API Gateway Changelog¶

Release date: 2026-10-29
Previous version: 2026.09.24 (2026-09-24)

New feature additions¶

Mutual TLS authentication: The new mtls-auth policy authenticates callers by client certificate, against a pool of trusted client CAs that you manage. You can narrow it further by subject alternative name (SAN) or certificate thumbprint. It also accepts a certificate forwarded by a TLS-terminating load balancer, from trusted relay connections only.
Upstream TLS per backend: A tls block on an upstream sets the client certificate the gateway presents to that backend, the CAs it trusts, and whether it verifies the hostname.
Certificate management improvements: Certificates have a usage, a role and match rules. You can rotate a certificate in place with PUT /certificates/{id}. Private keys are encrypted at rest and never returned, and the gateway warns about certificates that are about to expire.
GraphQL APIs: GraphQL is a first-class API type, managed through /graphql-apis and the ap gateway graphql-api commands, with API keys, policies, CORS preflight and analytics.
Gateway signing keys and JWKS endpoint: Configure signing keys (RS256, PS256, ES256 or ES384) under [signing]. The gateway publishes their public keys at /.well-known/jwks, and the Backend JWT policy (v1.1.0) signs with them.
Fault policies: Attach policies that run only when a request fails, at the API or the operation level.
Request IDs in responses: Every response carries an x-request-id header that matches the gateway's logs and analytics.
Subscription monetization: With Platform API and the API Portal, you can sell API access through paid plans, priced at a flat rate or by usage and billed through Moesif and Stripe. With Moesif analytics enabled, the gateway attributes a paid subscription's calls to its billing customer. A subscription whose payment stops is suspended at the gateway.
Subscription updates: Subscriptions accept your own ID (externalRefId), partial updates, plan changes and token rotation, through the management API and ap gateway subscription update.
Traffic logging: Logs can include the operation's path template (request.pathTemplate).
Redis over TLS: The Advanced Rate Limit policy (v1.3.1) can connect to Redis over TLS.
OpenShift support: The gateway images run under arbitrary user IDs, and the Helm chart can create OpenShift Routes. For more information, see OpenShift standalone deployment.

New policies

mTLS Authentication
OAuth2 Token Exchange: Exchanges the caller's credential for a token from the backend's own authorization server, by RFC 8693 token exchange or an RFC 7523 JWT bearer grant. If the exchange fails, the request is rejected; the caller's token is never forwarded instead.

See Policy Hub for policy references.

Changed¶

New defaults: Each of these is on by default. To keep the previous behavior, set it to false.
- [router.upstream.tls] present_default_identity: the gateway presents its default client certificate to backends that request one.
- [router.http_listener] return_request_id_in_response: responses carry x-request-id, replacing any value a backend or policy set.
- [signing] jwks_endpoint_enabled: /.well-known/jwks is served on every host, ahead of any API on that path.
Backend JWT signing: Once gateway signing keys are configured, the backend-jwt policy signs with the gateway key and adds a kid header. Give your backends the gateway's JWKS before you configure keys.
Logs and metrics: JSON access logs add sni, tlsVer, peerSubj, peerFp and upTlsFail, and policy_executions_total adds the denied and short_circuited status values. Moesif events from a subscription with a billing customer carry that customer as the company ID.
Analytics and traffic logging keep up under constrained CPU, and repeated headers keep every value.
Upgrading: SQLite databases from 2026.09.24 are migrated automatically. For PostgreSQL or SQL Server, re-run the scripts in resources/gateway-controller/db-scripts before you start the new version. For Helm upgrades, use --reset-then-reuse-values (Helm 3.14 or later) or pass your values file, not --reuse-values.
Platform updates: Envoy v1.39.6, with updated Go dependencies and OS packages.

Fixed¶

Fixed analytics-header-filter not applying to response headers: it now filters them when response-header capture is on, and headers it removes no longer reach analytics (#3530).
Fixed analytics events with multi-value headers not reaching OpenTelemetry backends (#3608).
Fixed renaming a subscription plan to a name already in use, or deleting a plan still in use, returning 500 instead of 409 (#3804).
Fixed ap gateway add not saving --admin-server, which broke ap gateway health (#3820).
Fixed the gateway operator not redeploying a failed gateway after a configuration change (#3509).
Fixed gateways with long names failing to deploy through the operator: the Helm release name is now bounded so derived Service names fit (#3566).