07 September 2026

Production release: 07 September 2026
Staging release: 31 August 2026

07 September 2026

Features

Public Flag Added for Applications: Applications now support a public field on POST /applications and PUT /applications/{id}. Accounts other than the owning account can use public applications, and GET /applications/{id} returns the flag when it has been set.

Public Application Authorization for Auth and DeAuth Endpoints: POST /applications/{applicationId}/auth and POST /applications/{applicationId}/deAuth now check the public flag for cross-account operations. The check runs after the existing permission checks pass.

Default Public Flag Migrated for Existing Applications: A migration sets the default public value on all existing applications.

SMS Onboarding Support for Managed Users: The Managed User API now supports phone numbers, custom SMS attributes and templates, and resend/update, so managed users can onboard with an SMS magic link. Phone numbers used for magic links are not stored in IAM.

Default Account Flag on Organization-to-Customer Account Relation: STNH organization-to-customer-account relations now have a default boolean. When an organization is created, the caller’s account is marked as its default account, which supports the TID SCIM implementation.

Users Added Directly to an Organization Join the Default Account: A user added directly to an STNH organization is now also added to the organization’s default account, and the account ID is returned in the API response.

App-Account Relations and Consent Synced to TID: App-account relationships and admin consent properties are now sent to TID through EventBridge when a third-party app is created.

Product Entity Sync to TID: Product entities now sync to TID for create, read, update and delete.

Account User Relation Nodes Introduced: Added account-user relation nodes to represent user membership in accounts.

Audit Log Coverage Extended Across IAM BLUs: Audit events now cover role and permission changes, dealer/customer account relations, owner-role transfer and bulk invite, API products, group join and unjoin, organization partnerships, and Accounts GraphQL mutations.

CDH Account Sync Audit Logs: CDH account sync now writes audit logs.

Audit Log Automation for Users BLU: Automated audit-log tests now cover all Users BLU APIs.

Invitation Secret Key Moved to Secure Configuration: The invitation secret key moved from source code to secure configuration management.

Client IP Passed Through CloudFront: The IAM CloudFront function takes the client IP from X-Forwarded-For and passes it to the origin in the x-custom-client-ip header.

Address Source Systems Synced on Reconciliation: Address reconciliation sync now also syncs the address source systems.

CSV Validation Failures Collected and Alerted in S3: CSV validation failures are collected in S3 and trigger alerts.

Validation Scripts Enhanced for CDH and PX Data: Added a validation script for PX user-account and organization associations. The account and address validation scripts now check for a CDH account and handle EBS as a source system, and their results can be exported.

Profiles Sync Preserves Event Metadata: eventMetadata is now kept when Profiles sync updates a user.

Organization Tradestyle Names Backfilled: Tradestyle names were backfilled for existing organizations (VW/MTP).

Application-to-Group Relation Script Converted to Migration: The Glue script that updates application-to-group relations now runs as a standard migration script.

New Relic Adoption for IAM Services: IAM services moved from Datadog to New Relic, through Production.

STNH Edge Cascader Invocation Metrics: Added a metric for the total invocation time of the STNH edge cascader.

DynamoDB Request ID Logged for Diagnosis: DynamoDB request IDs are now logged to help diagnose errors.

Common Layer Logs Printed in Authorization BLU: Common-layer logs now print correctly from the Authorization BLU.

Admin Console Custom Application Dialog Labels Updated: Updated the labels in the Admin Console “Add custom application” dialog.

TAM Documentation Updated: Updated the TAM docs for all CLI and SDK commands.

AwsService Retry, Timeout and Client Caching Improvements: Addressed review comments on AwsService retry, timeout and client caching.

Address Payload Model Naming Aligned: The address common payload model now uses Python naming conventions.

Unused Geo Regional Databases Cleaned Up: Removed unused regional databases from the geo regions.

Mend and SonarQube Findings Addressed: Fixed Mend SCA vulnerabilities in the Bootstrap and Events BLUs, and SonarQube issues in the GraphQL, Accounts and Events BLUs.

Bug Fixes

List Accounts With External Systems No Longer Fails: GET /accounts?include=externalSystems no longer returns 500 when one account has invalid externalSystems data.

GraphQL Permission Errors Handled Consistently: GraphQL now returns standard error responses for permission failures.

GraphQL Group Query With Invalid ID Returns Consistent Payload: A GraphQL group query with an invalid ID now returns a consistent error payload instead of an unexpected shape.

GraphQL Internal Server Error Stack Trace Removed: GraphQL internal server error responses no longer include stack traces in the message block.

Internal Flag Preserved on Application Update: The is_internal flag is no longer removed when an application is updated with PUT /applications/{id}.

Account Source System PUT Prioritizes OSR Reference: When the source system name matches OSR, account and address source system upserts now use the OSR reference.

Removed Team Members Lose Group Read Access: Users removed from a Developer Console team can no longer read that team’s data through GET /groups/{groupId} or GET /groups/{groupId}/users.

Delete Relation NotFoundException Routed to Correct Handler: NotFoundException raised by delete_relation is now caught by the correct handler.

DynamoDB Region Lookup Uses Correct Key Suffix for Accounts: Region lookup now builds #accounts keys with the correct suffix instead of #users.

Invitation Deletion Flow Corrected: Invitation deletion now removes the reserved UUID instead of relying on TTL updates.

Account Deserialization Guarded Against Missing Results: IAM now checks that an account was returned before deserializing it.

Flaky AWS Pooling Test Removed: Removed a flaky, redundant AWS pooling test from the test suite.