Skip to content

API Gateway Changelog

Release date: 2026-07-07
Previous version: 1.1.0 (2026-04-30)

New feature additions

  • Traffic logging support: Added traffic logging capabilities for gateway request and response flows.
  • Timeout functionality support: Added timeout configuration support for gateway traffic handling.
  • MSSQL support for gateway: Added Microsoft SQL Server support for gateway persistence.
  • Multiple virtual host support: The endpoints array replaces the single vhost field, allowing one gateway to expose multiple virtual hosts simultaneously (#2128).
  • upstreamDefinitions URL improvements: Upstream definition URLs support query strings and path fragments correctly (#2068).
  • Kubernetes Gateway API conformance support: Added Kubernetes Gateway API conformance support.
  • Multi-provider routing: Added routing support across multiple providers.

New policies

See Policy Hub for policy references.

Added

  • feat(llm): Multi-provider routing for LLM proxies (9288a1e20).
  • feat(gateway): Multi-provider model round-robin routing (2878f7b90).
  • Added AWS Bedrock multi-provider support (6da796b0e).
  • Added opt-in pprof endpoints on admin servers (da3d42c0b).
  • Added global traffic logging support and field-exclusion controls (d484dd7bb, bd2f451f7, 58eb41727).
  • Added support for request/response body and header capture options in traffic logging (8a3b33f4f).
  • Added policy-engine context snapshots for downstream path/method and upstream status (61a68890e).
  • Added policy metadata support for analytics/traffic logging (6ad01d3b3).
  • Added SQL Server support and related schema/distribution updates (505abca5f, 4707e2b38, 9eff6defd, c70f3ff1c).
  • Added gateway health check implementation (4fea1ce05).
  • Added basic auth protection for admin service (health endpoint excluded) (ac2129858).
  • Added role-based admin validation and enforced role-claims when IDP is enabled (d53b8844d, bf8342c62).
  • Added support for multiple -config files in both controller and policy-engine (c6b343a87, 073cb77bf).
  • Added set-headers append mode support (policy update from #2103).
  • Added HTTP connection manager (downstream) timeout config support in runtime config model.

Changed

  • Refactored policy definition sourcing to use gateway-builder output (0f8b59aeb).
  • Updated routing model: moved header-based routing and redirect logic out of API YAML into dedicated policies (22198fd11, eec5e2fa7, 504d33bdf, d0f84a780).
  • Updated operation routing model to use a new match object for path match type and header-based matching (from #2103).
  • Enabled path normalization by default (c7979cf16).
  • Updated policy bundles/versions, including API key and auth policy lines (f67181bb5, ff1965e9b, cb788c033, 855da688b, d573b07a8, c7553aa1a).
  • Refined config interpolation and overrides, including env/file interpolation and allowlist behavior (bff0bc3ee, 47e74040d, eca558827, 4a9a263a7).
  • Updated runtime/build baselines (Go toolchain and Envoy updates) (f4ff5034c, a38b95f5f, be297cf32).
  • Included distribution docs and packaging updates for release artifacts (41f89cde7, c70f3ff1c).
  • Bumped gateway controller REST API base paths to v1 and aligned artifact API versioning to gateway.api-platform.wso2.com/v1.
  • Added data_version handling for gateway-controller artifacts to decouple stored data shape from wire version (290606d8a, 70a86c6e3).
  • Changed custom policy managedBy default/normalized value from customer to organization.
  • Updated analytics/collector config model: renamed gRPC collector section and split payload controls for request/response bodies and headers.
  • Moved toward config-driven env/file interpolation for runtime config management via config.toml templates, plus bff0bc3ee and 47e74040d.

Config Changes

  • Added new traffic_logging config block:
[traffic_logging]
enabled = false
masked_headers = ["authorization", "x-api-key", "x-jwt-assertion"]
max_payload_size = 0
request_headers = false
request_body = false
response_headers = false
response_body = false

[traffic_logging.properties]
  • Collector and analytics config changes:
    • Renamed [analytics.gprc_event_server] to [collector.server].
    • Removed [analytics.gprc_event_server].server_port.
    • Replaced analytics payload toggles with collector-level request/response controls:
[collector]
request_body = false
response_body = false
request_headers = false
response_headers = false
ignored_path_prefixes = []
  • Added downstream HTTP listener timeout block:
[router.http_listener.timeouts]
request_timeout         = "0s"
request_headers_timeout = "0s"
stream_idle_timeout     = "5m"
idle_timeout            = "1h"
  • Configuration source model update: direct APIP_* runtime overrides are removed in favor of {{ env }} / {{ file }} interpolation in config.toml, with required env vars supplied via env files.

Fixed

  • Fixed stale extracted policy artifacts in gateway runtime (6b07c59c4).
  • Fixed controller behavior for overlapping/same-name LLM policy matches (746db0ed9, 14451b47e).
  • Fixed dynamic endpoint/base path handling in gateway and controller (7cff05d2f, 30a24d2b7, ad921c208).
  • Fixed upstreamDefinitions URL validation and error clarity (query/fragment rejection) (227e19bc5, d5bc0b535, d267f3346, a43762260).
  • Fixed xDS snapshot update race with synchronization improvements (62b7f22a8, b87094a43).
  • Fixed graceful runtime shutdown by draining Router (271cc4c2b).
  • Fixed duplicate analytics event emission in LLM proxy flows and hardened loopback suppression (995a97edc, 07c5fe644, 9b4f54d23, 447d5a7bb).
  • Fixed policy-engine update behavior to retain unchanged chains and avoid false route removals (edb2e453d, 066695c7a).
  • Fixed LLM provider validation/sync edge cases, including duplicate-named API-level policy preservation and invalid config rejection (6ce9cbde3, 2843f9eb5).
  • Fixed translator/runtime handling for timeout mapping and upstream selection continuity (34a82c1bc, 6e79649c7, 0a98f265b).