Skip to main content

Version 1.18.0

Release Date: August 20, 2026 Release Type: Stable

Backend Server​

New Features​

  • ESR facade — browse MIP's XI interfaces from proxy-generation tools: MIP now exposes an ESR-compatible facade, so backend proxy-generation tools (SPROXY) can connect to MIP as if it were an ESR: browse the interface object tree with its real folder hierarchy, run object queries, and download two-part WSDLs ready for proxy generation. Conformance polish is included — object version tracking, correlation columns, a real-folder model and OR query conditions — so the proxy browser renders MIP's XI interfaces cleanly.
  • AS2 Start connector — configurable listen port/path and optional inbound authentication: The AS2 Start connector now resolves its listen port and path through the central endpoint configuration instead of fixed defaults, aligning it with the other inbound connectors. A new as2AuthenticationOptional option lets you accept AS2 messages from partners that do not send HTTP authentication, while keeping authentication enforced everywhere else.
  • Groundwork for richer logging and metrics: Internal preparation for upcoming observability improvements — a catalogued message-code system and a standardized flow-metrics vocabulary — was added behind disabled feature gates. No behavior changes in this release.

Bug Fixes​

  • Flow simulation is now reliable under concurrent runs: The simulation engine was hardened against a series of concurrency defects: runs could hang waiting on inputs that never arrived, results could be frozen before the flow actually finished, and payload previews could show internal object identifiers or bodies shared between runs. Simulations now wait on the run's real terminal state and snapshot payloads safely, so mock responses and step outputs are correct and stable.
  • OFTP2 delivery receipts (EERP) no longer lost when the partner offers its own files: After MIP delivered a file, some partners would first offer their own queued files before releasing the delivery receipt; MIP had no answer for that offer, so the session stalled and the transfer looked like a silent disconnect even though the file had arrived. MIP now declines such offers with a retry-later response (SFNA reason 14), keeping the partner's files queued and letting the EERP receipt come through so the transfer completes.
  • System log retention is now configurable: Server system logs were previously kept for only about one day and then lost. Log retention, location and rolling behavior are now configurable via settings, and the log line format was made cleanly parsable.
  • All Steps logging now records attachments on every node: With logging set to All Steps (Full Log), multipart attachments received at the Start connector were only visible on the entry log, not on the per-node logs of later steps such as HTTP calls or Set Context. Every step logged under All Steps now saves the message's attachments as well, without affecting flows using payload-only logging.
  • Deployed Integrations show the same endpoint URLs as before the endpoint-catalog upgrade: Moving connector addresses onto the central endpoint catalog unintentionally changed the addresses displayed on the Deployed Integrations page for installations that configure a global HTTP endpoint variable. The displayed URLs now fall back to that legacy setting again and render byte-identical to previous releases; actual traffic routing was and remains unaffected.
  • OFTP2 listener address resolved from the endpoint configuration: The OFTP2 connector now derives its advertised listener origin from the central endpoint catalog instead of a separately maintained value, so the address shown and used for OFTP2 always matches the configured endpoints.

Frontend Server​

New Features​

  • View system logs directly in Monitoring: System logs can now be viewed in the Monitoring UI without downloading log files, with filtering and sorting like Message Monitoring. Retained logs older than one day (rotated files) are now readable with reliable cursor-based paging, and the new system log endpoints are restricted to administrators.
  • Optional partner authentication for AS2 receive connectors: AS2 start connectors gain an "authentication optional" setting that lets you accept messages without the AS2-To/AS2-From partner-ID check when needed. Inbound AS2 connector addresses shown in the UI are now resolved consistently through the endpoint catalog.
  • ESR folder structure preserved on PO import: When importing ESR objects from a PO system, the original folder hierarchy and each object's provenance are now captured and stored. Imported interfaces keep track of where they came from, making large ESR imports easier to navigate.
  • Configurable platform encryption key: Sensitive data encryption now uses the shared ENCRYPTION_KEY environment setting, unified across platform services, instead of a built-in key. Existing installations remain compatible: previously encrypted data still decrypts when no custom key is configured.
  • Internal groundwork for observability: Internal scaffolding for standardized log/message codes and service-to-service communication was added, including support for rendering response timestamps in the caller's time zone via a Time-Zone request header. No workflow changes are required.

Bug Fixes​

  • Removing OAuth2 from an API now fully disables it on the gateway: In API Management, unsyncing OAuth2 from a published API now also removes the OIDC plugin from the gateway route. Previously the route could keep enforcing OAuth2 authentication even after protection was removed.
  • Deployed Integrations show the original endpoint addresses again: The Deployed Integrations page once again displays connector addresses based on the configured public endpoint (BACKEND_HTTP_ENDPOINT), exactly as before the endpoint catalog migration. Asynchronous callback URLs handed to remote systems are now always built from the functional base URL, so they never advertise an unreachable address.
  • Flow simulation returns proper mock responses: The simulation run proxy now explicitly requests JSON from the backend, so simulation results and mock responses render correctly instead of coming back in an unexpected format.

Frontend Web​

New Features​

  • System log browsing with retention settings: The System Logs page now lets you browse the full retained log window — including entries older than one day — with log-level and multi-select service filters and reliable cursor-based paging. A new admin-only System Log Settings page presents each service's retention and log-level settings in a clear table layout.
  • Safer service-user unsync with consumer cleanup: On the Service Users page, Unsync is now only enabled when an API-management binding actually exists, and after unsyncing you are prompted to optionally delete the corresponding API-management consumer. Sync status also refreshes immediately after a successful sync without reopening the dialog.
  • AS2 receive without authentication: The AS2 start connector gains a "No Authentication" option, so inbound AS2 endpoints can be configured to accept messages from partners without requiring authentication credentials.
  • Internal groundwork for improved observability: Behind-the-scenes scaffolding for standardized API responses, error references, and request tracing was added in this release. It has no user-facing effect yet and prepares upcoming observability features.

Bug Fixes​

  • OAuth2 service-user credential sync now works: Syncing an OAuth2 service-user credential to API management always failed with a validation error because the request carried the wrong field name. The sync now sends the expected field and completes successfully.
  • Flow simulation panel input and mock validation: The simulation panel now flags duplicate header/property names instead of silently dropping rows, validates mock definitions (duplicate names, HTTP status range, malformed JSON bodies), and enforces one selected mock per node. The mock node dropdown only offers connector types that can actually be intercepted, and deleting the partial-flow stop node cleanly falls back to running the entire flow.
  • Re-uploaded WSDLs picked up in SOAP connector: After re-uploading a WSDL resource, the SOAP connector configuration now picks up the new bindings and operations immediately, without having to de-select and re-select the resource.
  • XSLT editor validation and scrolling: The XSLT editor now validates parameter and property names before saving, and the editor panels scroll correctly, including jumping to the line of a reported error.
  • XSD designer input validation and label fixes: The XSD designer validates element, schema, and WSDL method inputs to prevent invalid definitions from being saved, and the Copy/Duplicate actions now show correct labels.
  • JSON designer validation and OpenAPI output fixes: The JSON designer validates fields, paths, and operations, and generated OpenAPI documents now resolve $ref references correctly and produce valid YAML output.
  • Dashboard activity details scoped to the right connector: Activity details on the dashboard no longer list configuration fields belonging to a different connector type as if they were settings of the changed node.

Health Check​

New Features​

  • Platform information stays current automatically: Health Check now re-collects the platform's environment and version information every hour and re-syncs it to the license server, instead of only once at startup. Version details that were unavailable while other services were still booting (previously shown as "N/A" until a restart) now fill in on their own, and the license server no longer keeps a stale record.
  • Internal groundwork for standardized service APIs: Internal-only scaffolding was added for a future standardized API response format, per-request time-zone handling, and a complete service endpoint catalog. It is inactive by default and has no visible effect in this release.

Bug Fixes​

  • Health Check starts reliably in production with default settings: A default context-path value in the production configuration caused the Health Check service to fail at startup when no custom context path was configured. The default is corrected and root-path handling in internal URL building is fixed, so the service boots cleanly out of the box.
  • Deployed integrations show their configured public endpoint again: The legacy BACKEND_HTTP_ENDPOINT setting is honored again as the inherited display URL, so installations that rely on it see their configured public endpoint address for deployed integrations instead of an empty value.

1.18.0 is a stable release. Previous: 1.17.0