What's new in the latest release (version 10.0.10.0)

Product files and release notes

Upgrading from API Connect 10.0.8.x and 10.0.9.0

API Connect 10.0.10.0 supports upgrade only from 10.0.9.0, 10.0.8.2-ifix1, 10.0.8.1, and 10.0.8.0.

What's new for Developers

Accelerate your API Journey with GenAI-powered API Agent

Built on agentic framework, API Agent can plan, reason, understand, and run tasks from natural language request. Available as a Visual Studio Code plug-in, the API Agent is trained on API Connect's platform APIs to discover, create, govern and test APIs easily. For more information, see API Agent.

AI Gateway functionality on DataPower® API Gateway

Previously, there was a restriction that prevented you from enabling AI Gateway if your own gateway-extension was deployed on the gateway, and vice-versa. This limitation has now been removed.

With this change, you can now deploy your own gateway-extension and enable AI Gateway on the same gateway instance without any restrictions

For more information, see Using the AI Gateway to support APIs for AI applications.

Out-of-the-Box (OOTB) gateway policy deployment

For this release, when a DataPower API Gateway is created (registered) in IBM API Connect, the system will automatically deploy out-of-the-box (OOTB) gateway policies.

The following OOTB policy is deployed upon gateway registration: Token Mediation policy.

When upgrading to IBM API Connect 10.0.10.0, all existing DataPower API Gateways will automatically receive the new OOTB policy(ies) after the API Management subsystem upgrade.

AI Gateway feature adds support for Azure OpenAI

API Connect now provides a policy that enables your API to send requests to Azure OpenAI, and supports the following operations:

• POST /chat/completions
• POST /embeddings
• GET /models/[model-id]
• GET models

For more information, see Using the AI Gateway to support Azure OpenAI APIs.

AI Gateway feature adds support for Gemini

API Connect now provides a policy that enables your API to send requests to Gemini, and supports the following operations:

• POST models/[model]:generateContent
• POST models/[model]:countTokens
• POST models/[model]:embedContent
• POST models/[model]:batchEmbedContents
• GET models/[model]
• GET models

For more information, see Using the AI Gateway to support Gemini APIs.

Enhanced API path search with wildcard support

You can now perform flexible searches across the full path of APIs published to a catalog using the new full_path query parameter in the apis:list and apis:list-all commands. For more information, see API development and management commands.

Support for Product and API sync for API Connect Config Sync

You can now enable or disable the Product and API sync, as per your requirement. For more information, see Using Config Sync to replicate catalog data.

Support for Noname collector configuration for API discovery

You can now use the Noname collector to discover APIs from the Noname environment. For more information, see Configuring Noname collector for API discovery.

Technology previewGovernance enforcement

Use the new governance enforcement feature in IBM API Connect to add the APIs and Products rulesets for enforced validation before publishing APIs and Products to catalogs. For more information, see Using governance enforcement for validation.

Optional environment setting to disable product-level feedback

A new environment-level setting has been introduced for customers who prefer not to receive product-level feedback. When this feature is disabled, visibility into the product state beyond the API Manager is no longer available. This allows greater control over the information displayed within the environment. For more information, see Disabling the status feedback on products page.

What's new for API product managers

Summary API Event Record Field Reference Now Available

You can now access a comprehensive reference for the fields stored in a Summary API event record. For more information, see Summary API Event Record Field Reference.

Support added for email as a destination for alert notifications

Analytics now supports email notifications as a built-in destination type for alert rules. This capability uses the centralized send email API from API Connect, which is also used by other subsystems. This approach ensures consistent behavior and removes the need for custom SMTP configuration. Users can select Email as a destination and must provide values for the subject, recipient (To), and email body fields. The CC and BCC fields are optional.

Analytics handles the rest behind the scenes via a secured internal webhook. For more information, see Creating a notification task.

Analytics retention enforcement improvement

A serviceability enhancement was introduced to enforce correct retention and rollover policies on the api-event, summary, and all-content-count OpenSearch indices. For more information, see Retention and rollover.

Full data support

You can now use the Full data as CSV and Full data as JSON options to export all raw event data directly from the Discover table. To access these options, click the Actions menu at the upper-right side of the Discover table and select the required option. This enables exporting complete datasets in JSON or CSV formats to provide greater flexibility for data analysis and reporting. Previously, the export options were limited to the displayed fields. For more information, see Accessing analytics in the API Manager UI.

Audit Logging updates

You can now configure API Connect to send audit events to a registered Analytics service. For more information see Configuring audit logging to monitor user operations and Configuring the audit settings.

Selective offload for API events or audit events

You can now offload API events or audit events selectively by updating the offload filters. If API Connect is configured to send audit events to a registered analytics service, then the default offload includes both API events and audit events. Filtering helps to avoid offloading unintended events. For more information, see Configuring offload on Kubernetes and Red Hat OpenShift.

Automatic recovery of rollover failure

An automated forced rollover is now attempted if a rollover is in the failed state for more than 36 hours. If this attempt is unsuccessful, the following error message is displayed in the analytics director pod logs:

Error triggering forced rollover

For more information, see Retention and rollover.

Enhanced engagement permissions

The following permission are now added to enable access to Engagement-related features in the new user interface:

• engagement:view: Allows users to view engagement-related content.
• engagement:manage: Enables users to manage engagement content.

For more information, see Using Engagement.

New Engagement destination options

Engagement now supports the following destination options:

• PagerDuty
• Slack

For more information, see Create a destination.

New Engagement datasource

Engagement now supports audit event based engagement rules. You can now configure engagement rules to respond to audit events. For more information, see Audit events.

What's new for Developer Portal site administrators

Drupal 11 upgrade

The Drupal version has been upgraded from v10 to v11. All the existing Developer Portal sites are upgraded to Drupal 11. The core modules and themes are automatically made compatible as part of the upgrade. For more information, see Guidelines on upgrading your Developer Portal from Drupal 10 to Drupal 11.

Alphabetical sorting to enhance the consumer organization selection

The drop-down menu located at the top right of the portal to select the consumer organizations now sorts the organizations in alphabetical order, making it easier to find and select an organization quickly.

Safe Links for enhanced security

The Safe Links feature in Microsoft is now used to enhance the safety of the unlock links sent via emails. When a user receives an email containing an unlock link, the Safe Links feature modifies the URL to route it through Microsoft's security checks. Before the user clicks the link, Safe Links performs a background request to verify its safety.