Releases
A release every few days, each one documented.
Flexway's published releases and what each one brought; then what is coming, with no promised date.
Pace
A small team, a visible pace
Flexway's published releases and what each one brought; then what is coming, with no promised date.
1.8.0API lifecycle1.9.0API lifecycle1.10.0Agents and AI, European compliance, API lifecycle, Operations, Securityv1.6.3fixesv1.6.2fixesv1.6.17 new features- Including:
- Native Kafka proxy: Kafka clients on the gateway, virtual clusters and topics per tenant
- Message field encryption at the native proxy
- Console: Kafka clients and clusters, connections per tenant, refusals by cause, encryption and built-in alert rules
- and 4 more
v1.6.0fixesv1.5.011 new features- Including:
- AsyncAPI as the source of the asynchronous plane
- Kafka publishing under contract, CloudEvents envelope
- Mediation of the synchronous to asynchronous boundary
- AMQP(S) and MQTT
- Signed, replayable outgoing webhooks
- OpenAI-compatible multimodal content, vision backend
- Embeddings, with budget and audit
- Backends by kind (OpenAI, relay, gRPC), local or upstream metering
- gRPC method of a specialised model, metered per call
- and 2 more
v1.4.05 new features- Including:
- Health per gateway replica: status of each replica and freshness of its last report
- and 4 more
v1.3.014 new features- Including:
- Built-in alerts: thresholds per upstream or operation, webhook notification
- Service-level objectives per operation: remaining error budget, burn rate over several windows, built-in alert rule
- and 12 more
v1.2.1fixesv1.2.08 new features- Including:
- Declarative proposal: a diff, never a mutation
- Pull request opened from the proposal
- Agents dashboard: tools called, cost, scopes
- and 5 more
v1.1.010 new features- Including:
- Upstream Cache-Control, ETag and Vary honoured
- Public response cache, per operation
- Authenticated cache, isolated per tenant and subject
- Import of an existing gateway's configuration, with a coverage report
- External call: timeout budget and declared failure behaviour
- Body field projection and filtering, schema conformance checked
- Masking of sensitive fields in responses
- Upstream status code mapped to a semantic code
- and 2 more
v1.0.0fixesv0.3.0fixesv0.2.04 new features- Including:
- REST to gRPC translation through Protobuf descriptors
- gRPC and gRPC-Web end to end
- Global in-flight cap: an overloaded replica sheds instead of being killed
- and 1 more
v0.1.086 new features- Including:
- MCP surface: the contract's operations offered as tools
- OAuth 2.1 resource server, RFC 9728 metadata
- RFC 8693 token exchange: human subject, agent actor
- Delegation bounded in time and depth, cascading revocation
- MCP federation: existing MCP servers under the same authorisation, quota and audit
- An OpenAPI 3.1 contract loaded; what is served is derived from it
- Start refused when a declared operation has no upstream
- flexway validate offline, output usable in CI
- Live reload through an immutable snapshot, no request lost
- An invalid configuration never replaces the running one
- API catalogue derived from the contracts, with lifecycle
- Traffic per operation, upstream and tenant
- Tenant isolation in the console: 403, never an empty list
- Upstream health: circuit breakers, ejections, timeouts
- Usage: requests, tokens, euros, per tenant
- Opening an end-to-end trace
- OpenAI-compatible /v1/* surface
- Policy routing across providers and models
- Budget and rate per tenant
- Sensitive requests pinned, sovereignty and fallback by policy
- Metadata audit, never a prompt
- Inference streaming relayed without holding
- Structured JSON logs, no personal data
- Metrics per operation, upstream and tenant, bounded cardinality
- W3C traces propagated end to end
- /healthz, /readyz, /metrics, /config on a separate port
- Dashboards and alerts delivered with the product
- /simulate: route, effective chain and verdict without calling the upstream
- Start with no mandatory dependency
- CEL conditions compiled at load time
- Dry-run simulation of a policy chain
- Streams relayed without holding: SSE and chunked bodies
- WebSocket relayed
- Timeout budget per operation
- In-flight request cap per upstream (bulkhead)
- Retries limited to idempotent methods
- Circuit breaker with half-open state
- Degradation announced (header and trace), never silent
- Graceful shutdown: streams in flight are drained
- JWT validation, cached JWKS keys with rotation
- iss and aud checked; several issuers in one configuration
- Scopes and roles derived from the contract's security
- Closed by default: undeclared header, parameter, method or origin refused
- Body and parameters validated against the contract's schema
- API keys and client mTLS as first-class identities
- Opaque token introspection (RFC 7662)
- Chained audit log of authorisation decisions
- Rate per caller (token bucket)
- 429 with Retry-After and RateLimit headers
- Rate classes per method, per-operation override
- Quota per tenant per day and month
- Adaptive load shedding under saturation
- Request and response headers: set, remove, rename, derive
- Path rewrite and query parameters
- Protected elements cannot be written, refused at start
- and 31 more
Upcoming, no date promised
What is coming
Flexway's next releases, by theme: forecasts from its roadmap, target releases not binding. An idea becomes a feature only once framed and delivered.
| Coming | Theme | Target release |
|---|---|---|
| Report of calls outside the contractPriorityFlexway already refuses what is not declared: it shows what clients try to call (shadow APIs, outdated clients) | API lifecycle | 1.8.0 |
flexway diffPriorityTwo versions of a contract compared in CI: breaking change, deprecation, new scope; refused if breaking without a new version | API lifecycle | 1.8.0 |
| Human approval of sensitive tool callsPriorityA tool marked sensitive waits for a person's approval, traced, before it goes out | Agents and AI | To be scheduled |
| Budget per agent runPriorityA cap on calls, tokens and euros for a whole agent task, not only per request | Agents and AI | To be scheduled |
| Jurisdiction routingPriorityA request from a European tenant only goes to upstreams and models hosted in Europe, declared and proven in the trace | European compliance | To be scheduled |
| Evidence report for the European AI ActPrioritySigned export of the decisions, models and guardrails applied, per period | European compliance | To be scheduled |
| Guaranteed structured outputsA model's response checked against the expected JSON schema; retry or refusal | Agents and AI | 1.10.0 |
| Personal data detection in promptsMasking, or a switch to an internal model, before sending | Agents and AI | To be scheduled |
| OpenTelemetry GenAI conventionsModel, tokens, cost, tool called, readable by any observability tool | Operations | To be scheduled |
| Routing by measured cost and latencyThe model chosen by its actual latency and cost | Agents and AI | To be scheduled |
| MCP server registryThe tools offered to agents, with owner, scopes and usage | Agents and AI | To be scheduled |
| DORA and NIS2 reportsIncidents, availability per critical service, third-party dependencies, drawn from the SLOs and traces | European compliance | 1.10.0 |
| FAPI 2.0 profileThe open banking security profile | European compliance | To be scheduled |
| Carbon footprint per requestEstimated energy and CO2 per operation and per model, in the console and in usage | European compliance | 1.10.0 |
| Mock responses from the contractAn operation without an upstream answers with the contract's examples | API lifecycle | 1.10.0 |
Sunset and Deprecation headers to callersClients warned automatically; extends x-flexway-sunset | API lifecycle | 1.8.0 |
| Migration from other gatewaysMigration assistants for other configuration formats on the market | API lifecycle | 1.9.0 |
| SOAP and XMLA WSDL contract declares the operations; a REST caller reaches an existing SOAP service, XML decoded under strict limits (external entities refused, size and depth bounded) | API lifecycle | 1.10.0 |
| Declared fault injectionDelays and errors on a share of the traffic, in pre-production | Operations | 1.10.0 |
| Traffic mirroringA copy of real traffic to a new version, with no effect on the response | Operations | 1.10.0 |
| Anomaly detection in the consoleUnusual rises in errors, latency or cost, as proposals, never as decisions | Operations | 1.10.0 |
| AI cost forecastEnd-of-month projection per tenant | Operations | To be scheduled |
| SPIFFE workload identity to upstreamsmTLS without hand-managed certificates | Security | 1.10.0 |
| Hybrid post-quantum TLSML-KEM key exchange with X25519 | Security | 1.10.0 |
Let's talk about your gateway
Flexwiz is a young company: you talk directly with the person who founds it. Tell us what you want to run through Flexway. We talk about your infrastructure and your digital sovereignty requirements.
Online booking is coming soon; until then, an e-mail is enough.