v0.9.0
Released October 21, 2026. Supported until April 21, 2027.
v0.9.0 ships 30 behavior changes, 6 security updates, 43 new features, 24 bug fixes, and 3 deprecations. Behavior between the management plane and the data plane changed in this release. The most severe security issue cleared is high.
A fully detailed version of these release notes (including artifact versions) is included in the Admin Console.
The full release notes are opened from the Admin Console, as described in Check the management plane version.
Upgrade and rollback
- The release carries no breaking change, and no operator action is required before upgrading.
- The upgrade rolls through without dropping traffic.
- Rollback to v0.8.0 is unconditional.
Behavior changes
Consoles
Legacy BYOK lists now show only active keys, excluding keys with pending rotation as well as revoked keys.
Removing a project-scoped BYOK key revokes it in its own project and preserves the remaining keys' configured routing weights and order.
The seed-signin-info script writes through the management plane API and keeps earlier sign-in versions instead of replacing them.
Alert destinations are now owned by a customer, not just by a workspace name.
The Developer Console's landing page is now called Home and lives at /home.
The app switcher in each console is now a single button that opens the other console in the same tab.
Gateway
A data plane that has ever hosted a project gateway refuses requests once it has none left, including after a restart. Available once the data plane is on 0.9.0 or later.
A project budget that is used up now stops, or moves to its fallback model, every key of the project on a 0.9.0 data plane, including a key created since the last budget refresh, such as an application's first calls. Available once the data plane is on 0.9.0 or later.
A project or system token rate limit now also covers API keys that have no route of their own yet, including an application's first calls and calls that fail over to a fallback model. Available once the data plane is on 0.9.0 or later.
With Request Logs set to Metadata only, the management plane receives a fixed set of fields: request ID, user, API key ID and name, resolved model, endpoint, hostname, status, latency, token counts, cost, the routing response headers, and the data plane's budget, fallback, rate-limit and attribute routing decisions. Available once the data plane is on 0.9.0 or later.
For callers admitted with a project OIDC token whose sub is a valid email address, Request Logs, metrics and traces record a stable e_-prefixed digest of that address as the user instead of the address itself. Available once the data plane is on 0.9.0 or later.
Management plane API
Saving fallback chain entries requires enabled models and providers.
Audit records for changes made through the Developer Console now name the signed-in user and their email instead of the console's service key.
Granting or revoking super_admin now fails with Internal, and changes nothing, when its audit record cannot be written.
An audit record is now written in the same transaction as the change it records.
The Developer Console no longer writes its own audit records for key rotation, management-key create and delete, and project telemetry changes; the server's ROTATE_CLIENT_KEY, ISSUE_MY_KEY, REVOKE_MY_KEY and CREATE_ or UPDATE_TELEMETRY_CONFIG records cover them.
Until a later release removes the Admin Console's own audit records, an Admin Console change that the server audits leaves two records, and both now name the signed-in user: the console's and the server's.
Audit records of Developer Console calls now carry the browser's user_agent, and the X-Forwarded-For chain that the console received in metadata.forwarded_for.
Removing a provider from a project's allow-list fails with FAILED_PRECONDITION while the project still has models from that provider.
Existing metrics_reader keys can read their organization's usage per user, team or API key.
A fallback policy saved before retry conditions were configurable reads back the five conditions the gateway applies to it, timeout,rate-limit,server-error,connect-failure,overloaded, instead of its stored retry_on.
An API key's client that was created without a project now belongs to its key's project once a fallback or traffic split policy of the key is saved, so it is then listed only in that project, not in every project.
Traffic split policies now read back with entries as well as split.
Listing fallback or traffic split policies without a target now also returns the per-key policies saved in the Developer Console, so the Admin Console's Fallback Policies page shows them too.
Saving a per-key fallback policy, or turning one back on, is refused when one of its models, or that model's provider, is not available to the key's project.
Adding or removing a provider on a project's allow-list through the API now needs the project provider permission, which Project Owner and Super Admin hold, as the Admin Console already did.
UpdateApiKey called without user_id for a key that does not exist now returns NotFound or a field error, where it returned InvalidArgument with the message user_id is required.
Observability
Metrics a data plane pushes over OTLP (router_, Envoy stats and gen_ai_) now carry service.instance.id, k8s.pod.name and k8s.namespace.name, so each replica writes its own series, including at backends.custom[] destinations.
With the metrics signal on, the data plane chart adds a ClusterRole that lets the otel-gateway service account get, list and watch pods in every namespace, to identify the pod behind each pushed metric.
Alert events now record which customer they were raised for, decided when the report is ingested rather than when the alert is delivered.
Security updates
Management plane API
Revoking a BYOK key now attempts to remove its stored provider secret; a cleanup failure does not prevent the key from being revoked.
Open OAuth client registration (/oauth/register) is now bounded.
The project MCP OAuth client operations no longer read or change the OAuth clients set up in the Admin Console, which every project signs in through.
Gateway
Request logs sent to the management plane no longer include credential headers such as Authorization, Cookie, Set-Cookie or x-api-key, in any mode. Available once the data plane is on 0.9.0 or later.
With the default rate limit image, the gateway's rate limit server now requires a client certificate signed by the Envoy Gateway CA.
The gateway and the MCP profiles API now pick a server's OAuth client by the same rule as the Developer Console: the profile's project first, then the clients set up in the Admin Console.
New features
Consoles
Administrators can edit or clear a tag's description from the Tags tab.
Workspace members can now manage their own alert destinations from a new Alert Destinations page, adding Slack channels or generic webhook receivers, editing and testing them, without asking an administrator.
Audit Logs record calls the management plane refuses for missing permissions on the identity, tenancy, API key, AI key, model catalog, MCP, RBAC and Developer Console request-log APIs, with action AUTHORIZATION_DENIED, the caller, the operation and the customer the call named.
Management plane API
GET /v1/policy/api-key-ids lists the IDs of API keys that carry a tag, or of keys with no tags (untagged=true).
GET /v1/api-keys takes project_id and application_keys_only filters, and each key now says whether it serves an application, so you can find an application's key and disable it to stop that application.
The owner of an API key can set and turn off the fallback and traffic split policies of that key, without a project role.
Traffic split policies can target one API key, and hold one weighted split for each primary model in the new entries field.
User directory responses include the team name alongside its ID, without a separate team lookup.
The MCP catalog operations accept a platform MCP role, so a platform admin can manage the catalog without full admin rights.
A new operation returns the OAuth client that signs a project in to an MCP catalog server: the project's own client, or else the shared one from the Admin Console.
Project admins can add and remove the providers on their own project's allow-list.
Platform admins can manage the Admin Console's shared MCP OAuth clients through the API, and complete a sign-in through one, which returns only an access token.
GetSystemSetting takes an optional include_config_event flag for guardrails.enabled.
A call made with an admin key can name the signed-in person behind it in the X-Audit-Session-Token header.
Audit log queries accept search, a case-insensitive match over the actor's email, user ID and type, the action, the resource type and ID, the correlation ID, the endpoint, the source IP and the error message.
Announcements and sign-in page content can be managed through the API, and the published content can be read without signing in.
Administrators can list, export, create, edit, deactivate and import email domain policies through the API.
You can read and change your own API key's global fallback and token rate limit through the API.
GET /v1/usage/stats reads an organization's usage over time, with distinct users, per user, team or API key.
GET /v1/me/usage/stats reads your own usage over time, per API key, filtered by key or project.
SSO providers now carry scopes, attribute mapping, the discovery URL and the organization name and slug.
CreateOrUpdateSSOProvider takes validate_config.
Admins can set a user's role with POST /v1/users/{user_id}/role.
GET /v1/me/projects now returns member_role on each project: your own role as a member of that project.
An administrator can disable or re-enable one application's API key by sending the key id alone to UpdateApiKey.
Request log statistics can be grouped by caller_type, which separates identity-provider callers from API key callers, and by application, which shows the usage of each application under its key's current name.
Each request log carries caller_type, idp for an identity-provider application and api_key for any other caller, and QueryRequestLogs and GetRequestLogStats take a caller_type filter with the same values.
Data planes now carry stored_url, the URL stored for the data plane.
EnsureDefaultProject creates an organization's default project when it does not exist yet, with the enabled providers, MCP servers and models, and returns it.
Projects now carry preferred_endpoint_url, the address a project owner starred, as tenancy.v1 projects do.
ListDataplaneURLs accepts project_id, customer_id and include_unaddressed.
Project owners can choose the endpoint the consoles show for a project with SetPreferredEndpoint.
SDK
The Go, Python and TypeScript SDKs now include a client for gateway authentication policies and their identity-mapping rules.
The Go, Python and TypeScript SDKs now include a client for budget, rate-limit, fallback, traffic-split and attribute-routing policies, user groups and API key tags, as Policy() in Go and policy in Python and TypeScript.
Gateway
The data plane's Controller exports liaison_finalizer_cleanup_abandoned_total, counting deleted routes whose cleanup gave up and may have left resources behind, and liaison_finalizer_cleanup_retries_total for cleanups it is retrying.
The data plane can keep chosen x-tars- request headers in the request log, so a caller's attribution headers reach usage reporting. Available once the data plane is on 0.9.0 or later.
tare CLI
tetrate agentrouter api mcp catalog list-available lists the MCP catalog servers available to a customer.
tetrate agentrouter api mcp catalog oauth-client shows the OAuth client that serves an MCP catalog server in a project.
tetrate agentrouter api projects mine now takes --page-size and --page-token, so you can fetch pages after the first.
The tetrate agentrouter api list commands that return results in pages, such as projects list, customers list, and the policy and guardrails list commands, now take --page-size and --page-token.
Observability
Data plane health findings can raise alerts to a workspace's Slack channels or to its own webhook receivers, routed by whether the finding pages or only notifies.
An alert now clears itself once its finding has been absent for 15 minutes and the cluster reports in again.
Helm charts
The management plane charts can read their secrets, such as the database URL, admin key and auth secret, from Kubernetes Secrets you name in global.secretRefs, so a GitOps install no longer has to commit them to git.
Bug fixes
Management plane
In a single-tenant deployment, a management plane restart or a role change on the Users page or at SSO sign-in no longer removes a user's platform billing, bonus claims, model and MCP roles.
With EVENT_REAPER_ENABLED on, a data plane that stops polling no longer collects configuration updates without limit.
Gateway
An application that calls with a token from its identity provider is now held to its key and project rate limits after it gets its own route. Available once the data plane is on 0.9.0 or later.
Requests to /v1/messages served by an OpenAI-schema model now report and bill cached prompt tokens at the cached rate.
A fresh data plane install with multiple AI Gateway controller replicas no longer restarts some of them during startup.
A route rollout on a busy data plane no longer fails and retries with "no AIGatewayRoutes found for deployed route", which tare doctor reported as a route deployment with no routes.
Metadata-only trace export now keeps the OpenTelemetry GenAI attributes: operation, provider, request and response model, and token usage.
Deleting or disabling an API key now reliably removes its routing from the data plane.
A route rollout no longer leaves the previous rollout's retry policies behind on the data plane when one of its routes was already removed, and no longer logs "failed to delete AIGatewayRoute … not found" for it.
The rate_limit_exceeded reply on a key's first calls, before the key's own limits reach the data plane, now names the project or system rate-limit policy.
A request no longer fails with an empty 500 in the few seconds after its API key gets a route of its own, which every token caller goes through shortly after its first call.
Management plane API
Listing policies by target_key_id finds the per-key fallback and traffic split policies saved in the Developer Console, and those of a disabled key.
These changes are now audited: data plane changes made through the workspace API, guardrail pattern and fallback-policy changes, refused gateway attaches, data plane upgrade outcomes, and the data plane URL, token revocations and MCP catalog entries a data plane writes.
The warning for a gateway with no URL no longer says the gateway serves nothing.
One API key name longer than 50 characters no longer makes the hourly usage rollup fail for every key in that hour.
tare CLI
The doctor's scheduled health check no longer runs out of memory on a data plane with a few hundred API keys.
tetrate agentrouter doctor now also catches a container that OOMKilled and has since restarted; it previously only caught one still sitting in the killed state.
Consoles
The Audit Logs page now loads quickly on a management plane with millions of audit records.
The sign-in page shows its default content when the published sign-in content cannot load, instead of an empty panel.
Agent apps that sign in through the Developer Console now get the URL of your oldest data plane that has one, not an empty URL when the oldest data plane has none.
Data plane
Removing BYOK keys that are already gone no longer makes the data plane rebuild every key's routes, and the data plane's periodic drift check no longer pauses configuration updates while it reconciles.
Gateway authentication on a gateway that also serves an MCP server with its own OAuth, API key or external auth now takes effect.
Helm charts
A management plane image tag given as a number, such as global.imageTag=123, now renders as that tag instead of an invalid image reference.
Observability
Changing the configuration of the data plane or management plane OpenTelemetry collector (otel-gateway) now restarts its pods, so the change takes effect; before, the running collector kept the old configuration until its pods were restarted by hand.
Deprecations
Consoles
The seed-signin-info script is deprecated.
Management plane API
stored_url on data planes and ClearSystemSetting are deprecated.
Auth
The auth service is deprecated and is removed no earlier than 0.11.