Skip to content
Identity and Access Management

17 December 2025

Production release: 17 December 2025

17 December 2025

Section titled “17 December 2025”

Stage Release : 2025-12-09 & 2025-12-16

Enhancements

Section titled “Enhancements”

  • User Role Assignment with Metadata: Enhanced role assignment API to support relation metadata when assigning roles to users on target entities.

  • Application Certificate Details: Expanded the GET application details API to include application certificates in the response.

  • Invitation Management: Added metadata support to the POST /invitation endpoint with Time-To-Live (TTL) functionality for improved invitation tracking and lifecycle management.

  • Organization Address Schema: Refined organization address fields with “anyOf” policy to accept either streetAddress or addressLines, improving schema flexibility and data consistency.

  • Configuration Management for Groups and Users: Integrated configuration management into Groups BLU by migrating SSM values to DynamoDB, and implemented configuration management for Users BLU using existing code for streamlined integration.

  • Role Permissions Limit Increased: Raised the maximum number of permissions per role from 50 to 100.

  • Bootstrap API Certificate Generation: Integrated certificate generation into the bootstrap API for code reuse with device certificate APIs.

  • Application-Group Relation Creation: Application creation with a groupId now establishes application-group relations, capturing the “ownership” attribute as “home” or “guest.”

  • Cascade Delete for Group Settings: Added support to cascade delete subgroups and their relations when deleting a parent group (Connect-specific).

  • Dealer Endpoint Permission Checks: Dealer endpoints now verify user permissions, enabling applications to use these APIs.

  • Webhook Failure Error Reporting: Improved error reporting for Accept Webhook failures for better diagnostics.

  • Devices Data to EDW: Devices data is now pushed to EDW, similar to organizations and accounts.

  • Pending Group Invitations API: Implemented an API to retrieve all pending group invitations or join requests for a user.

  • Account Transfer Support: Added account transfer with authorization checks for the roles:transfer permission, limited to owner roles of IAM applications.

  • Case-Insensitive User Search: Enabled case-insensitive wildcard string matching in RSQL queries for user searches.

  • Add User to Account Endpoint Enabled: The user-to-account relation creation endpoint is now available in the internal gateway.

  • Delete User Identity on Invitation Cancellation: Cancelling invitations now deletes the corresponding user identity in TID to prevent orphaned identities.

  • EDW Organization Schema: Updated the IAM ORGANIZATION schema to remove the org_name field from required attributes in EDW.

Bugfix

Section titled “Bugfix”

  • User Update with Virtual Role: Fixed a bug causing a 500 error when updating a user with a virtual role assigned to a group.

  • API Unmapping Error: Resolved a 500 error that occurred when unmapping an API from a product in the console.

  • RoleIds Field in API Spec: Corrected the ‘add existing user in account’ API specification by removing the mandatory label from the roleIds field.

  • Access Token Expiry Messaging: Fixed misleading “Access Token Expired” responses for unauthorized templates.

  • GET /users Sort and Pagination: Addressed sorting and pagination issues in the GET /users endpoint for more accurate results.

  • Accounts Without External Systems: Fixed a bug where listing accounts without external systems returned a complete error instead of valid accounts.

  • Pending User Addition to Application: Restricted users in PENDING state from being added to applications, enforcing proper validation.

  • AOSS Ingestors DLQ Reliability: Analyzed and fixed errors in the DLQ for AOSS regional ingestion handlers, improving reliability.

  • Opensearch DLQ Discrepancies Resolved: Resolved discrepancies in OpenSearch accounts collection Dead Letter Queue (DLQ), enabling proper index updates and eliminating DLQ message backlog.

  • Invitation Context Data Storage: Fixed an issue where context data from the POST /invitation API was incorrectly stored in user data; it is now stored only in invitation data.