23 August 2026
Production release: 23 August 2026
Staging release: 17 August 2026
10 August 2026
Section titled “10 August 2026”Features
Section titled “Features”Timezone Reference Data Updated to Global Standards: The IAM timezone reference dataset and API documentation have been updated to include individual global standard timezones, replacing the previous GMT-offset grouped format. IAM PR #4444
Application Account Details Added to Get and List Endpoints: The GET and LIST application endpoints now return account details for authorized subjects when the include=accounts query parameter is used.
HTU Validation Enabled for DPoP Verification: Implemented HTTP Target URI (HTU) validation within DPoP verification middleware to ensure strict endpoint matching for incoming requests.
Depth Limiting Implemented in GraphQL: Depth limiting has been introduced in GraphQL to prevent cyclic queries and ensure API stability.
Developer Console Enhanced with User Count Integration: The teams page in the developer console now displays the count of users for better visibility.
EDW Data Product for Users Noun Exported: A static, one-time dataset of the existing user base has been generated for downstream consumers.
Incremental User Capture for EDW Data Product: New users created after the initial extract are now captured incrementally for downstream consumption.
Application Consent Repository Cleanup: The application consent repository in IAM has been cleaned up for better maintainability.
CDH Source System Validation Added for Credential Sync: Active source systems are prioritized during sync, ensuring inactive systems are only used when no active ones are available.
GraphQL Device Certificate Thumbprint Issue Resolved: GraphQL now correctly populates the thumbPrint field for device certificates, aligning with REST API behavior.
Cloudfront IAC Script Updated for Origin MTLS Support: Updated Cloudfront IAC scripts to support the origin_mtls field in the latest Terraform version.
Write Script Updated for Attribute-Wise Reconciliation: The write script logic has been updated to reconcile specific attributes first, improving validation accuracy.
Bug Fixes
Section titled “Bug Fixes”Timeout Error Resolved for Adding Users to Applications: Fixed timeout errors when adding users to applications using the POST /applications/{applicationId}/users endpoint.
GraphQL Internal Server Error Stack Trace Removed: The GraphQL response no longer includes stack traces in the message block for internal server errors.
Guest Group Cleanup Aligns User DefaultAccount: Fixed an issue where guest group cleanup deleted user-account relations without updating the user’s defaultAccount.
User Update Fails for ACTIVE Users Due to Pending State Validation: Resolved an issue where ACTIVE users were unable to update their profiles due to incorrect pending state validation.
DefaultAccount Maintained for Cross-Account Group Invitations: Fixed a bug where the defaultAccount field was not updated when users were invited to cross-account groups.
Device Sync Handles Out-of-Order REMOVE and MODIFY Events: Prevented DLQ failures by handling out-of-order REMOVE and MODIFY events during device synchronization. Related DLQ Investigation
Device Role Assignment API Validates Subset Roles: Added subset validation to ensure role assignment is permitted only if the source has a higher role than the target being assigned.
Dealer Opt-In Request Expiry Handled Seamlessly: Fixed a gap where expired TTL records caused errors during dealer opt-in request refresh.
Reverse Sync Handles NULL Descriptions Gracefully: Fixed crashes in the DeviceProfileTransformer caused by None.lower() when Profiles devices had description: NULL.
GET /users API Returns Proper Error for Excessive IDs: The API now returns a 400 Bad Request error with a clear message when the id in (...) filter exceeds the 20-id limit, instead of a 500 Internal Server Error.
Application Subscription Context Added for Authorization Requests: Explicitly tracks the context of application-account relationships to differentiate ownership and access relationships. Reference Document
IAM Sync Endpoints Whitelist Updated for APICloud Application: The APICloud application is now whitelisted for IAM internal sync endpoints in the staging environment.
Admin Console UI Supports i18n Translations: Updated the admin console UI to support internationalization (i18n) translations.
IAM API Supports SCIM Enabled Status for Applications: Added support for SCIM integration status in the applications endpoint.
IAM API Enables Application Secret Retrieval: Introduced an endpoint for retrieving application secrets.
Reconcile Users Without Email or Username: Script implemented to reconcile users missing email or username with TID data.
Prevent IAM Sync Failures for Out-of-Order Events: Enhanced device synchronization to handle out-of-order REMOVE and MODIFY events without failures.
Handle Actions After Request Expiry in Dealer Opt-In: Fixed issues with dealer opt-in requests failing due to expired TTL records.
Mend Scan Vulnerabilities Addressed Across Multiple BLUs: Remediated Mend SCA vulnerabilities in various BLUs, including Accounts, Applications, Common, Groups, Organizations, Roles, and Users.