Skip to content
Identity and Access Management

01 December 2025

Production release: 01 December 2025
Staging release: 25 November 2025

01 December 2025

Section titled “01 December 2025”

Enhancements

Section titled “Enhancements”

  • Application Endpoint Certificate Support: IAM now provides an API endpoint for applications to obtain certificates using the subject-delegation grant-type, enhancing secure identity delegation.

  • Sync Expiry Days to TID on Invitation Resend: Expiry information is now synchronized with TID when invitations are resent, ensuring consistent expiry handling across IAM and TID systems.

  • Update Invitation Max Expiry Days to 60: The maximum invitation expiry configuration has been increased to 60 days, improving user experience and reducing re-invitation requests.

  • Invitation API Returns Invitation ID: The Invitation API now includes the invitation ID in its response, providing better tracking and integration.

  • Update Accounts Logic in TID-Sync Creation Endpoint: The TID sync endpoint now creates users without establishing an account relationship if the account ID is missing from the user creation request’s query parameters.

  • Update Roles Assigned to Application API Enhancements: IAM API now allows account administrators to provision applications to act on behalf of identities within their account, with a new API for updating application role assignments.

  • Amend User Status Field in TID Sync Update Endpoint: The user status field in the TID-Sync update endpoint is now updated according to the data shared from TID, ensuring accurate status representation.

  • Permission Structure Refactoring on Devices BLU: Device-related endpoint permissions are now checked against account containers, improving security and access control.

  • Enhance Device-Account Migration Profiles-IAM: Devices are now synced with CDH formatted accounts to IAM, ensuring proper account relations and migration consistency.

  • Implement DELETE API for TID to Sync Users to IAM: A DELETE endpoint has been added to TID users sync, allowing user deletion from TID to IAM.

  • Live Sync - Sync User Details to OpenSearch: Live synchronization keeps user data in IAM OpenSearch up to date with IAM DynamoDB, ensuring data consistency across systems and providing search functionality

  • Ensure Removal of Application/Device from Parent Group Also Removes Them from Local Nested Groups When applications or devices are removed from a parent group, they are also removed from local nested groups, maintaining group integrity.

  • Update Get Entity Endpoint to Throw 404 Error Along with Region : The Get entity endpoint now throws a 404 error with region details if data resides in other regions, improving error transparency.

  • Restrict Inviting Cross Account Users Who Are Still in Pending State: Users in pending state under an account are restricted from being added to cross account groups, with a valid error message returned.

  • Migration - Rename Subject Type to SubjectType in Central Table: The “subjectType” field is now correctly displayed as “SubjectType” in the central table, resolving previous format issues.

Bugfix

Section titled “Bugfix”

  • RSQL Operator =in= List Endpoint Fix:Resolved an issue where the RSQL operator =in= was not returning results in list endpoints, ensuring correct filtering behavior.

  • GET Groups/{groupId}/Users API Spec Query Function Removal: Removed the unimplemented query function from the GET Groups/{groupId}/Users API spec description for accuracy.

  • 502 Internal Server Error on GET Organizations/{organizationId}: Addressed and fixed the 502 Internal Server Error occurring on GET requests for organizations.

  • Search Customer Account by Owner Email 500 Error Fix: Fixed a 500 error when searching for customer accounts using the owner email, restoring expected search functionality.

  • Central Events Handler Lambda Exception Handling: Ensured errors in the central events handler lambda are properly handled, preventing unhandled exceptions.

  • Device Model/Manufacturer Update 500 Error Fix: Resolved a 500 error when updating device model or manufacturer with an existing value, allowing successful updates.