API Management Release Notes for September 2026

Updated 17 September 2026

September 17 2026

API Control Plane

Enhancement

• If an API was not deployed to an environment, the Try it Out feature was not available in the Developer Portal. With this enhancement, you can select the Not Deployed filter option to use the Try It Out option for undeployed APIs. (ACP-5202)

Fix

• All API versions did not have the Try it Out option available in the Developer Portal. Now, all versions have the option available. (ACP-5196)

Platform Release

September 12 2026

API Control Plane

New Features

• Introduced API policy templates, a new entity in API Control Plane, discovered automatically from connected Boomi API Gateway environments. API policy templates are synched from connected Boomi API Gateway environments and you can assign templates to APIs directly from the API Control Plane. (ACP-2653).

  Refer to API Policy Templates for more information.

• The Apigee agent now supports keyless authentication using Application Default Credentials or Workload Identity Federation (WIF), in addition to service account key files. (ACP-4736)

  Refer to How to Connect to Apigee for more information.

• API Control Plane REST API documentation is available on developer.boomi.com. You can import the API Control Plane REST API collection into Postman to test endpoints, view request examples, and accelerate development.

  Refer to API Control Plane REST APIs for more information.

• Enabled GraphQL API support in the administration and developer portals of API Control Plane. You can view GraphQL schemas and make test calls directly through an interactive interface, making it easier to explore and validate API behavior. (ACP-3405)

  Refer to GraphQL Explorer for GraphQL APIs for more information.

Enhancements

• Added MCP server status synching so published server now reflect changes to the Official MCP Registry. When you delete or re-activate the backing API product, Boomi automatically updates the server's status. (ACP-4653)

  Refer to MCP Registry for more information.

• MCP servers in the MCP Registry with multiple remotes now fetch and report tools from every remote, not just one. Server queries show the total tool count across all remotes, giving you a complete view of available tools for each server version. (ACP-4548)

  Refer to MCP Registry Server Catalog for more information.

• Added a refresh option for an MCP server version that pulls the latest tools and metadata. This ensures your server details stay current without needing to re-import the server. (ACP-4540)

  Refer to MCP Registry Server Catalog for more information.

• Added support for setting the lifecycle status of MCP server versions directly via the API, using active, deprecated, or deleted values. (ACP-3413)

• The developer portal login and password recovery screens now include a dedicated button to show your password while typing, separate from the input field. This makes it easier to verify your password before signing in. (ACP-1539)

• The developer portal now shows all deployed versions of an API, each labeled with its environment, so you can tell identical version numbers apart across environments. You can also try out any version directly, with only the environments where that version is deployed available for testing. (ACP-4391)

  note

  An API version will be available on the developer portal if it is deployed to an environment where its stage is Production and its status is Active.

• Added support for bulk actions across API Control Plane, including bulk API tagging, activating, deactivating, setting roles and organizations for users, and validating API specification files. (ACP-170)

Fixes

• Resolved an issue where the certificate dropdown for custom domains didn't scroll far enough to display or select all certificates when four or more were available. (ACP-4680)

• Resolved an issue where navigating directly to the URL of a page with a hidden menu item caused an invalid token error instead of loading the page correctly. (ACP-4863)

• Resolved an issue that was causing API specification files with non-ASCII characters to parse incorrectly and prevented MCP server tools from being listed. (ACP-4932)

• Resolved an issue with MCP server tool names to make tool titles unique if the operation summary is missing from the specification file. (ACP-4781)

API Gateway

New Features

• API Gateway introduces API Policy Templates, allowing you to group existing policy configurations under a single named template, with custom descriptions and execution order, so you can apply them consistently across one or more APIs. The Gateway automatically combines and executes all assigned policies from the template in sequence, while built-in versioning automatically creates a new version whenever the template attached to an API is updated, ensuring deployed API configurations remain stable. (APIM-18810, APIM-18823)

  Refer to Policy templates for more information.

• Boomi API Gateway now supports outbound mTLS for API Proxies, letting the Gateway authenticate itself to backend services with a client certificate. You can configure Gateway-level and API-level outbound SSL settings, manage trusted backend certificates, and test connections directly from the API Management UI. (APIM-18652, APIM-19349)

  Refer to Outbound SSL settings for more information.

• You can now manage OpenTelemetry tracing on a per-API basis with new API-level controls, enabling or disabling tracing for individual APIs rather than relying solely on the Global gateway setting. You can also enable Advanced tracing mode for a specific API to capture additional diagnostic details when troubleshooting issues. (APIM-18811)

  Refer to OpenTelemetry support for more information.
  

  Note: For a known issue when enabling advanced tracing mode, refer to the Known Issue section.

important

Subsequent to the September Runtime Release, an issue was identified that required the WSS connector updates to be rolled back. If you applied the new version 26.09.0 during the Runtime Release, it will be automatically reverted to the previous release version 25.07.5. No action is required on your part. Future updates will be documented in the relevant release notes.

Fixes

• Resolved an issue where the user having the API Management - Access privilege was not able to access the Gateway's Advanced and Custom properties tabs, requiring the API Management - Gateway privilege as well. (APIM-19765)

• Resolved an issue where users with the API Management - Access privilege or API Administrator role could not view or modify API Management subscriptions details despite having the correct privileges. (APIM-20028)

• Corrected an error that occurred when saving an API Proxy Component's Server Configuration page with OAuth 2.0 authentication selected, even when all required fields contained valid values. (APIM-19787)

• Resolved a defect where the Refresh Time field in the API Proxy's OAuth 2.0 server configuration incorrectly accepted non-numeric characters. (APIM-19964, APIM-19652)

• Enabled outbound TLSv1.3 support during JWT authentication when identity providers require TLSv1.3 to fetch JWKS keys to prevent SSLHandshakeException errors. (APIM-19739)

Known Issue

• Some spans may appear as "Missing parent" in your observability tool (for example, New Relic) instead of nested under their expected parent span. This can occur when a policy rejects a request (for example, an IP Filter deny) or a backend connection times out or fails to establish, while Intermediate or Advanced API tracing is active. This happens because a tracing span tied to a content-processing policy does not get closed when the failure occurs, so spans created under it during normal execution arrive without a valid parent. (APIM-20415)
  Impact: Affects trace visualization only, in both Intermediate and Advanced tracing modes. Does not impact API request processing, policy enforcement, or backend connectivity.
  Workaround: None at this time.
  Resolution: A fix is planned for a future release.