Changelog

Enterprises running heavy XML — SOAP services, SAP IDocs, EDI batches, legacy middleware — now have first-class platform support. Three pieces, one story.

• Native SOAP Services — Host SOAP API endpoints natively on Workato by providing a WSDL, the same way REST APIs are hosted today. The WSDL is read directly from a governed Workato Resource.
• Workato Resources — WSDLs, XSDs, and XSLTs are now versioned, governed assets living in the project folder — referenced everywhere instead of pasted inline, and portable across environments with nothing to re-wire.
• XML Connector — Resource Support — Transform, Validate, and Generate from Sample XML actions can now reference resource assets instead of inline content, with full reuse and no UI lag.
• XML Streaming — Up to 200 MB — Large XML payloads stream natively, handling SAP IDocs, EDI batches, and other high-volume XML flows without size constraints.
• Generate XML from Sample — A new action generates a working XML shape from a representative sample, enabling mapping even when the schema is non-deterministic (anyType).

Learn more in Native SOAP and Workato Resources.

Two significant enhancements enhance Workato API Gateway's alignment with OIDC standards.

• Public API Endpoints — API collections can expose unauthenticated endpoints with no access profile or credentials required, enabling standards-compliant discovery documents like /.well-known/openid-configuration (OIDC) and /.well-known/smart-configuration (SMART on FHIR). A clear warning is shown when configuring public endpoints to prevent accidental exposure.
• Custom Claims and Scopes Validation — Access Profiles can be resolved through OIDC token claims with no IdP modification required, enabling enterprise customers with locked-down shared IdPs — PingFederate, Okta, Azure AD, ADFS — to integrate end-to-end without involving their IdP admin teams.
• Clients Tab Renamed to Applications — The API Keys tab under Clients is now called Applications, reflecting support for multiple credential types beyond API keys alone.

Learn more in API Platform.

CSV Import for Data Tables is now available via the Dev API and Embed/OEM, extending the UI wizard shipped in May to programmatic, bulk loading.

• Bulk Import over the Dev API — Create a file upload link, push a CSV to file storage, and trigger a server-side import of thousands of records in a single async job.
• Append, Refresh, and Fresh-Load Modes — append adds rows to an existing table, truncate_table clears then loads, and assert_table_empty guards clean first-time loads.
• Configurable Parsing — Specify delimiter, quote character, encoding, and header handling when creating the upload link so the parser reads the file exactly as intended.
• Validated Column Mapping — Map CSV columns to table fields by index or label, with required-field coverage and type compatibility checked before the import runs.
• Embed/OEM Parity — Every import endpoint has a managed_users counterpart so Embed partners can run imports on behalf of their end customers.

Learn more about Data Tables.

The API Edge Gateway (EGW) is a Workato-managed gateway that runs inside your own infrastructure — on-prem or private cloud — while staying connected to Workato's cloud control plane for configuration, monitoring, and alerting. Enterprises in regulated industries no longer have to choose between powerful API management and compliance.

• Keep API traffic within your network and jurisdiction — sensitive data never leaves your private infrastructure.
• Deploy to Cloud or Edge from a single Workato workspace, with consistent policies, auth, quotas, and rate limits enforced across both.
• Supports Docker & Kubernetes (Helm) deployment with all existing auth types: Token, JWT, OIDC, OAuth, and mTLS.
• Monitor EGW health, connectivity, and traffic from the Workato UI — with proactive RecipeOps alerts for connectivity loss, auth failures, or version drift.
• Graceful fallback mode keeps the gateway running on cached config even when disconnected from the control plane.

Learn more about API Edge Gateway.

The Developer Portal supports Single Sign-On (SSO) authentication, giving enterprise teams a secure, seamless login experience using their existing identity providers — including Okta, Google Workspace, and Microsoft Entra ID.

• Enable SAML SSO for the Developer Portal via Workspace Admin → Access Control → Authentication.
• Just-in-Time (JIT) provisioning automatically grants access to new users on first login — no manual invites or account setup required.
• Developers authenticate through their organization's IdP and land directly in the portal with a secure, persistent session — replacing the previous magic link flow.
• Enforce centralized authentication policies — MFA, conditional access, and session controls — across the Developer Portal alongside all other internal tools.

To enable SSO for your Developer Portal, email accounts@workato.com with your Workspace ID to get started. Learn more about Developer Portal SSO.

We've increased the maximum number of API keys allowed per client.

New Limit: You can now create up to 20 API keys per client (previously 10).

This update provides more flexibility for managing keys across different environments (Dev, Test, Prod) and supports better key rotation practices.

Custom domains are now available in the API Developer Portal, enabling organizations to fully white-label their developer experience and meet enterprise branding and compliance needs.

• Set up a custom URL for your Developer Portal to match your brand.
• Deliver a seamless, branded experience for end users across all touchpoints.
• Enhance privacy and security by eliminating third-party cookie issues.

Learn more in the API Developer Portal documentation.

Mutual TLS (mTLS) is now available on Workato’s API Platform, further strengthening our enterprise-grade security offering for regulated industries and public sector use cases.

• Client-level mTLS enforcement with granular certificate attribute validation.
• New Truststore to manage client certificates, with automated expiry reminders and Developer API support.
• Enables secure, certificate-based authentication—essential for customers in healthcare, finance, manufacturing, and government.
• Available to all customers with API Platform (requires API custom domain setup).

Learn more in the mTLS documentation.

Workato’s API Platform now supports OAuth 2.0 token introspection, enabling the gateway to validate opaque access tokens issued by external identity providers (IdPs).

• Enhances OpenID Connect support for broader compatibility with enterprise IdP architectures.

Learn more in the OAuth 2.0 Token Introspection documentation.

As part of our transition to industry-standard token-based security, legacy API key authentication will be fully deprecated on July 14, 2025.

• API requests using legacy API key + email authentication will no longer be supported after this date.
• Customers must migrate to API client authentication using bearer tokens.
• Required steps include creating a new API client, assigning appropriate roles, generating a new token, and updating applications to use the new Authorization: Bearer header.
• We recommend deleting any legacy “Migrated API Client” after confirming all systems are updated.

Learn more in the Workato API migration docs.