three different locations, has now been consolidated into a single unified portal. It now features dedicated sections for administrators (formerly Administrator manual), developers (formerly API and SDK docs), SDKs, and APIs (formerly API Explorer). The API Explorer has a modern, redesigned interface and now includes ready-to-use code snippets and examples in multiple languages. All data models have been carefully reviewed for accuracy and completeness, making it easier than ever to find the information you need.

8.4.2​

Released on: 05 September 2025

Engine​

Fixed

  • Updating a Point configuration could remove Settable flag: due to a bug, updating a point's configuration with a JSON payload that omitted the settable flag resulted in the flag being removed instead of remaining unchanged. The issue has been resolved.

8.4.1​

Released on: 24 August 2025

Engine​

Fixed

  • Achievement progress not resetting on expiry: fixed a bug where an achievement's reward progress could fail to reset to 0 at the configured expiration time under certain timing conditions; progress now reliably resets on expiry.

8.4.0​

Released on: 23 August 2025

Important note: This version of Mambo introduces several changes to the point system that may cause incompatibilities in how users interact with the platform. Before performing any database schema migration, the release checks for potential issues, and if any are found, the migration is aborted with an explanatory error. In such cases, please contact our support team and provide a copy of the migration log file for assistance.

Engine​

Added

  • First-In-First-Out point spending mechanism: Redeemable points are now consumed in First‑In‑First‑Out (FIFO) order — points are spent in the same order they were earned. Each transaction now also reports how many points remain available for the user to spend before they expire.

Fixed

  • Expiration of redeem, refund and set transactions: A bug could cause Redeem, Refund and Set activities to expire when their underlying point type was configured as expirable. This has been corrected so that only Increment activities can expire.

  • Returned points losing expiry after rejection: When a Redeem activity (or an Increment activity with a negative value) was rejected, returned points were restored to the user's balance but lost their expiration settings. Returned points now retain and enforce their original expiration.

  • Incorrect deductions on point expiration: In some cases the wrong number of points were deducted at expiry — for example when an original activity applied only part of its points (e.g. when a stopAtZero point was decremented for more points that the user had). Expiration now deducts only the correct amount.

  • Wrong number of points in Webhook payload for PointWalletDebitExpiredEvent: under rare circumstances, the Webhook event PointWalletDebitExpiredEvent could report the wrong number of points. The underlying issue has now been resolved.

Changed

  • Points designated as Giftable, Bountiable, Redeemable, or Expirable cannot be Set to a specific value through point activities: to set a user's points to a specific value, the point must be configured as Settable at the time of creation. Points configured as Settable have the following characteristics:

    • The Settable configuration is mutually exclusive with the Giftable, Bountiable, Redeemable, and Expirable settings.
    • The Settable status cannot be modified after the point has been created.
    • A Settable point cannot be awarded as a prize
    • A Settable point cannot be used as ad hoc points in a behaviour
    • Point activities for a settable point cannot be rejected
    • A Set point activity with a createdOnOverride in the past, does not have an effect on a user's points if there are other Set point activities (for the same user and point) with a later createdOn date.

  • Redeemable points cannot use stopAtZero: Configuring a Redeemable point with the stopAtZero flag could allow users to spend unlimited points without affecting wallets. That configuration is no longer permitted.

  • Set point activities can no longer be rejected: Rejecting a Set activity could lead to inconsistent user wallets if later Set activities for the same user and point exist. Instead of rejecting Set activities, administrators should create a new activity that directly sets the number of points to the correct value. In order to prevent the issue, set point activities can no longer be rejected.

  • The negativeable and stopAtZero settings can no longer be changed: changing the negativeable or stopAtZero configuration options for an exiting point could cause inconsistencies in user point Wallets. To prevent the issue, these settings can no longer be changed after a point is created.

8.3.1​

Released on: 21 August 2025

Engine​

Fixed

  • Ineffective expiration of achievements: Due to bug, achievement configured with an expiration would fail to expire under multiple circumstances. The underlying issue has now been fixed and achievements expire correctly

SDKs​

Fixed

  • PHP SDKs initialisation issue: Initialising the PHP SDKs by directly loading MamboInit.php could throw an error on case-sensitive filesystems. The underlying issue has now been fixed.

8.3.0​

Released on: 15 July 2025

Engine​

Added

  • Ability to configure different authentication mechanisms per administrator: administrators can now be individually assigned to use either the default authentication mechanism (e.g. SAML/SSO) or the Mambo Internal Directory. This allows scenarios where most administrators authenticate via SSO, while select accounts use internal credentials. A new toggle is available in the Administrator configuration page to control this setting.

Fixed

  • Delay in expiration of time-limited points: previously, points configured to expire after a fixed time since being earned could remain available for up to 59 minutes beyond their intended expiry, depending on when the scheduled cleanup job ran. The expiration job now runs every 5 minutes to reduce this delay and ensure more accurate point expiry.

8.2.1​

Released on: 4 July 2025

Engine​

Fixed

  • Missing rewards in response from the User Rewards API: a bug could, in rare cases, cause a mismatch between rewards a user had earned and those returned by the User Rewards API. This occurred under high system load, when secondary MongoDB nodes lagged behind the primary, resulting in outdated data being read. The system now queries the primary database node to ensure up-to-date information is used when unlocking rewards.

8.2.0​

Released on: 2 July 2025

Engine​

Added

  • Added support for Custom Fields in Coupons: this new feature allows assigning Custom Fields to Coupons.

Changed

  • Consistent ordering in lists of mechanics in API responses: the API endpoints to obtain lists of Behaviours, Points, Leaderboards, Tags or Notifications now return lists consistently ordered by the id of the mechanic.

Fixed

  • Operations queued for retry could be executed in the wrong Tenant context: in multi-tenant systems, under high concurrency circumstances, it was possible that operations queued for retry would be executed in the wrong tenant context, causing documents such as point transactions to be saved in the wrong MongoDB collection. The underlying issue has now been fixed.

  • Upon deletion of a Tenant not all collections were removed form MongoDB: due to a bug, some collections were not deleted from the database when a tenant was deleted. The underlying issue has now been solved.

8.1.3​

Released on: 17 June 2025

Engine​

Changed

  • Migration dropped leaderboard configuration instead of leaderboard state: due to a bug in the migration that updated the MongoDB data models from version 8.0.4 to version 8.1.0, the leaderboard configuration documents were erroneously deleted instead of the leaderboard state documents. The issue has now been resolved.

8.1.2​

Released on: 13 June 2025

Engine​

Changed

  • Leaderboards are ranked only when needed: previously, all leaderboards were automatically ranked every 20 minutes. With this release we instead do not rank leaderboards that had no point changes since their last raking. This change improves the performance of systems with a large number of leaderboards and/or users.

  • Consistent ordering of coupons in API responses: the API endpoint to obtain a list of coupons (/v1/{site}/coupons) now returns a list consistently ordered by coupon id.

  • Consistent ordering of rewards in API responses: the API endpoints to obtain list of rewards of a specific type used to return a list consistently ordered by id of the condition target, followed by the condition threshold. We have now added the reward Id as a third sorting criterion to guarantee a consistent order even when there are ties on the first two fields.

8.1.1​

Released on: 9 June 2025

Engine​

Fixed

  • Fixed Purchase of 0 point buyable Coupons: Coupons priced at 0 points could not be purchased due to a bug. This has been resolved, and now 0-point coupons can be bought, enabling freebies to incentivize user behavior.

  • Fixed error with validation of point Refunds: Refunds now require the user to have sufficient spent points. Previously, it was possible to refund points even if they had not been spent. This validation has been added to prevent invalid refunds and ensure consistent point balances.

Widgets​

Security

  • Upgrade Lodash dependency: The lodash JS dependency has been upgraded to version 4.17.15.

8.1.0​

Released on: 7 June 2025

Engine​

Added

  • Mission with Reward Repetitions: You can now create missions that unlock when a specific reward is earned multiple times. This allows for more dynamic and engaging mission designs, where specific rewards are required to be completed multiple times in order to unlock the mission.

Changed

  • New leaderboard ranking algorithm: Leaderboard ranking is now performed using the MongoDB Aggregation framework, leading to improved performance.

Fixed

  • Fixed Exception on Invalid or Missing Bearer Token: Requests with an invalid or missing bearer token were correctly rejected but caused a system error. This issue has been resolved.

  • Improved Shutdown Sequence: Resolved a rare issue where the system could shut down before all queued asynchronous tasks were completed. The shutdown process now properly waits for all tasks to finish, ensuring a clean termination.

  • Fixed Leaderboard Cloning Issue: When cloning a leaderboard, the "rankedOn" property was incorrectly copied. This has been fixed, and the "rankedOn" value is now properly unset on cloned leaderboards.

  • Fixed PointStore Deserialization Precision: Resolved a bug that caused loss of decimal precision when deserializing PointStore data from requests. Decimal digits are now preserved correctly.

Admin Panel​

Removed

  • API Secret Key Visibility: API secret keys are now only visible immediately after creation. Once you leave the API keys page, the secret keys can no longer be viewed for enhanced security.

8.0.4​

Released on: 29 March 2025

Engine​

Added

  • Leaderboards can now track users with no points in the period being tracked: Previously, leaderboards excluded users who had not performed at least one activity during the tracked period. For example, if a user had no activities in the current week, they would not appear in the weekly or daily leaderboard. With this update, leaderboards can be configured to include inactive users with 0 points. This behavior can be enabled in the admin panel using the "Include Inactive Users" toggle.

Fixed

  • Large number of concurrent activities for the same user could cause Out of Memory errors: The retry strategy used to handle concurrent attempts to modify the same user could lead to a very deep call stack. The strategy has now been redesigned for better performance.

  • Error in leaderboard point counting under rare circumstances: When the same user performed two point activities exactly one year apart with no intervening activities, the points from the previous year could be counted toward the current year. This issue has now been fixed.

  • Creating a new API key could occasionally result in an error: Under rare circumstances, creating a new key via the Admin panel could display a KeyNotFound exception despite the key being created correctly. This issue has now been fixed.

  • POST requests with no data could cause Internal Server Exceptions: Requests to the /v1/{site}/coupons/validate or /v1/{site}/activities endpoints with null data could result in an Internal Server Exception. This issue has been fixed; null data now causes a Validation Exception instead.

  • Error when counting users during initialization of analytics: Under rare circumstances, initialization of analytics could over-count users with no activities. This issue has been fixed.

Deprecated

  • User data model: Facebook and Twitter details have been deprecated and will be removed in a future version.

Admin Panel​

Fixed

  • Code samples in data store section of administrator manual are misformatted: The formatting has been corrected.

  • Display error for Custom Fields: Custom fields with invalid HTML content could break formatting of data tables. This issue has been fixed.

Removed

  • Data model class diagram: The diagram displaying the data model was of little practical use and has therefore been removed.

8.0.3​

Released on: 1 March 2025

Engine​

Fixed

  • ESAPI not compatible with Jakarta servlets: The version of ESAPI bundled with Mambo was changed to one compatible with Jakarta.

8.0.2​

Released on: 21 February 2025

Admin Panel​

Changed

  • Improved error messages related to Behaviour metadata scope: Error messages for invalid Behaviour metadata are now clearer. Additionally, the informational text in the Metadata Scope tooltip for rate-limited behaviours has been rewritten for better clarity.

Fixed

  • Group permissions page in the admin panel not loading: A bug prevented the Group Permissions page from being properly displayed. The issue has now been solved.

8.0.1​

Released on: 19 February 2025

Engine​

Fixed

  • Tomcat no longer displays stack traces: Previously, for certain exceptions a stack trace could be shown instead of a custom error page; this issue has now been resolved.

  • Invalid Token exceptions not compatible with SDKs < 8.0.0: The Accept-Version header presented by the client was erroneously ignored when downgrading OAuth exceptions to the pre-8.0.0 format. The underlying issue has now been resolved.

8.0.0​

Released on: 14 February 2025

Engine​

Changed

  • Newly created leaderboards no longer count past points: Previously, new leaderboards included points from past activities due to automatic reprocessing, whereas now they only track points awarded after creation. To include past points, the leaderboard can be manually regenerated after creation.

  • Upgraded to Servlet 6.x and Tomcat 10: Mambo Engine now supports Servlet 6 and Tomcat 10; earlier Tomcat versions are no longer compatible.

Fixed

  • Templates failed to load under certain circumstances: Templates with mechanics configured using HTML code could not be loaded. The underlying issue has now been fixed.

  • Error when uploading malformed templates: Uploading a malformed template ZIP files caused templates to indefinitely remain in the "uploading" state. The underlying issue has now been fixed.

  • Error when creating Prizes or Points with very large values: Creating prizes or points with large numerical values caused an exception. The underlying issue has been fixed, and the maximum value of points and prizes has been set to 1,000,000,000.

  • Rewards API could return wrong mission progress: The rewards API could return incorrect mission progress when the request specified a filtering tag or when rewards tracked by the mission had not yet been awarded to the user. The underlying issues have now been fixed.

  • Validation error when creating prizes with fractional points: Creating a point prize where the number of points had a decimal component caused a validation error. The underlying issue has been fixed and it's now possible to create fractional prize points.

  • Levels with 100% could be shown as not awarded: Under rare circumstances, it was possible that a level was not awarded to a user despite the user having earned sufficient points. The underlying issue, which was linked to latency in DB replication, has now been resolved.

SDKs​

Changed

  • SDKs refactored for better usability and developer experience: Java, .NET, and PHP SDKs now use MamboClient as the main access point, support RequestOptions per request, and include detailed exceptions. See SDK docs for details and examples. The Java SDK also introduces individual method parameter classes. See SDK docs for details and examples.

  • Java SDK improvements: The number of dependencies of the Java SDK was greatly reduced. In particular, the SDK no longer depends on javax dependency, minimized other dependencies, and introduced individual method parameter classes for better integration.

Documentation​

Changed

  • API Specification fully compatible with OpenAPI Spec v3: The format of Mambo API specification available from the API explorer has been upgraded to the latest version of the OpenAPI specification.

  • API Explorer shows code samples for the pinned version: Selecting a pinned version in the API and SDK manual now updates the API specification and SDK code samples accordingly.