Deprecation and shutdown of GenAI Incident Summary (generative AI Insights)
The standalone GenAI Incident Summary (generative AI Insights) feature in Apigee Advanced API Security Abuse Detection, currently in Preview, is deprecated and shut down as of July 9, 2026. This feature used Google Cloud generative AI large language models (LLMs) to provide automated summaries and mitigation guidance for security incidents identified by the Abuse Detection clustering tool.
For more information, see GenAI Incident Summary deprecation.
On July 10, 2026 we released an updated version of the Apigee hybrid software, v1.16.7.
Various security and CVE fixes are included in this release.
]]>An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allowed an authenticated attacker to exfiltrate cross-tenant data.
This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed. Apigee hybrid was not affected.
For more information, see CVE-2026-12879.
]]>On July 6, 2026, we released an updated version of the Apigee UI.
ParsePayload policy and payload operations matching in the Apigee UI
The Apigee UI now supports the new payload operations matching feature:
For more information, see Manage MCP tool access with API products.
Support for payload operations matching in API Products
Apigee now supports payload operations matching (payloadOperationGroup) in API
Products, powered by the new ParsePayload policy.
Payload operations matching allows you to define API Product operations that match fields within request payloads, such as JSON-RPC requests used by the Model Context Protocol (MCP). Apigee can then route, monetize, authorize, and apply distinct quota limits to traffic based on the derived payload operation.
This feature is available to all Apigee X customers in all supported regions with no additional charge. For more information, see Manage MCP tool access with API products and the ParsePayload policy reference.
]]>On July 3, 2026 we released an updated version of the Apigee hybrid software, v1.15.5.
Various security and CVE fixes are included in this release.
]]>Apigee Emulator
On June 24, 2026, we released Apigee Emulator version 2.0.1.
This is a security-only hotfix release on top of v2.0.0 that addresses 10 security vulnerabilities in the Netty networking library and the embedded Cassandra Go standard library health-check binary. There are no functional, API, or configuration changes -- v2.0.1 is a drop-in replacement for v2.0.0.
The emulator image is available at Google Artifact Registry.
To upgrade, update the emulator version in your VS Code Cloud Code settings
to 2.0.1. See
Manage the Apigee Emulator
for details.
Apigee Emulator
4.1.135.Final (from 4.1.133.Final) and pinned all
transitive netty-* artifacts via netty-bom.1.25.11
(from 1.25.10) in the embedded health-check binary.netty-tcnative-boringssl-static classifier variants from
2.0.53.Final to 2.0.77.Final.Apigee Emulator
This release addresses 10 security vulnerabilities in the Netty networking
library and the embedded Go standard library. All Netty fixes come from
upgrading to 4.1.135.Final; all Go standard library fixes come from a
Cassandra base image rebuild against Go 1.25.11.
| CVE | Component |
|---|---|
| CVE-2026-50010 | Netty (netty-handler) |
| CVE-2026-50020 | Netty (netty-codec-http) |
| CVE-2026-50560 | Netty (netty-codec-http2) |
| CVE-2026-48043 | Netty (netty-codec-http2) |
| CVE-2026-44249 | Netty (netty-handler) |
| CVE-2026-45416 | Netty (netty-handler) |
| CVE-2026-47244 | Netty (netty-codec-http2) |
| CVE-2026-27145 | Go standard library |
| CVE-2026-42504 | Go standard library |
| CVE-2026-42507 | Go standard library |
On June 22nd, 2026, we released an updated version of Apigee (1-17-0-apigee-10).
| Bug ID | Description |
|---|---|
| 519996459 | Security fix for Apigee. Upgraded the Apigee ingress gateway to patch the following vulnerabilities:
|
| N/A | Security fix for Apigee infrastructure. |
| Bug ID | Description |
|---|---|
| 515788622 | Upgraded the default outbound TLS protocol from TLSv1.2 to TLSv1.3 on JVMs that support it. Per-proxy <SSLInfo><Protocols> settings continue to take precedence, and the new HTTPClient.outbound.tls.protocol override lets operators force a specific protocol. |
| 184266748 | Fixed an issue where ApigeeDatastore TLS certificate creation could fail in namespaces with longer names when the certificate common name exceeded the 64-byte limit. |
| 286069772 | Added a per-gateway proxyProtocol.mode property (strict, permissive, disable) on Apigee ingress gateway components to opt in to HAProxy PROXY-protocol parsing. The property defaults to disable. |
| N/A | Updates to infrastructure and libraries. |
On June 19, 2026 we released an updated version of the Apigee hybrid software, v1.16.6.
HAProxy PROXY-protocol support on Apigee ingress gateway
In this release, you can opt into HAProxy PROXY-protocol parsing by setting the ingressGateways[].proxyProtocol.mode property (with options strict, permissive, or disable) in your overrides configuration file. The property defaults to disable.
Various security and CVE fixes are included in this release.
]]>On June 18th, 2026, we began maintenance updates of Apigee instances configured for maintenance windows.
If you set a preferred window for maintenance for your instance, and your instance version is below 1-17-0-apigee-9, your instance will be updated to 1-17-0-apigee-9 within the next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.
For more information on participating in scheduled maintenance windows, see Maintenance overview and Manage Apigee instance maintenance windows.
]]>On June 16, 2026 we released an updated version of the Apigee hybrid software, v1.14.6.
Various security and CVE fixes are included in this release.
]]>On June 8th, 2026, we released an updated version of Apigee (1-17-0-apigee-9).
| Bug ID | Description |
|---|---|
| 514384893 | Security fix for Apigee. Hardened the Script policy to block server-side request forgery (SSRF) to link-local addresses. |
| N/A | Security fix for Apigee infrastructure. |
| Bug ID | Description |
|---|---|
| 512850756 | Added observability metrics for the OpenTelemetry trace export pipeline, reporting spans exported, export latency, batch size, and dropped spans. |
| 515039499 | Fixed an issue where OpenTelemetry trace export over HTTP could fail to authenticate when sent through a forward proxy that requires basic authentication. |
On June 8, 2026 we released an updated version of the Apigee hybrid software, v1.16.5.
Various security and CVE fixes are included in this release.
]]>On June 2nd, 2026, we released an updated version of Apigee Cassandra.
| Bug ID | Description |
|---|---|
| Apigee Cassandra security update | Security fix for Apigee Cassandra infrastructure. This addresses the following vulnerabilities: |
On May 30, 2026 we released an updated version of the Apigee hybrid software, v1.15.4.
Various security and CVE fixes are included in this release.
]]>On May 29, 2026, we released an updated version of the Apigee UI.
Apigee EventFlow now supports the DataCapture policy
You can now use the DataCapture policy within an EventFlow to extract and persist data from server-sent events (SSE) streams, such as token counts and other fields from streaming LLM responses. For more information, see Use the DataCapture policy to capture token counts.
Manage Spaces in the Apigee UI
You can now create, view, update, and delete spaces, and manage their Identity and Access Management (IAM) policies directly in the Apigee UI. Previously, these actions could only be performed using the Apigee API. For more information, see Apigee Spaces overview.
]]>Apigee Emulator
On May 22, 2026, we released Apigee Emulator version 2.0.0.
Starting with this release, the Apigee Emulator is versioned and released independently from Apigee hybrid. This enables faster delivery of security patches and updates without waiting for hybrid release cycles. The emulator image continues to be available at Google Artifact Registry.
To use the new version, update the emulator version in your VS Code Cloud Code
settings to 2.0.0. See
Manage the Apigee Emulator
for details.
Apigee Emulator
Apigee Emulator
This release addresses 78 security vulnerabilities across Cassandra base image, Go standard library, Java dependencies, and Python packages. Key fixes include:
| CVE | Component |
|---|---|
| CVE-2022-42003 | Jackson Databind |
| CVE-2022-42004 | Jackson Databind |
| CVE-2022-38749 | SnakeYAML |
| CVE-2022-38750 | SnakeYAML |
| CVE-2023-2976 | Google Guava |
| CVE-2020-8908 | Google Guava |
| CVE-2024-12798 | Logback |
| CVE-2025-22866 | Go stdlib |
| CVE-2025-22870 | Go stdlib |
| CVE-2022-40897 | Python setuptools |
And 68 additional CVEs fixed through updated upstream dependencies.
On May 22, 2026 we released an updated version of the Apigee hybrid software, v1.14.5.
Various security and CVE fixes are included in this release.
v1.16.0On May 22, 2026 we released an updated version of the Apigee UI.
The Management > Instances page now displays Apigee hybrid instances. The display includes the instance name, location, and runtime version.
See Managing instances.
Starting May 22, 2026, the Apigee Emulator is versioned and released independently from Apigee hybrid. Emulator updates, including security patches, are no longer tied to hybrid release cycles.
The emulator image continues to be available at
gcr.io/apigee-release/hybrid/apigee-emulator. The first independent release
is v2.0.0.
For emulator release notes going forward, see Apigee release notes.
]]>On May 21st, 2026, we released an updated version of Apigee (1-17-0-apigee-8).
| Bug ID | Description |
|---|---|
| 514973778 | Fixed Model Armor response parsing to gracefully handle unknown fields, so future Model Armor field additions no longer cause policy failures. |
On May 21, 2026 we released an updated version of the Apigee hybrid software, v1.16.4.
| Bug ID | Description |
|---|---|
| 515424331 | Fixed an issue with missing container images in the gcr.io/apigee-release/hybrid/ repository. |
On May 20, 2026, we published a security bulletin for Apigee.
A vulnerability was found in Apigee
(CVE-2026-2264)
where the IntegrationRegion
parameter in the SetIntegrationRequest policy lacks validation,
allowing for Server-Side Request Forgery (SSRF) and service account token
exfiltration. The issue arises when an attacker can control a flow variable used
for IntegrationRegion, leading to requests being sent to an
attacker-controlled host with the service account token.
Security bulletin published: GCP-2026-034
]]>On May 19, 2026 we released an updated version of the Apigee hybrid software, v1.16.3.
| Bug ID | Description |
|---|---|
| 512866352 | Fixed an issue where the apigee-redis pod entered a CrashLoopBackOff state when deployed with Vault-based secret injection due to a GLIBC version mismatch in the bundled /bin/sh and /bin/cat binaries. |
Custom environment variables for Guardrail pods (guardrails.envVars)
Starting in version v1.16.3, you can inject custom environment variables into Apigee hybrid Guardrail pods using the new guardrails.envVars property in overrides.yaml. This is most commonly used to set NO_PROXY (or no_proxy) so that Guardrail pods bypass a configured forward HTTP proxy when calling internal in-cluster endpoints such as the Kubernetes API server, which previously failed in restricted-network environments with a global httpProxy configured. The property is supported on Guardrail pods for the following components: apigee-datastore, apigee-env, apigee-ingress-manager, apigee-operator, apigee-org, apigee-redis, apigee-telemetry, and apigee-virtualhost.
Example:
guardrails:
envVars:
NO_PROXY: 'kubernetes.default.svc,172.20.0.1'
On May 13, 2026 we released an updated version of the Apigee hybrid software, v1.16.2.
Basic Auth credential support for forward proxies
Starting in version v1.16.2, Apigee hybrid runtime components can accept credentials for an upstream forward proxy that enforces HTTP Basic Auth. You can now configure a Basic Auth username and password for the forward proxy in your overrides.yaml. This resolves known issue tracked in b/499322601. See Configure Apigee hybrid to use a forward proxy.
Sidecar authentication for Workload Identity Federation on AKS and EKS
Starting in version v1.16.2, you can now use a sidecar along with Workload Identity Federation on AKS and EKS to mount security tokens from your preferred identity provider (IDP) for service account authentication. This method is an alternative to using Kubernetes Projected Service Account Tokens, and is useful when you need to integrate with a custom Identity Provider. See Use sidecar authentication for Workload Identity Federation on AKS and EKS.
| Bug ID | Description |
|---|---|
| 485738013 | Fixed an issue where API products with LLMTokenQuota operations were not enforcing model-based access restrictions, allowing requests to models not listed in the product to bypass the operations check. |
| 479288727 | Fixed an issue where the Apigee UI and API reported a 10+ minute delay in deployment status after performing a proxy deployment. |
| 499223890 | Fixed an issue where the runtime could not handle HTTP proxy passwords containing special characters in Apigee hybrid 1.16.0-hotfix-1 configurations. |
| 500861814 | Fixed an issue that caused excessive Message Processor (MP) upscaling and failure to downscale. |
| 510438578 | Fixed an ingestion-blocking issue with apigee-stackdriver-prometheus-sidecar in Apigee hybrid 1.16.1. |
Various security and CVE fixes are included in this release.
]]>MCP tools support for Agentic AI workflows (Preview)
API hub now exposes read-only APIs as Model Context Protocol (MCP) tools. Agentic AI applications can now use the standard MCP tools/list and tools/call methods to list and inspect API hub resources, including APIs, specs, versions, and deployments.
This feature is in Public Preview. For more information, see API hub MCP reference.
On May 12th, 2026, we released an updated version of Apigee (1-17-0-apigee-7).
| Bug ID | Description |
|---|---|
| 511325186, 505460952, 502250074, 491231600, 497357701, 509560467, 496969438, 495897297, 495033618, 511332617, 505183435, 500735547, 500890221 | Security fix for Apigee infrastructure. This addresses the following vulnerabilities: |
| Bug ID | Description |
|---|---|
| 480260846 | Improved XML processing security to prevent external entity injection. |
| 510061670, 505723451, 503723862, 503817773 | Improved security in OAuthV2 policy. |
| 505645076 | Fixed a security issue in OAuthV2 policy to prevent unauthorized token injection. |
| 503047744, 410026138, 496021751 | Improved security isolation for PythonScript policy execution. |
| 469694040 | Fixed an issue where custom security policies could intermittently fail to apply, and improved security policy resolution to ensure correct policy selection. |
| 502971220 | Fixed a concurrency issue to improve stability under high load. |
| 509692565 | Fixed content-length header handling in external processing to prevent incorrect values. |
| 282207038 | Improved performance while listing apps on scale. |
| 501102321 | Fixed recurring fee calculation in monetization to correctly apply rate plan overrides. |
| 449729840, 502604752 | Fixed streaming response handling to prevent race conditions in bidirectional flows. |
| 507167063 | Fixed preservation of client request IDs during proxy chaining. |
| 507580304 | Improved IPv4 address normalization for consistent access control evaluation. |
| 502692267 | MCP to handle /.well-known/oauth-protected-resource/mcp resource paths. |
| 430170696 | Changed the error response from 500 to 401 for expired consumer keys. |
| 480770263 | Fixed SpikeArrest policy to handle edge cases that previously caused 500 errors. |
| 500861814 | Gracefully handle connection failures involving the forward proxy, resolving an issue where port exhaustion could trigger aggressive retry storms, excessive CPU usage, and unnecessary scaling. |
| 500313309 | Fixed SSE streaming detection logic. |
| 494304819 | Hardened message processor management ports by blocking external access to internal management endpoints. |
| 469642464 | Improved input validation in AI protection policies to prevent Server-Side Request Forgery. |
| 472526232 | Improved SAML assertion validation. |
| 494590020 | Added enforcement for product association in OAuthV2 flow. Apps without valid products are now denied. |
| 479288727 | Improved performance and reduced redundant work in ingress status watcher. |
| N/A | Updates to infrastructure and libraries. |
Unified MCP Proxy Configuration in API hub (Preview)
API hub allows you to create and deploy Model Context Protocol (MCP) discovery proxies. Select specific API operations from your registered catalog, bundle them into an MCP server, and automatically deploy them as discovery proxies in your Apigee project. This feature eliminates the need to manually author MCP specifications in Apigee.
This feature is in Public Preview. For more information, see Manage MCP proxies.
]]>On May 4, 2026 we released an updated version of the Apigee hybrid software, v1.15.3.
| Bug ID | Description |
|---|---|
| N/A | Security fixes for apigee-asm-ingress. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-asm-istiod. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-connect-agent. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-fluent-bit. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-hybrid-cassandra. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-hybrid-cassandra-client. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-kube-rbac-proxy. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mart-server. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mint-task-scheduler. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-open-telemetry-collector. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-operators. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prom-prometheus. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prometheus-adapter. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-redis. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-runtime. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-stackdriver-logging-agent. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-synchronizer. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-udca. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-watcher. This addresses the following vulnerabilities: |
On April 29th, 2026, we began maintenance updates of Apigee instances configured for maintenance windows.
If you set a preferred window for maintenance for your instance, and your instance version is below 1-17-0-apigee-4, your instance will be updated to 1-17-0-apigee-4 within the next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.
For more information on participating in scheduled maintenance windows, see Maintenance overview and Manage Apigee instance maintenance windows.
]]>On April 27, 2026 we released an updated version of the Apigee hybrid software, v1.14.4.
Sidecar authentication for Workload Identity Federation on non-GKE platforms
Starting in version v1.14.4, you can now use a sidecar along with Workload Identity Federation on non-GKE platforms to mount security tokens from your preferred identity provider (IDP) for service account authentication. See Use sidecar authentication for Workload Identity Federation on non-GKE platforms.
| Bug ID | Description |
|---|---|
| 471527485, 471173296, 471172082, 471171833 | Security fixes for apigee-synchronizer. This addresses the following vulnerabilities: |
| 471290390, 471199955, 471197958, 470990914 | Security fixes for apigee-runtime. This addresses the following vulnerabilities: |
| 470992132, 470991089, 470989623, 470989232, 470988977 | Security fixes for apigee-mart-server. This addresses the following vulnerabilities: |
| 470953507, 470953254, 470952893 | Security fixes for apigee-hybrid-cassandra. This addresses the following vulnerabilities: |
| 451224723, 451224123 | Security fixes for apigee-fluent-bit. This addresses the following vulnerabilities:
|
| N/A | Security fixes for apigee-asm-ingress. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-asm-istiod. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-connect-agent. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-envoy. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-hybrid-cassandra-client. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-kube-rbac-proxy. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-mint-task-scheduler. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-open-telemetry-collector. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-operators. This addresses the following vulnerability: |
| N/A | Security fixes for apigee-prom-prometheus. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-prometheus-adapter. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-redis. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-stackdriver-logging-agent. This addresses the following vulnerabilities:
|
| N/A | Security fixes for apigee-udca. This addresses the following vulnerabilities: |
| N/A | Security fixes for apigee-watcher. This addresses the following vulnerability: |
On April 20, 2026 we released an updated version of the Apigee hybrid software, v1.16.1.
| Bug ID | Description |
|---|---|
| 469900037 | Apigee hybrid now supports LLMTokenQuota and PromptTokenLimit policies. |
| 502577947 | Enhanced the ParsePayload policy to support a broader set of Model Context Protocol (MCP) methods and implemented governance bypass for essential system-level methods. |
| 503029410 | Removed PII from ParsePayload policy outputs to improve security and privacy. |
| Bug ID | Description |
|---|---|
| 485998102, 482978613 | Security fixes for apigee-runtime, apigee-mart-server, and apigee-synchronizer. This addresses the following vulnerabilities: |
| 471527485, 471173296, 471172082, 471171833 | Security fixes for apigee-synchronizer. This addresses the following vulnerabilities: |
| 454672970 | Security fix for apigee-runtime. This adds strict input validation to the IntegrationRegion parameter in the SetIntegrationRequest policy to prevent potential server-side request forgery (SSRF). |
| 493067053, 493061344, 492959383, 492957334, 492359443, 492358696, 492067139, 490280970, 489908390, 489907729, 489489437, 488070159, 485580973 | Security fixes for apigee-hybrid-cassandra. This addresses the following vulnerabilities: |
| 494902472, 493902764, 493747531, 493747186, 493066364, 492956556, 492812098, 492810982, 492737291, 492733739, 492067214, 491191150, 490628133, 490627481, 490279890, 490278396, 489905507, 489904404, 477290192 | Security fixes for apigee-kube-rbac-proxy. This addresses the following vulnerabilities: |
| 494874583, 493352686, 493350530, 493065065, 492958506, 492958221, 492810419, 492734198, 492360831, 491606491, 491602959, 490628958, 490628720, 490625335, 489487288, 477290192 | Security fixes for apigee-watcher. This addresses the following vulnerabilities: |
| 493904046, 493748763, 493353749, 492959837, 492959353, 492958532, 492734063, 492358967, 491163162, 489907974, 489494841, 477290192 | Security fixes for apigee-operators. This addresses the following vulnerabilities: |
| 493940049, 493935866, 492812693, 492811208, 490847438, 490285784, 443494822, 430609333, 428036268, 428035602 | Security fixes for apigee-fluent-bit. This addresses the following vulnerabilities: |
| 494873893, 492957899, 492811896, 492735230, 492734621, 492362013, 492358145, 492044636, 491192904, 491163716, 490628292, 490283689, 489908590, 489487798, 485998102, 482978613 | Security fixes for apigee-open-telemetry-collector. This addresses the following vulnerabilities: |
| 495206280, 492736206, 492358267, 491606961, 491603879, 490845184, 490842872, 490626346, 490625529, 490278258, 489155677 | Security fixes for apigee-udca. This addresses the following vulnerability: |
| 492959491, 492959470, 492959266, 492812323, 492736535, 492736355, 492736200, 492734720, 492549333, 492528258, 492528186, 492361814, 492360845, 492359742, 492359020, 492039084, 490625473, 489488025, 489120498 | Security fixes for apigee-prometheus-adapter. This addresses the following vulnerability: |
| 492959323, 492958717, 492813153, 492736850, 492736096, 492735265, 492360419, 492359937, 492359237, 492041473, 491604321, 491602140, 490847572, 490627493, 490282905, 489151338, 489127231 | Security fixes for apigee-redis. This addresses the following vulnerability: |
| 492736867, 492735320, 492550947, 492549407, 492360316, 492359543, 492358244, 491608063, 491603446, 491169265, 490282128, 490278007, 490276323, 489127588, 489124394 | Security fixes for apigee-asm-ingress. This addresses the following vulnerability: |
| 492956844, 492956300, 492812417, 492811007, 492810814, 492528300, 492361776, 492360457, 492360310, 492360053, 492358006, 492037890, 491606683, 489492294, 489152529 | Security fixes for apigee-asm-istiod. This addresses the following vulnerabilities: |
Relaxed limitation on header name for Client IP resolution
The client IP can now be resolved from any header, not just the X-Forwarded-For header. The most common headers are X-Forwarded-For or True-Client-Ip.
For more information, see Client IP resolution.
]]>Agent Registry integration support for MCP metadata (Preview)
API hub now includes a managed integration with Agent Registry to automatically synchronize Model Context Protocol (MCP) servers and tools metadata. This feature enables AI agents to discover and interact with the APIs registered in your hub without manual configuration.
This feature is in Public Preview. For more information, see Manage Agent Registry integration.
Correction to April 2, 2026 release note: Deployment disruption for Apigee Drupal Portal via Google Cloud Marketplace
For the deployment disruption announced on April 2, the announcement noted that deployment and management functionality using Google Cloud Deployment Manager would definitely be unavailable during the transition. This statement is incorrect. The functionality might be unavailable.
See the Known issue for more information.
On April 6th, 2026, we released an updated version of Apigee.
This change introduces the new apigee.coreServiceAgent IAM role for
Apigee. Effective immediately, use apigee.coreServiceAgent instead of the
apigee.serviceAgent role.
For information on the new role, see
apigee.coreServiceAgent.
Deployment disruption for Apigee Drupal Portal via Google Cloud Marketplace
Google Cloud Deployment Manager was deprecated as of March 31, 2026. We are currently transitioning the Apigee Drupal Portal Marketplace solution to use Infrastructure Manager. During this transition period, some deployment and management functionalities are unavailable.
Impact:
gcloud deployment-manager tool.Workaround & Resolution: Any configuration changes or management tasks must be performed directly on the individual Google Cloud resources (Compute Engine, Cloud SQL, etc.) rather than through the Marketplace UI.
We are actively working to release the updated Infrastructure Manager-based solution.
]]>On March 31st, 2026, we released an updated version of Apigee.
General Availability (GA) launch of Model Context Protocol (MCP) in Apigee
With this release, Model Context Protocol (MCP) in Apigee is generally available, enabling you to expose your Apigee APIs as MCP tools to agentic applications.
Any MCP client that supports remote MCP endpoints over HTTP/S can access these tools. Because the endpoints are managed, you don't need to install or manage local MCP servers, remote MCP servers, or additional infrastructure to enable agentic applications to access your services.
MCP in Apigee is available for Subscription, Pay-as-you-go, and Evaluation organizations, including organizations with Data Residency and VPC Service Controls enabled.
For more information on using MCP in Apigee, see MCP in Apigee overview.
Enhanced OAS server URL path handling for MCP in Apigee
With this feature enhancement, your OpenAPI specification (OAS) configurations behave exactly
as defined in the OAS standard, automatically combining the server.url base path value with individual operation paths.
For example, a server URL ofhttps://example.com/api/v1 paired with a path of /users will now correctly route to https://example.com/api/v1/users without additional manual intervention.
If you previously prepended base paths to your OAS paths entries, remove the path segment from your servers.url field to prevent
duplication. For example, change https://example.com/api/v1 to https://example.com.
For more information, see Create an OpenAPI 3.0 specification.
Updated MCP server target endpoint for MCP Discovery Proxies
With the GA launch of Model Context Protocol (MCP) in Apigee, the structure of the MCP server target endpoint for MCP Discover Proxies has changed to ORG_NAME.mcp.apigee.internal.
Private preview customers using the previous format (mcp.apigee.internal) are encouraged to update their proxies to reflect the new structure. Existing endpoints using the old format will continue to work, but new endpoints will use the new structure.
Known Issue 496552286: Deployment fails for MCP Discovery Proxies in regions with capacity limitations.
For more information, see Apigee known issues.
]]>On March 26th, 2026, we released an updated version of Apigee (1-17-0-apigee-6).
| Bug ID | Description |
|---|---|
| 495897297, 495909767 | Security fix for Apigee infrastructure. This addresses the following vulnerabilities: |
| Bug ID | Description |
|---|---|
| N/A | Updates to infrastructure and libraries. |
On March 19th, 2026, we began maintenance updates of Apigee instances configured for maintenance windows.
If you set a preferred window for maintenance for your instance, and your instance version is below 1-16-0-apigee-6, your instance will be updated to 1-16-0-apigee-6 within the next seven to 21 days. A notification containing the expected date of upgrade will be sent within the next two business days.
For more information on participating in scheduled maintenance windows, see Maintenance overview and Manage Apigee instance maintenance windows.
]]>