Documentation Index
Fetch the complete documentation index at: https://docs.apinizer.com/llms.txt
Use this file to discover all available pages before exploring further.
Version 2026.04.5
Release date: May 18, 2026 NEW FEATURES- Cache Policy
- Unified Cache Access Standard Across All Cache-Using Screens
- Trace Screen Policy-Specific Execution Details
${...} and #{...} placeholders in Specify Value fields of Business Rule Modify operators (Format, Mask, Transform, Insert) were not resolved at runtime.
APNZ-6249 : Fixed an issue where requests with encoded special characters in the URL path were rejected with “Illegal character in path” when forwarded to the backend.
APNZ-6253 : Fixed an issue where ${...} and #{...} placeholders in Use Custom Value (condition rules) and Specify Value (action rules) fields were not resolved.
APNZ-6254 : Fixed an issue where dotted custom variable keys (#{custom.environment}) returned empty values in routing addresses and template fields.
APNZ-6256 : Fixed an issue where CONTAINS/NOT_CONTAINS body searches with multi-word phrases on the API Traffic screen returned no results. See.
APNZ-6257 : Fixed an issue where ${...} and #{...} placeholders in Action Definition Conditions Specify the Value fields were not resolved at runtime.
APNZ-6258 : Fixed an issue where Business Rule Add action Injection Target wrote to the wrong region based on target type.
APNZ-6260 : Fixed request body loss, HTTP 503 ERR-070, and empty body fields in traffic logs for SOAP requests sent via API Proxy Group.
APNZ-6266 : Fixed an issue where API Proxy log setting changes were not reflected in the linked Proxy Group.
Version 2026.04.4
Release date: May 14, 2026 NEW FEATURES- Cluster Diagnostics Tab Added to the Elasticsearch Monitor Screen
- Authorization Basic Header Support for OAuth/JWT Token Endpoints (RFC 6749 §2.3.1)
client_secret_basic standard is supported. See. APNZ-6231
- MKK SSL Certificate Lifetime Management Improvements
- Wildcard and Case-Sensitivity Hints Added to API Traffic Search Fields
application/x-www-form-urlencoded request body and form parameter list were not kept in sync.
APNZ-6185 : Fixed an issue where Elasticsearch ILM policy phase changes were not sent to Elasticsearch after Save & Deploy.
APNZ-6235 : Fixed an issue where bodies larger than 5 MB were written as placeholder text in downloaded API Traffic records; downloads now include full body content.
APNZ-6234 : Fixed missing Testing permissions for Project Owner and API Developer roles after upgrade, causing Quick Test and REST API Test to return HTTP 401.
APNZ-6233 : Fixed an issue where LDAP users saw an empty project list.
APNZ-6149 : Fixed an issue where deleting a global policy from the View page proceeded without a confirmation dialog.
APNZ-6226 : Fixed an issue where placeholders in Business Rule Add action Specify Value fields were not resolved at runtime.
Version 2026.04.3
Release date: May 5, 2026 CHANGES AND IMPROVEMENTS- API Traffic Log Settings — Logging of Disabled Fields on Failure/Block Moved to Connector Level
- curl Package Added to Container Images
Version 2026.04.2
Release date: April 23, 2026 NEW FEATURES- APIOps Deploy History Management
- Schema and Custom Table Name Configuration for Log Tables
- Syslog TCP Async Queue and Watchdog
- Compress/Decompress Improvements
Version 2026.04.0
Release date: April 6, 2026Major Version ReleasedFor all innovations, improvements, and changes made in this version → Review Version 2026.04.01 Detailed Release Notes
Version 2026.01.7
Release Date: March 12, 2026 NEW FEATURES- API Definition File Access Control Added ability to restrict access to API definition files (WSDL, OpenAPI) on a per-API Proxy basis. Three-level access control can be configured: public, authentication required, or completely hidden.
Version 2026.01.6
Release date: February 19, 2026 NEW FEATURES- tuneStreamingReadTimeout
tuneStreamingReadTimeout environment variable added to separately configure Undertow’s socket read timeout value for Streaming (SSE/LLM) connections; default value is 0 (unlimited), preventing long-running streaming responses from being unexpectedly disconnected.
- Import Options
- Default language Turkish (TR): Fixed issue where static navigation menu text (e.g. “How it works”) appeared in English when default language was TR, while it worked correctly when default was EN. Also fixed inconsistency between menu and page language on the product documentation and home page during page refreshes when default was TR.
- Appearance logo loss: Fixed issue where the right logo added via Portal → Appearance was removed when making different settings or changes in Portal → Settings.
- Document language inconsistency: Fixed reversed language matching when default language was Turkish (e.g. documents added to TR section appearing with English names when page was in Turkish, and Turkish names when page was in English).
Version 2026.01.5
Release date: February 5, 2026 NEW FEATURES- Unified SSL/TLS Settings Component
- Skip SSL Verification Option
- Save to Certificate Pool
- PEM Certificate Support
- Test Console SSL/TLS improvements: The legacy “Certificate” section in Test Console has been removed and merged into the mTLS settings section. TrustStore and KeyStore can now be configured separately, with KeyStore being optional.
- SSL preservation on API Proxy reparse: SSL/TLS settings used during API Proxy creation are now saved, allowing the same settings to be automatically used during reparse operations.
- Backend SSL common infrastructure: All SSL/TLS context creation operations now run through a common infrastructure, reducing code duplication and improving maintainability.
- Email connection SSL support: A “Use SSL” option and certificate selection have been added to email SMTP connection configuration. Secure connections can be established to SMTP servers using self-signed certificates.
- Per-error message customization: A “Customize” button and dialog have been added for each error row in the error messages screen. A template-based custom message builder can be enabled per error row.
- JVM TrustStore certificate synchronization: Certificates assigned to the API Manager environment are automatically added to/removed from the JVM TrustStore. These certificates are automatically loaded when the application starts, no restart required.
- Authentication database test improvement: The authentication database test operation has been renewed with environment selection and a standard result dialog.
- WSDL parser improvement: Protection against circular schema references in WSDL files has been added. Already processed URLs are tracked to prevent infinite loops.
Version 2026.01.3
Release date: February 1, 2026 NEW FEATURES- Dynamic Error Message Customization
- Template-based messages: Write free text; request/error information is included automatically via placeholders (e.g.
#{error.defaultErrorCode},#{request.uri},#{dateTime.formattedText},#{message.correlationId}). - Available information (28 fields): Error code, HTTP method, URI, IP, query parameters, date/time, API Proxy details, Correlation ID, etc.
- HTTP response settings: Status code (400, 500, 503, etc.) and Content-Type (JSON/XML/plain text) can be set.
- Usage areas: Global Policies (all APIs), API Proxy (specific API), Routing (endpoint-level), Business Rule STOP.
- Optional: Existing error messages continue to work as before.
Your API call failed. Error Code: #{error.defaultErrorCode} | Time: #{dateTime.formattedText} | Request ID: #{message.correlationId}
Example result: Your API call failed. Error Code: BUSINESS_RULE_STOP | Time: 2024-01-29 14:30:45 | Request ID: 12345-67890-abcde
See
- Context Variable Substitution
#{variable_name} format added for HTTP-calling policies and routing addresses. Placeholders are replaced with values from the custom variable map in MessageContext on each request.
- Supported fields: HTTP URL, header name and value, query parameters, form parameters, request body, routing address (backend), JSON/XML Error Response Template.
- Error template placeholders:
#{error.defaultErrorCode},#{error.defaultMessage},#{error.defaultHttpCode},#{error.customizedMessage}, etc. - Variable types:
${key}Environment variable – resolved at deploy time (existing behavior).#{key}Context variable – read from custom variable map on each request (can be set via script policy, data manipulation).- Affected policies: REST API Policy, JOSE Validation/Implementation (dynamic key), Authentication API, OIDC, routing addresses, Error Response Template.
- Behavior: Missing
#{key}values are replaced with empty string ""; no exception is thrown, a warning-level log is written to the application log. Existing Variable-based substitution logic is unchanged.
https://${baseHost}/api/v1/users/#{userId} – ${baseHost} resolved at deploy, #{userId} resolved on each request.
This feature applies only to HTTP context (MessageContextHttp).
- Business Rule policy has been improved.
- Texts on the Kubernetes Resources screen have been updated (Apinizer applications management, namespace, deployment configuration, etc.).
Version 2026.01.2
Release date: January 29, 2026 PREVIEW- Dynamic Key Usage in JOSE Policies
- Embedded: Keys are read from JWK environments defined in Apinizer (current behavior). This mode applies when Key Source Mode is empty or EMBEDDED.
- Dynamic HTTP: Keys are fetched at runtime from a remote endpoint via a configured HTTP request.
- Defined by HTTP request.
- Key is extracted from the response via Variable (body/header + JSON path or XPath).
- Key format: AUTO DETECT, PUBLIC KEY, PRIVATE KEY, CERTIFICATE, or JWK JSON.
- Optional cache: TTL, capacity, storage type, connection timeout, and cache error behavior are configurable.
- Embedded or Dynamic HTTP can be selected separately for Jose Validation & Sign and Jose Decryption & Encryption (Signing / Encryption in Implementation).
- Runtime Context Variable Support (#)
#{variableName} format are resolved dynamically from the message content in the pipeline for each request. This capability is distinct from the existing environment variable (${}) mechanism and should not be confused with it.
This feature applies only to HTTP.
- Dynamic Error Message Customization
#{error.defaultErrorCode}, #{request.uri}, #{dateTime.formattedText}, #{message.correlationId} automatically include error, request, time, API, and message details. HTTP status code and Content-Type (JSON, XML, plain text) can be set. Usage areas: Global policies, API Proxy, Routing, Business Rule STOP. See
CHANGES AND IMPROVEMENTS
- Visual display of validations when editing deployment on the Kubernetes Resources screen has been improved.
- User experience has been improved when creating action types and variable types in Business Rule policy (variable usage with conditional stop action). See
- Search capability for project and proxy has been added in Product in the API Portal application; multi-select and project/proxy/proxy group search behavior have been fixed.
Version 2026.01.1
Release date: January 23, 2026 BUG FIXES- The backward compatibility issue that occurred during the URL path handling improvements in the January 23 version 2026.01.0, specifically in the trailing slash value processing enhancements, has been resolved.
Version 2026.01.0
Release date: January 22, 2026Major Version ReleasedFor all innovations, improvements, and changes made in this version → Review Version 2026.01.0 Detailed Release Notes
Version 2025.11.1
Release date: December 12, 2025 NEW FEATURES- The API Traffic log details viewing feature can now be enabled/disabled through the “Enable API Traffic Log Details” setting in general settings.
- With this setting, the display of log record details on the Apinizer API Manager application is completely blocked. However, this does not mean that these log details are not kept; log records can still be viewed in other applications such as Kibana by authorized personnel only. Additionally, with this setting, when the “Enable Quick Test in API Traffic Log Records” and “Enable API Traffic Log Details” settings are turned off in general system settings, a warning “Log details and quick test disabled” will appear in API Traffic records.
- APNZ-5581: Security improvements have been made in the API Portal application.
- APNZ-5464: The notification email confirming access approval in the API Portal application is being sent twice.
- APNZ-5550: The image changes we make on the API Portal home page return to default values after login.
- APNZ-5554: The “how-it-works” page disappears when language is changed in the API Portal application.
- APNZ-5585: API Portal documentation does not update when API Product changes.
- APNZ-5593: No URL redirection occurs when clicking on the logo in the API Portal application.
- APNZ-5589: When certificate is selected along with the “certificate required” value in LDAP connection and the test button is pressed, the test is performed without the relevant certificate.
- APNZ-5564: We cannot access Gateway Environments through API Manager when a user with insufficient Kubernetes permissions sets up the system.
- APNZ-5578: Audit log of ApiProxyTrafficLogSettings operations is not kept.
- APNZ-5586: The “expire date” field in Credential is not working properly.
- APNZ-5559: Global policies cannot be localized within API Proxy.
- APNZ-5595: When directly calling XSD without triggering the API Proxy WSDL definition file provided by Apinizer, the addresses of references within the XSD do not appear correctly.
- APNZ-5597: When API Proxy Group is deleted, the relative path value remains in API Gateway.
Version 2025.11.0
Release date: November 21, 2025Major Version ReleasedFor all innovations, improvements, and changes made in this version → Review Version 2025.11.0 Detailed Release Notes
Version 2025.07.6
Release date: September 23, 2025 BUG FIXES- APNZ-5233: Access to definition files on Apinizer is now restricted to only GET HTTP method; this restriction has been removed for other methods, allowing access to the backend.
Version 2025.07.5
Release date: September 5, 2025 NEW FEATURES- In Reverse Proxy, clients should be able to access the definition file (Previously, the Reverse Proxy’s definition file was being returned).
- APNZ-5207: Case sensitivity issue when accessing API Proxies within API Proxy Group via API Proxy Group should be resolved.
- APNZ-5208: Class not found error occurring during WSDL parsing should be fixed.
Version 2025.07.4
Release date: September 1, 2025 CHANGES AND IMPROVEMENTS- Microsoft MSSql database JDBC library used in Apinizer API Creator module has been updated to version 13.2.0.jre8.
- APNZ-5201: Measures should be taken to prevent organizations using ApinizerBasicHeader and EnumHttpRequestMethod classes available in Script policy from being affected, as their packages have been reorganized.
- APNZ-5202: Error is being received regarding logging of Server Streaming response status code when Redirect is enabled.
Version 2025.07.3
Release date: August 26, 2025 BUG FIXES- APNZ-4947: In API Portal, the authorize button in the pop-up should not be pressable without making a selection.
- APNZ-5183: Chatbot integration in API Portal is not working.
- APNZ-5169: Requests sent with authorization in API Portal are not displayed in the API traffic tab.
- APNZ-5184: In API Manager’s API Portal management page, only 12 Products can be displayed; the rest appear in filters.
Version 2025.07.2
Release date: August 07, 2025 NEW FEATURES- MCP server feature has been added to Apinizer API Portal product, creating a bridge for AI to automatically access defined APIs.
Version 2025.07.1
Release date: August 05, 2025 BUG FIXES- APNZ-4488: In the Excel output on the API proxy page, an extra / character is being added before the relative path information.
- APNZ-4706: In the Excel output on the API proxy page, if multiple environments are defined, only the first environment’s address is reflected in the Excel output.
- APNZ-5156: When a service is duplicated in SOAP type services, the sample body is not visible in the Test Console.
- APNZ-5157: Numeric values are being returned in Scientific Notation format in Rest2Soap request transformation.
- APNZ-5158: Namespace prefix is missing or being deleted in elements marked with xsi:nil in RestToSoap.
Version 2025.07.0
Release date: July 24, 2025Major Version ReleasedFor all innovations, improvements, and changes made in this version → Review Version 2025.07.0 Detailed Release Notes
Version 2025.04.5
Release date: June 20, 2025 CHANGES AND IMPROVEMENTS- The message body truncation unit in connector log settings under Environment has been updated from KB to byte to provide more precise control.
- Issues are being experienced with processing form-data content and proper display of logs when the Server stream feature is activated.
Version 2025.04.4
Release date: May 26, 2025 NEW FEATURES PREVIEW- Development should be done to enable JMS connection running on Weblogic server with Script policy to perform consume and produce operations.
Version 2025.04.3
Release date: May 17, 2025 NEW FEATURES PREVIEW- With the Server Side Streaming feature, responses from APIs that return HTTP responses as Stream, especially like OpenAI, Claude, Gemini, can now be transmitted to the client in chunks rather than all at once. (APNZ-5040)
Version 2025.04.2
Release date: May 9, 2025 IMPORTANT NOTES ATTENTION! Within the scope of newly added parameters, theHAZELCAST_OPERATION_RESPONSEQUEUE_IDLESTRATEGY parameter has been set to “backoff” by default. This setting provides a 5-10% performance increase; however, this setting will continuously use 90-100% of the Cache Pod’s CPU limit. If you do not want this situation, change this parameter to “block”.
NEW FEATURES
- New configuration parameters that can be used within the scope of Cache performance improvements have been added.
- Within the scope of Cache performance improvements, Cache TTL settings for Circuit Breaker, Client Ban, API Proxy Response, API Proxy Group Response, and API Proxy Endpoint Response components have been improved.
- In Client Ban policy, the setting that determines whether to give an error when Identity is not found has been added to the policy configuration.
- All conditions in Condition definitions have been reviewed and improvements have been made.
- Healthcheck mechanisms prepared for Cache servers have been expanded to verify the health status of the Cache Cluster in addition to API accessibility.
- In multipart/form-data requests, API traffic has been enabled to be partially logged excluding file content.
- Support for token generation using API Key and Secret Key via Policy Group has been added.
- APNZ-5014: The “tuneCacheConnectionPoolMaxConnectionTotal” value is being ignored; this affects the cache connection pool count.
- APNZ-5024: When the specified path is not found in XPath and JsonPath queries, an empty string ("") is returned instead of null.
- APNZ-4914: The system continuously throws errors when entering the API Proxy Group page; the user interface cannot be rendered as expected.
- APNZ-4232: The Overview page in the Analytics section and the Overview page in the left menu show different content; there is inconsistency in page redirects.
- APNZ-5021: New additions made for API Based Throttling and API Based Quota fields are not properly reflected in the Management API, causing missing data problems.
- APNZ-4984: JWT and OAuth 2.0 authentication mechanisms should not be supported in WebSocket and gRPC connections.
- APNZ-5032: When username and password fields are sent empty on the login page, the request is forwarded to the backend.
- APNZ-5033: The default character encoding of the Content-Type header in multipart form requests has been fixed to UTF-8.
- APNZ-5009: In API Traffic, even if the API Proxy’s X-Forwarded-For (XFF) parameter is enabled, the XFF field returns empty.
Version 2025.04.1
Release date: April 25, 2025 NEW FEATURES- Feature for simultaneous configuration loading to Kubernetes clusters located in different locations has been added.
Version 2025.04.0
Release date: April 16, 2025Major Version ReleasedFor all innovations, improvements, and changes made in this version → Review Version 2025.04.0 Detailed Release Notes
Version 2025.01.4
Release date: March 17, 2025 NEW FEATURES- Prometheus Metric Management: Support for enabling/disabling Prometheus metric server via Environment has been added.
- Routing Control: Whether to send the header to the backend when Content-Length is 0 in Routing can now be controlled with a setting.
- Connection management between Worker-Cache has been strengthened. In addition to API Proxy Connection Pool, all HTTP connections made within Apinizer are now managed with a separate Pool.
- APNZ-4911: When a password is not provided for the environment from the Advanced section in Credential, it cannot be saved.
- APNZ-4920: When the Credential page is first created and saved, operations cannot continue without refreshing the page.
- APNZ-4924: Errors are found in allowed and disallowed IP control due to geolocation control.
- APNZ-4925: Errors received when disabling Geolocation:
- While trying to add non-existent data, it appears successful, but errors occur in workers.
- When the disable operation is performed, the 70MB selection remaining on the screen appears as if it has been deployed.
- APNZ-4956: Security header values sent when establishing a Websocket connection are not being transmitted.
Version 2025.01.2
Release date: February 20, 2025 NEW FEATURES- Options autoreconnect, autoReconnectMaxRetries, and autoReconnectRetryDelay have been added to Websocket connection management.
- In Websocket API Proxy type, when autoreconnect=false, if the backend connection closes, the client connection is also automatically closed.
- In Jose Implementation policy, the ability to add type to the JWT header value has been added.
- APNZ-4896: In Jose Implementation policy, the value appears selected even though ‘Sign By Issuer’ is not selected.
- APNZ-4897: In Websocket API Proxy type, problems occur when headers used by the client when connecting to Apinizer are used to connect to the backend.
Version 2025.01.1
Release date: February 17, 2025 NEW FEATURES- Trino Connector Support: Apinizer Trino Connector support has been added.
- When ‘Global Setting’ is active in Connection Settings, access to the relevant ‘Global Setting’ has been provided.
- When searching by method in the API Traffic screen, a tag indicating which communication protocol the method is in has been added.
- The ‘Path (of Backend API)’ value in Endpoint settings can now be left empty.
- In Script policy, entering the #EMPTY# value has been enabled for the requestBackendUrlToTargetAPI value to be empty. When this value is used, the request is redirected directly to the routing address without adding any path or query.
- The ability to add a logo to API Portal has been added.
- APNZ-4862: When downloading an OpenAPI file in API Portal, it gets caught by the WAF rule and gives an error.
- APNZ-4863: There is a namespace mismatch when Apinizer Manager is deployed to a namespace other than the Apinizer namespace.
- APNZ-4878: If the Content-Type value of form-data is not specified as octet-stream, text-type files are sent as text instead of files.
- APNZ-4879: When names are changed in Worker deployment, probes or service objects cannot be accessed even though the pod is running.
- APNZ-4869: The start time of WebSocket messages is being stored as the session start time.
- APNZ-4871: ‘PICK First’ algorithm is being used in Routing Algorithms in HTTP type API proxies.
- APNZ-4873: ‘Error Response Template’ is not automatically activated according to whether the API is SOAP or REST type.
- APNZ-4874: Text area view is scrolling behind HTML elements.
- APNZ-4876: Null error is being received in API proxies without spec during import operation.
- APNZ-4882: API Proxy cannot be found in websocket access when Apinizer root context is empty.
- APNZ-4883: PFX extension keystore and truststore cannot be loaded in Environment screens.
Version 2025.01.0
Release date: January 31, 2025Major Version ReleasedFor all innovations, improvements, and changes made in this version → Review Version 2025.01.0 Detailed Release Notes
Version 2024.09.2
Release date: November 14, 2024 IMPORTANT NOTES ATTENTION: With the version upgrade of the JDK used by Apinizer, the usage method of the JVM parameter “-XX:MaxRAMPercentage” has changed. This value, which previously allowed Integer type data usage (-XX:MaxRAMPercentage=75), now expects values as Double (-XX:MaxRAMPercentage=75.0), so old values in the yaml file need to be updated to be decimal. If the update is expected to be done by Apinizer manager, pods will need to be restarted after Apinizer manager is opened. Otherwise, this field needs to be fixed as a decimal number by manually making changes in deployments. NEW FEATURES- New methods have been added to enable CORS and XFF settings when OAuth2 or JWT token acquisition is managed with credential.
- The ability to perform certificate operations (creation, update, query, deletion) with Management API has been enabled.
- The JDK version used by Apinizer has been upgraded to the latest version of JDK 1.8.
- Apinizer images have been enabled to run as rootless in Kubernetes or OpenShift.
- The type of API added to API Portal is now visible on the portal page.
- The ability to register with multiple Apps to API Product in API Portal has been enabled.
- APNZ-4675: Audit logs cannot be written to connectors.
- APNZ-4681: The accept-encoding value in the request header disrupts response processing during routing.
- APNZ-4677: Role names in API portal should be standardized.
- APNZ-4645: Request body added from the Design tab is not reflected in the portal test console.
- APNZ-3078: Problems occur with subscription deletion when an API Product is deleted in API Portal.
- APNZ-4680: CORS headers were not visible in logs in OPTIONS response.
Version 2024.09.1
Release date: November 4, 2024 NEW FEATURES- Environment (Namespace) Metrics have been added to “Application Log Cleanup Tasks” for automatic deletion of metrics data.
- API Portal API products page has been enabled to be displayed as read-only.
- When the incoming message’s content-type value is gzip but the data is not gzipped, the message is processed as plain. (“Disable Content Compression”)
- Custom time interval option has been added to throttling and quota features.
- Cache and Worker pod count can now be set to 0.
- API Portal Home and How It Works pages have been made dynamic.
- API Portal Appearance Settings page has been made more user-friendly and understandable for the portal’s visual configurations.
- API Portal API Products page has been made more understandable for API product configurations.
- Fields in API Portal Appearance can now be set in Turkish and English languages.
- In API Portal, the ability to display the schema in JSON and YAML formats in the example section within API Product has been added.
- The ability to add tables to the API Product description section and display this table in API Portal has been added.
- Business Role and Developer Role have been added to API Portal.
- Fields that can be added to ActiveMQ connection have been enriched.
- The requirement to send specUrl when reverse proxy is used in Management API has been removed.
- APNZ-4601: Endpoints of two API proxies imported with different relative paths are getting mixed up in the test console.
- APNZ-4588: When Environment “http” port is closed and only “https” port is open, deployment to all pods cannot be done.
- APNZ-4557: When switching to the Design tab, the proxy automatically logs out
- APNZ-4460: When JOSE policy in Global is exported and imported, it is not added as a global policy.
- APNZ-4591: Since multipart/related content type is not supported by Undertow, such data should be processed as plain text rather than form data.
- APNZ-4584: Issues in Management APIs:
- “deploy-undeploy” permission in user should be mandatory only if “deploy” is selected.
- Exception messages should be presented in more detail.
- Error received when project name is not sent properly should be resolved.
- APNZ-4580: If the responseTypeByteArray context value in ProxyContext has been changed, this updated context value will be used during processing.
- APNZ-4615: Error occurs in the section where pod count is retrieved during license calculation.
- APNZ-4595: Hour-based TTL setting for Cache quota was missing; this setting has been updated to a maximum of 2 hours.
- APNZ-4581: Schema validation is performed by calling XSDs with GET message.
- APNZ-4593: Some general problems are found in the Design and Portal sections.
- APNZ-4647: In the Trace screen, Quick Test continues to be visible even though it is closed.
- APNZ-4658: When using “Database Provider” in Authentication policy, the error “An error occurred during database validation. Detailed Error Message: Configuration is empty or null!” is received.
- APNZ-4655: Null error occurs in Database Authentication provider and it cannot be tested.
- APNZ-4630: Old LDAP users have been deleted, and new users have been created with project administrator permissions; however, users still cannot view projects.
- APNZ-4641: Null error is received when creating Management API reverse proxy.
- APNZ-4665: The mark above global policies is not visible in the Error line.
- APNZ-4662: Authorization error and error related to connection remaining open are received in Database Authentication provider.
- APNZ-4624: Body data of PATCH method in test console is not going to the backend.
- APNZ-4627: Analytics authorized persons cannot access API Endpoint Creation Report and API Endpoint Creation Report pages.
Version 2024.09.0
Release date: September 9, 2025Major Version ReleasedFor all innovations, improvements, and changes made in this version → Review Version 2024.09.0 Detailed Release Notes
Version 2024.05.4
Release date: August 13, 2024 SECURITY UPDATE With the security patch made in this version, value control of client IPs where browsers are located in Apinizer Management Console has been made mandatory. Therefore, institutions connecting to the interface using “Kubernetes Ingress Controller” need to configure settings to send client IP information with the X-Forwarded-For header. NEW FEATURES- Display of ports being worked on in the Environment screen has been enabled.
- XML and JSON data formatting (pretty) features have been added to the test console.
- Creation of a super admin user with permissions to access all projects has been enabled.
- Unused/Less Used Clients Report Screen has been added to reports.
- Unused/Less Used Endpoints Report Screen has been added to reports.
- The ability to retrieve person information when performing LDAP API authentication has been enabled.
- Java and operating system versions of Apinizer Container images have been updated.
- Auto-fill of fields in the API Proxy development tab in Chrome has been prevented.
- Method search in API Proxies Development tab has been enabled to be case-insensitive.
- Hop-by-hop headers examined in routing have been enabled to be processed as case-insensitive.
- In quota and throttle policies, as well as in authentication throttle and quota screens, the option ‘System should continue to work if Cache does not respond’ has been added to be configurable as preferred.
- API Proxy Group endpoints can be tested, and only Proxy and Proxy Group options are visible in the test console.
- The ability to prevent manually added methods from being deleted during reparse operation has been enabled.
- Customization of logo and colors in the Portal interface has been enabled. Additionally, API Product list is displayed categorized and filtering feature has been added.
- A tab has been added in Portal Test Console where you can directly get JWT through the application (can be encoded for basic authentication). Additionally, the ability to display authentication type on the service in Portal has been enabled.
- New options related to connection routing have been added to API Proxy routing settings.
- The ability to dynamically add CORS settings to Token Service in API Gateway has been enabled.
- In endpoint testing in API Portal, when authentication information is selected as ‘application’, it is automatically applied.
- For proxies using proxy groups, a setting has been added as ‘can only be used through proxy groups’.
- APNZ-4485: When an account or a linked credential is disabled in Portal, all credentials not related to the account are also disabled.
- APNZ-4483: Portal menu in the navbar is not visible when logged in and does not load without refreshing the page.
- APNZ-4479: In the Project Member page, dropdown menus appear below the table.
- APNZ-4474: If the user only has Proxy Group (PG) role, a redirect to login page error occurs when clicking Proxy Group > Endpoints tab.
- APNZ-4432: HTTP error occurs in Cache and it cannot be started when there are two caches.
- APNZ-4471: Proxy Group Permission Issues and Permission Arrangements:
- API Tester role cannot see analytics data.
- Users with API Proxy Group viewing permission can see the connection on the variable page but cannot access its content.
- APNZ-4463: 3-hour time period issue is experienced in the Trace screen.
- APNZ-4453: Some API Proxies are not visible when adding API Product in API Manager.
- APNZ-4441: Error occurs when credentials are first created and first called with basic auth.
- APNZ-4412: Project cannot be deleted; rollback error is received due to API Product in the project.
- APNZ-4433: Errors encountered when a newly registered user in Portal tries to log in:
- User is added as disabled even though auto-approve is open.
- If a disabled user tries to log in, it gives an error but does not log correctly to the pod.
- User remains in approval even though auto-approve is open.
- A newly registered user should not be required to be added to an organization and activated.
- APNZ-4473: In GitOps Environment screen, if multiple environments have been opened before, a transaction error occurs when saving connector.
- APNZ-4491: In PolicyConfigurationTemplate’s routing tab, initial values of fields with missing values should be filled.
- APNZ-4457: Certificates in Apinizer should also be valid for WSS (WebSocket Secure) and STSToken.
- APNZ-4499: When downloading files through API Portal, the download operation is blocked by the browser.
- APNZ-4497: An exported authentication policy configuration has been detected as empty or invalid: ‘configuration is null or empty!’ error has been received.
- APNZ-4496: During MongoDB connection test, connection is accepted as successful even if the entered password or address is wrong.
- APNZ-4434: Regarding missing XML namespace prefix in Rest2Soap, when we export a service running in prod environment and take it to test environment, a namespace is missing in XML in the test environment.
- APNZ-4501: IDs are displayed instead of Keystore names in WS-Security From Target policy.
Version 2024.05.3
Release date: July 11, 2024 NEW FEATURES- With the removal of applying policies in API Proxy Group to API Proxies, “Policy Group” is planned to meet this need.
- The ability to dynamically enter Hop-by-Hop Headers and User-Agent values in Routing has been enabled.
- Expire time field has been added for JSON Web Key (JWK) screen, and this duration is taken as the end of the certificate’s validity period.
- JWK (JSON Web Key) expiration warning has been added to alarms.
- Validation feature according to WSDL schema has been added in XML schema validation.
- API Manager vulnerabilities found in the new version have been resolved.
- Multiple API Proxy selection in API Proxy Group has been enabled.
- Creation time and expiration time fields have been added to the JWK list.
- Indication of whether API Call and Script policy is asynchronous or synchronous has been enabled in the Trace tab.
- The ability to add JWT ID value to Policy JOSE implementation has been enabled.
- In JSON schema validation, if the error message is in JSON format, Error Response Template has been prevented from directly displaying this JSON to prevent message corruption.
- Performance improvements have been made in XPath usage.
- A gear icon has been added next to endpoints with policies in Apinizer, and “Policy Exist” text is displayed when hovering over the gear.
- The ability to set the charset of requests coming to Apinizer GW as default has been enabled.
- The ability to update values under Secret Manager has been enabled.
- In global policies, XSLT value has been prevented from appearing in the XML transformation policy list.
- Display and filtering of remaining time in Apinizer Certificate screen has been enabled.
- Global policies menu has been sorted alphabetically.
- API type has been added to Product in API Portal.
- In XML validation policy, when adding schemas, if multiple can be added, the ability to enter system id value has been enabled to resolve cross-referencing situations (include/import).
- APNZ-4395: If the policy is global, it does not update its references in the API Proxy method when saved, and does not give a warning that it needs to be fixed.
- APNZ-4384: In some screens, when a list item is deleted and logged out and logged back in, the delete confirmation window remains open.
- APNZ-4409: When we update a global policy, the list of used API Proxies is not included in the error message and does not go to “redeploy required” status.
- APNZ-4405: Elasticsearch disk fullness alarm is working incorrectly.
- APNZ-4414: JSON Schema Validation is displayed as XML Schema Validation in the policy type section.
- APNZ-4419: When the user selects a value under conditions but does not enter the related variable, it does not allow saving due to validation error.
- APNZ-4420: When the test console is opened for the first time through Tools, two CodeMirrors appear.
- APNZ-4445: In XML validation policy, when “validate according to WSDL definition file” is checked, if there are multiple schemas, it does not load all schema files.
- APNZ-4447: In SOAP - REST Protocol transformation, elements without namespace prefix value should be prevented from getting a prefix due to name similarity.
- APNZ-4448: When trying to read data from an XML file with XPath, if the XML file is corrupted, an empty value should be returned instead of returning the entire value.
Version 2024.05.0
Release date: June 7, 2025Major Version ReleasedFor all innovations, improvements, and changes made in this version → Review Version 2024.05.0 Detailed Release Notes
Version 2024.01.6
Release date: May 31, 2024 NEW FEATURES- The ability to perform team-based authorization from LDAP in Manager console has been enabled.
Version 2024.01.3
Release date: March 29, 2024 NEW FEATURES- In Jose Implementation policy, when the “Target to be Signed/Encrypted” field is selected as “Message Body”, the claim name value can be left empty, and in this case, the message body is used as payload as is.
- When Credential is first initialized, creation and caching of secret information has been enabled.
- APNZ-1403: When variable is selected as the second value in Condition, the value cannot be found correctly.
Version 2024.01.2
Release date: March 22, 2024 IMPORTANT NOTES If Apinizer update is done from yaml file, the line given as the old version in cache-deployment.yaml should be like the new version. Otherwise, Cache will not start. Old version:- Test Console Audit Records Screen: Test Console Audit Records screen has been created where tests made from Test Console are displayed with username.
- Display of Total Method Count in Proxies on Overview Screen: Information about the total method count in API Proxies has been added to the Overview screen.
- New Report: API Endpoint Creation Report: API Endpoint Creation report has been added to visualize API Endpoints grouped by time.
- New Charts on Overview Screen: Charts showing the distribution and count of API Proxy, connection, and HTTP Method types have been added to the Overview screen.
- Extracting Claim Value from JWT with Business Rule: Two new fields have been added to Business Rule to extract claim value from JWT: Extract JWT Header Claim and Extract JWT Body Claim.
- Running Policy Based on Environment: Environment name and ID information has been added to Context Value found in Variables and Script policy.
- ZoneID Value in Context Value: The ability to enter ZoneID value for values containing date in Context Value has been enabled.
- New Fields in Context Value in Script Policy and Variables: New fields have been added to Context Value found in Script policy and Variables.
- Accessing Secret Values Belonging to Credential with Script Policy: The ability to access secret values belonging to credential with Script policy has been enabled.
- Bulk activation/deactivation of policies within API Proxy methods has been added.
- The ability to enable/disable Quick Test in System Settings has been added.
- Backend API Version is automatically filled when parsed from Swagger and OpenAPI.
- Option to add JSON as string or as JSON has been added to Jose Implementation policy.
- Description entered for Environment is now visible on the list screen.
- Display of Context Value values in popup has been improved.
- The ability to get status code from response in Context variable has been added.
- The ability to select client identity with variable in Jose Validation policy has been added.
- In JSON Schema Validation policy, JSON path can be empty, and when multiple JSON schemas are entered, all schemas are validated separately for the target path.
- XPath can be empty in XML Schema Validation.
- For Extract Body and Header values among data type values selected when adding action, the target variable header has been changed to “Target Variable Where Extracted Data Will Be Added”.
- APNZ-4096: There are errors in screens that a user with only Analyzer role can access and perform operations in the development menu.
- APNZ-4149: Those who cannot log in to the interface are not recorded in audit.
- APNZ-4156: Auth information is not coming for services created with API Creator in Portal.
- APNZ-4177: Pod list is not coming in Kubernetes resources.
- APNZ-4194: When an API Proxy created with DB2API is added as a new API Proxy from another project, request bodies come empty.
- APNZ-4195: Error is given when testing LDAP.
Version 2024.01.1
Release date: March 14, 2024 NEW FEATURES- New Screen: Application Log Cleanup Tasks: Automatic cleanup of logged data in Apinizer at desired time intervals has been enabled.
- Creating Alarms for Logs: The ability to create alarms when logs kept in Apinizer reach a certain size has been enabled.
- Trace Search Filter: Search filter according to trace mode has been added to API Proxy advanced searches.
- Globalize Feature: The ability to move items listed on project pages (connection information, monitor settings, report settings, credentials, certificates) to the administrator side has been added, so that their management can be done by the administrator and their usage can be done commonly across all projects.
- NTLM Settings: NTLM feature has been added to the routing tab of API Proxy to enable authorization when backend APIs require NTLM.
- Setting Log Levels by Class/Package: Log levels can now be set by class/package with the Log Levels tab added to the Application Logs page.
- URL encode and URL decode Operations in Business Rule Policy: URL encode and URL decode features have been added to Business Rule policy.
- URL encode and URL decode Operations on Data Operations Page: URL encode and URL decode features have been added to the Data Operations page in the test tool.
- “is exist” and “is not exist” conditions have been added to policies.
- Information about which project is currently in has been added to Apinizer’s left menu.
- Roles that can access Test Console in Test Tools have been arranged.
- Configuration of credentials and analytics in API Portal has been enabled.
- Link has been added to Breadcrumbs.
- Node affinity has been added to Manager, Integration, and Portal on Apinizer Kubernetes servers.
- Missing table names and missing entity names to be excluded when taking backup have been added to Audit and Backup page.
- Information about which API Proxies connectors work for has been added to application logs.
- Performance improvement has been made in saving data to Apinizer database with failover.
- Menu changes have been made.
- New error type has been added to Routing Connection.
- Sample SOAP XML Message Production Limits settings have been added to General Settings to limit the size of sample SOAP XML messages produced with WSDL.
- Option to fix SOAP Action and Namespace information has been added to the routing tab valid for SOAP services. Thus, this operation that was previously done automatically can now be done optionally.
- The ability to change the level of API Proxy Application Logs only for the specified API Proxy has been enabled.
- APNZ-4063: Schedule requirement in Backup screen should be removed.
- APNZ-4065: Methods with the same endpoint are coming grouped in analytics charts.
- APNZ-4069: There are problems with pagination.
- APNZ-4070: Time display of data in charts in the Analytics tab should be local time.
- APNZ-4071: Webhook should be removed from actions.
- APNZ-4089: If global STS Authentication and Backend API Authentication policies are defined to Proxy, the password is encrypted again.
- APNZ-4090: When a Proxy’s log level is set to debug, it writes too many logs and search cannot be performed because API Proxy and Client ID information is not available.
- APNZ-4100: When application logs are set to debug, it also writes MongoDB insert log.
- APNZ-4102: In token acquisition with scope, scope content returns empty.
- APNZ-4111: When an error is received during connection definition creation for saving logs, it does not fall back to failover.
- APNZ-4113: If an error occurs during Connector creation, it does not go to failover.
- APNZ-4115: API Proxy information in application logs is missing for some loggers.
- APNZ-4121: There are headers added during connection in routing that are not logged.
- APNZ-4125: Total value shows as 0 in IP Traffic & Time Metrics reports.
- APNZ-4127: In caching, if the same key goes to a different endpoint with the same proxy or in a proxy group, it returns the previous result.
- APNZ-4133: Previous records are not displayed and new records are not reflected on the screen in Identity Providers.
- APNZ-4142: Format xml option in Data Operations makes the result a single line.
Version 2024.01.0
Release date: January 2, 2024Major Version ReleasedFor all innovations, improvements, and changes made in this version → Review Version 2024.01.0 Detailed Release Notes