API Management Release Notes for September 2026

Platform Release

September 12 2026

API Control Plane

New Features

• Introduced API policy templates, a new entity in API Control Plane, discovered automatically from connected Boomi API Gateway environments. API policy templates are synched from connected Boomi API Gateway environments and you can assign templates to APIs directly from the API Control Plane. (ACP-2653)
• The Apigee agent now supports keyless authentication using Application Default Credentials or Workload Identity Federation (WIF), in addition to service account key files. (ACP-4736)
• Enabled GraphQL API support in the administration and developer portals of API Control Plane. You can view GraphQL schemas and make test calls directly through an interactive interface, making it easier to explore and validate API behavior. (ACP-3405)

Enhancements

• Added MCP server status synching so published server now reflect changes to the Official MCP Registry. When you delete or re-activate the backing API product, Boomi automatically updates the server's status. (ACP-4653)
• MCP servers in the MCP Registry with multiple remotes now fetch and report tools from every remote, not just one. Server queries show the total tool count across all remotes, giving you a complete view of available tools for each server version. (ACP-4548)
• Added a refresh option for an MCP server version that pulls the latest tools and metadata. This ensures your server details stay current without needing to re-import the server. (ACP-4540)
• Added support for setting the lifecycle status of MCP server versions directly via the API, using active, deprecated, or deleted values. (ACP-3413)
• The developer portal login and password recovery screens now include a dedicated button to show your password while typing, separate from the input field. This makes it easier to verify your password before signing in. (ACP-1539)
• The developer portal now shows all deployed versions of an API, each labeled with its environment, so you can tell identical version numbers apart across environments. You can also try out any version directly, with only the environments where that version is deployed available for testing. (ACP-4391)
• Added support for bulk actions across API Control Plane, including bulk API tagging, activating, deactivating, setting roles and organizations for users, and validating API specification files. (ACP-170)

Fixes

• Resolved an issue where the certificate dropdown for custom domains didn't scroll far enough to display or select all certificates when four or more were available. (ACP-4680)
• Resolved an issue where navigating directly to the URL of a page with a hidden menu item caused an invalid token error instead of loading the page correctly. (ACP-4863)

API Gateway

New Features

• Boomi API Gateway now supports outbound mTLS for API Proxies, letting the Gateway authenticate itself to backend services with a client certificate. You can configure Gateway-level and API-level outbound SSL settings, manage trusted backend certificates, and test connections directly from the API Management UI. (APIM-18652, APIM-19349)
• API Gateway introduces API Policy Templates, allowing you to group existing policy configurations under a single named template, with custom descriptions and execution order, so you can apply them consistently across one or more APIs. The Gateway automatically combines and executes all assigned policies from the template in sequence, while built-in versioning automatically creates a new version whenever the template attached to an API is updated, ensuring deployed API configurations remain stable. (APIM-18810, APIM-18823)
• You can now manage OpenTelemetry tracing on a per-API basis with new API-level controls, enabling or disabling tracing for individual APIs rather than relying solely on the Global gateway setting. You can also enable Advanced tracing mode for a specific API to capture additional diagnostic details when troubleshooting issues. (APIM-18811)
  note

  For known limitations when enabling advanced tracing mode, refer to the Known Limitations section.

Enhancements

• Upgraded the WSS connector’s internal web server interface and libraries to lay the groundwork for future enhancements. Current functionality and operations remain unchanged. (APIM-20114)

Fixes

• Resolved an issue where the user having the API Management - Access privilege was not able to access the Gateway's Advanced and Custom properties tabs, requiring the API Management - Gateway privilege as well. (APIM-19765)
• Resolved an issue where users with the API Management - Access privilege or API Administrator role could not view or modify API Management subscriptions details despite having the correct privileges. (APIM-20028)
• Corrected an error that occurred when saving an API Proxy Component's Server Configuration page with OAuth 2.0 authentication selected, even when all required fields contained valid values. (APIM-19787)
• Resolved a defect where the Refresh Time field in the API Proxy's OAuth 2.0 server configuration incorrectly accepted non-numeric characters. (APIM-19964, APIM-19652)
• Enabled outbound TLSv1.3 support during JWT authentication when identity providers require TLSv1.3 to fetch JWKS keys to prevent SSLHandshakeException errors. (APIM-19739)
• The WSS connector update released for the July 2026 Runtime was rolled back after introducing the following issues. These issues have now been resolved:
  • Resolved an issue where CORS preflight (OPTIONS) requests to Web Services Server APIs returned no Access-Control-* headers, causing browsers to block follow-up API calls. (APIM-20098)
  • Corrected behavior where NoAuth APIs returned an HTTP 500 error upon receiving an Authorization header containing a bare Base64 value without a scheme prefix. NoAuth APIs now correctly respond with HTTP 200 for any Authorization header format. (APIM-20088)
  • Remediated an issue where Basic Auth-protected APIs returned a 401 Unauthorized status for valid credentials sent without the Basic schema prefix or with a different scheme token. (APIM-20087)
  • Addressed an issue where the inheader_Authorization Dynamic Document Property for API Services using Gateway authentication prepended an unexpected BOOMI-GATEWAY schema prefix to the Base64 credential value. The property now returns only the Base64 credential. (APIM-20072)
  • Restored standard behavior for the Web Services Server (WSS) Dynamic Process Property inuser, which previously appended the Account ID to usernames. With WSS authentication enabled, inuser now returns only the username. (APIM-20070)

Known Limitations

• When you enable Advanced tracing mode, some spans may appear as "Missing parent" in your observability tool (for example, New Relic) instead of nesting under their expected parent span in the trace. This can occur when an asynchronous policy (such as IP Filtering) closes its span out of order, or when a backend call times out or errors, disconnecting one or more nested spans from the trace.(APIM-20415)
  Impact: This affects trace visualization only. It does not impact API request processing, policy enforcement, or backend connectivity (requests are handled correctly regardless of how the trace renders). Affected spans still contain accurate data; they may just not display under the correct parent.
  Workaround: None at this time.
  Resolution: A fix is planned for a future release.

• If you select a tracing mode in the UI but do not save it, then select and save a different mode (Advanced) instead, the system may incorrectly retain the unsaved selection. Once the Advanced session's time limit expires, the API reverts to the unsaved mode rather than the last saved mode. (APIM-20430)
  Impact: This affects which tracing mode is active after an Advanced session ends. It does not affect API request processing.
  Workaround: After selecting a tracing mode, save it before making further changes. If you have recently used Advanced mode, verify the API Tracing setting reflects your intended mode once the session expires.
  Resolution: A fix is planned for a future release.