Integration Digest for September 2026

September 2026 Integration Digest

OpenAPI Overlays 1.1 now treat API features as standalone, reviewable documents. These include metadata, descriptions, and ordered actions applied to a base specification. The new format adds Bar schemas and paths, updates Foo, and replaces JSON Patch array indexes with RFC 9535 selectors.

Authenticated Passthrough allows the Gateway to serve metadata while remaining stateless. The Gateway validates the caller's JWT in AuthorizationGW, challenges with its own metadata, and forwards the upstream bearer token in Authorization. Clients supporting custom headers are required, and opaque upstream tokens are not validated.

Postgres row changes can now be captured efficiently without dual-writing. A transactional outbox commits domain data and an outbox row together, which are then streamed through replication slots using logical decoding. Tools like test_decoding, pgoutput, and wal2json facilitate this process without changing the application.

The MCP has been made stateless following the 2026-07-28 revision. This change removes protocol sessions and replaces server-initiated requests with MRTR. Security vectors such as header/body desync, forged or replayed requestState, and cache poisoning have been tested and mitigated. The MCP-bastion component ensures cross-request security state by binding requestState to principal, server, and tool with an HMAC and a 300-second TTL.

As of three years ago, 1,927 public API specs were analyzed from the APIs.guru corpus. Of these, 48.9% changed structurally, with 66.8% of changed contracts containing breaking changes. Most breaks occurred due to removed endpoints and response fields. The analysis uses a 20-second fetch with no retries, inlines local references, and compares path parameters by position.