Announcements / highlights
- Improved gateway reliability. Fixed stale backend connection reuse, TLS certificate initialization issues during gateway restarts, and false capacity-related HTTP 429 responses. Internal health probes are no longer disrupted by capacity throttling or connection rebalancing.
- More flexible WebSocket routing and load balancing. Added wildcard and URL-template matching for routing multiple paths through a single WebSocket API, plus support for distributing connections across backend pools.
- Enhanced backend certificate validation. Added SHA-256 and SHA-512 certificate thumbprints, issuer-only pinning without a common-name requirement, and matching against intermediate certificates in the available chain.
- Expanded messaging controls. Added configurable Event Hubs logging message-size limits and Service Bus correlation ID, reply-to, and scheduled enqueue time properties.
- More reliable caching and API updates. Fixed truncated cached responses and addressed API import/update failures involving operation-ID changes and HTTP-method/path conflicts.
- Stronger credential protection and request validation. Improved secret redaction in API exports and import errors, tightened workspace isolation checks, and added validation for conflicting SOAP routing information and duplicate case-insensitive GraphQL request keys.
New features and improvements
- More flexible WebSocket routing. Added URL-template and wildcard matching so a WebSocket API can route requests across multiple backend paths.
- WebSocket backend load balancing. Added support for routing WebSocket connections through backend pools.
- Enhanced backend certificate pinning. Added SHA-256 and SHA-512 thumbprints, issuer-only validation, and matching against intermediate certificates throughout the available certificate chain.
- Configurable Event Hubs message sizes. Added configuration for the maximum message size used by Event Hubs logging.
- Additional Service Bus message properties. The send-service-bus-message policy supports correlation ID, reply-to, and scheduled enqueue time.
- Support for dot-prefixed API paths. API paths can begin with a dot, enabling patterns such as .well-known/openid-configuration.
- Temporary access blocking. Added API-version-dependent controls for blocking and restoring access to APIs and tool servers without deleting their configuration.
Breaking changes / compatibility considerations
- Backend secret retrieval. For management API version 2026-05-01 and later, backend GET responses no longer return secret-bearing credentials. Use the listSecrets operation when those values are required.
- Workspace policy restrictions. The get-authorization-context policy is rejected in workspace-scoped policies. Service-level usage remains supported.
- Stricter request and policy validation. Previously accepted configurations or requests that rely on restricted policy-expression APIs, conflicting SOAP routing information, or duplicate case-insensitive GraphQL JSON keys may now be rejected.
Bug fixes
- Improved backend connection reuse. Fixed connection-pool behavior that could repeatedly select stale connections after traffic decreased. Also prevented connections from being reused before request-body transfer was safely completed.
- Improved gateway startup reliability. Fixed certificate-initialization timing and certificate-store access issues that could interrupt startup or cause transient TLS failures after restarts.
- More reliable health monitoring. Prevented capacity throttling and connection rebalancing from disrupting internal health probes.
- Correct response caching. Fixed an issue where responses exceeding the cache size limit could be cached as truncated content.
- Reliable empty-body handling. Fixed policy-expression failures when reading empty request or response bodies.
- Improved API import and update reliability. Addressed operation-ID changes, HTTP-method/path conflicts, OpenAPI schema handling, and preservation of milliseconds and time values in examples. Some operation-matching behavior remains feature-gated.
- Improved management API behavior. Fixed backend-search errors, GraphQL resolver updates with omitted descriptions, product-tag pagination, and incorrect HTTP 500 responses for certain resource conflicts.
- Improved developer-portal registration. Corrected interactions between sign-in requirements, registration settings, and management-created users. Restored subscription-key visibility for authorized subscription owners.
- More accurate diagnostics. Preserved incoming distributed-trace sampling decisions, improved backend-pool attribution and WebSocket failure classification, and added more actionable policy-expression errors.
- Improved configuration consistency. Prevented recreated configuration entities from disappearing during cleanup and addressed concurrent AI model/provider update failures.
- Better protection of credentials. Improved secret redaction in API exports, management responses, and API-import error messages.