Catch up on the latest product updates, best practices, and expert insights from the Checkmk Conference #12 – Watch the livestream recordings now
back to website

Werk #22319: Proxy credentials are stored as typed and notification proxies move to the password store

Component Notifications
Title Proxy credentials are stored as typed and notification proxies move to the password store
Date Oct 3, 2026
Level Prominent Change
Class New Feature
Compatibility Incompatible - Manual interaction might be required
Checkmk versions & editions
3.0.0b1
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT

You can now configure the HTTP proxy of notification plug-ins with the same structured form the Check HTTP web service ruleset already uses: scheme, proxy server, port and, if needed, a user with a password. The password can come from the password store or be entered explicitly. This affects Cisco Webex Teams, ilert, Jira, JSM, Microsoft Teams, Opsgenie, PagerDuty, Pushover, ServiceNow, SIGNL4, Slack, SMS API and Splunk On-Call.

Until now, an explicitly configured proxy was a single URL, and the update moves the credentials found in these URLs into the password store.

Automatic migration

When you update, existing proxy URLs are converted into the new form. The credentials of a URL, like http://user:secret@proxy:3128, are moved into the password store. This applies to notification parameters, rules of the notification parameter rulesets and personal notification rules of users.

  • There is one password store entry per proxy credential. Its ID starts with notification_proxy_ and is made of the user, server and port, for example notification_proxy_user_at_proxy_lan_3128. A proxy used in several places is changed in one place. The comment of the entry lists where it is used.
  • The entries are owned by administrators and are not shared with anyone.
  • Credentials of personal notification rules get entries of their own, whose ID also contains the Checkmk user. Since only users with the permission Write access to all passwords can use these entries, other users have to enter the proxy password again when they edit such a rule.

The notifications keep using the same proxy with the same credentials. Do not delete the created password store entries: notifications that refer to a missing entry fail.

A path in a proxy URL is dropped, since proxies only use scheme, server and port. Proxy URLs that cannot be fully converted, for example with an unsupported scheme, an invalid port or a password without user, are converted as far as possible and get the invalid port 0. Their credentials are moved to the password store as well. The update reports them, and the proxy does not work until you fix it in the Setup. If rules for the parameters of these notification plug-ins contain such a URL, the validation before the update reports them as well and asks whether to continue.

Notification plug-ins from extension packages (MKPs) are not affected.

Proxy credentials are now stored as typed (incompatible)

Proxy user names and passwords are now stored exactly as you type them, and encoded only when the proxy URL is built. This applies to all proxies, including the global proxies in Global settings > HTTP proxies, and to everything that uses them: notifications, special agents, license verification, product usage reporting and OAuth2 connections. Until now, most of these expected special characters to be entered percent-encoded, while the HTTP check used the password as typed. So a password with @, :, / or % now works everywhere.

If you entered the user or password of a global proxy percent-encoded, for example p%40ss for p@ss, enter it as typed after the update. This also applies to global proxies that the update to Checkmk 2.4 converted from a proxy URL, since that update kept the credentials as they appeared in the URL. The update warns about global proxies whose user or password contain percent-encoded characters, so you know which ones to check.

REST API (incompatible)

The http_proxy field of notification rules has a new option manual with the fields scheme, proxy_server_name, port and an optional auth with user and password (either {"option": "explicit", "password": ...} or {"option": "store", "store_id": ...}).

Responses now return explicitly configured proxies with the option manual. Proxies the update could not fully convert have the port 0. If your scripts read the url of a proxy, switch them to the new fields.

Requests with the option url are still accepted but deprecated. The URL is converted into a manual proxy, and credentials in it are saved as an explicit password. A URL that cannot be converted is rejected.

To the list of all Werks