Skip to content

Test new release version formatting #6431

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
vanngo-okta wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Test new release version formatting #6431

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
90 changes: 90 additions & 0 deletions packages/@okta/vuepress-site/docs/release-notes/2026-okta-identity-engine/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,96 @@ title: Okta Identity Engine API release notes 2026
Subscribe to RSS
</a>

## October

### Minor release 2026.44.1

| Change | Expected in Preview Orgs |
| ------ | ------------------------ |
| [Bug fixed in 2026.44.1](#bug-fixed-in-2026-44-1) | October xx, 2026 |

#### Bug fixed in 2026.44.1

API calls to `GET /api/v1/mappings` using filter parameters, such as `sourceId` or `afterId`, returned an invalid link in the response header. (OKTA-1193755)

### Major release 2026.43.0

| Change | Expected in Preview Orgs |
| ------ | ------------------------ |
| [Manual MCP registration is Beta](#manual-mcp-registration-is-beta) | Oct 26, 2026 |
| [Bug fixed in 2026.43.0](#bug-fixed-in-2026-43-0)| Oct 26, 2026 |

#### Manual MCP registration is Beta

You can now add manually configured authorization servers to a third-party MCP server using the **Add an authorization server to an MCP server** API. Include the `issuer`, `authorizationEndpoint`, and `tokenEndpoint` parameters in your request. You can also update authorization servers (discovered or manually added). The `issuer` parameter is immutable. An MCP server can have multiple authorization servers, including a mix of discovered and manually added ones. See the [Add an authorization server to an MCP server](https://developer.okta.com/docs/api/secures-ai/openapi/secures-ai-resource-servers/tags/mcpserverregistration/other/addmcpserverauthorizationserver) and [Update an authorization server for an MCP server](https://developer.okta.com/docs/api/secures-ai/openapi/secures-ai-resource-servers/tags/mcpserverregistration/other/updatemcpserverauthorizationserver) APIs.
<!-- SECURE_AI_MCP_SERVER_ENHANCEMENTS to Beta 2026.08.3 OKTA-1255807 -->

#### Bug fixed in 2026.43.0

* After an org upgraded to Identity Engine, `sms` and `call` factors that were migrated from Classic Engine returned an incorrect `created` date from the Factors API (`GET /api/v1/users/{userId}/factors`). The date reflected the factor's first use for authentication rather than its original enrollment date. (OKTA-1172610)

* When a user who was removed from an app in Okta was re-assigned to it, the status remained in a "Disabled" state in the app's UI. (OKTA-1217473)

### Minor release 2026.42.1

| Change | Expected in Preview Orgs |
| ------ | ------------------------ |
| [Unified identity for AI agents is GA in Production](#unified-identity-for-ai-agents-is-ga-in-production) | Oct 19, 2026 |
| [Bugs fixed in 2026.42.1](#bugs-fixed-in-2026-42-1) | Oct 19, 2026 |

#### Unified identity for AI agents is GA in Production

Okta now resolves AI agent identities across every registration path into a single authoritative record per org. Each agent can now carry an `externalId` and `platform` value to ensure agents are unique. This feature adds new endpoints for listing, reviewing, resolving staged conflicts and managing provider priority. See [AI Agent Providers](https://developer.okta.com/docs/api/secures-ai/openapi/secures-ai-workload-principals/tags/agentproviders). <!-- OKTA-1246247 FF: SECURE_AI_AGENTS_UNIFY_IDENTITY -->

#### Bugs fixed in 2026.42.1

* When you added a URL value to parameters for resource server API endpoints, the trailing slash was removed. (OKTA-1250066)

* When you added a manual MCP server with an incomplete URL, the endpoint `POST /resource-servers/api/v1/mcp-servers` returned an HTTP 400 error. (OKTA-1246008)

* When you sent a PATCH request to `/resource-servers/api/v1/mcp-servers/{mcpServerId}/authorization-servers/{authServerId}` that included the immutable `issuer` or `type` fields, the API silently ignored those fields instead of returning an HTTP 4xx error. (OKTA-1244902)

* The endpoints `POST /api/v1/users` and `POST /api/v1/users/{userId}` intermittently returned an HTTP 400 error stating that a profile property wasn't defined, even though the property existed on the user's schema. (OKTA-1210697)

### Major release 2026.41.0

| Change | Expected in Preview Orgs |
| ------ | ------------------------ |
| [Cross App Access support for AI agents and apps for all customers](#cross-app-access-support-for-ai-agents-and-apps-for-all-customers) | Oct 17, 2026 |
| [New IP service categories for enhanced dynamic zones](#new-ip-service-categories-for-enhanced-dynamic-zones) | Oct 12, 2026 |
| [Authorization and token endpoints now support multiple resources per refresh token is GA in Preview](#authorization-and-token-endpoints-now-support-multiple-resources-per-refresh-token-is-ga-in-preview) | August 12, 2026 |
| [Bugs fixed in 2026.41.0](#bugs-fixed-in-2026-41-0) | August 12, 2026 |

#### Cross App Access support for AI agents and apps for all customers

Use XAA to secure access between custom SSO-agentic requesting apps and SSO resource apps. XAA enables customers to connect AI agents and apps to take action on behalf of a user, and removes the need for user consent at runtime. The XAA connection is managed by Okta admins, providing them with visibility and control over which actions an AI agent can take on behalf of a user across the supported OIDC and SAML SSO protocols. See [Configure AI agent-to-app with XAA](/docs/guides/xaa-agent-to-app/main/).

For agentic requesting apps that use OIDC for SSO, Okta enables binding an AI agent with an OIDC SSO app so that they share the same credentials. If you want to remove this configuration in Okta, delete the AI agent and the corresponding OIDC app.

From this AI agent-app binding capability, admins can now configure direct user authentication for the AI agent. If you have an Okta for AI Agent org and have previously used the **Delegation** tab to configure AI agent access through delegation links, you need to reconfigure them with the **User access** tab. See the [Migration from Okta for AI Agent delegation link](/docs/guides/xaa-agent-to-app/main/#migration-from-okta-for-ai-agent-delegation-link) guidance.

<!-- OKTA-1212187 SECURE_AI_XAA Preview: Aug 17, 2026 -->

#### New IP service categories for enhanced dynamic zones

The `ipServiceCategories` object of the [Enhanced Dynamic Network Zone API](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/networkzone/other/getnetworkzone#other/getnetworkzone/t=response&c=200&path=&d=2/ipservicecategories) now supports several new IP service categories. <!-- OKTA-1239915 -->

#### Authorization and token endpoints now support multiple resources per refresh token is GA in Preview

The `/authorize` and `/token` endpoints for custom authorization servers now accept multiple `resource` parameters. Request a refresh token that's scoped to several resources at authorization time. Then exchange it at `/token` (`grant_type=refresh_token`) for an access token whose `aud` claim is just one of those resources. One refresh token now covers multiple resources, and each call mints a precisely scoped, single-audience token, instead of one refresh token per resource. See [Resource Indicators for OAuth 2.0](https://datatracker.ietf.org/doc/html/rfc8707).

This feature is only available for orgs that are subscribed to Okta for AI Agents and have the agent-to-agent connections feature enabled. <!-- OKTA-1245853 FF: SECURE_AI_A2A_SERVERS -->

#### Bugs fixed in 2026.41.0

* In some cases, the [Create a log stream](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/logstream/other/createlogstream) limit of two active streams could be exceeded. (OKTA-1179998)

* When an AI agent import returned a 404 error, the [Validate an AI agent provider](https://developer.okta.com/docs/api/secures-ai/openapi/secures-ai-workload-principals/tags/agentproviders/other/validateaiagentprovider) endpoint returned an HTTP 500 error. (OKTA-1216248)

* The `okta.users.credentials.resetFactors` permission incorrectly allowed you to enroll authenticators on behalf of users (`POST /users/{userId}/factors`). (OKTA-1220095)

* For some orgs, when you [Register an AI agent](https://developer.okta.com/docs/api/secures-ai/openapi/secures-ai-workload-principals/tags/agentregistration/other/registeraiagent) with a name shorter than five characters, a minimum-length validation error was returned, even though the minimum had been reduced to three characters. (OKTA-1242199)

## August

### Weekly release 2026.08.4
Expand Down