Release - API Management service: March 2024

‼️ Breaking changes ‼️

• On June 14, 2024, we’re introducing breaking changes to the Workspaces feature. You may have to take action to continue using workspaces beyond June 14, 2024.

New features, improvements, and changes

• We’ve introduced several new features and improvements to workspaces:
  • You can now create and manage certificates, backends, diagnostics, and loggers inside a workspace with the 2023-09-01-preview management API version.Azure portal interface will be released soon.
  • You can now use context.Workspace in policy expressions.
  • "default-workspace" is now a reserved workspace resource name.
• We now preserve the format and schema properties of the form-data parameters when importing OpenAPI APIs.
• HTTP version information will now be included in the request trace.
• We’ve added support for HS512 and RS512 algorithms in the validate-jwt policy.
• client-application-ids element is now optional in validate-azure-ad-token policy.
• We've made a couple improvements to the GraphQL support:
  • We've added support for Union Type in GraphQL resolvers
  • Arrays can now be used within the set-body policy to project the data obtained by a resolver onto the list of primitive data types specified in the GraphQL schema
• An Azure Advisor notification will be sent to customers when they inadvertantly delete the FQDN property from the public IP resource assigned to API Management.
• We've made several improvements to the VNet integration in the Standard v2 tier:
  • We will now detect if the prerequisites for VNet integration are not being met - i.e., subnet delegation and service association link, and fail the deployment faster.
  • All traffic from the VNet-integrated Standard v2 service instances to the Internet will be now routed via the integrated VNet.
  • The outbound IP will now be populated and shows its respective value.

Fixes

• We’ve resolved the issue where Azure API Management would incorrectly log requests that were rejected due to public network access is disabled. This fix ensures that logs and metrics in Azure Monitor now exclude these rejected requests when API Management is set up with a private endpoint.
• An attempt to create diagnostics in a workspace that doesn't exist will now return a 404 Not Found error. Previously, API Management returned a 500 Internal Server Error response.
• Workspace users can no longer override diagnostics settings defined for all APIs on the service level.
• Exporting APIs with empty or whitespace-only examples no longer produces an error.
• Optional string query parameters are no longer added to the API operation's URL template.
• $DevPortalUrl variable in the developer welcome email template now returns a new developer portal URL. Previously, it returned a legacy developer portal URL.
• The authenticate-certificate policy now performs a case-sensitive certificate ID validation. Previously, request processing would fail when the casing between the certificate ID in the policy and in the request didn’t match.
• We've fixed an issue preventing recovery of the soft-deleted Basic v2 and Standard v2 service instances.

Self-hosted developer portal releases

• 2.26.0

Self-hosted gateway container image releases

• 2.5.0

Self-hosted gateway Helm chart releases

• 1.9.0

Release - API Management service: February 2024

New features, improvements, and changes

• TLS 1.3 and related cipher suites are now supported.
• The validate-jwt policy now works with tokens signed PS256 signature algorithm.
• We raised the content size limit in the validate-content policy to 4MB.
• A current API revision can now be addressed using a revision-specific URL in addition to the API's base URL.

Fixes

• Self-hosted gateway using EntraID authentication to connect to the associated Azure API Management service instance are now showing heartbeats in the Azure Portal.
• We fixed the issue preventing “Scheduled Maintenance” events from being shown in the Activity log.
• The set-body policies contained within GraphQL resolver policies (see example) is now executed for streamed responses.
• The issue making resolver get incorrect values from the cache for some GraphQL requests is now fixed.
• Requests resulting in a log entry larger than 32KB, previously not logged at all, are now logged to Azure Monitor after trimming.

Developer portal releases

• No releases.

Self-hosted gateway container image releases

• 2.5.0

Self-hosted gateway Helm chart releases

• 1.9.0

Release - API Management service: December, 2023

New features, improvements, and changes

• We reserved default Workspace name for internal use. After the update, users will not be able to create Workspaces with that name.

Fixes

• We fixed an issue causing degraded performance when creating new service instance.
• We fixed an issue with DevPortalHost property not being passed correctly into the email notification template.
• We eliminated inconsistency in Security Scheme and Security Requirement objects in OpenAPI exports when performed by authenticated vs. anonymous users.

Developer portal releases

• No releases.

Self-hosted gateway container image releases

• 2.4.0
• 2.3.6

Self-hosted gateway Helm chart releases

• 1.8.0
• 1.7.6.

Release - API Management service: November, 2023

New features, improvements, and changes

• We will now provide specifics about token validation failures in validate-azure-ad-token policy in API Inspector.
• We made the password policy stronger for users creating accounts on the developer portal - e.g., it now requires using a special character. Complete password requirements will be shown on the sign-up page.
• Users now must provide their current password before changing it on the developer portal.
• Pagination controls on the developer portal now feature only the Next and Previous buttons.

Fixes

• We fixed an issue that caused tokens of logged-out developer portal users signed in via Azure AD B2C to remain valid under some circumstances.
• We fixed a regression that caused POST requests issued from the try it console on the developer portal not to work correctly.
• We fixed an issue in the Content Access Control feature of the developer portal that allowed unauthorized access to pages via direct link.

Developer portal releases

• No releases.

Self-hosted gateway container image releases

• 2.4.0
• 2.3.6

Self-hosted gateway Helm chart releases

• 1.8.0
• 1.7.6

Release - API Management service: October 2023

Highlights

• We're excited to announce availability of the Public Preview of our latest Azure API Management pricing tiers: Basic v2 and Standard v2.
• API Management is now Generally Available in the Israel Central and Italy North Azure regions.

New features, fixes and improvements

• You can now specify timeout in milliseconds in the the forward-request policy via the new timeout-ms attribute.
• We fixed an issue where a large request log entry blocked Azure monitor log stream.
• We fixed an issue where the emit-metric policy could fail the request when no diagnostic entries are configured at any of the scopes.
• We fixed an issue where a request to a GraphQL API with empty GraphQL resolver policy fails the request.
• We fixed a few bugs in the developer portal test console.
• We fixed an issue in the publisher component of the developer portal which caused it to fail when there was not enough memory for creating a snapshot.

Developer portal releases

• No releases.

Self-hosted gateway container image releases

• 2.3.5

Self-hosted gateway Helm chart releases

• 1.7.5

Release - API Management service: September 2023

New features, fixes, and improvements

1. We have introduced new Azure Advisor recommendations:
   • Use Azure AD authentication instead of gateway token for Configuration API
   • Identity self-hosted gateways using gateway tokens that will expire in < 7 days
   • Identity validate-jwt policy usage with insecure key size
2. We have removed support for the retired set-graphql-resolver policy which had already been replaced with GraphQL API resolvers.
3. We have fixed an issue where the OpenAPI would fail if the parameter names where empty.
4. We have fixed an issue where nested objects were being overridden when import OpenAPI was used.
5. We have fixed an issue where the FixOpenApi parameter schema can now import complex schemas.
6. We have fixed a bug where validate-azure-token policy was not properly using expressions to resolve tenant-id.
7. We have fixed an issue where deleting the API release will now return 204 instead of 404 if release does not exist.
8. We have fixed an issue where the Deletion of API was not removing all of the releases. When deleting an API it will now delete all of its releases.
9. We have fixed an issue where the DELETE operation for API endpoint was synchronous and timing out. The DELETE operation has been made asynchronous to fix this issue.

Self-hosted gateway container image releases

1. 2.3.4
2. 2.3.3
3. 2.3.2
4. 2.3.1
5. 2.3.0

Self-hosted gateway Helm chart releases

1. 1.7.4
2. 1.7.3
3. 1.7.2
4. 1.7.1
5. 1.7.0

Release - API Management service: April 2023

Highlights

1. Azure API Management and Microsoft Defender for APIs integration is now in preview. Learn how Microsoft bolsters cloud-native security in Defender for Cloud with new API security capabilities.
2. Workspaces in Azure API Management are now in preview.
3. Synthetic GraphQL is now generally available.
4. Authorizations in Azure API Management are now generally available.
5. Incoming traffic to Azure API Management's gateway can be secured to clients running in a virtual network through Azure Private Link.

New features, fixes, and improvements

1. We fixed an issue, where the customers potentially could not change organization or email in the email notifications.

Developer portal releases

1. 2.23.0

Self-hosted gateway container image releases

1. 2.2.0

Self-hosted gateway Helm chart releases

1. 1.6.0

Release - API Management service: February & March 2023

A regular Azure API Management service update was started February 9, 2023. This release concluded rollout on March 31, 2023.

New features, fixes, and improvements

1. We added the new context.Deployment.Gateway.* object with several properties for accessing gateway information in runtime policies. (Learn more)
2. We fixed an issue, where the definition names in the API schema would display blank spaces.
3. We fixed an issue, where the developer portal was hiding default domain, a parameter has been added to include default domain in the hostnames.
4. We fixed an issue, where the API revisions were not being properly filtered.
5. We fixed an issue, where adding API schemas with the same namespace resulted in an error.
6. We fixed an issue, where policies contained all named values which caused a problem for secrets. The policy failed to check if given user had access to secret.
7. We fixed an issue, whereby Azure Active Directory v1 tokens could be validated with validate-azure-ad-token policy, but v2 tokens could not be validated. With this release, both v1 and v2 tokens are supported.
8. Previously, validate-azure-ad-token would only validate tokens against the public cloud instance of Azure Active Directory (AD). With this release, token validation is supported in every Azure cloud where Azure Active Directory is available.
9. Previously, the gateway would not refresh the GraphQL schema when it was updated from the Azure portal. The gateway now correctly refreshes the GraphQL schema after it's updated in the Azure portal.
10. We implemented a GraphQL context variable to allow access to all portions of the GraphQL context within policy expressions.

Self-hosted gateway container image release

1. 2.2.0 (Preview 1)
2. 2.1.8
3. 2.1.7

Self-hosted gateway Helm chart

1. 1.5.5
2. 1.5.4
3. 1.5.3
4. 1.5.2

Release - API Management service: December, 2022

A regular Azure API Management service update was started on December 8, 2022. This release will continue to roll out through January 2023.

New features, fixes, and improvements

1. The log-to-eventhub policy now supports securing connections to Azure Event Hub with managed identity.
2. We fixed an issue, where the GraphQL in API Management will no longer fail when an introspection query is added to the synthetic GraphQL resolver policy.
3. We fixed an issue, where saving some policy fragments in Consumption tier services was failing.
4. We fixed an issue, where modifying a policy using client SDKs or PowerShell was failing with a 406 Not Acceptable response. The issue was caused by the management API's failure to handle PUT requests with the wildcard (*/*) Accept header.

Developer portal releases

1. 2.22.0

Release - API Management service: October, 2022

A regular Azure API Management service update was started on October 31, 2022. It may take several weeks for your API Management service to receive the update.

Feature retirements

1. Support for Azure API Management self-hosted gateway version 0 and version 1 ends 1 October 2023.

New features, fixes, and improvements

1. You can now easily validate Azure Active Directory tokens on incoming requests with the new validate-azure-ad-token policy. Learn more in the documentation or blog post.
2. We fixed an issue, where API Management didn't allow clients to open new WebSocket connections even though they didn't exceed the connections limit.
3. API Management updates are now rolled out to one Availability Zone at a time. Previously, updates were rolled out to multiple Availability Zones, reducing the service capacity by up to 50%.
4. You can now use cors and caching policies (cache-store and cache-lookup) inside policy fragments. Previously the cors policy inside policy fragments didn't correctly apply CORS configuration to the API; caching policies couldn't be configured due to an error.
5. API Management scale-out attempts that fail due to insufficient subnet capacity are now properly logged in Activity Logs.
6. XML schema validation with validate-content policy no longer results in validation errors for elements with type "anyType".
7. The execution time of the send-one-way-request policy is no longer included in the backendTime metric in the diagnostic logs, since it's an asynchronous, non-blocking operation. Previously, it was included in the backendTime metric but excluded from the totalTime metric.

Developer portal releases

1. 2.21.0
2. 2.20.0
3. 2.19.1

Self-hosted gateway container image releases

1. 2.1.6
2. 2.1.5

Self-hosted gateway Helm chart releases

1. 1.5.1
2. 1.5.0