Project: Azure API Management (Orchestration & Management / API Gateway)
File: api-management-service.md

We added support for type to . Customer-managed public IP is no longer required when . Changing the subnet will remove public IP from a previously deployed service instance. We now correctly import schemas from OpenAPI 3.1 specifications. API imports will no longer fail because of OData specification warnings. However, errors will still cause import failures. Liquid template and policy expressions with XML special characters, such as "<" or ">", no longer result in runtime failures. No new releases No new releases On June 14, 2024, were introducing to the Workspaces feature. You may have to take action to continue using workspaces beyond June 14, 2024. Weve introduced several new features and improvements to workspaces: You can now create and manage certificates, backends, diagnostics, and loggers inside a workspace with the `2023-09-01-preview` management API version.Azure portal interface will be released soon. You can now use `context.Workspace` in policy expressions. "default-workspace" is now a reserved workspace resource name. We now preserve the `format` and `schema` properties of the form-data parameters when importing OpenAPI APIs. HTTP version information will now be included in the . Weve added support for HS512 and RS512 algorithms in the policy. `client-application-ids` element is now optional in policy. We've made a couple improvements to the GraphQL support: We've added support for in GraphQL Arrays can now be used within the policy to project the onto the list of primitive data types specified in the GraphQL schema An notification will be sent to customers when they inadvertantly delete the property from the public IP resource assigned to API Management. We've made several improvements to the in the Standard v2 tier: We will now detect if the prerequisites for VNet integration are not being met - i.e., , and fail the deployment faster. All traffic from the VNet-integrated Standard v2 service instances to the Internet will be now routed via the integrated VNet. The outbound IP will now be populated and shows its respective value. Weve resolved the issue where Azure API Management would incorrectly log requests that were rejected due to public network access is disabled. This fix ensures that logs and metrics in Azure Monitor now exclude these rejected requests when API Management is . An attempt to create diagnostics in a workspace that doesn't exist will now return a `404 Not Found` error. Previously, API Management returned a `500 Internal Server Error` response. Workspace users can no longer override diagnostics settings defined for all APIs on the service level. Exporting APIs with empty or whitespace-only examples no longer produces an error. Optional string query parameters are no longer added to the API operation's URL template. -`$DevPortalUrl` variable in the developer welcome email template now returns a new developer portal URL. Previously, it returned a legacy developer portal URL. The policy now performs a case-insensitive certificate ID validation. Previously, request processing would fail when the casing between the certificate ID in the policy and in the request didnt match. We've fixed an issue preventing recovery of the Basic v2 and Standard v2 service instances. . The `validate-jwt` now works with tokens signed PS256 signature algorithm. We raised the content size limit in the `validate-content` to 4MB. A current API revision can now be addressed using a in addition to the API's base

Self-hosted gateway using to connect to the associated Azure API Management service instance are now showing heartbeats in the Azure Portal. We fixed the issue preventing Scheduled Maintenance events from being shown in the Activity log. The `set-body` policies contained within GraphQL resolver policies (see ) is now executed for streamed responses. The issue making resolver get incorrect values from the cache for some GraphQL requests is now fixed. Requests resulting in a log entry larger than 32KB, previously not logged at all, are now logged to Azure Monitor after trimming. No releases. We reserved`default` name for internal use. After the update, users will not be able to create Workspaces with that name. We fixed an issue causing degraded performance when creating new service instance. We fixed an issue with `DevPortalHost` property not being passed correctly into the email notification template. We eliminated inconsistency in and objects in OpenAPI exports when performed by authenticated vs. anonymous users. No releases. We will now provide specifics about token validation failures in `validate-azure-ad-token` policy in API Inspector. We made the password policy stronger for users creating accounts on the developer portal - e.g., it now requires using a special character. Complete password requirements will be shown on the sign-up page. Users now must provide their current password before changing it on the developer portal. Pagination controls on the developer portal now feature only the Next and Previous buttons. We fixed an issue that caused tokens of logged-out developer portal users signed in via Azure AD B2C to remain valid under some circumstances. We fixed a regression that caused POST requests issued from the try it console on the developer portal not to work correctly. We fixed an issue in the Content Access Control feature of the developer portal that allowed unauthorized access to pages via direct link. No releases. - We're thrilled to announce the public preview launch of our latest Azure API Management pricing tiers: Basic v2 and Standard v2. () Minor bug fixes and improvements. No releases. We have introduced new Azure Advisor recommendations: Use Azure AD authentication instead of gateway token for Configuration API Identity self-hosted gateways using gateway tokens that will expire in < 7 days Identity validate-jwt policy usage with insecure key size We have removed support for the which had already been replaced with GraphQL API resolvers. We have fixed an issue where the OpenAPI would fail if the parameter names where empty. We have fixed an issue where nested objects were being overridden when import OpenAPI was used. We have fixed an issue where the FixOpenApi parameter schema can now import complex schemas. We have fixed a bug where validate-azure-token policy was not properly using expressions to resolve tenant-id. We have fixed an issue where deleting the API release will now return 204 instead of 404 if release does not exist. We have fixed an issue where the Deletion of API was not removing all of the releases. When deleting an API it will now delete all of its releases. We have fixed an issue where the DELETE operation for API endpoint was synchronous and timing out. The DELETE operation has been made asynchronous to fix this issue. . . . . .

We fixed an issue, where the customers potentially could not change organization or email in the email notifications. A regular Azure API Management service update was started February 9, 2023. This release concluded rollout on March 31, 2023. We added the new `context.Deployment.Gateway.*` object with several properties for accessing gateway information in runtime policies. . We fixed an issue, where the definition names in the API schema would display blank spaces. We fixed an issue, where the developer portal was hiding default domain, a parameter has been added to include default domain in the hostnames. We fixed an issue, where the API revisions were not being properly filtered. We fixed an issue, where adding API schemas with the same namespace resulted in an error. We fixed an issue, where policies contained all named values which caused a problem for secrets. The policy failed to check if given user had access to secret. We fixed an issue, whereby Azure Active Directory v1 tokens could be validated with `validate-azure-ad-token` policy, but v2 tokens could not be validated. With this release, both v1 and v2 tokens are supported. Previously, `validate-azure-ad-token` would only validate tokens against the public cloud instance of Azure Active Directory (AD). With this release, token validation is supported in every Azure cloud where Azure Active Directory is available. Previously, the gateway would not refresh the GraphQL schema when it was updated from the Azure portal. The gateway now correctly refreshes the GraphQL schema after it's updated in the Azure portal. We implemented a GraphQL context variable to allow access to all portions of the GraphQL context within policy expressions. (Preview 1) A regular Azure API Management service update was started on December 8, 2022. This release will continue to roll out through January 2023. The `log-to-eventhub` policy now supports securing connections to Azure Event Hub with managed identity. We fixed an issue, where the GraphQL in API Management will no longer fail when an introspection query is added to the synthetic GraphQL resolver policy. We fixed an issue, where saving some policy fragments in Consumption tier services was failing. We fixed an issue, where modifying a policy using client SDKs or PowerShell was failing with a 406 Not Acceptable response. The issue was caused by the management API's failure to handle PUT requests with the wildcard (`/`) `Accept` header. A regular Azure API Management service update was started on October 31, 2022. It may take several weeks for your API Management service to receive the update. . You can now easily validate Azure Active Directory tokens on incoming requests with the new `validate-azure-ad-token` policy. Learn more in the or . We fixed an issue, where API Management didn't allow clients to open new WebSocket connections even though they didn't exceed the connections limit. API Management updates are now rolled out to one Availability Zone at a time. Previously, updates were rolled out to multiple Availability Zones, reducing the service capacity by up to 50%. You can now use `cors` and caching policies (`cache-store` and `cache-lookup`) inside policy fragments. Previously the `cors` policy inside policy fragments didn't correctly apply CORS configuration to the API; caching policies couldn't be configured due to an error. API Management scale-out attempts that fail due to insufficient subnet capacity are now properly logged in Activity Logs. XML schema validation with `validate-content` policy no longer results in validation errors for elements with type

The execution time of the `send-one-way-request` policy is no longer included in the `backendTime` metric in the diagnostic logs, since it's an asynchronous, non-blocking operation. Previously, it was included in the `backendTime` metric but excluded from the `totalTime` metric. A regular Azure API Management service update was started on September 7, 2022. It may take several weeks for your API Management service to receive the update. . . . The new `allow-additional-properties` attribute of the `validate-content` policy lets you implement a runtime override of the `additionalProperties` value configured in the JSON schemas - for example, to always prevent requests or responses with undefined schema properties, regardless of the JSON configuration. Documentation will be released soon in the . Account confirmation links in the account registration email notifications sent to developer portal users no longer include user ID and identity in the URL. We fixed an issue, where request and response validation policies would skip the `on-error` policy section if multiple validations failed. Azure API Management no longer depends on the SMTP endpoints for sending email notifications and those endpoints can now be removed from the VNet configuration for allowed network traffic. We optimized performance of synthetic GraphQL APIs resolving multiple fields from the same endpoint. We fixed an issue, where using the developer portal test console configured with authorization code grant flow and OpenID Connect resulted in an error. We fixed an issue, where several properties in the "" management API response weren't propagated with values. The contract now follows the documented schema. We fixed an issue where an invalid request to create an could result in an `500 Internal Server Error` response. API Management now returns `400 Bad Request` in such cases. We fixed an issue, where an unsuccessful management operation on a policy fragment could result in failure of future management operations on that policy fragment. We fixed an issue, where built-in git repository export could fail. A regular Azure API Management service update was started on July 20, 2022. It may take several weeks for your API Management service to receive the update. We optimized the loading time of API schemas for management plane (including Azure portal) and developer portal operations. We increased the maximum length of each URL path segment from 520 to 1024 characters. We fixed an issue, where API Management allowed creation of multiple API versions with empty identifiers within one API version set. We fixed an issue, where API Management deserialized C-style hex strings in exported OpenAPI files as hex values. We fixed an issue, where API Management failed to export OpenAPI definitions if referenced schemas didn't have the `typename` property defined. The `set-body` policy now supports `xsi-nil` attribute with two values (`"blank"` and `"null"`) for controlling how elements marked with `xsi:nil="true"` are represented in XML payloads. If the value is set to `blank`, API Management uses the prior behavior, where nil is represented as an empty string. If the value is set to `null`, nil is represented with a null value. You can now monitor inbound connectivity to the API Management control plane in the "Network status" tab of the "Network" page in the Azure portal interface for your API Management service. now support Salesforce, ServiceNow, Twitter, Stripe, and Zendesk identity

Authorizations now support PKCE authorization flow in the generic OAuth2 identity provider. Improvements to the GraphQL support: API Management now supports GraphQL requests with the content type `application/graphql`. Previously, such requests resulted in a `400 Bad request` error. GraphQL resolvers can now be configured in policy fragments for reuse in the `backend` policy section. We fixed an issue, where creating a new GraphQL API using the property `format: graphql-format` resulted in failures in execution of the management API operations or ARM templates. This property worked only for existing GraphQL APIs. We fixed an issue, where accessing `context.Request` in a synthetic GraphQL API's `set-graphql-resolver` policy would overwrite the `context.Request` value. We fixed an issue, where parsing of lists with scalar values resulted in runtime errors. Browse the recently added release notes for older images: A regular Azure API Management service update was started on June 20, 2022. It may take several weeks for your API Management service to receive the update. Email notifications now have valid SPF and DKIM signatures. Previously, the generated DKIM signatures were invalid. `System.Net.IpAddress` and `System.Enum` namespaces are now allowed in policy expressions. Scale-up operations will now fail faster if there isn't enough space in a virtual network subnet to accommodate additional API Management service units. The error will be included in the Activity Logs. We fixed an issue, where scale-up operations could get stuck for multiple days in `stv1` deployments. As a precaution against other potential problems with the `stv1` architecture, we recommend migrating services to the `stv2` architecture. . We fixed an issue, where WebSocket connections couldn't be established for requests with multiple `Connection` headers. Management API SAS token can no longer be generated with an expiration date set in the past. "Dapr" is now a reserved backend entity ID. A regular Azure API Management service update was started on May 10, 2022. It may take several weeks for your API Management service to receive the update. GraphQL support now includes , `graphql-ws`-based subscriptions, and improved developer portal and Azure portal interfaces. Availability zone deployments are now available in the Switzerland North region. You can now access the API Management service name in runtime policies with the new `context.Deployment.ServiceId` property. The `ServiceId` property is also included in Application Insights logs. `validate-parameters` and `validate-content` policies now support GUID properties defined as `format: uuid`. Event Hub loggers can now use managed identity authentication. Azure portal interface for configuring this authentication is coming soon. Values of the `server name` property in Application Insights live metrics no longer include the `.azure-api.net` suffix. The value of `ServiceName` property in API inspector JSON no longer includes the `.azure-api.net` suffix. - highlights: Improvements to API reference pages and test console. Support for GraphQL subscriptions. - highlights: Includes a fix for a regression in the API list dropdown widget introduced in version 2.15.0. - highlights: The authorization server information has been temporarily removed from the API details widget, until a more complete solution is in place. Terms of use are now included in the authentication pages. A regular Azure API Management service update was started on March 28, 2022. It may take several weeks for your API Management service to receive the update. Starting with this service release, we will be posting regular release announcements only here, on GitHub, and we will not be posting them on

We will continue to post feature or breaking change announcements on Azure Updates and reference them in regular release notes on GitHub. . . . . . To protect services from username enumeration attacks, any attempt to reset user's password now results in a successful response from the API Management service. Previously, API Management returned `404 Not Found` if the username didn't exist in the service. Users no longer can subscribe to products that they don't have access to. Previously, product access configuration only restricted retrieval of product details and its APIs and it didn't prevent subscription attempts. If a policy expression contains a loop and takes over five seconds to execute, API Management will now terminate its execution to avoid infinite loops. You can now reference JSON schema resources from another JSON schema resource. The new is used for . Null values are no longer accepted inside the `certificateIds` array when creating or updating backend entities. Client disconnects from gateway are no longer reported as errors. `X-Forwarded-For` header logs now include addresses added by the gateway. Severity level is now correctly configured in Application Insights traces. Previously, `verbose` and `information` traces were logged to Application Insights with higher severity. GraphQL request processing is now faster and more efficient thanks to a series of optimizations. - highlights: Support for `contact`, `license`, and `termsOfService` OpenAPI properties in the API reference pages. Improvements to GraphQL API reference pages, including the code view. - highlights: HTML injection widget, which allows you to render custom HTML code in an iframe in your managed or self-hosted developer portal pages. Revised code samples in the test console and a new code sample for Swift. : Major code refactoring to the Extractor to make it more maintainable and easier to contribute to. Update of the API version used in the Extractor to the latest generally available version (`2021-08-01`). Other fixes, improvements, and community contributions. A regular Azure API Management service update was started on January 20, 2022, and included the following new features, bug fixes, and other improvements. It may take several weeks for your API Management service to receive the update. . Published developer portals are now automatically upgraded to new portal releases, without the need to republish the portal manually. Automated upgrades will preserve the latest published content; they won't publish saved but unpublished content. You can now use curly brackets in a SOAP action URL template (for example, `/soapAction={wildcard}`) to define a wildcard SOAP action, which will match any SOAP request that doesn't have a dedicated action defined in the API. The value inside the curly brackets doesn't affect the execution. Availability zones are now supported in the East Asia region. New .NET SDK for the management API . Newly created diagnostic settings will no longer be configured to log request query parameters by default. As part of this change, 's `dataMasking.queryParams` properties will be set with the following wildcard configuration `{ "value": "*", "mode": "Hide"}`. The same wildcard configuration can also be applied to `dataMasking.headers`. Self-hosted gateway now properly handles a certificate change (`certificateId`) for existing hostnames. Multiple `validate-content` policies can now be specified in a single policy section. It is now possible to delete a resource group with an `stv2`-based API Management service in a virtual

Previously, the deletion could fail due to an unreleased public IP resource. . `ConfigurationChange` event is no longer logged in for API Management service backups. `tracestate` header values are no longer truncated after the first key-value pair. An attempt to deploy an `stv2` API Management service into a virtual network subnet with an `stv1` API Management service will now result in a descriptive error message. A regular Azure API Management service update was started on October 25, 2021, and included the following new features, bug fixes, and other improvements. It may take several weeks for your API Management service to receive the update. . . . You can now import as an API in API Management. API Management now supports . To configure it, specify the `identityClientId` key in the `properties.credentials` property of the `Logger` object and set the value to: `systemAssigned` for a system-assigned identity, or ID of a user-assigned identity. Support for the multi-dimensional `Request` metric in Azure Monitor is now generally available. We fixed an , where the `Portal Revision` API marked all new developer portal revisions as current, regardless of the `isCurrent` parameter's value. We fixed an issue, where the `specified-parameter-action` attribute of the `validate-parameters` policy was ignored. Scale-outs of API Management services in the no longer affect existing service capacity. Previously, each scale-out forced a restart of the existing nodes. This optimization has already been implemented in services in the `stv1` infrastructure and those services aren't affected by the change. All header's schema properties are now preserved when importing an OpenAPI v3 document. Schemas for headers are supported in management API versions `2021-01-01-preview` or later. Properties with `format: date` in OpenAPI documents are no longer converted to a date-time object. Unknown countries are now reported as `Unknown` in the built-in API reports (Analytics tab in the Azure portal). WebSocket APIs now support backend service URI with the WebSocket schema and a custom port. Services deployed in a virtual network with forced tunneling need to allow an . Although this requirement wasn't documented, it is not introduced by the current release. A regular Azure API Management service update was started on August 19, 2021, and included the following new features, bug fixes, and other improvements. It may take several weeks for your API Management service to receive the update. . is now supported in four new regions: South Africa North, Germany West Central, Korea Central, Norway East. The `rate-limit-by-key` policy now supports policy expressions in the `calls` and `renewal-period` attributes. The `renewal-period`'s upper limit of 5 minutes still applies. The upper limit of the `max-size` attribute of the `validate-content` policy can now be increased beyond 100kB through Azure support. API inspector's traces now include the service name property. API Management is now more responsive to moves and cluster scale-outs of Service Fabric backends. API Management now supports custom domain certificates encrypted with the `AES256_SHA256` algorithm. The `Network Status` management API response and page in the Azure portal now include details about the connectivity to Azure Application Insights for services with configured Application Insights loggers. The "Publish" button on the "Developer portal overview" page of API Management services in the Azure portal now uses the new `Portal revisions` API, which makes it easier to publish the portal for virtual-network-injected

Clicking on a grid's row in the "Subscriptions" page of Azure API Management services in the Azure portal now brings up a new subscription editing interface. We fixed an issue, which could cause schema definitions to be omitted while importing APIs from OpenAPI files. We fixed a paging issue for API calls for retrieving the list of APIs from the developer portal. The `PublisherEmail` service property now supports email addresses with the `#` character. The runtime `context.Deployment.ServiceName` property and the `Service Name` attribute in Azure Application Insights logs no longer include the default hostname suffix `.azure-api.net` for API Management services in the Developer, Basic, Standard, and Premium tiers. This change has been reverted. Consumption tier services now allow request URLs up to 16384 characters long. All responses with status code lower than `400` are now considered successful in the built-in Analytics, metrics, Azure Monitor logs, and Azure Application Insights telemetry. The API gateway can no longer be disabled if the API Management service is in an internal virtual network. A regular Azure API Management service update was started on July 5, 2021, and included the following new features, bug fixes, and other improvements. It may take several weeks for your API Management service to receive the update. . . You can now emit custom metrics to Azure Application Insights with the new `emit-metric` policy. . Policy expressions now support `System.Net.IPAddress`. The policy expressions' `context` object now includes the `context.Deployment.GatewayId` property. For managed gateways, its value is `managed`. You can now export your APIs for consumption in the Power Platform through the dedicated Power Platform page in the Azure portal. We fixed an issue, which caused Developer tier services in a virtual network to not emit resource health events. The validation policies now correctly return: Responses with the status code `400 Bad Request` and a precise error description in case of the schema mismatch for errors detected in the incoming requests. Responses with the status code `502 Bad Gateway` and a generic message in the body for errors detected in the outgoing responses, to not leak API implementation details. We fixed an issue, where the validation policies ignored the `nullable` property of JSON schemas. We fixed an issue, where the validate content policy didn't fail the validation for empty bodies. We fixed an issue, where the validation policies modified the format of the JSON payload's properties resembling datetime strings. We fixed an issue, where a character sequence `@*` prevented the policy XML document from being saved. We fixed an issue, where responses with an empty payload and the `Transfer-Encoding: chunked` header were incorrectly classified as completed and the response latency was miscalculated. We fixed an issue, where successful API requests were marked as non-successful in the Azure Monitor and Azure Application Insights logs if the client disconnected right after receiving the response. We fixed an issue, which caused the API gateway endpoint of Consumption services to remain unavailable for a few seconds after the service activation. Validation policies' `error-variable-name` attribute is now optional. The `firstName` and `lastName` properties of the `User` entity no longer accept special characters (for example, `<`, `>`, `:`, `;`, `(`, `)`, `\`, `/`, `@`, `!`, and more). A regular Azure API Management service update was started on May 5, 2021, and included the following new features, bug fixes, and other

It may take several weeks for your API Management service to receive the update. . . . You can now validate the client certificate with the new `<validate-client-certificate>` policy. Documentation and support in the Azure portal are coming soon. The Visual Studio Code extension now supports policy debugging for self-hosted gateways running locally. The Visual Studio Code extension now supports Dapr and validation policies. The developer portal now supports resource owner password grant flow. The new Ciphers + Protocols page in the Azure portal lets you manage API gateways' cipher and protocol configuration and displays a warning if a weak cipher or protocol is enabled. The Locations page in the Azure portal lets you now configure Availability Zones. You can now apply with the visual policy editors in the Azure portal, without writing any policy code. The `timeout` attribute of the `send-request` policy now supports policy expressions. Caching issues, which might have resulted in a broken developer portal's administrative interface, are now resolved. The client certificate renegotiation feature is now disabled for all new and existing API Management services, except for the services that relied on it in the last 30 days (services with at least one API call that resulted in a client certificate request from a policy, not as part of an initial TLS handshake). The API gateway will request a client certificate only if property `negotiateClientCertificate` is set to `true`. If the property is set to `false`, the client certificate won't be available in the `context.Request.Certificate` property. A regular Azure API Management service update was started on March 8, 2021, and included the following new features, bug fixes, and other improvements. It may take several weeks for your API Management service to receive the update. . . . . You can now add an Application Insights logger by specifying a connection string. Support for this feature in the Azure portal is coming soon. List, GET, PUT, and PATCH operations on named values managed in a key vault are no longer allowed in API versions prior to `2020-06-01-preview`. Those named values will no longer be exported in ARM templates. Recreating a user-assigned managed identity with the same Azure resource ID no longer results in an error. Metrics and monitoring endpoints now use a new DNS service with higher availability. If you have been using the hostname to filter the traffic, make sure to change it to the new address. Otherwise, no action is required; the IP address of the resources has not changed. `https://global.metrics.nsatc.net/` has changed to `https://global.prod.microsoftmetrics.com/`. `https://prod3.metrics.nsatc.net:1886/RecoveryService` has changed to `https://prod3.prod.microsoftmetrics.com:1886/RecoveryService`. Managed identity no longer requires outbound access to Certificate Revocation List endpoints. If you have configured network connectivity to allow outbound traffic to CRL endpoints, you may now remove this dependency. A regular Azure API Management service update was started on January 21, 2021, and included the following new features, bug fixes, and other improvements. It may take several weeks for your API Management service to receive the update. You can now use the `cache-response` attribute in the `cache-store` policy to specify when to cache the outgoing HTTP response. For example, `<cache-store cache-response="@{return true}" />` will cache all API responses. If the `cache-response` attribute isn't specified, only HTTP responses with the status code `200 OK` will be cached. Documentation will be updated

You can now view service summary, explore service recommendations, and access additional resources in the redesigned overview page in the Azure portal. You can now use the `isKeyVaultRefreshFailed=true` query parameter in the list certificates by service and list named values by service API calls in the API version 2020-06-01 or later to find the entities, for which the refresh from Azure Key Vault action failed. Documentation will be updated soon. You can now monitor connectivity to Azure Key Vault using the network status endpoint in the API version 2020-06-01-preview or later. We fixed an error, which could cause named values and certificates stored in Azure Key Vault to not be refreshed. A regular Azure API Management service update was started on December 7, 2020, and included the following new features, bug fixes, and other improvements. It may take several weeks for your API Management service to receive the update. You can now create and manage API backends in the Azure portal. You can now log to Application Insights and Azure Monitor by setting the `verbosity` property of to `debug`. Azure portal interface for this feature will be released in early 2021. You can now mask or hide sensitive query parameters and headers in diagnostic logs. The `hide` setting will remove an entity, while `mask` setting will replace it with the word "hidden". Refer to for more details. Azure portal interface for this feature will be released in early 2021. You can now monitor database connectivity in secondary regions in the `Network Status` page in the Azure portal as well as via the respective API call, if your API Management service is deployed in multiple regions. is now available for testing. Elements of collections in responses from the `Content Types` and `Content Items` management API endpoints no longer overlap between pages. A regular Azure API Management service update was started on October 21, 2020, and included the following new features, bug fixes, and other improvements. It may take several weeks for your API Management service to receive the update. You can now create Developer, Basic, Standard, or Premium API Management services in the Brazil Southeast region. `xml-to-json` policy supports two new parameters for handling empty values and trimming string values: ```xml <xml-to-json empty-values="preserve|asNull" trim="true|false" /> ``` `context.Request.Body` and `context.Response.Body` support three new methods: ```csharp JToken AsJToken(bool preserveContent = false, JsonSerializerSettings settings = null); JObject AsJObject(bool preserveContent = false, JsonSerializerSettings settings = null); JArray AsJArray(bool preserveContent = false, JsonSerializerSettings settings = null); ``` Liquid templates in the `<set-body>` policy now support accessing JObject and JArray variables, for example: `context.Variables.contoso.property` or `context.Variables.contosoarray[0].property`. `validate-jwt` policy now supports JWE tokens compressed with the . `Network Status` API now returns status for the Azure Active Directory endpoint. `Named Values` API now supports filtering by ID. Developer portal session is now correctly persisted in case of redirects to other websites. Previously, the session could have been lost when using sign-in delegation or redirecting to websites from e-mail notifications. Developer portal now supports additional OAuth parameters for acquiring access tokens, which enables integration with external identity providers, like Auth0. API Management now correctly handles wildcard OpenAPI parameters, such as `/sample-operation/{*rest}`. We fixed several bugs, which could result in inaccurate `Network Status` API responses. We fixed a bug, where API Management stored incorrect payload in the cache if a request contained conditional headers `If-Modified-Since` or `If-None-Match` and cache entry didn't exist. The is no longer forwarded from the backend to the client.