Version: Dev

Release Notes

These release notes cover the AISIX gateway runtime shared by AISIX OSS, AISIX Enterprise, and AISIX Cloud. They also cover the control plane and dashboard shared by AISIX Enterprise and AISIX Cloud, together with AISIX Enterprise deployment artifacts.

When upgrading across multiple versions, review the Breaking Changes and Upgrade Considerations for each intervening release in chronological order. For the control-plane-first sequence, follow Upgrade AISIX Enterprise. For AISIX OSS or a connected gateway rollout, follow Upgrade a Gateway on Kubernetes.

The shared gateway image is published at docker.io/api7/aisix. AISIX Enterprise artifacts include control-plane images under docker.io/api7/aisix-cp-*, the aisix-cp Helm chart, and the offline installation package.

For versioned changes in the AISIX Cloud Admin API used by AISIX Enterprise and AISIX Cloud, see the AISIX Enterprise / Cloud Admin API Changelog. The changelog begins with the comparison from 1.0.0 to 1.1.0. It does not cover AISIX OSS resource configuration, the AISIX gateway Admin API, or its proxy APIs.

1.8.0

Release date: October 29, 2026

This release moves budget enforcement into gateways connected to AISIX Enterprise and AISIX Cloud, adds delegated MCP authentication, and introduces two-factor authentication and organization password policies. The shared gateway adds a dedicated gateway-key header, trusted PROXY protocol support, more complete observability, and more tolerant startup configuration. It also raises the supported gateway floor for AISIX Enterprise and AISIX Cloud to 1.6.0 and changes several deployment and API contracts that operators must review.

For the complete AISIX Cloud Admin API endpoint and schema comparison, see changes from 1.7.1 to 1.8.0.

Breaking Changes

The following changes can require updates to gateway configuration, clients, observability consumers, or AISIX Enterprise deployment values.

Budget Decisions Continue Through Control-Plane Outages

AISIX Enterprise and AISIX Cloud gateways now enforce the budget state delivered with their configuration instead of asking the control plane on every request. Limit changes and period boundaries take effect without a live control-plane request path.

Mode	Behavior during a control-plane outage
`sticky` (default)	Preserves the last pushed budget state. On 1.7.1, every request received `429 budget_exceeded` once the cached decision was older than 600 seconds. On 1.8.0, only requests whose last pushed state is exhausted are blocked.
`closed`	After `budget_closed_grace_seconds`, only budget-subject requests receive `503 budget_unverified` until usage delivery recovers. The grace period defaults to 600 seconds and accepts values from 60 to 86,400 seconds.

An exhausted provider_key budget removes only routing targets that use that key and does not consume a fallback attempt. If every eligible target is excluded, the caller receives 429 budget_exceeded. MCP and A2A calls remain outside provider-key budget enforcement.

When upgrading, review the affected organizations and mixed-version behavior:

Review organizations that use open; the value is no longer accepted, and those organizations move to sticky.
Upgrade every gateway before relying on the new outage and provider-key behavior.
During a mixed-version rollout, account for gateways at 1.6.x and 1.7.x. They keep the earlier per-request checks and count the new budget documents in aisix_config_unknown_kind_resources without failing reload.

AISIX Enterprise Chart Values and Service Routing Change

The separate UI Service is removed, and the API Service now serves the dashboard on every path. Chart 1.5.0 UI environment variables and any duplicate overrides of variables rendered by the chart must move to supported values. A dropped AISIX_CLOUD_DATABASE_URL override can start migrations against the database derived from values.yaml.

Move the chart 1.5.0 UI settings as follows:

Previous location	New location
`AISIX_TRUSTED_ORIGINS` in `ui.extraEnvVars`	`api.trustedOrigins`
`AISIX_AUTH_BEARER_SESSIONS` in `ui.extraEnvVars`	`api.bearerSessions`

api.extraEnvVars remains an alternative for both settings.

Before upgrading, update the affected service routing and chart values:

Point ingress, reverse proxies, and NodePorts at the API Service.
At every source version, move duplicate overrides of chart-owned variables, including AISIX_CLOUD_PUBLIC_BASE_URL and AISIX_CLOUD_DATABASE_URL, from api.extraEnvVars or dpm.extraEnvVars to their dedicated values.
If an override has already been dropped, repeat the Helm upgrade with the intended values.

Gateway Observability Contracts Change

Chat Completions debug response headers are now disabled by default. x-aisix-request-id, x-ratelimit-*, retry-after, and server remain available.

Access-log fields change as follows:

Before 1.8.0	1.8.0
`status`	`status_code`
`error_kind`	`error_class`
`model`	`requested_model`
`latency_ms`	`downstream_latency_ms`

Metric consumers must also account for these changes:

Signal	Change
Spend	`aisix_llm_spend_micro_usd_total` is removed.
OAuth discovery	`/.well-known/oauth-protected-resource` and `/.well-known/oauth-protected-resource/mcp` have distinct `endpoint` label values.
A2A agent cards	The label changes from `endpoint="/a2a"` to `endpoint="/a2a/{agent}/.well-known/agent-card.json"`.
Budget cache	`aisix_component_entries{component="budget_cache"}` is no longer reported.

Before upgrading, update the affected observability consumers:

Set proxy.expose_debug_headers: true (Helm: config.proxy.expose_debug_headers) if clients still need call, routing, or cache headers. Otherwise, read the same information from usage events, access logs, metrics, and traces.
Update access-log parsers and saved metric queries.
Move spend dashboards to control-plane usage records or cost_usd on usage events.

Gateway Configuration and Client-Address Handling Change

This release changes two areas of gateway configuration:

Unknown startup keys produce a WARN instead of stopping the gateway. The warning also reaches standard error when log filtering hides warnings. Other configuration errors also list any ignored keys. The observability.metrics.otlp, observability.tracing, and observability.usage_event blocks are removed.
Dual-stack listeners convert IPv4-mapped addresses such as ::ffff:a.b.c.d to plain IPv4 in logs, usage events, and OTLP client.address. Every proxy listener detects PROXY protocol v1 and v2. A trusted load balancer can supply the client address used by logs, policies, allowlists, and client-IP hash routing without a separate listener. Connections carrying a PROXY header from an untrusted peer are closed and logged.

Before upgrading, review the affected gateway configuration:

Review startup warnings and remove misspelled keys, the retired observability blocks, and AISIX_DP_BUDGET_STALE_MAX_SECONDS.
On [::] listeners, rewrite mapped-IPv4 entries in proxy.real_ip.trusted_proxies, allowed_cidrs, passthrough source allowlists, and MCP source_cidrs.
Add CIDRs covering PROXY-protocol load balancers to proxy.real_ip.trusted_proxies.

Gateway Credential Handling No Longer Falls Back Across Present Headers

Credential handling changes in the following cases:

An empty x-aisix-api-key, Authorization, or x-api-key header counts as an authentication attempt, so anonymous MCP access refuses it with 401.
On a gateway_key passthrough route, a present but unusable Authorization bearer value no longer falls back to x-api-key.
Authentication errors identify the header that failed. The bearer scheme is case-insensitive, while the key remains case-sensitive.

Before upgrading, stop sending empty credential headers. Send the gateway key in x-aisix-api-key on gateway_key passthrough routes and reserve Authorization for the upstream.

Multi-Wildcard Patterns Are Rejected on Save

MCP access rules, A2A and passthrough allowlists, and model display_name or model_name patterns containing more than one * never matched or filled; a deny rule could therefore have been silently ineffective. Existing rows are not migrated, and complete-list saves return 400 INVALID_REQUEST while an invalid entry remains. A stored model pattern can be resent unchanged.

Before saving the affected resource, remove or replace every pattern containing more than one *.

AISIX Cloud Admin API Validation Becomes Stricter

The AISIX Cloud Admin API now rejects identity_header: x-aisix-api-key on passthrough routes with 400 INVALID_REQUEST and rejects x-aisix-api-key in exporter request_headers or upstream_response_headers with 400. Existing passthrough routes continue serving but cannot be saved until the identity header changes; auth_header_name may still use that header.

Before saving affected passthrough routes or exporters, remove those unsupported uses of x-aisix-api-key.

Upgrade Considerations

The following sequencing and rollback requirements apply to AISIX Enterprise and AISIX Cloud upgrades.

The Supported Gateway and Control-Plane Floor Moves to 1.6.0

AISIX Enterprise and AISIX Cloud no longer compatibility-check gateways older than 1.6.0, so those gateways can reject newly saved configuration. AISIX Enterprise also refuses to migrate a database last used by a control plane older than 1.6.0.

Before moving the control plane to 1.8.0, update connected gateways to 1.6.0 or later. For AISIX Enterprise, upgrade an older control plane through 1.6.x or 1.7.x first.

To override the database check after taking a backup, set api.allowUnsupportedUpgrade: true or AISIX_ALLOW_UNSUPPORTED_UPGRADE=1. For the offline package, run AISIX_ALLOW_UNSUPPORTED_UPGRADE=1 ./run.sh; proceeding also removes the separate 1.5.x UI container.

If startup has already been refused, restore AISIX_VERSION in .env to the recorded database release. Remove API and data-plane manager image pins before taking the staged path.

Rolling Back Can Restore Overly Broad Guardrail Attachments

AISIX Enterprise 1.8.0 removes phantom environment-wide attachments that an earlier backfill could place beside narrowly scoped guardrails. Rolling back to a release whose startup backfill still runs can recreate those attachments and broaden enforcement to the complete environment.

After returning to 1.8.0 from such a rollback, delete the 2026-08-29_guardrail_phantom_env_attachment_cleanup row from schema_migrations and restart the control plane so the cleanup runs again.

Complete the AISIX Enterprise Data-Plane Manager Rollout

A 1.7.x data-plane manager replica does not participate in the new configuration-delivery lock. Stale or out-of-order delivery therefore remains possible during a mixed control-plane rollout.

Finish the data-plane manager rollout before relying on serialized configuration delivery.

New Features

The major additions let MCP servers act with a caller's upstream identity and give AISIX Enterprise and AISIX Cloud stronger account controls. AISIX Cloud also adds a release notification for organization owners.

Delegate Caller Identity to MCP Servers

The dedicated x-aisix-api-key header separates gateway authentication from upstream authorization. It is accepted across proxy, MCP, A2A, Realtime, and gateway_key passthrough entry points, takes precedence over other gateway credential headers, and is never forwarded upstream. A caller can therefore authenticate to the gateway with x-aisix-api-key while reserving Authorization for the upstream.

Two upstream authentication modes use that separation:

Mode	Upstream identity behavior
`oauth_delegate`	Relays the caller-supplied `Authorization` token to an allowed `mcp` or `openapi` server only when the request authenticated to the gateway through `x-aisix-api-key`. An `Authorization` value used as the gateway credential is never relayed.
`oauth2_token_exchange` with `token_exchange_profile: entra_obo`	Verifies the caller through a JWT trust provider, exchanges the token through Microsoft Entra ID On-Behalf-Of, and sends only the minted token upstream. Tokens are cached until near expiry and exchanged once more after an upstream `401`. The server's `timeout_ms` also bounds the exchange.

On a direct /mcp/{server} call, token-exchange failures are scoped as follows:

Scenario	Result
Caller token is missing or rejected	`401` with `token_exchange_subject_missing` or `token_exchange_subject_rejected`
Token exchange is misconfigured	`500 token_exchange_misconfigured`
Token service is unavailable	`503 token_exchange_unavailable`
Entra requires a Conditional Access step-up	`insufficient_claims` challenge

On aggregated /mcp, a failed exchange removes only that server's tools.

Both delegated modes require 1.8.0 gateways. AISIX Enterprise and AISIX Cloud return 422 DP_INCOMPATIBLE while an older gateway remains registered.

Protect Dashboard Accounts with Two-Factor Authentication and Password Policies

AISIX Enterprise and AISIX Cloud add the following account controls:

One TOTP enrollment covers every organization and provides 10 one-time recovery codes.
Ten consecutive invalid codes lock second-factor verification for 15 minutes.
An organization can require two-factor authentication for dashboard sessions. A session established through that organization's single sign-on satisfies the requirement; admin tokens are unaffected.
Password policies can set a maximum password age, which is off by default, and prevent reuse of recent passwords. Existing password age begins from the account's last update, so a short maximum can require an immediate password change.

AISIX Enterprise operators can reset an account's second factor with:

cp-api two-factor reset --email <address>

TOTP setup requires the control-plane master key configured by AISIX_CLOUD_MASTER_KEY.

Notify Organization Owners About New Releases

After AISIX Cloud upgrades to a stable release, each active verified organization owner receives one release-announcement email with a link to the release notes.

Improvements

Per-request metrics cover the applicable proxy routes and early authentication refusals more consistently, including MCP, A2A, audio, video, Realtime, passthrough, file, batch, and fine-tuning traffic.
Access logs record prompt, completion, and total tokens across endpoint families that report them, including Realtime session totals.
Realtime usage events identify upstream transport and timeout termination, making the reason visible in Usage Logs and exporters.
aisix_usage_delivery_unhealthy_seconds reports how long usage events have waited without reaching the control plane.
HTTP/2 keepalive detects and recovers a silently dropped etcd configuration watch.
Resource-schema validation uses substantially less gateway memory.

Fixes

AISIX Enterprise and AISIX Cloud configuration delivery is serialized so concurrent replicas or a re-projection race cannot restore a deleted or stale resource on gateways.
AISIX Enterprise and AISIX Cloud organization-wide team, member, pricing, and MCP configuration reaches newly created environments consistently, including during concurrent edits.
AISIX Enterprise and AISIX Cloud concurrent tag-key and organization-currency updates no longer fail with 500.
An AISIX Enterprise or AISIX Cloud refused organization security-setting update identifies whether the caller attempted to change the password policy, two-factor requirement, or both.
The gateway updates rustls to a patched release that addresses upstream security advisories.

1.7.1

Release date: October 27, 2026

This patch improves request and response compatibility across the OpenAI-wire, Claude, Amazon Bedrock, and Vertex Gemini adapters. It also corrects streaming usage, audio and transcription accounting, provider endpoint handling, and several AISIX Enterprise database and deployment problems.

For the complete AISIX Cloud Admin API endpoint and schema comparison, see changes from 1.7.0 to 1.7.1.

Breaking Changes

Request stream usage explicitly. Clients that read usage from /v1/chat/completions streams must send stream_options.include_usage: true. Without it, the stream carries no usage chunk.
Review requests that relied on silently dropped parameters. On the Bedrock Chat Completions route for Grok and for GPT 5.6 and later, sampling parameters, penalties, logprobs, top_logprobs, n, and stop are sent as written. When the model rejects one, callers receive the upstream's 400. max_tokens on that route is still sent as max_completion_tokens. On Converse, stop is sent even to models that refuse stop sequences, and a tool's strict value is forwarded. n, logprobs, and top_logprobs are still omitted on Converse. A /v1/messages thinking.budget_tokens is sent as Gemini 2.5's exact thinkingBudget instead of a reasoning-effort tier, so a budget the model does not accept returns the upstream error.
Control caller-selected Anthropic betas if necessary. anthropic-beta now reaches Anthropic without being listed in forward_client_headers. Set a provider-key default_headers value when callers must not choose the beta.
AISIX Enterprise and AISIX Cloud: repair affected provider keys. Re-save Vertex AI keys stored with service_account_json as a string. Add a real API base to existing cloudflare-workers-ai and infomaniak keys that contain a models.dev ${...} endpoint template; affected requests otherwise continue receiving an upstream 404.

Upgrade Considerations

The following preparation and mixed-version limitations apply when upgrading AISIX Enterprise or AISIX Cloud components.

AISIX Enterprise: prepare the database connection before upgrading. Remove database.admin_url (AISIX_CLOUD_ADMIN_DATABASE_URL), use the database owner's connection in database.url, and disable twoDSN.enabled. The first control-plane start removes legacy row-level security settings; a database with tables owned by another role can require DBA action. For the current procedure, see Prepare the database role and connection.
AISIX Enterprise and AISIX Cloud: account for connected older gateways. Plaintext exporter endpoints outside the previously accepted test hosts return 422 DP_INCOMPATIBLE while a 1.7.0 or earlier gateway remains registered.
Account for a mixed-version shared response cache. A 1.7.0 or earlier gateway cannot read cache entries containing multiple choices or logprobs.

Known Issues

Amazon Bedrock ensemble judge limitation. A reasoning GPT 5.6 or later cannot be used as an ensemble judge because the judge request includes temperature: 0.2, which Bedrock refuses with 400. Use another judge model.

New Features

Legacy function calling works on Claude, Vertex Gemini, and Amazon Bedrock paths. functions, function_call, and role: "function" turns are translated to tools, and compatible responses return the legacy function-call shape. One call per turn fits that legacy response format.
Embeddings accept token-id input on OpenAI-wire targets. Bedrock and Vertex AI embeddings continue to reject token ids because their APIs require text.

Improvements

The following improvements affect endpoint and provider behavior, guardrail coverage, observability, and AISIX Enterprise deployment.

Endpoints and Providers

A successful upstream response that cannot be decoded is not retried. The caller receives 502, and the request does not repeat billable work through failover or cooldown. Credential token exchanges retain their existing retry behavior.
Anthropic request and response translation is more consistent. Claude stop reasons map to OpenAI finish reasons on chat, Anthropic server tools are not offered to chat upstreams, and Anthropic errors preserve the provider's message.

Guardrails

Input guardrails inspect replayed reasoning content. Unsigned reasoning parts can be blocked or masked. Signed Anthropic thinking blocks are scan-only because rewriting them would invalidate the signature.
Output guardrails inspect every returned choice. They now cover refusal text and legacy function-call arguments. Requested logprobs remain unmasked, so operators should not treat masked response text as proof that token-level output was also rewritten.

Observability and Deployment

AISIX Enterprise validates deployment mode at control-plane startup. Invalid mode, database, SMTP, or billing combinations are reported in the control-plane API pod log instead of failing Helm rendering. The error states whether the value came from an environment variable, configuration file, or default.
Provider-key forms explain when API base is required. The dashboard validates required bases, shows protocol-appropriate examples, and no longer uses a generic placeholder for Bedrock or bring-your-own providers.
Provider-key validation errors identify the malformed field. A Vertex AI credential with the wrong service_account_json shape now receives an actionable message.
Dashboard controls are easier to understand and localize. Icon-only actions provide explanatory text, including reasons for disabled actions, and date and time fields follow the dashboard language with 24-hour time.

Fixes

Streamed ensembles no longer fail when the caller requests usage. Panel members no longer receive stream_options; the caller still receives the final usage chunk.
OpenAI-compatible responses preserve every choice. Choice indices, refusals, annotations, logprobs, and legacy function calls are no longer discarded after the first choice.
Array-form text and reasoning content works across protocol bridges. OpenAI-compatible responses that return content parts no longer fail or lose parts when used through Chat, Messages, Responses, caching, guardrails, or telemetry.
Structured-output requests to older Claude models stay on native Messages paths. Claude on Bedrock or Vertex AI no longer loses Anthropic-only fields through an unnecessary chat conversion.
Interrupted Claude and passthrough streams record the usage the provider reported. Early stream termination no longer replaces available input and cache counts with estimates or records zero tokens when a server-labelled usage frame exists.
Vertex AI global, us, and eu locations use valid Google endpoints. Regional locations remain unchanged.
Audio usage and duration are recorded more reliably. Transcription and translation paths accept both audio-style and chat-style token counters, streamed duration uses the provider's value when available, and one invalid duration no longer discards an entire usage batch.
Response-cache hits export the replayed answer's metadata. Finish reason and structured output now match a fresh response. Requests that never reached an upstream report no upstream latency.
AISIX Enterprise and AISIX Cloud no longer save provider-key endpoint templates as unusable API bases. A missing required base is rejected or presented as required in the dashboard.
AISIX Enterprise and AISIX Cloud store Vertex AI service-account credentials in the shape consumed by the gateway. Valid keys work instead of failing every request with 401.
AISIX Cloud Admin API concurrent edits preserve resource references. Deletes of referenced resources return 409, and concurrent rename or membership updates no longer leave dangling references or overwrite each other.
AISIX Enterprise starts on a database that also contains tables owned by other tools. Unrelated objects no longer cause control-plane startup or import failures.
AISIX Enterprise chart setup follows the effective deployment mode. First-administrator credentials and install notes use the mode the control-plane API actually runs in.

1.7.0

Release date: October 22, 2026

This release adds cost-attribution tags and expanded pricing for AISIX Enterprise and AISIX Cloud. The shared gateway adds decision endpoints, native Claude support on Amazon Bedrock and Vertex AI, and richer observability. Existing operators should review changes to telemetry fields, media fetching, provider error exposure, pricing, dashboard language, usage rollups, and AISIX Enterprise deployment defaults.

For the complete AISIX Cloud Admin API endpoint and schema comparison, see changes from 1.6.0 to 1.7.0.

Breaking Changes

The following changes can require updates to observability, security and cost controls, clients, or deployment configuration.

Observability and Usage

Update OTLP and Datadog queries for the OpenTelemetry GenAI span shape. Apply these 1.7.0 mappings:
- Replace gen_ai.system with gen_ai.provider.name. For a model hosted on another platform, the hosting platform wins, so Claude on Amazon Bedrock uses aws.bedrock. Use aisix.requested_model for the model or Model Group named by the caller and gen_ai.request.model for the model sent upstream.
- Include Anthropic-style cache-read and cache-creation tokens when interpreting gen_ai.usage.input_tokens. Datadog uses the same total.
- Update operation span names to {operation} {upstream model}, server span names to the HTTP method and route, and MCP tool-call spans to tools/call {tool}. Successful spans leave status unset. A 4xx does not mark the server span as an error, and a client disconnect (499) does not mark any span as an error.
- Replace OTLP gen_ai.prompt and gen_ai.completion with gen_ai.input.messages, gen_ai.output.messages, gen_ai.system_instructions, and gen_ai.tool.definitions. Content that is truncated or cannot be converted to messages remains in aisix.content.prompt or aisix.content.response.
- Replace aisix.client_source_ip and aisix.client_user_agent with client.address and user_agent.original on the server span. Move http.request.header.* queries to the server span as well. Only an upstream-attempt span carries gen_ai.operation.name and gen_ai.request.model.
- Update filters for the resource service.name: it now uses observability.service_name, which defaults to aisix, rather than the fixed aisix-dp value.
Move SLS indexes and Datadog facets to structured content fields. Apply these 1.7.0 mappings:
- In SLS, move prompt queries to input_messages, with system_instructions and tool_definitions where present, and move response queries to output_messages.
- In Datadog, replace gen_ai.prompt with gen_ai.input.messages, with gen_ai.system_instructions and gen_ai.tool.definitions where present, and replace gen_ai.completion with gen_ai.output.messages.
- Continue indexing the earlier flat fields for content that is truncated or cannot be converted to a message exchange. A record can contain structured content on one side and a flat field on the other.
Configure captured headers per exporter. observability.usage_event.request_headers is removed. Add the required request and upstream-response headers to each exporter.
Update usage-export consumers for the cache-write split. Events and CSV exports add cache_creation_5m_tokens and cache_creation_1h_tokens; consumers that require a fixed column count must accept the new columns.
Update guardrail log queries. The fields row, member, and name are now guardrail_name. On a Bedrock guardrail line, guardrail_id is now bedrock_guardrail_id.
Update failure-class alerts. A Bedrock guardrail 4xx other than throttling, and credentials refused before signing, are classed bedrock_config_error. Transport failures and 5xx stay bedrock_5xx. Requests the gateway refuses before calling the provider, previously classed invalid_config, are now invalid_request_error. An invalid upstream configuration stays invalid_config.
AISIX Enterprise and AISIX Cloud: set organization language when needed. If the dashboard should not follow the browser, set the organization language. No organization has a language set after the upgrade. The dashboard then uses the browser's language when it is English or Chinese, and otherwise the deployment default. Verification, password-reset, and SSO account-claim emails use the same order. Emails an administrator sends, such as invitations, follow the organization setting and then the deployment default.

Security, Cost, and Client Behavior

Review provider error exposure. Bedrock, Azure OpenAI, Vertex AI, and provider 5xx responses can now include the provider's own message, including account, project, deployment, or ARN details.
Allow required internal media hosts. Media fetched for Bedrock, Anthropic, and Gemini is subject to SSRF protection. Add internal hosts to outbound.ssrf_protection.allowed_hosts or explicitly disable the protection where appropriate. Public host names that a fake-IP or transparent proxy resolves into 198.18.0.0/15 are refused unless allowlisted. The inbound body and downloaded media are checked together against proxy.request_body_limit_bytes, and an oversized request returns 413.
AISIX Enterprise and AISIX Cloud: review pricing and budgets. Long-context catalog tiers can increase post-upgrade spend. When a Claude price served by Anthropic, Amazon Bedrock, or Google Vertex AI has no cache_write_1h_usd_per_1m, one-hour cache writes bill at twice the input rate. Before this release they were not split out and billed at the cache-write rate. A price that sets the one-hour rate uses that rate. Other models keep the cache-write rate. Usage recorded before the upgrade is not repriced.
AISIX Enterprise and AISIX Cloud: update connection-test automation. An Azure AI Content Safety test with an unresolvable host now returns 200 with ok: false instead of 400 INVALID_ENDPOINT.

Deployment and Compatibility

Review proxy exclusions. Bedrock runtime, Bedrock guardrail, STS, and Realtime connections now honor HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, and NO_PROXY. Realtime requires an HTTP proxy rather than SOCKS.
Size gateway termination grace for Realtime sessions. A draining gateway waits for open sessions to close.
AISIX Enterprise: migrate to unified SSRF protection. For a 1.7.0 target, replace outbound.notify_allow_private_urls, outbound.playground_allow_private_ips, outbound.mcp_spec_allow_private_urls, and outbound.guardrail_test_connection_allow_insecure with outbound.ssrf_protection and an explicit allowed-host list. Enable it with Helm api.outbound.ssrfProtection.enabled=true or AISIX_CLOUD_SSRF_PROTECTION_ENABLED=true.
AISIX Enterprise: review custom database URLs. A password embedded in a URL must be URL-encoded. Prefer the chart-managed password environment variable and omit it from the URL.
AISIX Enterprise: review offline-package image handling. Earlier package archives are removed after a successful start and retained when startup fails. Image tarballs placed in images/ manually are no longer loaded automatically.

AISIX Cloud Admin API Callers Must Update

Date-time query parameters use strict OpenAPI validation. Omit optional parameters rather than sending an empty value, and use . for fractional seconds.
Usage summary and metric windows align to whole UTC hours and use the new hourly-rollup semantics.
model_id on usage events identifies a dispatched direct model. Use exact requested_model filtering for Model Group pre-dispatch failures and cache hits.
Model, rate-limit, and Bedrock credential writes enforce additional referential, capability, and authentication-mode validation.

Upgrade Considerations

The following one-time and mixed-version conditions apply during the rollout.

Expect temporary usage backfill. The Overview and Usage pages can show zero and then incomplete totals while a new index and hourly rollup are built. Traffic continues to be recorded.
Clear an old gateway image pin during Helm upgrades. Dashboard-generated commands before this release set image.tag; helm upgrade --reuse-values retains it. Clear the pin, for example with --set image.tag=.

The following mixed-version actions apply to AISIX Enterprise and AISIX Cloud.

Account for other mixed-version gaps. Until the connected fleet is upgraded, do not rely on new Bedrock authentication modes, Claude automatic prompt caching, exporter header capture, new usage attribution fields, or new resource kinds. For current rollout guidance, see Mixed-Version Behavior.
Adjust old-gateway configuration alerts. Gateways from 1.0.0 through 1.3.x reject the new resource kinds, count them in aisix_config_rejected_resources, and keep aisix_config_last_reload_successful at 0; gateways from 1.4.0 count them in aisix_config_unknown_kind_resources without failing reload. Traffic continues and the control-plane Rejected Resources view remains empty.
Delay tag budgets and tag-scoped rate limits until older gateways are gone. A tag budget returns 422 DP_INCOMPATIBLE while any environment in the organization has a registered gateway that cannot stamp tags. A tag: rate-limit policy is refused while the target environment has one.
Expect missing endpoints and attribution on older gateways. Decision endpoints require 1.7.0 gateways. Requests served by older gateways omit service_tier, so they price at base rates, and omit requested_model_id.
Expect older gateways to use the generic cache-write rate. Gateways at 1.6.x or earlier do not report the one-hour cache-write split, so one-hour writes keep billing at the cache-write rate until those gateways are upgraded.
Restart a Responses conversation after an older-gateway continuation failure. A conversation started on a 1.7.0 gateway can fail when a follow-up later lands on an older gateway, returning OpenAI 400 with string too long, or 404 on another upstream. Start a new conversation to recover.

Known Issues

AISIX Enterprise and AISIX Cloud: tag enforcement gap. A tag rate limit or tag budget can miss a gateway that registers or rolls back after the policy is saved. Such a gateway can ignore tag enforcement and report untagged usage. Check the rejected-resources report and upgrade the gateway.

New Features

New capabilities span cost management, endpoints and providers, observability, and dashboard workflows.

Cost, Pricing, and Usage

These capabilities are available in AISIX Enterprise and AISIX Cloud.

Cost-attribution tags connect users and resources to usage. Organizations can define tag keys, assign values to API keys, teams, and members, and use resolved tags in budgets, rate limits, exports, and Cost Analysis.
Pricing supports organization currency, input-length tiers, Model Group prices, off-peak discounts, and upstream service tiers. Catalog and organization-defined prices remain distinct.
Cost Analysis provides organization-level cost, token, and request views. The dashboard and the AISIX Cloud Admin API endpoint GET /usage_analysis can group and filter by time, environment, model, provider, API key, team, member, and tag.

Endpoints and Providers

Decision models are available through /v1/systemone and /v1/decisions. They support TypeSafe, Microsoft Foundry, OpenRouter, and OpenAI targets with normal authentication, routing, guardrails, telemetry, and usage accounting.
Bedrock provider keys support API keys, the AWS default credential chain, static access keys, and assumed roles. Bedrock guardrails use the same authentication modes where supported.
Cohere embeddings on Bedrock accept provider-specific input and output options.

Observability and Dashboard

Each exporter chooses which request and upstream-response headers to capture. Sensitive credential slots remain excluded.
Usage events and exporters expose requested-model identity, cache-write split, service tier, provider request ID, and richer token details.
The dashboard adds organization language selection, Cost Analysis, tag management, in-use pricing, and clearer deleted-resource references.

Improvements

Existing telemetry, provider traffic, and AISIX Enterprise deployment workflows improve in the following areas.

Observability and Usage

Usage and passthrough telemetry identify the work actually performed. Model Groups distinguish requested and dispatched models, passthrough traffic uses endpoint-specific parsers, failed attempts retain provider request IDs, and total-token fields are populated across endpoint families that report them.

Endpoints and Providers

Claude on Bedrock and Vertex AI uses native Messages and token-count paths. Prompt caching and supported Anthropic betas work on those platforms, with platform-specific filtering.
Responses conversations through a routing Model Group stay on the selected target. Follow-ups remain on the provider that created their context while they continue through gateways that support this release.
Realtime shutdown drains active sessions. Late requests are either served once or refused without replaying upstream work.

AISIX Enterprise Deployment

Database passwords are no longer placed in chart-managed connection URLs. This avoids failures with URL-reserved characters.
AISIX Enterprise and AISIX Cloud Overview and Usage queries avoid scanning raw usage for every page load. The hourly rollup improves normal query cost after the initial backfill completes.
Compatibility and configuration errors are more actionable. Refusals identify the affected gateway version, field, and reason; gateway startup errors name the invalid key.
Bedrock provider keys can use the standard platform endpoint without specifying an API base.
AISIX Cloud keeps active organization selection per browser tab. Switching one tab no longer changes another.

Fixes

AISIX Enterprise and AISIX Cloud usage, budgets, and exports no longer double-count re-sent attribution batches or duplicate terminal events.
AISIX Enterprise and AISIX Cloud dashboard-generated gateway Helm commands no longer pin an image tag, so a later chart upgrade follows the chart version.
AISIX Enterprise and AISIX Cloud refuse writes during organization deletion cleanly instead of returning 500 or landing in a deleted organization.
Short-lived PostgreSQL connection reuse errors no longer surface as intermittent AISIX Enterprise or AISIX Cloud dashboard 503 responses.
Claude request translation preserves supported cache controls, thinking options, stop settings, output limits, audio output, and nullable usage counters across hosted platforms.
Structured-output requests retain returned reasoning on Claude paths without native structured output.
AISIX Enterprise and AISIX Cloud test connections close DNS-rebinding gaps for Azure AI Content Safety and MCP specification URLs, without exposing the blocked internal address.
Custom roles refuse permissions unavailable in the selected product. AISIX Enterprise rejects billing permissions; AISIX Cloud rejects data-export permissions.
Users left without an organization receive a recoverable dashboard flow in AISIX Enterprise and AISIX Cloud instead of an environment-load failure.
AISIX Enterprise rolls deployments when chart-managed secrets change and accepts database passwords containing URL-reserved characters in the offline package.

1.6.0

Release date: October 12, 2026

This release moves AISIX Enterprise sign-in and the dashboard into the control-plane API and adds AISIX Enterprise email delivery. It also adds organization SAML for AISIX Enterprise and AISIX Cloud and limits AISIX Enterprise to one organization. Deployments that contain several organizations must permanently consolidate before normal dashboard use. The gateway also reports streaming, guardrail, and passthrough outcomes more accurately.

For the complete AISIX Cloud Admin API endpoint and schema comparison, see changes from 1.5.0 to 1.6.0.

Breaking Changes

These changes can require updates to observability, gateway clients, control-plane automation, or AISIX Enterprise deployment settings.

Observability and Traffic

Update streaming dashboards and alerts. Streaming requests are now counted when the stream ends and use the terminal status. Completed streams are 200, client disconnects are 499, upstream failures are 502, timeouts are 504, and in-stream 4xx responses retain their status. Success rates can fall, whole-stream duration percentiles can rise, and rate-based signals can arrive later.
Update pipelines that match error_kind or error_class. Replace upstream_error with upstream_status, transport_error with transport, upstream_decode_error with upstream_decode, upstream_in_band_error with upstream_in_band, config_error with config, invalid_request_error with invalid_config, and authentication_error with invalid_credentials. Output or session-ending guardrail refusals also gain content_filter classification.
Update semantic-router failure handling. An embedding failure under on_embedding_failure: fail remains HTTP 503, but callers now receive type: api_error and code: semantic_routing_failed instead of type: provider_unavailable. Match the error code rather than the old type.
Review access-log volume and defaults. Authentication denials, unrouted 404 responses, wrong-method 405 responses, /v1/models, A2A agent cards, and OAuth metadata now write access-log lines. A gateway with no observability block now uses log_level: info with access logging; set observability.log_level: error or observability.access_log: false if the earlier silence was intentional.
Review guardrails that matched text only inside tool-call identifiers. Those identifiers are no longer screened. Function names and arguments remain in scope.
Update legacy tool clients for Vertex Gemini and Bedrock. Requests that relied on tools being flattened or dropped can now receive 400 invalid_request_error; use tools and tool_choice, and replay Vertex Gemini tool-call identifiers unchanged.
Remove observability.access_log: false if access logging should remain enabled. The setting was ignored previously and now disables the access log.
Review passthrough URL composition and redirects. Requests with traversal segments or caller query keys that collide with target_url now return 400. Upstream 3xx responses are relayed instead of followed, so the gateway does not carry provider credentials to Location.
Review passthrough input guardrails. A raw JSON body is scanned through its decoded string values, not object keys or surrounding structure. Malformed JSON, more than 256 KiB of selected strings, or input beyond the scanner's depth limit fails closed unless fail_open is set.
Configure passthrough event-stream timeouts. First-byte and inter-chunk gaps use route timeout_ms, then upstream.stream_timeout_ms, then upstream.timeout_ms (default 100 minutes). To remove the limit, omit route timeout_ms and set both deployment settings to 0. Concurrency is held for the full stream.
Review passthrough output guardrails. Streams and response bodies that cannot be evaluated return 422 unscannable_body unless output_fail_open is set.
AISIX Enterprise and AISIX Cloud: check older-gateway compatibility. Gateways through 1.3.x count the new teams and users kinds in aisix_config_rejected_resources and keep aisix_config_last_reload_successful at 0; traffic and configuration loading continue, and the control-plane Rejected Resources view remains empty. Do not page on that signal alone during the mixed-version window. Gateways from 1.4.0 count the kinds in aisix_config_unknown_kind_resources without failing reload.
Account for notification-record retention. AISIX Enterprise and AISIX Cloud retain notification delivery records for 90 days.

AISIX Cloud Admin API Callers Must Update

AISIX Enterprise organization import requires an owner's dashboard session and a fresh installation. Admin tokens and anonymous calls receive 401; non-fresh installations receive 409.
Import responses no longer contain owner_user_id, and warnings is always empty. Read ca for the certificate-authority outcome.
API key writes reject SCIM-deactivated owners with 400 INVALID_REQUEST.
Budget state no longer changes when bindings change. Treat recorded spend as historical attribution.
Do not infer free, sub-cent, or absent rates from rounded *_cents_per_1m fields; read exact *_usd_per_1m fields instead.
Role reads omit permissions unavailable in the current product. AISIX Cloud also removes direct member creation and organization data export; POST /members and GET /data_export return 404.

Upgrade Considerations

The following one-time preparation, rollout, and database conditions apply during the upgrade.

Authentication and Dashboard

Back up and consolidate AISIX Enterprise deployments that contain several organizations. Until an owner keeps one organization and permanently deletes every other one, dashboard sessions are refused with 403 ORG_CONSOLIDATION_REQUIRED. Sign-in, admin tokens, and gateway traffic continue working. Deleted organizations, resources, records, memberships, and gateway certificates cannot be recovered without the database backup. For the current procedure, see Consolidate Several Organizations into One.
AISIX Enterprise: prepare for invitation-only registration and a one-time sign-in. Users who already have passwords sign in again after the upgrade. Identify users who signed in only with Google or GitHub; an administrator must enable sign-in or reset their password after the upgrade. Update non-dashboard registration clients to send invitationToken, move trusted origins to api.trustedOrigins, and retain the previous dashboard authentication secret while rollback remains possible.
AISIX Enterprise: move dashboard deployment settings. The separate UI workload is removed. Move a private database CA to externalDatabase.sslRootCert, and move application settings from extraEnvVars to their chart values before upgrading. For the current checks and recovery path, see Review Control-Plane Values.

Deployment and Database

Review outbound private-address settings when the target is 1.6.x. AISIX Enterprise allows the playground, notification channels, MCP specifications, and guardrail connection tests to reach private addresses unless their individual 1.6.x switches are disabled. A helm upgrade --reuse-values from chart 1.5.0 keeps that chart's false values for playgroundAllowPrivateIPs and notifyAllowPrivateURLs, and those explicit values still deny private destinations. These switches are retired by 1.7.0, so use the final target release's unified SSRF configuration when upgrading past 1.6.x.
AISIX Enterprise: set audit retention before first start. If 730 days is too short, set the retention period before the upgraded control plane starts. The control plane deletes older audit records after startup according to audit.retention_days; 0 disables retention deletion.
AISIX Enterprise: finish the control-plane rollout promptly. Do not leave 1.5.x and 1.6.0 control-plane replicas running together. Older replicas can return transient errors and continue using database structures that the new release replaces. The first budget aggregation seeds every budget from its period's usage because no snapshot is stored yet. A seed that fails is retried on the next tick. A serialization failure (40001) or deadlock (40P01) retries the tick, and repeated failures log budget spend is not advancing.
AISIX Enterprise: wait for background database work before another upgrade. Large usage tables increase database I/O while indexes are built. Budget aggregation and cleanup resume after the control-plane log reports background index build: every index is in place.
AISIX Enterprise and AISIX Cloud: expect one-time withdrawal of previously deleted environments. When the 1.6.0 data-plane manager first starts, it removes gateway configuration namespaces for environments deleted before automatic withdrawal existed. Gateways still serving those environments lose that configuration.

New Features

AISIX Enterprise can send email through SMTP. Invitations, forgotten-password messages, and administrator-issued sign-in links use the configured relay.
AISIX Enterprise and AISIX Cloud organizations can use SAML 2.0 single sign-on. Owners configure the identity provider, attribute mapping, role mapping, and enforcement policy. AISIX Enterprise trusts the asserted email; AISIX Cloud requires the organization's verified domain.
Fresh AISIX Enterprise installations can create the first administrator automatically from package or Helm settings, then require a password change.
The AISIX Enterprise control-plane chart can trust a private PostgreSQL CA for both the API and data-plane manager.
AISIX Enterprise and AISIX Cloud owners can delete an organization. The last AISIX Enterprise organization cannot be deleted.
Semantic routers can use the TypeSafe jev decision service with configurable input, output, failure, and fallback behavior.
Metrics can include readable resource names for API keys, teams, members, models, provider keys, and policies while retaining stable identifiers.
Usage events can capture selected request headers for export and investigation.
Gateway-initiated embedding calls appear in usage events so semantic routing, semantic caching, and guardrails can be attributed and costed.
AISIX Enterprise and AISIX Cloud model pricing supports exact fractional USD rates rather than cents-only storage. AISIX OSS declarative models continue using inline cost values.

Improvements

The following improvements make observability, request processing, and control-plane operation more complete and predictable.

Observability, Usage, and Cost

Gateway refusals include a safe diagnostic reason in usage events. Unknown models, policy denials, quota failures, guardrail blocks, and other gateway-generated failures carry an error class and message when the text cannot expose request or provider content.
AISIX Enterprise and AISIX Cloud member budgets participate in dashboard alerts.

Guardrails and Provider Requests

Guardrail timeouts cover the complete remote call. DNS, connection establishment, request upload, response headers, and response body all share the configured budget.
Reasoning survives OpenAI and Anthropic protocol conversion. Reasoning input and output is preserved across supported chat, Messages, and Responses bridges, including streaming paths.

AISIX Enterprise and AISIX Cloud

The AISIX Enterprise Helm chart renders application configuration files. Environment variables continue to override file values for compatibility, while secrets remain in Kubernetes Secrets.
Deleting an environment withdraws its gateway configuration. Connected gateways continue serving their last configuration until the withdrawal reaches them, then stop serving configuration for the removed environment.
A custom API-key value must be unique within its environment rather than across the complete deployment, so another environment can use the same value.
The AISIX Enterprise and AISIX Cloud pricing page scales to larger catalogs with server-side pagination and search.
Gateway failure logs provide actionable provider and guardrail context without requiring debug logging.
The AISIX Enterprise control-plane API becomes available after schema migration while indexes build in the background. Logs show progress and the blocking database session when a migration must retry a table lock.
AISIX Enterprise and AISIX Cloud background retention and purge work yields between batches to reduce interference with interactive operations.
When data_plane.image is unset, a released AISIX Enterprise or AISIX Cloud control plane suggests the gateway image with its own stable release tag rather than the Dev image.
Sequence-valued gateway environment settings accept comma-separated values, including heap-profiling thresholds and Redis node or sentinel lists.

Fixes

reasoning_effort works on supported Claude models that do not accept the effort field directly. The gateway maps effort to an extended-thinking budget while preserving caller-supplied thinking configuration.
AISIX Enterprise and AISIX Cloud dashboard lists and settings pages settle on an explicit error state instead of leaving a failed request behind an indefinite spinner.
AISIX Enterprise and AISIX Cloud SCIM-deactivated members lose dashboard, organization, invitation, and API-key access consistently. API keys cannot be assigned to or re-enabled for a deactivated member.
AISIX Enterprise and AISIX Cloud usage cannot charge an API-key budget in another environment. Foreign key identifiers are removed from new events and excluded from historical attribution.
Vertex Gemini and Claude tool calls round-trip across supported protocols and streams. Parallel streamed calls retain separate indices.
Google AI Studio embedding responses without an explicit item index are accepted. They no longer fail with 502 upstream_decode_error.
Expired AISIX Enterprise and AISIX Cloud dashboard sessions consistently return users to sign-in and return them to the original page afterwards.
The AISIX Enterprise offline package gives PostgreSQL more time to stop cleanly before forcing container shutdown.
Embedding responses with missing token counts remain available and are marked as usage unavailable instead of failing.
Redis concurrency leases are renewed for long requests so the configured concurrency limit continues to apply for the whole request.

1.5.0

Release date: September 29, 2026

This release expands Model Groups across single-request endpoints, records streaming and failed-request usage more accurately, and strengthens guardrail handling on streamed and passthrough traffic. It also adds gateway memory diagnostics, HMAC JWT verification, richer usage exports, and safer configuration validation.

For the complete AISIX Cloud Admin API endpoint and schema comparison, see changes from 1.4.0 to 1.5.0.

Breaking Changes

The following changes can require updates to observability queries, guardrails, clients, or configuration.

Usage and Observability

Review cost after the complete 1.5.0 rollout. Once an AISIX Enterprise or AISIX Cloud control plane and its connected gateways reach 1.5.0, reasoning, malformed token totals, and previously dropped usage are recorded and billed more completely. Gemini counts can also move between completion and reasoning fields without changing cost.
Update latency queries for the new side label. aisix_request_ttft_seconds and aisix_llm_time_to_first_token_seconds each record an upstream and a downstream observation of the same stream. Exclude side="downstream" to keep the upstream measurement. aisix_request_e2e_latency_seconds records both as well. Gateways before this label recorded the client-perceived measurement without side, and side!="upstream" selects that measurement on both old and new gateways. A query that does not filter side blends the two observations.
Expect streaming success rates and latency percentiles to change. Failures after response headers now use their terminal status instead of appearing as successful 200 responses.
Allow fractional seconds and numeric UTC offsets in exported timestamps. Update parsers that accept only whole-second UTC values.

Guardrails and Traffic

Review keyword and PII rules that matched across values. These guardrails now evaluate each string value separately rather than concatenating messages, keys, values, tool names, and arguments.
Review passthrough and buffered-output guardrails. More protocol content is screened, and reasoning or tool-heavy streams can reach max_buffer_bytes sooner.
Handle new guardrail action values. guardrail_enforced_hits can include blocked_buffer_exceeded and mask_unsupported. guardrail_monitor_hits can include would_mask_unsupported. A guardrail refusal relayed on an Anthropic passthrough stream names the refusal on error.code, such as content_filter or guardrail_unavailable. error.type stays invalid_request_error.
Validate AISIX OSS MCP servers before restart or reload. Use a 1.5.0-or-later binary to run aisix validate --resources <file> for OpenAPI-backed servers. A document that produces no usable tools now invalidates the complete resources file. AISIX Enterprise and AISIX Cloud already reject it at create or update time.
Move credentials out of configured URLs where supported. Userinfo in A2A and MCP URLs, control-plane endpoints, OIDC or MCP configuration, Azure or Vertex API bases, and exporter endpoints is readable configuration and can appear in logs, errors, or published metadata. Use separate credential fields where available. For single-node or cluster Redis, use the explicit username and password fields; Sentinel-node authentication remains in sentinel URLs.
Update invalid guardrail and exporter payloads. Guardrail writes reject values that no gateway can load, including invalid empty enums, unsupported buffer sizes, and overlong custom PII pattern names. Exporter writes reject invalid endpoint spellings, including uppercase schemes and malformed loopback HTTP URLs.

Upgrade Considerations

The following rollout and diagnostic conditions apply during or immediately after the upgrade.

Plan for mixed response-cache versions. A 1.4.0 gateway treats some entries written by a 1.5.0 gateway as misses until they expire; responses and billing remain correct.
AISIX Enterprise and AISIX Cloud: plan for store compaction. The first scheduled configuration-store compaction processes accumulated history. It runs in batches, retains the newest revisions, and can temporarily slow configuration propagation. A restart resumes the work.
Review gateway memory diagnostics. The gateway listens on 127.0.0.1:9091 for GET /debug/pprof/heap unless observability.debug.enabled is false. A bind failure is logged and does not stop the gateway. Automatic heap profiles are written under /var/lib/aisix/heap, up to 5 files, unless observability.heap_profiling.auto_dump.enabled is false. Set _RJEM_MALLOC_CONF=prof_active:false to turn sampling off.

Known Issues

Gemini thinking-token counts are incomplete with Google AI Studio provider keys. Cost, token limits, and budgets can be lower than the actual reasoning use because that endpoint reports thoughts only inside total tokens.
AISIX Enterprise and AISIX Cloud: compaction restart risk. The data-plane manager can restart when PostgreSQL stalls during configuration-store compaction. It resumes after restart. AISIX Enterprise operators should avoid long database lock waits and verify database availability during the first compaction window.

New Features

OIDC providers can verify JWTs with a shared HMAC secret. AISIX Enterprise and AISIX Cloud encrypt the secret and omit it from audit and export output.
Model Groups work across completions, embeddings, rerank, image, audio, and video endpoints with failover, retry, balancing, and per-attempt usage.
Chat Completions accept developer messages on supported upstreams.
Usage rows retain upstream-reported total tokens and distinguish policy denials from fail-closed guardrail blocks.
AISIX Enterprise and AISIX Cloud Logs and Audit exports support an explicit time zone.
Google Cloud Storage exporters accept a custom endpoint.
The gateway exposes memory diagnostics and automatic heap profiles for high-memory investigations.
Access logs include request and response body sizes, and rejected usage events are counted by reason.
The AISIX Enterprise and AISIX Cloud dashboard exposes the complete configuration of the supported guardrail kinds.

Improvements

Usage, exporter diagnostics, and request processing become more complete in the following areas.

Usage and Observability

Each failed upstream attempt on single-request endpoints is recorded. Retry and failover behavior becomes visible in usage history.
Exporter health reports the first failed delivery attempt. A non-retryable object-store 4xx is dropped immediately as permanent_error, while retryable failures continue through the retry policy.

Guardrails and Passthrough Traffic

Passthrough guardrails understand typed request and response content, and stream buffer accounting includes reasoning, tool arguments, refusal content, and terminal events where the route can screen them.
The Responses-to-chat bridge preserves agent failure semantics. A partial stream failure emits response.failed after the error event, upstream codes reach that event, a guardrail refusal uses invalid_prompt, and an empty upstream stream becomes retryable upstream_error instead of appearing complete or dropped.
OpenAI reasoning models receive the correct token-limit field across OpenAI and Azure OpenAI.
Passthrough routes meter recognized rerank and DashScope traffic.
Custom guardrail scripts receive the resolved model on Chat, Responses, and Messages paths.
Event streams use consistent framing and usage handling.
The AISIX Enterprise and AISIX Cloud dashboard and usage pages are easier to read during partial failures and expose when budget spend was last measured.
AISIX Enterprise and AISIX Cloud organization export no longer scales with the complete shared configuration store.
AISIX Enterprise and AISIX Cloud control-plane services emit structured JSON logs suitable for centralized collection.

Fixes

AISIX Enterprise and AISIX Cloud configuration dependencies reach connected gateways in order, preventing attachments from arriving before the resource they reference.
Cohere and migrated Jina provider keys use the correct endpoint paths.
AISIX OSS Anthropic provider keys without api_base use the Anthropic platform endpoint for Messages and token counting, and legacy empty-vendor OpenAI-adapter keys use the OpenAI platform endpoint for endpoint-specific routes.
Provider responses that omit a model or error message remain usable and produce a meaningful fallback message.
Usage events record applied guardrails across endpoint families, failures, refusals, passthrough, Realtime, and jobs.
Output guardrails continue scanning beyond the first 256 KiB in monitor mode.
Streamed native Responses output guardrails no longer scan, mask, or block generated reasoning_text; answer content remains in scope.
Token-count retries and failover record every attempt.
Deleted resources do not return from an on-disk gateway snapshot after restart.
AISIX Enterprise and AISIX Cloud gateway replicas sharing a registration certificate no longer overwrite each other's rejection state.
Gateway request-body retention is reduced for concurrent large media requests.
A cancelled configuration watch reconnects and reloads instead of silently freezing configuration.
Exporter errors redact configured credentials while retaining the receiver's diagnostic text.

1.4.0

Release date: September 22, 2026

This release lets gateways start in a safe degraded state when Redis is unavailable, retries usage delivery without duplicating stored batches, and separates unknown resource kinds from rejected configuration. It also improves telemetry delivery, AISIX Enterprise CORS and database operations, and gateway health diagnostics.

For the complete AISIX Cloud Admin API endpoint and schema comparison, see changes from 1.3.0 to 1.4.0.

Breaking Changes

Upgrade the entire fleet before adding new metrics. Do not add aisix_config_unknown_kind_resources, aisix_config_apply_duration_seconds, aisix_config_apply_batch_events, or aisix_log_lines_dropped_total to observability.metrics.labels until every gateway in the environment runs 1.4.0. Older gateways reject unknown metric-family names at startup.
Update configuration-health alerts. aisix_config_rejected_resources no longer counts unknown kinds; include aisix_config_unknown_kind_resources to retain the wider signal.
Review authenticated etcd dial timeouts. Set etcd.dial_timeout_ms explicitly when an authenticated dial can exceed five seconds. The new default is 5000 ms; 0 restores the previous unbounded behavior.
Remove or correct stale Redis username and password fields. redis.username and redis.password were ignored in some modes before this release and now take precedence where documented.
Expect a missing Redis credentials warning. When Redis requires credentials but none are configured, the gateway emits an explicit degraded-start warning with reason=refused. The gateway already could not use that Redis; the release makes the refusal visible at startup.
Review fail-open Redis behavior. When Redis is unavailable at startup, rate limiting falls back to per-process counters and caches serve misses while reconnecting. Locally invalid Redis configuration remains fatal.
Review AISIX Enterprise CORS configuration. Cross-origin sign-in requires both the CORS allowlist and trusted-origin setting. The released Compose package does not forward the CORS variable from .env.

Upgrade Considerations

AISIX Enterprise: expect one-time database work on the first control-plane start. A new usage index is built concurrently and adds storage and write maintenance after completion.
AISIX Enterprise and AISIX Cloud: upgrade gateways and control plane. Complete both upgrades before relying on usage re-sending. A 1.4.0 gateway still drops a failed batch when the control plane is older.

New Features

New metrics distinguish unknown configuration, apply duration and batch size, and dropped log lines. All are available to the metric-label selector after the whole fleet is upgraded.

Improvements

Redis credential fields are applied consistently. Explicit username, password, and database settings now reach single-node, cluster, and discovered-master connections according to their documented precedence.
AISIX Enterprise and AISIX Cloud usage batches are re-sent after transient control-plane failures. Idempotent ingestion prevents a successfully stored batch from being counted twice when the acknowledgement is lost.
Telemetry and log delivery degrade without blocking request processing. Stalled log consumers can drop log lines, and exporters retry longer with Retry-After support.
Origin allowlists accept browser-canonical host and IPv6 spellings.
Background gateway work is isolated from request-serving threads. Large configuration applies, metric rendering, and snapshot cleanup interfere less with proxy traffic and health probes.
Large configuration updates perform less repeated work. Digests and derived state are recomputed only when needed rather than for every apply.
AISIX Enterprise and AISIX Cloud usage queues absorb longer control-plane stalls before dropping events.
AISIX Enterprise and AISIX Cloud budget aggregation and usage ingestion use indexed, bounded database queries instead of scanning unrelated records.

Fixes

The following fixes apply to AISIX Enterprise and AISIX Cloud control-plane services unless a narrower product is named.

Concurrent gateway-certificate issuance no longer exhausts the control-plane database pool, and failed issuance cannot leave a live credential without its private key.
Environment deletion revokes certificates atomically so a partial failure cannot disconnect gateways from an environment that still exists.
Transient failure while reading gateway compatibility no longer turns a resource save into an unrelated 500. Confirmed incompatibility still returns 422 DP_INCOMPATIBLE.
AISIX Enterprise GET /data_export reports 409 DATA_EXPORT_UNAVAILABLE when the data-plane manager has never started instead of 500 EXPORT_FAILED.
AISIX Enterprise export and import audit events record failed and disconnected attempts, including delivered export bytes.
The data-plane manager has a bounded graceful shutdown even with long-lived gateway watches.
Control-plane services no longer emit development route dumps during normal startup.
Usage ingestion clips bounded diagnostic fields instead of rejecting the complete batch.

1.3.0

Release date: September 18, 2026

This release makes configuration references resilient to renames, improves request and access-log accounting, and expands deployment support. The AISIX gateway now supports structured output across major provider platforms, several proxy listeners, and linux/arm64 images, while AISIX Enterprise adds organization export and import. The release also changes snapshot persistence, access-log timing, and several configuration validation rules that existing deployments should review.

For the complete AISIX Cloud Admin API endpoint and schema comparison, see changes from 1.2.0 to 1.3.0.

Breaking Changes

The following changes can require updates to gateway configuration, observability, stored resources, or integrations.

Traffic and Observability

Enable snapshot caching explicitly. If gateways that use etcd must recover from disk, set managed.snapshot_cache_enabled: true; snapshot_cache_path alone no longer enables persistence. In-memory last-known-good serving is unchanged. Without a snapshot, a connected gateway waits for its control plane and an AISIX OSS gateway using etcd waits for that configuration source.
Update request-count and success-rate expectations. Requests abandoned by callers now produce zero-cost usage rows with status 499 and error_class: client_disconnected, increasing request counts and lowering success rates without changing spend.
Read streamed access logs at the end of the stream. A streamed request now writes one final line with its terminal status, token counts, duration_ms, and other completed attribution instead of a 200 line at response start. For streams, latency_ms keeps its time-to-first-response meaning.

Deployment and Compatibility

AISIX Enterprise and AISIX Cloud: review configured service addresses. managed.cp_base_url and managed.cp_etcd_endpoint on the gateway, AISIX_CLOUD_DPMGR_BASE_URL on the control-plane API, and AISIX_DPMGR_BASE_URL on the data-plane manager must be valid HTTP or HTTPS URLs. A scheme-less host:port is interpreted as HTTPS.
Restore fixed container UIDs where required. The AISIX Enterprise chart no longer sets runAsUser, runAsGroup, or fsGroup for its application components. Configure them explicitly if your policies or mounted volumes require fixed IDs. The bundled PostgreSQL subchart retains its own UID; on OpenShift, disable it with --set postgresql.primary.podSecurityContext.enabled=false --set postgresql.primary.containerSecurityContext.enabled=false.

Stored Resources and Integrations

AISIX Enterprise and AISIX Cloud: re-save affected stored resources. Re-save an organization price whose audio-duration rate was updated after its first save or a cache policy pointing to a deleted and recreated model.
Correct invalid effort_mapping configuration before upgrading a gateway. {"": null} is invalid for both stored and AISIX OSS declarative models. An existing AISIX Enterprise or AISIX Cloud row that maps a source value to "" remains loadable but must be corrected before its next save; saving reserved empty or * source keys can return 422 DP_INCOMPATIBLE while an older gateway remains registered. An AISIX OSS resources file with that shape is rejected on load.
Handle protected model deletion. Deleting a model used as a rate-limit model scope now returns 409 MODEL_IN_USE instead of leaving a broken reference.
Update outbound User-Agent matching. Gateway requests now report aisix/<build version> instead of aisix/0.1.
Review upstream timeouts for Bedrock, object-store export, and Realtime. These paths now use upstream.pool_idle_timeout_secs (default 30 seconds) and upstream.connect_timeout_ms (default 5 seconds), replacing path-specific 90-second, 3.1-second, or unbounded behavior even when the settings were previously omitted.
Review host-scoped URL rewrites. Host-matched passthrough routes now receive URL rewrites. Add hosts to a rule when it should not apply to every matching host.
Review guardrails that depend on tool-result classification. Responses API input guardrails now scan replayed function names and arguments. Semantic and Azure text-moderation guardrails no longer treat tool results as user messages unless configured to read all messages.
Review AISIX Enterprise origin configuration. Cross-origin dashboard sign-in requires both the API CORS allowlist and trusted-origin configuration. The released Compose package does not forward AISIX_CLOUD_CORS_ALLOWED_ORIGINS, and the chart accepts browser-canonical IPv4-mapped IPv6 origins that the control-plane image rejects.

Upgrade Considerations

Use the architecture-specific AISIX Enterprise offline package. Select the linux-amd64 or linux-arm64 archive. The startup script refuses a package built for another architecture.
AISIX Enterprise and AISIX Cloud: adjust compatibility alerts. During the mixed-version window, a gateway older than 1.3.0 reports aisix_config_rejected_resources{kind="pricing"} 1 and keeps aisix_config_last_reload_successful at 0, while traffic, readiness, and later configuration updates continue. The control-plane Rejected Resources view remains empty. Do not page on the reload-success gauge for these gateways during the window.

New Features

New capabilities span models and providers, security and traffic control, and deployment operations.

Models and Providers

Structured output works across Anthropic, Vertex Gemini, and Amazon Bedrock paths. The gateway translates strict JSON-schema output into the target platform's supported form and preserves structured responses through streaming and protocol bridges.
The Responses-to-chat bridge carries reasoning, images, tool definitions, and usage. Responses conversations can use OpenAI-compatible chat targets with their expected request and response shape.
AISIX Enterprise and AISIX Cloud models can take their price from a shared pricing document. The gateway looks up pricing_key in the environment's pricing documents first and the shared catalog second. A model with no key, or a key that matches no document, uses its inline cost. Editing the pricing document reprices every model that names it. AISIX OSS declarative models continue using inline cost values.
Provider keys can resolve an endpoint to fixed addresses. This supports private-link and split-DNS deployments while preserving the configured hostname for TLS and HTTP routing.

Security and Traffic Control

Guardrails can evaluate only the latest user turn. The input_messages setting lets operators avoid repeatedly scanning the full replayed conversation.
URL rewrite rules can be limited by inbound host. The optional hosts list scopes a rule without creating separate listeners.
Custom webhooks support configured bodies, headers, and response capture. Templates can include request and resource context while secrets stay in protected configuration.

Deployment and Operations

AISIX Enterprise and AISIX Cloud organizations can be exported and imported. The control plane provides a complete organization transfer and a redacted support-bundle mode. For the current procedure, see Organization Backup and Restore.
Gateways can expose several proxy listeners with independent TLS. Each listener participates in readiness, graceful shutdown, and request handling.
Gateway and control-plane images support linux/arm64. AISIX Enterprise offline packages are published separately for AMD64 and ARM64.
AISIX Enterprise can expose control-plane Prometheus metrics and use a dashboard hosted at another trusted origin. The chart also supports mounting a private database CA for the dashboard workload shipped in this release.
AISIX Enterprise and AISIX Cloud MCP access controls can reference servers by identity. Anonymous access, API keys, and policies retain their intended server when it is renamed.

Improvements

Cache hits no longer claim an upstream that did not serve them. Routing and semantic Model Group hits leave target-provider attribution empty and report the cache layer. Direct-model hits continue to identify their model.
Buffered chat responses without upstream usage return the gateway estimate. Missing counters are filled from the estimate so the response agrees with recorded usage. Streaming responses remain based on upstream usage frames.
Protocol translation drops a tool choice when no tool remains. This prevents cross-provider requests with an empty converted tool list from being rejected by the upstream.
AISIX Enterprise and AISIX Cloud resource references survive renames. Model, MCP server, cache-policy, rate-limit, and pricing references use control-plane resource identity rather than mutable display names. Some protected references block deletion with 409; others are removed or remain visible but inert. Recreating a resource does not reconnect an old reference automatically.
An unrelated AISIX_* environment variable whose first segment is not a top-level configuration key is ignored with a warning instead of stopping gateway startup. A misspelled key beneath a recognized section still fails startup in this release.
Large configuration updates interfere less with request processing. Configuration snapshots, guardrail runtime state, and derived indexes are reused when their inputs have not changed rather than being rebuilt for every write.
High-cardinality metrics require less CPU to render. Label and histogram handling is more efficient without changing metric names or values.
Rate-limit evaluation and JWT authentication avoid unrelated-row scans. Large policy and identity sets have less effect on request latency.
Control-plane configuration delivery starts sooner after a write. Outbox work is processed with lower delay while preserving ordering.
MCP access logs include mcp_method, mcp_tool, tools_total, and tools_returned, distinguishing handshakes, tool calls, and filtered tool-list responses.

Fixes

Repeatedly excluded routing targets no longer block a request worker. Target selection terminates correctly when cooldown or health filtering repeatedly removes candidates.
Concurrent JWT requests share a valid key fetch. Requests no longer fail merely because another worker is refreshing the same issuer keys.
AISIX Enterprise and AISIX Cloud control-plane model listing no longer deadlocks under connection-pool pressure.
A gateway waiting for its initial configuration can shut down cleanly.
AISIX Enterprise and AISIX Cloud public control-plane URLs include a scheme. Dashboard-generated installation commands and data-plane manager certificates no longer receive an ambiguous host-only value.
Gateways connected to AISIX Enterprise or AISIX Cloud can read the shared pricing catalog without authorization warnings.
AISIX Enterprise and AISIX Cloud price updates apply every rate column. Later audio-duration changes are no longer discarded.
AISIX Enterprise and AISIX Cloud concurrent reference changes no longer leave deleted or renamed resources behind. Conflicting writes are serialized or refused instead of returning a server error or losing a rename.
The AISIX Enterprise and AISIX Cloud organization-backup form waits for the owner's role before presenting the redaction option, so it cannot appear enabled and then silently download an unredacted file.
AISIX Enterprise and AISIX Cloud can delete an environment containing internal model, cache-policy, or passthrough references without first dismantling the reference graph to avoid 500.
AISIX Enterprise and AISIX Cloud upgraded databases accept a valid kind: custom guardrail instead of rejecting it with 500 under a stale database constraint.

1.2.0

Release date: September 8, 2026

This release makes AISIX Enterprise and AISIX Cloud control-plane saves fail closed when a registered gateway cannot load the projected configuration. It also adds per-metric label selection, preserves raw cache-write usage, improves large configuration updates, and prevents Redis outages from indefinitely blocking requests.

For the complete AISIX Cloud Admin API endpoint and schema comparison, see changes from 1.1.0 to 1.2.0.

Breaking Changes

AISIX Enterprise and AISIX Cloud: handle 422 DP_INCOMPATIBLE on projecting writes. A write that a registered gateway cannot load is refused instead of succeeding with a row_rejected warning. Automation must stop branching on that warning code.
AISIX Enterprise and AISIX Cloud: re-save affected models. Re-save a model whose explicit background_model_check.ignore_statuses: [] was saved before this release. Earlier releases stored the default [408, 429]; saving again stores the intended empty list.
Review token-limit boundaries. tpm and tpd limits now refuse a request at the exact cap, and a token limit of 0 refuses every request.
Update compatibility-warning handling. warnings[].code no longer returns row_rejected and can return below_floor. A below_floor warning has an empty field because it concerns the gateway rather than one configuration field. For field_ignored, CompatibilityWarning.min_dp_version identifies the first gateway version that reads the field; for below_floor, it identifies the oldest gateway version supported by the control plane. affected_dp_count reports the registered gateways affected.

New Features

Operators can select labels per gateway metric family. observability.metrics.labels configures the complete supported label set for each family. AISIX Enterprise and AISIX Cloud dashboards include the selection in generated installation commands.
Raw OpenAI cache-write tokens are preserved by the gateway. The value reaches gateway responses and usage events without changing billing totals. AISIX Enterprise and AISIX Cloud also expose it through the AISIX Cloud Admin API, exports, and dashboard log details.

Improvements

Anthropic's billing-attribution line is removed before requests reach non-Anthropic providers. This prevents a per-request prefix from defeating upstream prompt caching. First-party Anthropic endpoints keep the line.
Redis and OTLP fail-open degradation is measurable. Redis, OTLP fan-out failure, and dropped-record metrics now emit labeled observations.

Fixes

An unavailable Redis has bounded request impact. Each rate-limit or cache redis: block accepts timeout_secs (default 5). Rate limiting falls back to per-process counters and caches miss within that timeout, then the affected subsystem short-circuits Redis for 30 seconds before one request probes for recovery.
Bulk configuration edits no longer rebuild unrelated gateway state. Request processing and liveness remain responsive while large changes are applied.
AISIX Enterprise and AISIX Cloud dashboard pages settle on a visible error state. Failed list and settings requests no longer leave a permanent spinner or blank surface.
An AISIX Enterprise or AISIX Cloud control-plane write reports success only after its transaction commits. Callers no longer receive a 2xx for a row that was rolled back.
Multi-line SSE frames preserve the gateway model name. Responses and Messages streams no longer leak the provider's model ID when one JSON event spans several data: lines.
AISIX Enterprise and AISIX Cloud dashboard token-mint failures back off. Open tabs no longer repeat a failing request sequence every polling interval.
AISIX Enterprise and AISIX Cloud routing-model audit events omit unset fields instead of recording unsupported null values.

1.1.0

Release date: September 7, 2026

This release improves gateway startup and recovery around etcd, removes configuration-size ceilings, and adds A2A client-header forwarding. The AISIX Enterprise chart also supports fixed API and dashboard NodePorts and correctly skips bundled-database readiness when an external database is configured.

For the complete AISIX Cloud Admin API endpoint and schema comparison, see changes from 1.0.0 to 1.1.0.

Breaking Changes

Review the gateway's etcd timeouts. etcd.dial_timeout_ms and etcd.request_timeout_ms take effect for the first time. Earlier examples set both to 5000; remove or resize request_timeout_ms when a configuration read can take longer. Detection of an unconfirmed watch also requires this setting.
Check existing api.service.nodePort and ui.service.nodePort values. These keys were previously ignored and are now rendered. Remove them to keep dynamic allocation. Both NodePorts serve plain HTTP; terminate TLS at a trusted proxy, and treat the dashboard Service as the upstream of the same-origin API proxy rather than an independent public endpoint.

New Features

A2A agents can forward selected client headers upstream. The allowlist applies to agent cards and JSON-RPC operations. Credential and tracing headers require exact names, and unsafe transport or AISIX-owned headers are never forwarded. When an HTTP/2 client sends cookie in repeated fields, only the first value is forwarded. Connected pre-1.1 gateways ignore the projected setting and relay nothing. AISIX OSS declarative resources must not add the field until the gateway is upgraded.

Improvements

A gateway binds its proxy listener only after applying a configuration. A first boot without a snapshot refuses proxy connections until configuration arrives instead of accepting traffic with no API keys. Admin and metrics readiness surfaces remain available for diagnosis.
An unreachable authenticated etcd no longer forces the gateway process to exit. The gateway continues retrying and begins serving when configuration arrives. Credentials actively rejected by etcd remain fatal.
A gateway waiting for its first configuration logs its state and retries.

Fixes

Expired or invalidated etcd authentication tokens recover without a gateway restart. The client reconnects, re-authenticates, and retries once.
Gateways load configuration sets larger than the former 4 MiB limit. Large environments no longer stop receiving updates because of a whole-response decode ceiling.
The AISIX Enterprise and AISIX Cloud control plane accepts larger projected resources. An unusually large individual resource no longer remains stuck in the delivery queue because of internal message limits.
Snapshot writes complete in order during shutdown. A quick stop after an update no longer loses the latest on-disk snapshot or allows an older write to replace a newer one.
An unconfirmed etcd watch is retried when etcd.request_timeout_ms is configured.
AISIX Enterprise no longer waits for the bundled PostgreSQL image when an external database is configured. Operators remain responsible for making the external database ready before startup.

1.0.0

Release date: September 4, 2026

This release makes guardrail decisions easier to tune and diagnose, expands secure client-header forwarding, and improves reasoning controls across provider protocols. It also changes cooldown defaults, Files API guardrail coverage, unsupported streaming errors, and stable image tags.

Breaking Changes

Model cooldown is opt-in. A direct model is removed from rotation after failures only when cooldown.enabled: true. Existing models that relied on an implicit cooldown must enable it explicitly.
Guardrails no longer scan Files API uploads, downloads, or file responses as one opaque body. Batch and fine-tuning request envelopes remain guarded; per-record JSONL screening is not provided.
Unreadable content follows the applicable guardrail's failure policy. A relevant fail-closed guardrail refuses the exchange, while an all-fail-open chain records an unscannable_body bypass and relays the content. fail_open applies to keyword and pii guardrails as well as remote guardrails. Held-back streamed output remains fail-closed when no safe content can be recovered.
Transcription and translation responses that cannot be decoded honor output failure policy. Fail-closed output guardrails return 422 content_filter with guardrail_unavailable; fail-open guardrails relay the original response and record the bypass.
Unsupported streaming requests fail before provider work begins. Streaming Completions and image-generation requests return 400 invalid_request_error instead of reaching an upstream and failing later.
Guardrail scope distinguishes caller-replayed reasoning from model-generated reasoning. Replayed reasoning is input and is scanned; model output reasoning remains outside output scanning. Signed Anthropic thinking can be blocked but is not rewritten.
Streaming guardrail errors use the endpoint's native error envelope. Anthropic Messages and Responses streams return their corresponding event shape.
Stable release images use immutable full-version tags. New stable releases publish X.Y.Z, latest, and SHA tags; abbreviated X.Y and X tags are no longer advanced.
Semantic guardrails require thresholds matched to their embedding model. Existing AISIX Enterprise and AISIX Cloud rows without thresholds keep enforcing 0.75. AISIX OSS declarative resources, and new or edited AISIX Enterprise and AISIX Cloud rules, must set deny_threshold when deny_examples is non-empty and allow_threshold when allow_examples is non-empty.
Invalid guardrail configuration is reported as configuration state. Malformed rows appear in status and rejection signals instead of silently disappearing.

New Features

Semantic guardrails can be tested and measured. AISIX Enterprise and AISIX Cloud dashboards can probe a saved rule before attachment. The gateway records the evaluated score, threshold, direction, and example index without storing screened text.
Client-header forwarding covers provider keys, MCP servers, passthrough routes, and Realtime. forward_client_headers is the allowlist. Credential and trace headers require exact entries, and forwarded credentials replace rather than duplicate gateway credentials. Bedrock signing remains gateway-owned.
Direct models can normalize reasoning-effort values. effort_mapping performs one exact mapping after target selection across native and translated provider paths.

Improvements

Fail-open and fail-closed outcomes are observable across guarded proxy surfaces. Usage events and metrics report bypass reasons and early guardrail refusals.
Reasoning controls survive protocol translation. Anthropic and OpenAI effort and structured-output settings map to the target protocol when supported.
Routing failures identify the affected target and reason. Cooldown and health exclusions, failed attempts, Responses latency, and ensemble usage now carry consistent diagnostic context.

Fixes

Rerank and Realtime responses preserve the gateway model name. Provider model IDs no longer replace the name addressed by the caller.
Unsupported provider capabilities return 501 without spending the retry budget.
Wildcard model references are validated before they become inert or widen API-key access. Existing references are validated again when the referenced value changes.
Buffered stream guardrails handle complete SSE framing. Multi-line and CRLF events, missing final terminators, and non-SSE JSON responses are evaluated without releasing unread content.
The AISIX Enterprise and AISIX Cloud dashboard preserves stale resource references during unrelated edits instead of silently clearing them.

1.8.0​

Breaking Changes​

Budget Decisions Continue Through Control-Plane Outages​

AISIX Enterprise Chart Values and Service Routing Change​

Gateway Observability Contracts Change​

Gateway Configuration and Client-Address Handling Change​

Gateway Credential Handling No Longer Falls Back Across Present Headers​

Multi-Wildcard Patterns Are Rejected on Save​

AISIX Cloud Admin API Validation Becomes Stricter​

Upgrade Considerations​

The Supported Gateway and Control-Plane Floor Moves to 1.6.0​

Rolling Back Can Restore Overly Broad Guardrail Attachments​

Complete the AISIX Enterprise Data-Plane Manager Rollout​

New Features​

Delegate Caller Identity to MCP Servers​

Protect Dashboard Accounts with Two-Factor Authentication and Password Policies​

Notify Organization Owners About New Releases​

Improvements​

Fixes​

1.7.1​

Breaking Changes​

Upgrade Considerations​

Known Issues​

New Features​

Improvements​

Endpoints and Providers​

Guardrails​

Observability and Deployment​

Fixes​

1.7.0​

Breaking Changes​

Observability and Usage​

Security, Cost, and Client Behavior​

Deployment and Compatibility​

AISIX Cloud Admin API Callers Must Update​

Upgrade Considerations​

Known Issues​

New Features​

Cost, Pricing, and Usage​

Endpoints and Providers​

Observability and Dashboard​

Improvements​

Observability and Usage​

Endpoints and Providers​

AISIX Enterprise Deployment​

Fixes​

1.6.0​

Breaking Changes​

Observability and Traffic​

AISIX Cloud Admin API Callers Must Update​

Upgrade Considerations​

Authentication and Dashboard​

Deployment and Database​

New Features​

Improvements​

Observability, Usage, and Cost​

Guardrails and Provider Requests​

AISIX Enterprise and AISIX Cloud​

Fixes​

1.5.0​

Breaking Changes​

Usage and Observability​

Guardrails and Traffic​

Upgrade Considerations​

Known Issues​

New Features​

Improvements​

Usage and Observability​

Guardrails and Passthrough Traffic​

Fixes​

1.4.0​

Breaking Changes​

Upgrade Considerations​

New Features​

Improvements​

Fixes​

1.3.0​

Breaking Changes​

Traffic and Observability​

Deployment and Compatibility​

1.8.0

Breaking Changes

Budget Decisions Continue Through Control-Plane Outages

AISIX Enterprise Chart Values and Service Routing Change

Gateway Observability Contracts Change

Gateway Configuration and Client-Address Handling Change

Gateway Credential Handling No Longer Falls Back Across Present Headers

Multi-Wildcard Patterns Are Rejected on Save

AISIX Cloud Admin API Validation Becomes Stricter

Upgrade Considerations

The Supported Gateway and Control-Plane Floor Moves to 1.6.0

Rolling Back Can Restore Overly Broad Guardrail Attachments

Complete the AISIX Enterprise Data-Plane Manager Rollout

New Features

Delegate Caller Identity to MCP Servers

Protect Dashboard Accounts with Two-Factor Authentication and Password Policies

Notify Organization Owners About New Releases

Improvements

Fixes

1.7.1

Breaking Changes

Upgrade Considerations

Known Issues

New Features

Improvements

Endpoints and Providers

Guardrails

Observability and Deployment

Fixes

1.7.0

Breaking Changes

Observability and Usage

Security, Cost, and Client Behavior

Deployment and Compatibility

AISIX Cloud Admin API Callers Must Update

Upgrade Considerations

Known Issues

New Features

Cost, Pricing, and Usage

Endpoints and Providers

Observability and Dashboard

Improvements

Observability and Usage

Endpoints and Providers

AISIX Enterprise Deployment

Fixes

1.6.0

Breaking Changes

Observability and Traffic

AISIX Cloud Admin API Callers Must Update

Upgrade Considerations

Authentication and Dashboard

Deployment and Database

New Features

Improvements

Observability, Usage, and Cost

Guardrails and Provider Requests

AISIX Enterprise and AISIX Cloud

Fixes

1.5.0

Breaking Changes

Usage and Observability

Guardrails and Traffic

Upgrade Considerations

Known Issues

New Features

Improvements

Usage and Observability

Guardrails and Passthrough Traffic

Fixes

1.4.0

Breaking Changes

Upgrade Considerations

New Features

Improvements

Fixes

1.3.0

Breaking Changes

Traffic and Observability

Deployment and Compatibility