Anypoint Flex Gateway Policy Development Kit (PDK) Release Notes

1.8.0

April 21, 2026

What’s New

PDK now provides the PDK-Unit testing framework to quickly test policies without deploying to a Flex Gateway.

See Writing Unit Tests.
PDK now automatically applies outbound policies to the service in the PDK debugging playground.
The Clock and Timer now expose the now method that returns the current SystemTime to provide more control than SystemTime::now for unit testing.

See Configuring Delayed, Periodic, and Synchronous Functions.
PDK now provides the Spike Control library for implementing spike arrest and smoothing rate limiting patterns. For more information, see:
- Using Spike Control Library Functions
- Spike Policy Example
PDK now provides the XML Validator library to validate and process XML payloads with configurable rules. For more information, see:
- Using XML Validator Library Functions
- XML Validation Policy Example
PDK now provides the JSON Validator library to validate and process JSON payloads with configurable validation rules. For more information, see:
- Using JSON Validator Library Functions
- JSON Validation Policy Example
Custom Policies can now read and write to headers and bodies at the same time by using the enable_stop_iteration feature.

See Reading and Writing Request Headers and Bodies with Stop Iteration.
The PDK Token Introspection Library now supports Microsoft Entra ID and the RFC 9728 specification. The token validator now provides these methods for configuration:
- with_client_id: Sets the client ID credential to talk with the introspection service.
- with_client_secret: Sets the client secret credential to talk with the introspection service.
- with_protected_resource_metadata Enables RFC 9728 protected resource discovery with the given authorization server URL.
- with_protected_resource_metadata_with_properties: Enables RFC 9728 protected resource discovery with the given authorization server URL and additional metadata properties (such as scopes_supported or bearer_methods_supported).
  
  See Using OAuth 2.0 Token Introspection Library Functions.

Fixed Issues

Issue Resolution ID

Issue Resolution	ID
PDK policies now properly handle distributed rate limiting quotas.	W-22108203
PDK message logging policies now properly resolve `dw::Core::--` expressions. `--` functions are supported only in Flex Gateway versions 1.2.0 or later.	W-21643871

PDK policies now properly handle distributed rate limiting quotas.

W-22108203

PDK message logging policies now properly resolve dw::Core::-- expressions. -- functions are supported only in Flex Gateway versions 1.2.0 or later.

W-21643871

1.7.0

February 12, 2026

What’s New

The name of the Anypoint CLI PDK plugin was changed from anypoint-cli-pdk-plugin to anypoint-pdk-plugin. To develop 1.7.0 policies, ensure you install the new plugin.

See Install the 1.7.0 Anypoint CLI PDK plugin.
The Anypoint CLI PDK Plugin now supports split model policies to enable you to update policy definitions and implementations independently.

See Create a Split Model Policy Project.
The JWT library now provides the functionality to create JWT tokens.

See Create a JWT Token.
You can now send an early response during the HTTP response event to terminate the execution flow early.

See Stop Response Execution.
The IP-filter library now provides functionality to create allowlists or blocklists of IP addresses and CIDR ranges.

See Filter IP Addresses.
The OAuth 2.0 library now provides functionality to validate incoming OAuth 2.0 with OAuth 2.0 servers.

See Using OAuth 2.0 Token Introspection Library Functions.

Fixed Issues

Issue Resolution	ID
There is no longer inconsistent store creation behavior across Object Store v2 and in-memory or Redis backends for the Rate Limiting library.	W-20223396
There is no longer a type mismatch error when extracting JWT objects from Bearer tokens.	W-20435785

Issue Resolution

ID

There is no longer inconsistent store creation behavior across Object Store v2 and in-memory or Redis backends for the Rate Limiting library.

W-20223396

There is no longer a type mismatch error when extracting JWT objects from Bearer tokens.

W-20435785

1.6.0

November 18, 2025

What’s New

PDK rust libraries are now hosted on crates.io. You can now download the crates without a connection to Anypoint Platform. Creating, publishing, and releasing policies still requires Anypoint Platform connection.

To upgrade your policies created before PDK v1.6.0, see Upgrade Policies with Versions Earlier Than v1.6.0.
The minimum Rust version is now v1.88.0 to meet dependency requirements.

To update your policy’s Rust version, see Upgrade a Policy’s Rust Version.
PDK now uses proxy_wasm v0.2.4 to fix a memory leak in the crate.

Fixed Issues

Issue Resolution	ID
For Windows, the Makefile commands no longer fail due to the unrecognized command “export”. You must create a new policy to fix this issue.	W-19991510
Data storage Time To Live (TTL) values are now correctly converted from milliseconds to seconds when creating stores, and the maximum TTL upper bound of 30 days is now enforced.	W-20148366

Issue Resolution

ID

For Windows, the Makefile commands no longer fail due to the unrecognized command “export”. You must create a new policy to fix this issue.

W-19991510

Data storage Time To Live (TTL) values are now correctly converted from milliseconds to seconds when creating stores, and the maximum TTL upper bound of 30 days is now enforced.

W-20148366

1.5.0

October 22, 2025

What’s New

PDK now provides data storage functionality to store and retrieve data across workers and replicas. Data storage supports both in-memory and shared storage. For shared storage, stored data can persist across API Gateway restarts.

See Configuring Data Storage.
PDK now provides rate limiting functionality to control request rates. PDK rate limiting supports both single Flex Replicas and multi-replica clustered deployments.

See Rate Limiting Requests.

1.4.1

June 30, 2025

What’s New

PDK policies are now built with Rust Version 1.87.0 and require the wasm32-wasip1 target.

To update your Device’s rust version and download the wasm32-wasip1 target, see Rust Requirements for Using PDK.

To update your existing policy’s rust version and WASI target, see Upgrade a Policy’s Rust Version and Upgrade a Policy’s WASI Crate.
PDK can now develop Mule Gateway custom policies.

See Creating Mule Gateway PDK Policies.
PDK now provides the Policy Violation framework to report policy violations to Anypoint Monitoring.

See Reporting Policy Violations.
PDK now supports streaming payload bodies to read payload bodies larger than 1MB.

See Streaming Bodies.
PDK now provides these new example policies:
- Stream Payload Policy Example: Use the Stream Payload Policy as an example of how to read payload bodies larger than 1MB.
- DataWeave Policy Example: Use the DataWeave Policy as an example of how to handle custom DataWeave expressions in your custom policy.
  
  To learn more about example policies, see Custom Policy Examples.
The payload DataWeave Schema parameter now supports the xml mimeType.

See DataWeave Expressions Schema Definition.

Fixed Issues

Issue Resolution	ID
HTTP calls from timers are now isolated from regular HTTP operations to avoid interference between them.	W-18121316

Issue Resolution

ID

HTTP calls from timers are now isolated from regular HTTP operations to avoid interference between them.

W-18121316

Compatibility

Policies created with PDK might be compatible with Flex Gateway versions that aren’t compatible with PDK’s integration testing framework. The Flex Gateway version used for testing doesn’t affect the functionality of the policy when deployed to a different Flex Gateway version. See the following table to ensure your Flex Gateway’s compatibility:

Component	Minimum Flex Gateway Version	Maximum Flex Gateway Version
Policies	1.6.1	Latest
Testing Framework	1.6.1	Latest

Component

Minimum Flex Gateway Version

Maximum Flex Gateway Version

Policies

1.6.1

Latest

Testing Framework

1.6.1

Latest

1.3.0

March 18, 2025

What’s New

PDK now provides a Contract Validation library to help with creating custom client ID enforcement policies.

See Using Contracts Validation Library Functions.
PDK is now built with Rust Version 1.83.0
Integration testing performance is improved for pdk-test with desktop configurations.
PDK can now develop outbound policies.

See Define Outbound Policies.

Fixed Issues

Issue Resolution ID

Issue Resolution	ID
`GrpcClient` now handles optional empty values instead of failing. Previously `GrpcClient` raised a `GrpcClientError::EmptyContent` error for some conditions with an empty optional field.	W-16486150

GrpcClient now handles optional empty values instead of failing. Previously GrpcClient raised a GrpcClientError::EmptyContent error for some conditions with an empty optional field.

W-16486150

Compatibility

Policies created with PDK might be compatible with Flex Gateway versions that aren’t compatible with PDK’s integration testing framework. The Flex Gateway version used for testing doesn’t affect the functionality of the policy when deployed to a different Flex Gateway version. See the following table to ensure your Flex Gateway’s compatibility:

Component	Minimum Flex Gateway Version	Maximum Flex Gateway Version
Policies	1.6.1	Latest
Testing Framework	1.6.1	Latest

Component

Minimum Flex Gateway Version

Maximum Flex Gateway Version

Policies

1.6.1

Latest

Testing Framework

1.6.1

Latest

1.2.0

August 28, 2024

What’s New

PDK now provides a CORS library to help create policies that process cross-origin requests.

See Using CORS Library Functions.
The PDK integration testing framework is improved for easier test configuration.

See Writing Integration Tests.
Incorrect conditional parameter schema configurations are now rejected when the policy is compiled instead of when the policy is deployed.
Conditional parameters can now depend on boolean and integer parameters.

See Define Conditional Parameters.

Compatibility

Policies created with PDK might be compatible with Flex Gateway versions that aren’t compatible with PDK’s integration testing framework. The Flex Gateway version used for testing doesn’t affect the functionality of the policy when deployed to a different Flex Gateway version. See the following table to ensure your Flex Gateway’s compatibility:

Component	Minimum Flex Gateway Version	Maximum Flex Gateway Version
Policies	1.6.1	Latest
Testing Framework	1.6.1	Latest

Component

Minimum Flex Gateway Version

Maximum Flex Gateway Version

Policies

1.6.1

Latest

Testing Framework

1.6.1

Latest