Release - API Management service: October, 2026

Announcements / highlights

• Improved gateway reliability. Fixed stale backend connection reuse, TLS certificate initialization issues during gateway restarts, and false capacity-related HTTP 429 responses. Internal health probes are no longer disrupted by capacity throttling or connection rebalancing.
• More flexible WebSocket routing and load balancing. Added wildcard and URL-template matching for routing multiple paths through a single WebSocket API, plus support for distributing connections across backend pools.
• Enhanced backend certificate validation. Added SHA-256 and SHA-512 certificate thumbprints, issuer-only pinning without a common-name requirement, and matching against intermediate certificates in the available chain.
• Expanded messaging controls. Added configurable Event Hubs logging message-size limits and Service Bus correlation ID, reply-to, and scheduled enqueue time properties.
• More reliable caching and API updates. Fixed truncated cached responses and addressed API import/update failures involving operation-ID changes and HTTP-method/path conflicts.
• Stronger credential protection and request validation. Improved secret redaction in API exports and import errors, tightened workspace isolation checks, and added validation for conflicting SOAP routing information and duplicate case-insensitive GraphQL request keys.

New features and improvements

• More flexible WebSocket routing. Added URL-template and wildcard matching so a WebSocket API can route requests across multiple backend paths.
• WebSocket backend load balancing. Added support for routing WebSocket connections through backend pools.
• Enhanced backend certificate pinning. Added SHA-256 and SHA-512 thumbprints, issuer-only validation, and matching against intermediate certificates throughout the available certificate chain.
• Configurable Event Hubs message sizes. Added configuration for the maximum message size used by Event Hubs logging.
• Additional Service Bus message properties. The send-service-bus-message policy supports correlation ID, reply-to, and scheduled enqueue time.
• Support for dot-prefixed API paths. API paths can begin with a dot, enabling patterns such as .well-known/openid-configuration.
• Temporary access blocking. Added API-version-dependent controls for blocking and restoring access to APIs and tool servers without deleting their configuration.

Breaking changes / compatibility considerations

• Backend secret retrieval. For management API version 2026-05-01 and later, backend GET responses no longer return secret-bearing credentials. Use the listSecrets operation when those values are required.
• Workspace policy restrictions. The get-authorization-context policy is rejected in workspace-scoped policies. Service-level usage remains supported.
• Stricter request and policy validation. Previously accepted configurations or requests that rely on restricted policy-expression APIs, conflicting SOAP routing information, or duplicate case-insensitive GraphQL JSON keys may now be rejected.

Bug fixes

• Improved backend connection reuse. Fixed connection-pool behavior that could repeatedly select stale connections after traffic decreased. Also prevented connections from being reused before request-body transfer was safely completed.
• Improved gateway startup reliability. Fixed certificate-initialization timing and certificate-store access issues that could interrupt startup or cause transient TLS failures after restarts.
• More reliable health monitoring. Prevented capacity throttling and connection rebalancing from disrupting internal health probes.
• Correct response caching. Fixed an issue where responses exceeding the cache size limit could be cached as truncated content.
• Reliable empty-body handling. Fixed policy-expression failures when reading empty request or response bodies.
• Improved API import and update reliability. Addressed operation-ID changes, HTTP-method/path conflicts, OpenAPI schema handling, and preservation of milliseconds and time values in examples. Some operation-matching behavior remains feature-gated.
• Improved management API behavior. Fixed backend-search errors, GraphQL resolver updates with omitted descriptions, product-tag pagination, and incorrect HTTP 500 responses for certain resource conflicts.
• Improved developer-portal registration. Corrected interactions between sign-in requirements, registration settings, and management-created users. Restored subscription-key visibility for authorized subscription owners.
• More accurate diagnostics. Preserved incoming distributed-trace sampling decisions, improved backend-pool attribution and WebSocket failure classification, and added more actionable policy-expression errors.
• Improved configuration consistency. Prevented recreated configuration entities from disappearing during cleanup and addressed concurrent AI model/provider update failures.
• Better protection of credentials. Improved secret redaction in API exports, management responses, and API-import error messages.