Layer7 API Security

PI Planning for PI41 is now complete and development has kicked off. Below you will find the list of items that are included in this PI and a summary of the releases completed in the previous PI. As always, we invite you to provide feedback. We would love feedback on both the current and future PI items to help us prioritize the items that will have the most benefit for our customers.

Recent Releases

The following product versions were released during PI40:

• API Gateway 11.0 CR4 - Release Notes 

• API Gateway 11.1.2 - Release Notes

• OTK 4.6.4 - Release Notes

Release and EOS Calendar

The following image provides a timeline view of past and planned releases (future releases are prefixed with “+”). For planned releases, the timeline, release name/version, and release content are subject to change. End of Service (EOS) dates are shown in gray on the bottom half of the image.

Planned Releases for PI41

The following product versions are planned to be released during the PI. The marquee features for each release are included. For planned releases, the timeline, release name/version, and release content are subject to change.

• API Portal 5.3.3 (June 2025)

• Rate Limits & Quotas for API per Application

• Migrate API Plans to Rate Limits & Quotas for API per Application

• [Preview] Layer7 Operator Support

• Custom Roles Framework (internal only for this release and planned to be exposed in the next release)

PI41 Key Capabilities

The sections below provide a listing of the key capabilities being worked on across the Layer7 family of products. Note that some capabilities will span multiple PIs. 

API Gateway:

• Common Criteria evaluation for GW 11.1.2 and Debian 12+ for PI41

• Core stack updates (new or continued from PI40):

• Tomcat from 9.0 to 10.1 [Part 2]

• Spring Framework from 5.x to 6.x [Part 2]

• Gateway develop branch JDK from 17 to 21 [Part 2]

• HSM for Gateway 11.2.0

• Debian from 12 to 13 [Part 1]

• MySQL from 8.0 to 8.4 (in appliance)

• In-place upgrade to 11.2 [Part 1]

• Validate AWS Solution Kit using SDK v1.x works with 11.1.3 and 11.2

• [GemFire][Preview] Distributed throughput quotas using embedded/external Gemfire [Part 2]

• [GemFire][Preview] Distributed key value storage using embedded/external Gemfire

• [GemFire][Preview] Distributed circuit breakers using embedded/external Gemfire

• [GemFire][Preview] Distributed rate limits using embedded/external Gemfire

• Support for AWS Elasticache for ValKey as a Redis alternative

• Distroless Container Gateway

• [Preview] arm64 container gateway image

• XAdES signature support

• Support for Siteminder 12.9

• [Container gateway optimizations] Enhanced health checks

• Mounted secret formatting enhancements [Part 1]

• [Experimental] Timeout block assertion

OAuth Toolkit:

• Provide Refresh Token based on offline_access scope

• [Preview] Layer7 Operator support for OTK - Dual GW Ephemeral

• Support mTLS with Load Balancers with client certificates provided in header

• Core Stack Updates:

• GW11.2 compatibility for supported OTK versions

API Portal:

• Bulk API Editing

• Custom Roles: Ability to create and manage roles in Portal

• API Products - Product Manager Role

• Removal of Deprecated PAPI Endpoints

• API List Page Filter for Compliance

• Improved Filter Management

• API Catalog Access for non-authenticated users in the UI

• One step API removal

• Core stack updates:

• Analytics update for Seaweed FS

• Spring Update

• PSSG and DSSG Certificate Removal

• Remove all use of JSON Path v1 gateway assertion

• Portal Compatibility for GW11.2

Mobile API Gateway/SDK:

• iOS 26/Android 16 latest beta compatibility check

• [Spike] Face Recognition Support (iOS/Android)

• Core Stack Updates:

• Upgrade security-crypto lib to 1.1.0

• GW11.2 compatibility for supported MAG versions

Note that some larger capabilities may span multiple PIs and, as always, plans are subject to change based on a number of different factors.

Candidates for PI42 and Beyond

While the capabilities to be included in the next PI are not yet set, please see below for a list of candidates being considered. Of course, not all of these will fit and we will select a subset of these based on your feedback. We'd love to know if there is a capability in the list you are eagerly awaiting and/or plan to use. We also would love to know if there is something missing from the list that is important to you. Please comment in the comments section below with your feedback.

API Gateway:

• Gateway 11.1.3 Release

• Gateway 11.2 Release

• Debian from 12 to 13 [Part 2]

• In-place upgrade to 11.2 [Part 2]

• Mounted secret formatting enhancements [Part 2]

• IronBank Go Live

• New Monthly Software Patches

• Automatic Certificate Management Environment (ACME)

• DCT enhancements

• Graphman client enhancements

• [Preview] arm64 Compatible Siteminder integration

• [Preview] JSON Patch Assertion

• [Preview] Timeout block assertion

• Optionally allow unsigned server modules

• SNI support for HTTPS in Gateway

• Support HTTP/2 streaming

• Support for gRPC

OAuth Toolkit:

• Enable additional customization hooks for Grant Management

• OTK Upgrade Improvements

API Portal:

• Bulk API Editing: Tags, Management Permissions, & Custom Fields

• API Revision History Management

• API Catalog for non-managed APIs

• Removal of Processed Request Objects

• Allow bulk API editing to force policy template compliance automatically

• Bulk Policy Template Deployments

• API Products - Workflow for Tier Change Requests