Changelog

• Applies to new tokens only. Existing tokens keep working as they are, with no action needed. Newly issued and newly refreshed tokens use the shorter length.
• Same security, simpler encoding. URL-safe base64 keeps tokens random and secure while making them shorter and safe to use in URLs.
• Check any length validation. If your integration validates token length (for example, expecting exactly 64 characters), update that rule before you issue or refresh tokens. If you replace tokens by creating a new API client (key) alongside the old one, you can roll over without interrupting live integrations.

• SAP — Updated SAP JCo libraries to version 3.1.14.
• SAP — IDoc triggers now retrieve ALE and IDoc configuration filtered by program ID on the SAP side, so unrelated or misconfigured ALE entries are no longer fetched.
• SAP — Fixed an issue where one connection failing to start its IDoc listener prevented other SAP subscriptions on the same agent from starting.
• PostgreSQL — Added support for the BIT data type.
• Kafka — Fixed handling of transactional messages.
• Audit logs — On-prem group and on-prem agent platform events are now recorded in audit logs.
• Security — Updated third-party libraries, including Spring 7.0.9.

See On-prem agent versions and the audit log reference.

✨ September’s spotlight is an agent-ready web stack. Firecrawl turns sites into clean, AI-ready data: scrape a page to markdown or HTML, extract with a prompt or schema, crawl a domain, map URLs, and flag page changes. Tavily handles the LLM half: web search with an optional generated answer, extract or crawl pages, and deep research with sourced reports. Jina adds the rest of the pipeline: read a URL into markdown, search, chunk, embed, rerank, classify, and run DeepSearch.

Also this month: Retell AI for outbound voice-agent calls, transcripts, and post-call analysis; Creatomate for template and RenderScript video, image, and GIF renders; TikTok and Bluesky for creator publishing; Baserow for no-code table CRUD and row-change webhooks; plus Supabase for Postgres rows, storage, and database webhooks, and Qdrant for vector upsert and similarity search.

🔧 Enhancements lean on schemas, auth, and media ops: document version and relationship actions in Veeva Vault; On-prem NTLM and expanded related-object field picks in OData; clearer SMTP send-failure reporting in Email (Custom) OPA; $select-scoped pills and $expand in SAP Sales Cloud; Google Vertex AI Generate content (Gemini) in place of deprecated PaLM 2; batch Create in Amplify; runtime Client secret preservation for VUA and opt-in full HTTP error bodies in OpenAPI; and Serverless as a job type in UiPath.

🛡 Stability fixes cover OpenAPI custom request headers coerced to text, UiPath Start Job targeting (Invalid RobotID) in modern folders, SAP Business One Search retries that keep the object name, AWS Secrets Manager Secret string sent as plain text, and Azure File Storage Upsert so large uploads no longer stop after the first 4 MB.

Proxy MCP servers now support OAuth, so each end user authenticates to the upstream MCP server with their own account.

• Registration — The builder configures OAuth credentials once when registering the proxy server.
• End-user authorization — Each end user completes a one-time OAuth authorization. Requests reach the upstream server under that user’s identity.
• Existing servers — Token-based proxy servers are unchanged.

See MCP servers.

The UK data center is generally available at app.uk.workato.com.

• Data residency — Customer data is processed and stored in the UK.
• Available at launch — On-prem agent, RBAC, SAML SSO, Enterprise MCP, Data Pipelines, Decision Models, Workato GO, Agent Studio, Copilots, AIRO, and IDP by Workato.
• Workato ONE — AIRO, Enterprise MCP, Agent Studio, Workato GO, Intelligent Document Processing, and AI by Workato are now available in the Israel, Korea, and UK data centers.

See Data Centers.

docs.workato.com now includes Ask AI, which answers natural-language questions using semantic search over the documentation.

• Semantic search — Matches on meaning rather than exact keywords and returns an answer with supporting pages.
• Languages — Uses a separate index per locale. English and Japanese are supported.

See Workato Docs.

Event Streams message size limits are raised from 512KB (recipe) / 1MB (API) to 10MB — large JSON payloads publish natively, no splitting or trimming required.

• 10MB Max Message Size — Publish large payloads directly across both connector actions/triggers and public APIs, with consistent behavior no matter how you publish.
• Dynamic Batching in recipes — Batches are capped at 50MB total payload; when messages approach the 10MB limit, Workato automatically returns remaining messages in subsequent batches with no data loss.

Learn more in Event Streams.

Native undo and redo support is available in the recipe editor. Experiment freely, backtrack instantly, and iterate without fear — no manual reversals, no restoring to a previous version.

• Full Action Coverage — Step additions, deletions, connection swaps, field-level changes, and AIRO-made changes all flow through a unified undo/redo stack.
• Familiar Shortcuts — Ctrl+Z to undo, Ctrl+Shift+Z to redo — just like any other editor you already use.

Learn more in Recipe Editor.

Enterprises running heavy XML — SOAP services, SAP IDocs, EDI batches, legacy middleware — now have first-class platform support. Three pieces, one story.

• Native SOAP Services — Host SOAP API endpoints natively on Workato by providing a WSDL, the same way REST APIs are hosted today. The WSDL is read directly from a governed Workato Resource.
• Workato Resources — WSDLs, XSDs, and XSLTs are now versioned, governed assets living in the project folder — referenced everywhere instead of pasted inline, and portable across environments with nothing to re-wire.
• XML Connector — Resource Support — Transform, Validate, and Generate from Sample XML actions can now reference resource assets instead of inline content, with full reuse and no UI lag.
• XML Streaming — Up to 200 MB — Large XML payloads stream natively, handling SAP IDocs, EDI batches, and other high-volume XML flows without size constraints.
• Generate XML from Sample — A new action generates a working XML shape from a representative sample, enabling mapping even when the schema is non-deterministic (anyType).

Learn more in Native SOAP and Workato Resources.

Share one MCP server across your entire org and control exactly which tools each user group can call — reads for everyone, writes and destructive actions only for the roles that need them. No duplicate servers, no code changes.

• Per-Tool, Per-Group Access — Grant a group access to a server, then scope it to specific tools, so each person's agent sees only what they're authorized to use.
• One Server, No Sprawl — Share a single mixed-sensitivity server across the whole org instead of maintaining watered-down copies per role.
• Contained Blast Radius — A hijacked or over-eager agent can only reach tools within its user's authorized scope — nothing outside it.

Learn more in MCP.