25 August 2026
Release date: 25 August 2026
Release Notes
Section titled “Release Notes”Features
Section titled “Features”Gateway Security & Policy Enforcement
Section titled “Gateway Security & Policy Enforcement”- OpenAPI Specification Enforcement: The API Gateway now acts as a strict policy enforcement point, validating incoming requests against the published OpenAPI Specification (OAS) for each API.
(TCAC-12477) - Undocumented Path Blocking: Requests to paths not defined in the OAS return a 404 Not Found, even when the backend supports the endpoint.
- Resource-Level Scope Validation: The Gateway enforces OAuth scopes defined in the OAS for each resource and operation, returning 401/403 when the access token lacks the required scope.
Bug Fixes & Stability
Section titled “Bug Fixes & Stability”- Deployed URL Correction: Fixed an issue where flattened lower-environment APIs showed an incorrect deployed URL after an update deployment.
(TCAC-12687) - UserRepository NullPointerException: Resolved a NullPointerException in UserRepository that caused UI error messages.
(TCAC-12561) - Malformed Request Handling: MismatchedInputException now returns a 400 Bad Request instead of a generic 500 error.
(TCAC-12571) - Deployment Deletion: Fixed deployment deletion failures caused by an association with a skip subval constraint.
(TCAC-12666) - Applications API Authorization (FedRAMP): Fixed GET /applications by name returning 403 when a team-role user is not provisioned in IAM.
(TCAC-12806)