What changed since your version.

Flexway 1.6.3 (0)

No new feature in the catalogue in this release.

Flexway 1.6.2 (0)

No new feature in the catalogue in this release.

Flexway 1.6.1 (7)

• Native Kafka proxy: Kafka clients on the gateway, virtual clusters and topics per tenant
• Message field encryption at the native proxy
• Binary payloads under a schema: Protobuf and Avro (schemaFormat), CBOR under a JSON schema, opt-in validation, transcoding to JSON for SSE and webhooks; a prerequisite of the native Kafka proxy and of the MQTT listener
• Read-only schema registry, Confluent API (Confluent, Apicurio, Karapace, Redpanda): magic-byte wire format, cache by identifier, schema bound to the declared subject required, never a write
• NATS Core and JetStream on the asynchronous plane, as a client of the broker: acknowledged JetStream publication (PubAck) from HTTP or an MCP tool, refused towards NATS Core; consumption over SSE (fan-out), WebSocket and webhook (durable JetStream consumers); subject bound to the tenant, * and > wildcards included in the channel after the bound segments; gateway identity by credentials file, nkey, token or password, TLS and mTLS
• AMQP 1.0 on the asynchronous plane, as a client of the broker (RabbitMQ 4, Azure Service Bus, ActiveMQ Artemis, Solace): accepted disposition before 202, message settled after the client's acknowledgement or the webhook's 2xx, CloudEvents AMQP binding, SASL PLAIN, ANONYMOUS and EXTERNAL, TLS and mTLS
• Console: Kafka clients and clusters, connections per tenant, refusals by cause, encryption and built-in alert rules

Flexway 1.6 (0)

No new feature in the catalogue in this release.

Flexway 1.5 (11)

• AsyncAPI as the source of the asynchronous plane
• Kafka publishing under contract, CloudEvents envelope
• Mediation of the synchronous to asynchronous boundary
• AMQP(S) and MQTT
• Signed, replayable outgoing webhooks
• Translation to the JSON-RPC error (MCP) and to the CloudEvents attribute (asynchronous)
• OpenAI-compatible multimodal content, vision backend
• Embeddings, with budget and audit
• Backends by kind (OpenAI, relay, gRPC), local or upstream metering
• gRPC method of a specialised model, metered per call
• Projection to gRPC and to a broker message

Flexway 1.4 (5)

• Health per gateway replica: status of each replica and freshness of its last report
• Console on phone and tablet - shell: navigation from 360 to 1,024 px (bottom bar, rail, drawer), tenant always visible, palette opened by touch
• Console on phone and tablet - lists and tables by touch: no horizontal scrolling of a list, priority columns, targets of at least 44 px
• Console on phone and tablet - charts, markers, heat maps and topology by touch: nothing on hover alone
• Console on phone and tablet - panels, dialogs and forms (silences, proposals, accounts) by touch

Flexway 1.3 (14)

• Detail of an operation: throughput, errors by code, latencies, split by tenant, comparison with the previous period
• Built-in alerts: thresholds per upstream or operation, webhook notification
• Traces seen by the gateway, in the console: a sample of slow or failing requests, with the duration of each step (routing, identity, policies, upstream)
• Log of the gateway's recent errors, filterable by operation, upstream and tenant
• Built-in metrics source: the console works without an external metrics backend, bounded and configurable history; the Prometheus API remains an option
• Reload markers: one mark per reload applied or refused on every chart of the console, version and result on hover, touch and focus
• Service-level objectives per operation: remaining error budget, burn rate over several windows, built-in alert rule
• Strongest changes against the previous period (throughput, errors, p95), on Traffic and the Overview
• Alert rule from a chart: generated YAML to copy into the values, no write
• Compare two freely chosen windows, overlaid on the same charts (Traffic, Operation, Upstreams)
• New error detected: a problem code never seen on an operation for 7 days, flagged, with a built-in rule
• Hour-by-weekday heat map (throughput, errors) on Traffic
• Periodic summary (daily, weekly) through the alerts' signed webhooks
• Shareable links: the URL keeps the screen, window, tenant and filters; scope reread by the server

Flexway 1.2.1 (0)

No new feature in the catalogue in this release.

Flexway 1.2 (8)

• Declarative proposal: a diff, never a mutation
• Pull request opened from the proposal
• Screen to simulate a policy chain
• Audit log of the proposals
• Agents dashboard: tools called, cost, scopes
• Catalogue conformance: operations without an owner, deprecated without a date
• Account activity and sign-in history, bounded, in the console
• OIDC identities seen, read-only, minimised

Flexway 1.1 (10)

• Upstream Cache-Control, ETag and Vary honoured
• Public response cache, per operation
• Continuous cross-tenant isolation test, a blocking prerequisite
• Authenticated cache, isolated per tenant and subject
• Import of an existing gateway's configuration, with a coverage report
• Version served visible: flexway version, build in /config, service.version, and in the console (sign-in and interface)
• External call: timeout budget and declared failure behaviour
• Body field projection and filtering, schema conformance checked
• Masking of sensitive fields in responses
• Upstream status code mapped to a semantic code

Flexway 1.0 (0)

No new feature in the catalogue in this release.

Flexway 0.3 (0)

No new feature in the catalogue in this release.

Flexway 0.2 (4)

• Translation to google.rpc.Status on the gRPC surface
• REST to gRPC translation through Protobuf descriptors
• gRPC and gRPC-Web end to end
• Global in-flight cap: an overloaded replica sheds instead of being killed

Flexway 0.1 (86)

• MCP surface: the contract's operations offered as tools
• OAuth 2.1 resource server, RFC 9728 metadata
• Issuer validation and resource indicators (RFC 8707)
• RFC 8693 token exchange: human subject, agent actor
• Delegation bounded in time and depth, cascading revocation
• Client ID Metadata Documents; the case of unattended agents
• MCP federation: existing MCP servers under the same authorisation, quota and audit
• An OpenAPI 3.1 contract loaded; what is served is derived from it
• Start refused when a declared operation has no upstream
• x-flexway-* extensions read in the contract, never anywhere else
• flexway.yaml: hosts, upstreams, contract references - no operation
• flexway validate offline, output usable in CI
• Live reload through an immutable snapshot, no request lost
• An invalid configuration never replaces the running one
• Secret references resolved at run time, never a plain value
• Several contracts and hosts, conflicts detected at load time
• API catalogue derived from the contracts, with lifecycle
• Traffic per operation, upstream and tenant
• Tenant isolation in the console: 403, never an empty list
• Upstream health: circuit breakers, ejections, timeouts
• Effective policy chain per route
• Usage: requests, tokens, euros, per tenant
• Opening an end-to-end trace
• Local accounts and first admin, without an identity provider: generated initial password, forced change, TOTP for admins, shared lock
• Management of local accounts in the console: invitation, role and tenant, reset, MFA, deactivation
• Optional OIDC coexisting with local accounts: accounts / breakglass / off modes, tenant taken from a claim or from the role
• RFC 9457 on every product route; stable, redirectable type
• Closed catalogue of codes in lowercase_snake_case
• RFC 9110 semantics: 400/422, 401/403, 404/405, 429/503, 502/504
• Normative refusal headers: WWW-Authenticate, Allow, Retry-After, RateLimit-*
• request_id and trace_id in the response; the detail stays in the log
• Translation to the OpenAI error envelope on /v1/*
• OpenAI-compatible /v1/* surface
• Policy routing across providers and models
• Budget and rate per tenant
• Sensitive requests pinned, sovereignty and fallback by policy
• Metadata audit, never a prompt
• Inference streaming relayed without holding
• Structured JSON logs, no personal data
• Metrics per operation, upstream and tenant, bounded cardinality
• W3C traces propagated end to end
• /healthz, /readyz, /metrics, /config on a separate port
• Dashboards and alerts delivered with the product
• Adaptive trace sampling
• /simulate: route, effective chain and verdict without calling the upstream
• Single binary, distroless non-root image, multi-architecture
• Start with no mandatory dependency
• Helm chart and reference manifests
• SBOM, signature and keyless attestation on the digest
• Phase engine: request, upstream, response, error
• Four attachment levels, effective chain, the most precise wins
• Explicit removal (!name)
• CEL conditions compiled at load time
• Dry-run simulation of a policy chain
• Routing tree compiled at load time, deterministic precedence
• Relay without transformation by default
• Upstream connection pool, HTTP/1.1 and HTTP/2
• Streams relayed without holding: SSE and chunked bodies
• WebSocket relayed
• mTLS to the upstream, workload identity
• Timeout budget per operation
• In-flight request cap per upstream (bulkhead)
• Retries limited to idempotent methods
• Circuit breaker with half-open state
• Degradation announced (header and trace), never silent
• Graceful shutdown: streams in flight are drained
• JWT validation, cached JWKS keys with rotation
• iss and aud checked; several issuers in one configuration
• Scopes and roles derived from the contract's security
• Closed by default: undeclared header, parameter, method or origin refused
• Response security headers and declarative CORS
• Body and parameters validated against the contract's schema
• No upstream error relayed as is
• API keys and client mTLS as first-class identities
• Opaque token introspection (RFC 7662)
• Chained audit log of authorisation decisions
• Rate per caller (token bucket)
• 429 with Retry-After and RateLimit headers
• Rate classes per method, per-operation override
• Shared counters reconciled asynchronously between replicas
• Quota per tenant per day and month
• Token quotas and monetary inference budget
• Adaptive load shedding under saturation
• Request and response headers: set, remove, rename, derive
• Path rewrite and query parameters
• Protected elements cannot be written, refused at start