22 September 2026

Production release: 22 September 2026
Staging release: 14 September 2026

22 September 2026

Features

PUT API to Update Device Roles in a Group: New PUT /groups/{groupId}/devices/{deviceId} endpoint with body {"roleIds": ["roleId1", "roleId2"]}. It replaces the calling application’s roles on an existing device-to-group relation and returns the updated device with its roleIds.

Increased Page Size for doingBusinessWith API: GET /accounts/{accountId}/doingBusinessWith?pageSize={n} now allows larger page sizes for approved applications such as NGSS, so large customer lists can load in one request. The higher limit applies only to unfiltered list requests.

API Product Subscription Sync With TID: API product subscriptions now sync to TID, so TID can check whether the requesting application is subscribed during authorize and token calls.

Applications Auth Endpoint Documentation Updated: The docs site now covers the accountId query parameter on POST /applications/{appId}/auth.

Internal Endpoint to Refresh Users From TID: Added an internal IAM endpoint that refreshes a user from TID, for testing and support.

ATC Applications Added to Skip Invitation Configuration: ATC application IDs are now in the skip-invitation configuration for every environment.

Identity-Aware Rate Limiting Foundation: Added a shared rate limiter with per-application (azp) limits. It runs in shadow mode, logging only without rejecting requests, and starts with GET /users/{userId}.

Config Management for IAM Authorization: Added configuration management for IAM Authorization.

DPoP HTU Validation Supported Through CloudFront: The global-router CloudFront function now passes the customer-facing URL in a request header, so DPoP htu validation passes when clients call IAM through CloudFront aliases.

GraphQL HTTP Batching Explicitly Disabled: HTTP batching is now explicitly disabled in the GraphQL server, with automation tests to keep it that way.

FedRAMP Private Gateway for Invite URLs: Set up a private gateway for the user invite accept success and failure URLs, and validated the full flow in the FedRAMP stack.

FedRAMP ALB and NLB Setup: Set up ALB and NLB and updated the IaC naming for the Internal and Common API Gateways.

FedRAMP System Info Endpoint: Added GET /system/info to the FedRAMP stack.

FedRAMP Source System and Seed Data Setup: Ran the source system script, and the seed data now links the IAM bootstrap account to a source system.

FedRAMP Network Egress Hardening: Removed the DNB/ALK configs and enforced network egress blocks.

Automatic Failover to DR Region: Enabled health checks on the common, writer and reader domains so IAM fails over to the DR region automatically.

CDH User Sync Uses Reconciliation Approach: CDH user sync now uses IAM APIs with a reconciliation approach.

Accounts Payload Models Refactored for Reconciliation: Refactored the account payload models to support reconciliation.

Duplicate OSR Handling for Records Without a Source System: Duplicate OSR handling now covers account and address records that have no source system.

LiveSync Skip and Exception Events Saved: LiveSync now saves skip and exception events for later reference.

Reverse Sync Log Improved for Missing CDH Reference: Reverse sync now logs a clearer message when a CDH reference is missing.

CDH to IAM Sync Documentation Updated: Reviewed and updated the CDH-to-IAM sync documentation.

Glue Job Uses Key Pair Authentication: The Glue job now authenticates with a key pair.

Address-Based Account Search Retired: Retired address-based account search and stopped indexing addresses in AOSS. Name-only search still works.

Account Names Backfilled in AOSS: Backfilled account name documents from DynamoDB into the AOSS accounts index.

AOSS Ingestor Timeout Tuning: SQS VisibilityTimeout is now 6× the Lambda timeout, as AWS recommends, and the OpenSearch client, Lambda and SQS timeouts for the AOSS ingestor were increased.

SIT and UAT Keep-Warm Endpoints Added: Added more endpoints to the SIT and UAT keep-warm cron to avoid Lambda cold starts.

AppSync Decommissioned: Removed orphaned AppSync IAM roles, renamed legacy AppSync artifacts, and removed AppSync from the IAM documentation.

Developer Console Passes Admin Role ID on Consent Accept: The Developer Console now sends the Admin Role ID when a user accepts consent from the notification page.

Audit Log Automation for Accounts BLU: Automated audit-log tests now cover the Accounts BLU APIs.

Accounts Automation Tests Improved: Updated the CDH address sync reconciliation test and consolidated error-message assertions in the accounts automation tests.

Invalid Account Entities Purged: Removed invalid account entities from IAM in Stage and Production.

User UUID Mismatch Fix Script for SIT: Added a script that fixes user UUID mismatches between TID and IAM in SIT.

PX Users Created With Verified Email in TID: The PX script now creates TID users with emailVerified: true and user_status: ACTIVE.

Code Quality and Vulnerability Fixes: Fixed Mend SCA vulnerabilities and SonarQube issues in the Devices BLU. MyPy in the Accounts BLU now covers the Common layer, and the errors it found are fixed.

Bug Fixes

GraphQL RSQL Injection Fixed: Values in the UserGroupsFilter.roleIds GraphQL filter are now escaped before the RSQL query is built, which prevents injected filter clauses.

Organization Owner Add and First Account Removal Fixed: Adding a user with the org-owner role using a user token no longer returns 403 (ORG_041), and removing an organization’s first account no longer returns 404 (ORG_017).

Reference Data Endpoints Work in All Geo Regions: The referenceData endpoints for country, language and timezone no longer fail outside the US region because of S3 access errors.

TID Sync Cursor Errors Resolved: Fixed “Cursor is either invalid or expired” errors in TID sync.

Too Many Open Files Error Resolved for Add User to Application: The add-user-to-application API no longer fails with “Too many open files”.

Out-of-Memory Error in Async Central Entity Handler Resolved: Fixed out-of-memory errors in iam-async-central-entity-handler caused by lazy mp_pipe_pool startup.

Lambda Timeouts No Longer Leave mp_pipe_pool Leases Stuck: mp_pipe_pool worker leases now recover after a Lambda timeout in warm containers.

Resend Invitation 500 Error Resolved: Fixed the Production 500 error on resend invitation.

LiveSync Respects MMS Unique Constraint for Duplicate Devices: LiveSync no longer breaks the IAM MMS unique constraint when a duplicate device is synced.

CDH Address Sync Handles Existing Addresses: CDH address sync now handles AddressIdExistsConflictError when the address already exists.

Profile Picture No Longer Stored in User Entity: The TID PATCH sync no longer stores the profile picture URL on the user entity.

Unsupported Languages Removed From Users BLU: The Users BLU no longer accepts languages outside the supported list, in line with the Trimble Language Standards Board.