Change logs

These change logs document all relevant changes for the Cumulocity cloud deployments.

The following types of change are included:

  • Feature - New features which are generally available.
  • Preview - Features which are in Public Preview and not yet generally available.
  • Improvement - Small improvements.
  • Announcement - Deprecations, removals or important UI changes.
  • API change - Breaking changes in the APIs.
Info
Subscribing to change log information is possible in the corresponding change log representation in the Cumulocity Tech Community.

Displaying all changes since December 6, 2023

August 10, 2026

Deprecation of device availability views

Context

The Device Management application currently provides two views for monitoring device availability based on raised and cleared critical alarms: the Availability tab on individual device detail pages, and the Availability page under the Devices menu in the navigator. Both views are powered by the legacy AngularJS c8y.parts.availability module.

Change

The per-device Availability tab and the fleet-wide Devices > Availability page are now deprecated. The underlying AngularJS module c8y.parts.availability (including the availabilityReportCtrl controller and associated views) is marked as deprecated in the codebase. The feature will remain available through y2027 and is planned for removal thereafter.

Consequence

Existing tenants and users will continue to see the availability views until the removal date. No immediate action is required. After removal, the views will no longer be accessible in the Device Management application. The underlying alarm-based availability data remains available via the Cumulocity REST API.

Persona

This deprecation affects Device Management application users who rely on the availability views for operational monitoring, as well as developers who have built custom applications referencing the c8y.parts.availability AngularJS module from the @c8y/ng1-modules package.

Action

  • End users: No action required before the removal date. After removal, use alarm-based monitoring via the REST API or build custom dashboards using the data.
  • Developers who import or extend the c8y.parts.availability module from @c8y/ng1-modules: plan to remove those dependencies before y2027.

Documentation

See Availability in the Device Management documentation.

August 7, 2026

Tenant options are not attached as request headers by microservices proxy

The deprecation of attaching microservices’ tenant options as request headers by the microservices proxy was under Public Preview, and is now Generally Available (GA) for CD versions 2026.230.0 and higher, and will be present in the 2027 annual release.

Until now, tenant options were attached to each microservice request unless this functionality was explicitly disabled via a feature toggle. The microservice proxy added the tenant options to the request headers and forwarded the request to the respective microservice. This functionality is now disabled by default. Tenant options are no longer attached as headers to requests to microservices. The retrieval of the tenant options remains possible through the endpoint <TENANT_DOMAIN>/application/currentApplication/settings.

This change is now available by default.

Caution
Migration from Public Preview to General Availability - action required. If you are relying on the attachment of tenant options as headers to the microservice requests, you need to change this behaviour respectively for cumulocity core CD versions higher than 2026.230.0 and 2027 annual release.
August 6, 2026

Data Preparation now supports alarm upsert

Feature preview
This feature is in Public Preview, that is, it is not enabled by default and may be subject to change in the future.

Data Preparation now supports alarm updates. This applies upsert behavior equivalent to Create or update an alarm:

For details, see Alarm.

ONNX block in Analytics Builder now requires file extension in model name

The ONNX block (Public Preview) in Analytics Builder now supports models uploaded to the Cumulocity files repository as a standalone .onnx file. Previously, the block only supported models packaged inside a .zip archive.

The ONNX model name parameter must now include an explicit .onnx or .zip file extension:

  • <modelName>.onnx looks for a standalone <modelName>.onnx file.
  • <modelName>.zip extracts the archive and looks for <modelName>.onnx inside it.

Previously, <modelName>, <modelName>.onnx, and <modelName>.zip were always resolved by extracting a <modelName>.zip archive and looking for <modelName>.onnx inside.

Important
This is a breaking change for existing models that omit the file extension, or that use a .onnx extension to extract a model from a .zip file uploaded to the files repository. To migrate, ensure the file extension used in your Analytics Builder model matches the type of file you have uploaded.
August 5, 2026

Share type dashboards across applications

In the dashboard manager, type dashboards can now be shared across applications. Use the new Data sharing option to pull in dashboards from other applications, or the Manage visibility row option to push a dashboard to specific applications.

Text-based configuration tab now uses code editor

The Text-based configuration on the Configuration tab in the device details now uses the code editor instead of a plain text area, adding syntax highlighting and code formatting.

Added information about the context path of the REST API to OpenAPI documentation

Documentation on proxied request URL structure for the DTM API has been added, including microservice path and REST API path composition, with a working example for querying assets.

Cloud Remote Access host key approval is backward compatible with older cloud-remote-access microservice versions

When users establish remote connections via SSH, the system now only prompts them to approve the remote server’s host key if the cloud-remote-access microservice supports host key probing on the SSH socket. With older microservice versions, SSH connections work as before.

Create and assign subassets in a single request

The Asset API previously required separate requests to create a subasset and then assign it to a parent asset. You can now create and assign a subasset in a single operation by providing the complete subasset representation during assignment, streamlining your asset management workflows.

This change reduces the number of API calls required for subasset operations, improving performance and simplifying integration logic. Existing code that uses separate create and assign operations continues to work without modification, so you can adopt this new capability at your own pace.

Create and manage custom icons with an improved icon selector

The Web SDK now includes full custom icon management. The improved icon selector lets you upload and customize your own icons, then find and apply them across applications and managed objects.

Improved security by SSH host-key confirmation on first use

When the “hostkey-autosave” tenant option is set to “true,” and you connect to a device via SSH for the first time, the system now prompts you to confirm the host key before establishing the connection. Previously, SSH connections could be established without explicit host-key verification, which posed a security risk by making it possible to connect to unverified or potentially compromised devices. With this change, you must verify and accept the host key during the initial connection attempt, ensuring that you are connecting to the intended device and protecting against man-in-the-middle attacks. This feature requires a compatible version of the cloud-remote-access microservice.

Multi-select support for aggregation functions and new auto aggregation mode

Previously, the “Data graph” widget and the data explorer supported only a single aggregation function per data point. Now you can select multiple aggregation functions at once (for example, minimum, maximum, and average) and compare them in parallel on the same chart, including a band display for minimum/maximum.

In addition, the new “Auto” aggregation mode calculates the aggregation interval automatically from the selected time range and a configurable number of data points per chart. When zooming in, the chart can either load data at a finer interval or reuse the already loaded data. Auto mode is available on tenants migrated to time series. Existing widget configurations continue to work unchanged.

July 23, 2026

Configurable SSH host key verification for Cloud Remote Access

The handling of the SSH server host key for Cloud Remote Access endpoints is now controlled by the hostkey-autosave tenant option in the remoteaccess category. The option defaults to false, so the server host key must be confirmed on first connect. This is a deliberate security change from the previous silent-autosave behavior.

When hostkey-autosave is false (the default), connecting to an endpoint that has no host key stored yet first probes the server and shows its host key fingerprint, and the connection continues only after you confirm it. When set to true, the server host key is instead trusted and saved automatically on the first successful connection. In both cases, the stored host key is verified on every subsequent connection, and a mismatch aborts the connection.

July 15, 2026

Syntax highlighting in configuration preview and new edit option

In the Device management application, the read-only configuration preview on a device’s Configurations tab now applies syntax highlighting. Snapshots retrieved from a device are shown in a syntax-highlighting editor, with the correct language applied automatically based on the file type, making them easier to read.

A new Edit in repository button lets you edit an available configuration and save it to the repository before it is sent to the device. It opens a drawer that is pre-filled with the selected configuration, where you can review and adjust it.

The Save to repository action now lets you edit the configuration retrieved from the device before it is saved to the repository, so you can adjust a snapshot on the way in instead of saving it as-is.

Dashboarding technology update and required gridstack dependency

Starting with the next major Web SDK release, version 1024.0.0, we are updating the underlying dashboarding technology.

As part of this change, every application that uses the Web SDK dashboarding technology must import the gridstack dependency.

Additionally, a significant part of the custom implementation in the DashboardChildChange class has been removed.

Breaking change

Applications that rely on dashboarding features but do not import gridstack will fail to build or run correctly after upgrading to 1024.0.0.

Impact: Custom applications built with the Web SDK dashboarding technology are affected.

Migration:

  • Add gridstack as a dependency and import it in each application that uses dashboarding features.
  • Review custom integrations that depend on the previous DashboardChildChange implementation and update them as required.

Explicit withChildren parameter for Inventory API calls

The Cumulocity platform will soon change the server-side default of the withChildren query parameter on /inventory/managedObjects GET endpoints from true to false for performance optimization; relying on the current true default is deprecated. Once the new default takes effect, responses no longer include the childAssets, childDevices, and childAdditions reference arrays unless withChildren=true is set explicitly.

This is a server-side change. The Web SDK’s InventoryService is unchanged — it passes withChildren straight through and never set a default. The UI codebase has been adapted:

  • AngularJS (legacy modules): A new HTTP interceptor c8yInventoryWithChildrenInterceptor appends withChildren=true to /inventory/managedObjects GET requests when the parameter is not already set, preserving existing behavior without call-site changes.
  • Angular (@c8y/ngx-components): Inventory call sites now pass withChildren explicitly. Shipped components behave correctly under the new default; no action is required.

Migration

If your custom code reads childAssets, childDevices, or childAdditions from an InventoryService.detail(), .list(), or .listQuery() response, add withChildren: true to those calls. Otherwise those references will be missing once the new default is active for the tenant.

Removal of the AngularJS event list widget and view from @c8y/ng1-modules

Starting with version 1024.0.0, the AngularJS event list has been removed from the @c8y/ng1-modules package. This covers both the Device Management event list view and the event list dashboard widget, together with their binary-event preview components. The functionality is fully replaced by the Angular event list shipped in @c8y/ngx-components, which the standard Device Management and Cockpit applications already use.

Breaking change

Custom applications that reference the removed modules in their AngularJS bootstrap (ng1.ts) will no longer build after upgrading. The affected import paths are:

  • @c8y/ng1-modules/devicemanagement-eventList/cumulocity.json
  • @c8y/ng1-modules/eventList/cumulocity.json

The build fails with a Module not found error for these paths.

Impact: Custom applications scaffolded from the Device Management or Cockpit application before the event list was migrated to Angular still contain these imports and are affected. The standard Device Management and Cockpit applications are not affected.

Migration: Remove the two imports from your ng1.ts. The Angular event list is provided by:

  • eventsDeviceManagementProviders from @c8y/ngx-components/events/devicemanagement for the Device Management view.
  • eventsCockpitProviders from @c8y/ngx-components/events/cockpit for the Cockpit view.
  • The event list dashboard widget is registered automatically through cockpitWidgetsExports from @c8y/ngx-components/widgets/cockpit-exports; existing widget configurations remain compatible.

Unified saveConfig$() return values in DataGridConfigurationStrategy

Starting with version 1024.0.0, the saveConfig$() method on all built-in DataGridConfigurationStrategy implementations consistently returns of(undefined) when there is no context or nothing to persist. Previously, return values were inconsistent, for example, VoidConfigurationStrategy returned of(null) while others returned of(undefined).

Additionally, the UserPreferencesService.set() JSDoc was corrected to state that it returns “a promise that resolves when the value has been saved” instead of “a promise with saved value”, matching the actual Promise<void> return type.

Breaking change

Custom DataGridConfigurationStrategy implementations that return of(null) from saveConfig$() or subscribers that check the emitted value with strict equality may break.

Impact: Developers who implemented custom DataGridConfigurationStrategy and relied on of(null) being emitted from saveConfig$() are affected.

Migration: Ensure custom saveConfig$() implementations return of(undefined) (not of(null)) for the no-op case. Subscribers should not rely on the specific emitted value. Treat the Observable<void> emission as a completion signal.

July 13, 2026

Enhanced SCADA widget

The “SCADA” widget has been significantly enhanced. The new version is built on modern web component technology with Lit syntax, replacing the previous AngularJS-based approach. Key improvements include:

  • AI-assisted SVG generation — analyzes the selected asset’s properties, measurements, alarms, and events to propose visualizations or generate one based on user’s instructions, and maps corresponding data to placeholders.
  • Interactive placeholder mapping — click directly on text or tspan elements in the widget preview to convert them into dynamic placeholders.
  • Flexible display settings — control how the SVG fits within the widget, with alignment options.
  • Advanced editor — for complex visualizations using Lit syntax and direct web component editing without a need to switch to an external editor.

This enhancement is available as a preview feature. To enable it, open the Preview features page from the right drawer and turn on the corresponding option. For details on new configuration options and SVG with Lit syntax, see SCADA widget in the user documentation.

Existing “SCADA” widgets using AngularJS syntax continue to work without any changes in the legacy mode. If you want to reuse existing SVGs in the new widgets, the documentation includes migration instructions for adapting them to Lit syntax.

Reorganized widget configuration view with a preview section

The widget configuration view has been reorganized for better consistency and now includes a preview section that shows how settings will appear before they are applied. Moreover, the screenshots of the available widgets in the widget selection drawer have been updated.

July 9, 2026

Alarm upsert endpoint changes

The POST /alarm/alarms/upsert endpoint has been updated with the following changes:

  • New response body: The endpoint now returns an object with two fields instead of a plain alarm representation: alarm (the alarm as it exists after the upsert) and previousState (a snapshot of the alarm before the upsert, or null if a new alarm was created).
  • New query parameter: A boolean incrementCount parameter (default: false) has been added. When set to true, the count property of an existing alarm is incremented during upsert.

For details refer to the alarm upsert operation in the Cumulocity OpenAPI Specification.

July 8, 2026

Asset breadcrumbs plugin now available in Dtm-plugins extension

The Asset breadcrumbs plugin displays the asset path in group and device contexts (that is, when the URL path is /group/:id or /device/:id), making it easier to navigate through hierarchical asset structures.

It automatically generates the navigation path from the root asset to the current subasset, thus reducing navigation complexity and improving the user experience when working with nested asset hierarchies.

Multiselect list type for property definitions

When modeling assets, some properties need to hold multiple values in a single field — for example, a list of supported protocols or applicable regions. Digital Twin Manager now supports multiselect list property definitions, which use the array data type to let you capture multiple selections in a single field.

To use this feature, create a new property definition and select the array type. Existing property definitions and assets are not affected.

For details, see Property definitions.

July 7, 2026

Angular 21 upgrade

In a future version of the Web SDK, we will update the Angular version used in the Web SDK to version 21. This update brings improvements and new features, but may also introduce breaking changes that could impact your existing implementations.

To ensure a smooth transition to Angular 21 and help you adapt your implementations, we will provide upgrade documentation when this change happens. This documentation will help you navigate the changes and update your codebase accordingly.

July 2, 2026

Configuration repository now supports creating and editing configurations in the browser

Users can now create and edit configuration repository entries directly in the browser using a built-in code editor, without having to prepare a file outside the application. The configuration detail form has been moved from a modal to a bottom drawer, providing more screen space. Three content modes are available: upload a binary file, enter an external URL, or edit the content inline. When a text file is dropped or selected, the editor automatically loads its content and detects the syntax based on the file extension. A language selector lets users override the auto-detected highlighting.

July 1, 2026

Data Preparation now available in Public Preview

Feature preview
This feature is in Public Preview, that is, it is not enabled by default and may be subject to change in the future.

Data Preparation is a new application that lets you transform incoming device messages before they are stored in Cumulocity. You create rules that receive raw payloads over MQTT, process them with custom code, and produce standard Cumulocity measurements—for example, converting proprietary sensor data from a device into a format the platform can store and display.

Each rule targets a specific MQTT topic or client ID filter and runs a smart function—a Javascript snippet—that processes the incoming message. The built-in AI assistant (powered by the AI Agent Manager) helps you generate the transformation code from a sample payload and a plain-language description of your goal.

Key capabilities include:

  • A guided wizard for creating rules with topic and client ID filters.
  • An AI assistant that generates smart function code from sample payloads.
  • A rule editor with live testing against sample data before deployment.
  • Draft and deployed states for safe iteration without affecting live traffic.

To enable Data Preparation, open the right drawer (by clicking on your username initials) in the Administration application and select Manage preview features. Then activate the toggle next to Data Preparation. If you use a custom or duplicated application (for example, a duplicate of Cockpit or Administration), upgrade to the latest Web SDK or duplicate the application again. Otherwise, the Data Preparation icon does not appear in the app switcher in those applications.

For details, see Data Preparation.

Support for on-demand refresh in the HTML widget

HTML widgets in the Cockpit application previously did not support the manual refresh functionality of the global time context feature, which meant that users could not update the widget content on demand when the automatic refresh was paused. HTML widgets now include a functional refresh button that allows users to manually refresh the widget content. This change gives you more control when widget data is updated.

Upcoming removal of LESS files following the migration to SCSS

The Cumulocity Web SDK styles in the @c8y/style package have been migrated from LESS to SCSS. As a follow-up, the redundant .less files will be removed from @c8y/style. This change is currently available in the Continuous Deployment (CD) version and will ship in an upcoming maintenance version of the 2026 release. The exact release version will be announced separately.

What changes?

All styling is now authored in SCSS. The .less files, LESS variables, and LESS mixins previously shipped in @c8y/style are being removed, and the package entry point moves from main.less to main.scss. The SCSS files provide the same variables, mixins, and compiled output.

Breaking change

Custom applications, plugins, or themes that import the removed .less files — or that override LESS variables and mixins — will no longer build after upgrading. The build will fail with a Module not found error for the removed paths.

Impact: Any UI customization that relies on the LESS styles is affected, including:

  • Direct imports of @c8y/style .less files, for example @c8y/style/main.less, @c8y/style/branding.less, or @c8y/style/login.less.
  • Overrides of LESS variables or mixins imported from @c8y/style/variables/index.less and the related _brand-vars and _color-vars files.
  • Custom themes and branding built on the LESS variables.

Applications and plugins that already consume the SCSS styles are not affected.

Migration: Switch your imports and overrides to the SCSS equivalents:

  • Replace each .less import with the matching .scss file, for example @c8y/style/main.scss and @c8y/style/branding.scss.
  • Import variables from @c8y/style/variables/index.scss instead of the .less file.
  • Update the import syntax from LESS @import 'file.less' to SCSS @use 'file' or @forward 'file', and change LESS variable overrides from @variable-name to $variable-name.

Detailed guidance on styling components and applications with SCSS will be added to the Web SDK Codex documentation when the release is published.

June 25, 2026

User search now supports partial username matching

Previously, when searching for users in the administration interface, you had to enter the exact username to find a user. Now, the user search supports partial username matching, allowing you to search by entering just a portion of a username. This makes it easier to locate users when you do not remember their complete username, improving the user search experience in the administration interface.

Single sign-on configuration now supports mutual TLS (mTLS)

Previously, single sign-on (SSO) configurations could authenticate to the external authorization server only with a client secret. You can now enable mutual TLS (mTLS) in the SSO configuration and upload a client certificate and private key for certificate-based authentication. The private key is encrypted on the server after saving.

June 23, 2026

Added compact mode for dynamic chart legend

When viewing dynamic charts with numerous data series, the hover tooltip can become large and consume significant screen space, occasionally obstructing the chart data itself. To address this, a new compact mode has been introduced for tooltips in both the “Data graph” widget and the data explorer.

This compact mode is automatically activated whenever a tooltip contains more than 5 data points. By reducing the visual footprint of the tooltip in high-density charts, this update ensures you can view more of your actual chart content while still maintaining full access to all relevant data point details.

Dynamic widget selection now available through extended widget hook component

The widget hook component has been updated to support dynamic widget selection.

This enhancement allows you to programmatically choose and load widgets based on different conditions and user preferences. For more details, see Widget hook in the Cumulocity Codex.

June 22, 2026

Configuring root groups or assets as top node entries in the navigator

The navigator displays root groups or assets as top-level entries that users can access directly. Previously, you could only manually select specific groups or assets to display as top nodes in the navigator. Now you can configure the navigator to automatically display all root groups or all assets as top node entries, giving you more flexibility in how you organize your navigation structure. This change allows you to quickly set up the navigator without having to manually select each individual group or asset, which is especially useful when you have many root-level items that you want to make easily accessible. Existing navigator configurations remain unchanged, and you can still manually select specific items if you prefer that approach.

Global context controls can now be collapsed in the widget header

Global context controls in a widget header can now be toggled between an expanded and a collapsed view. Collapsed, the controls shrink to a compact set of icons that keeps the header tidy; expanding them reveals the full controls inline. This works both for widgets linked to a dashboard’s global context and for standalone widgets.

June 18, 2026

Deprecation of password updates via general user APIs

To improve platform security, the ability to update passwords through general user endpoints is being deprecated. Password changes will soon require verification of the current password to prevent unauthorized account takeovers.

Affected endpoints

The password field is deprecated in the following endpoints:

New requirement

All password updates must use the dedicated endpoint for updating the current user’s password:

This endpoint requires the currentPassword field for validation.

Timeline

Starting in Q4 2026 for the SaaS instances and in 2027 for the yearly releases, the password field in general user endpoints will be ignored.

Important
Update all client applications and scripts to use the dedicated password endpoint. This transition is mandatory to ensure enhanced security and prevent unauthorized password modifications.
June 17, 2026

Enhanced access control and permissions for LWM2M service

To improve security for the LWM2M service, stricter access control has been enforced. To work with device-specific LWM2M configurations from the Device Management application, users must now be granted explicit LWM2M ADMIN and READ permissions. This affects Device settings, Connectivity, Bootstrap, and more under the LWM2M Configuration tab, the device registration, and Device protocols at the tenant level. Administrators can assign the necessary permissions to users in Administration > Accounts > Users > Roles.

Default value support for enumeration property definitions

Enumeration properties can now have a default value assigned. When creating an asset, the predefined default is applied automatically, so you no longer need to set the value manually every time.

DTM Data Service now available in Public Preview

Feature preview
This feature is in Public Preview. It is not enabled by default and may be subject to change in future releases.

The DTM Data Service microservice processes data point links configured through the DTM Data Points plugin and automatically propagates incoming device measurements to the corresponding assets in the digital twin hierarchy via c8y_LinkedSeries.

By transforming raw device measurements into structured asset-context data, the service enables operational data to be accessed and visualized directly from assets, powering asset-centric dashboards, analytics, smart rules, and business applications without requiring direct queries to individual devices.

Note: To enable the DTM Data Service, tenant administrators must enable the notification2.tenant.all.apis tenant option.

DTM OpenAPI is available in the API Documentation app

The OpenAPI of DTM is now available in the API Documentation application which shows all known OpenAPI documentations in the current tenant. Previously, the OpenAPI was only visible in a specific OpenAPI Documentation plugin within the DTM application.

If the API Documentation application is not visible in your application switcher, you can deploy it through Administration > Ecosystem > Extensions > api-doc by selecting the Deploy application button. This change improves discoverability and reduces the setup time needed to access API documentation across all tenants and users. The required version of the api-doc is 1023.82.1.

The OpenAPI Documentation plugin in the DTM application will be deprecated in the future and users should migrate to the API Documentation application.

New REST endpoint for reconciling the opposite child additions of all linked series of an asset

When an asset links to a measurement source on a device, the platform maintains a reverse index (c8y_LinkedSeriesReverseIndex) on the device that tracks which assets reference it. Previously, if this index became out of sync with the asset-side configuration, there was no dedicated API endpoint to correct it.

The Digital Twin Manager REST API now includes a new endpoint to reconcile the opposite ChildAddition of all LinkedSeries of an asset (also known as MeasurementSourceLink): PUT /assets/{assetId}/opposite. The endpoint updates the c8y_LinkedSeriesReverseIndex managed object on the device sides to accurately reflect the asset-side source references. The optional query parameter removeMissingSourceId removes the source.id if any linked device no longer exists. If the device is not found and the parameter is not set, the endpoint returns a 422 error.

Developers and administrators can use this endpoint to programmatically correct synchronization issues in linked data point configurations without manual intervention.

Preventing potential data loss from highly concurrent updates on assets

The Asset API now implements per-asset and per-device locking to serialize concurrent create and update operations. Previously, when multiple operations updated the same asset or LinkedSeries pointing to the same device simultaneously, data could be lost or corrupted because changes were not properly sequenced. The new locking mechanism ensures that concurrent updates on the same asset or device are processed sequentially, preventing lost updates and maintaining data integrity.

Your applications and devices continue to operate normally, but you can now safely perform concurrent update operations without risking data loss. There might be a performance decrease for highly concurrent operations due to the nature of the locking mechanism which waits for the previous request to be finished before starting the next request.

June 10, 2026

Deprecation of ODBC-based connectivity to Power BI

Microsoft Power BI can be connected to Dremio so that you can analyze your IoT data residing in the data lake. So far, that connection has been based on an ODBC driver. Microsoft has announced the transition from legacy ODBC drivers to Apache Arrow Database Connectivity (ADBC) drivers. While in the transition phase ODBC is still supported, ADBC will eventually become mandatory. Dremio provides an ADBC-enabled connector to connect to Power BI. Therefore, the connection between Power BI and Dremio needs to be reconfigured so that ADBC is used instead of ODBC.

June 5, 2026

Alarm upsert endpoint

Cumulocity now provides a dedicated alarm upsert endpoint (POST /alarm/alarms/upsert). The operation creates a new alarm if no uncleared alarm with the same source and type exists, or updates the existing one otherwise. The response status reflects the outcome 201 Created for a newly created alarm, or 200 OK when an existing alarm was updated.

For details refer to the alarm upsert operation in the Cumulocity OpenAPI Specification.

June 4, 2026

UI highlight for single data point series

When viewing data point series in charts, you can now easily identify and focus on individual series by clicking on them. The UI highlights the selected series visually, making it clearer which data you are examining. Previously, there was no visual distinction when selecting a single series, which made it difficult to track which data points corresponded to which series in complex charts with multiple data sources. This improvement enhances your ability to analyze and understand data point relationships in your visualizations, particularly when working with charts that contain many overlapping or similar-looking series.

May 19, 2026

Asset model tree nodes are now clickable during asset creation

During asset creation, users can now click directly on asset model tree nodes in the left-side hierarchy view to navigate between models. Previously, users could only view the selected root asset model hierarchy, but had to use the Next and Previous buttons to move through the tree, limiting their ability to quickly access specific models in the hierarchy.

The tree nodes are now fully interactive, allowing you to jump directly to any asset model in the hierarchy without stepping through each level sequentially. This change streamlines asset creation workflows by reducing the number of clicks needed to reach the desired model.

May 18, 2026

Extended data explorer view with collapse and full-screen mode

The data explorer view now provides better control over your workspace layout. You can collapse sections in the data explorer to focus on specific areas and use full-screen mode to maximize your viewing area when analyzing data. These improvements make it easier to work with large datasets and complex visualizations by giving you more flexibility in how you arrange and display information on your screen.

May 15, 2026

Added action column in device parameters list

In the Device Management application, editable device parameters can now be modified directly from the parameter list through a dedicated edit action.

Devices can now be assigned to assets with LINKING_UPDATE permission

Previously, assigning devices to assets required the ASSETS_ADMIN and the INVENTORY_UPDATE permission, which was overly restrictive for users who only needed to manage asset linking and relationships. The Asset API now allows users with the LINKING_UPDATE permission to assign devices to assets if the assets.permission.mode is set to either ALL, or EXTERNAL and the asset is an external asset. An asset is considered external if it has the marker fragment c8y_ExternalAsset.

May 14, 2026

Binding external identifiers when creating managed objects

Cumulocity now provides the ability to bind external identifiers within managed object creation operations. Both single managed object creation and bulk creation support creating external identifier binding within a single request.

For details refer to the create one or multiple managed objects operation in the Cumulocity OpenAPI Specification.

Enhanced traceability for support user logins in audit logs

The audit logging logic for User login actions has been improved to ensure full visibility during subtenant access.

When a support user logs into a subtenant, the audit log entry now consistently records the specific target user being accessed. Previously, if the system used only the <managementTenantUserId>$ identifier, the audit log would omit the impersonated user’s identity.

This has been corrected to ensure that even when the primary administrator account (anonymous user) is utilized, the audit trail explicitly captures and displays the identity of the chosen target user within the subtenant.

Strict validation of unit values in measurement fragments is now enforced

As announced earlier, Cumulocity now strictly validates unit values in measurement fragments.

If a measurement fragment contains a unit value that is null or an empty string, the platform removes the unit value before persisting the measurement. The measurement itself is still stored, but without the unit.

For example, if you send a measurement with an empty unit value:

{
  "c8y_Temperature": {
    "T": {
      "value": 22.5,
      "unit": ""
    }
  }
}

The platform stores the measurement, but the unit field is not persisted and is missing in the API response. To retain the unit in the stored measurement, send a valid, non-empty value:

{
  "c8y_Temperature": {
    "T": {
      "value": 22.5,
      "unit": "°C"
    }
  }
}

This change improves data quality and consistency across the platform.

May 13, 2026

Live preview added to Asset properties widget configuration

The “Asset properties” widget configuration now includes a live preview panel to help you visualize your widget before saving. When you select an asset and its properties, the preview panel displays the selected property and its values in read-only mode, showing exactly how the widget will appear in your application.

This enhancement eliminates guesswork when configuring the widget, as you can see real-time updates as you make selections. Existing widget configurations remain unchanged, and the preview panel appears automatically when you configure a new “Asset properties” widget or edit an existing one.

New endpoint to get direct subassets for an asset identified by its external ID

The Dtm microservice now includes a new endpoint /assets/externalIds/{externalId}/subAssets that allows you to fetch direct subassets using an asset’s external ID. Previously, you could only retrieve subassets by using the asset’s ID, which required an additional lookup step if you were working with external identifiers. This new endpoint streamlines workflows by enabling direct queries based on external IDs, eliminating the need for intermediate ID resolution.

With this addition, applications and integrations that manage assets through external identifiers can now access subasset hierarchies more efficiently. Your existing code using internal IDs continues to work without changes, and you can adopt the new endpoint at your own pace to improve performance and reduce complexity in asset management operations.

May 8, 2026

Automatic clearing of conflicting tenant option categories during microservice upload

Previously, when uploading a microservice that defined tenant options with a category that already existed in your tenant, the platform rejected the upload. It required you to manually remove the conflicting tenant options before proceeding. You are now informed about the conflict, and after you retry the upload, the platform automatically clears the existing tenant option category and replaces it with the category defined in the microservice manifest. A warning message appears before the upload completes, allowing you to review the change. This streamlines the microservice deployment process and eliminates the need for manual cleanup of conflicting tenant options in your tenant.

AI Agent Manager now uses Streamable HTTP transport for internal MCP server instead of HTTP with SSE

Feature preview
This feature is in Public Preview, that is, it is not enabled by default and may be subject to change in the future.

The AI Agent Manager has previously offered an MCP server that used the “HTTP with SSE” transport. The “HTTP with SSE” transport has been superseded by the “Streamable HTTP” transport in the MCP specification.

Therefore, we no longer offer the “HTTP with SSE” transport and only provide the MCP server via “Streamable HTTP”.

External clients that made direct use of the MCP server may need to adjust for the changed transport and endpoint.

May 7, 2026

Combined block parameter for function code in the Smart Function block

The Smart Function block now uses a single, dynamically sized block parameter instead of a fixed set of parameters for providing values to the smart function code.

Feature preview
The Smart Function block is in Public Preview, that is, it is not enabled by default and may be subject to change in the future.

Specifically, the block parameters params[0], params[1], params[2], params[3], and params[4] have been replaced by the Parameters for the Smart Function code parameter, which is of the list type. You can add any number of values to it.

The way to access the parameter values inside the smart function code remains the same:

let firstParam = context.params[0];
let secondParam = context.params[1];

Each value in the list can be either a fixed value or refer to a model parameter.

In existing models that use the Smart Function block, you must remove and re-add the block.

May 4, 2026

Improvements in authorization and permission of OPCUA management service endpoints

To improve security and access control for the OPC UA management service, permission requirements have been clarified and enforced for all management API endpoints. Users now need specific OPC UA permissions to interact with the service. To view OPC UA resources — such as device types, OPC UA server configurations, address space nodes, and search results — users require the OPC UA READ permission. To create, update, or delete device types, server configurations, or device type mapping entries, users require the OPC UA ADMIN permission. Administrators can assign the necessary OPC UA permissions to users under Administration > Accounts > Users, Roles.

Export operations disabled for users without appropriate permissions

Previously, users without Inventory WRITE permission could access all export operations on the Exports page and only received an error after attempting to save. This issue has been fixed.

  • For read-only users, the Add export button is now disabled, with a tooltip explaining the insufficient permissions.
  • Duplicate and Delete row commands are hidden.
  • The Edit command is replaced with a View command so that read-only users can still inspect export details but cannot modify them.
  • In the export details view, the Save buttons are disabled for users without the required permissions.

This change ensures that only users with the appropriate permissions can access export operations, providing a clearer and more secure user experience.

May 1, 2026

Device parameter real-time data synchronization

The device parameter list now automatically synchronizes to ensure displayed data remains current during active configuration. The interface triggers a refresh during common actions - such as receiving an event, updating an operation status, or navigating through rows - and provides immediate interactive notifications to confirm when changes are complete. This update ensures a consistent and up-to-date view of device parameters without requiring manual refreshes.

Improved page navigation of device parameter details

In the device parameter details, the automatic loading of historical operations and events has been replaced by a Load More button. Previously, the seamless fetching of older entries often prevented the user from scrolling to subsequent parameters in the list, as the page length kept increasing. With this change, older data is only retrieved upon an explicit click, ensuring that page navigation remains consistent and that subsequent parameters can be reached without interruption.

April 30, 2026

Automated audit logging for device re-enrollment

The platform now automatically generates audit logs for device certificate renewals and replacements. When a device uses the Re-enroll API to refresh or replace its certificate via existing credentials, a dedicated entry is now recorded in the system logs.

Log Specifications:

  • Activity: Tenant certificate authority(CA) re-signed certificate for device: %s.
  • Audit Text: Certificate serial number hex: '%s'
  • Event Type: TenantCertificateAuthority

Java SDK improved error propagation for authenticated requests

Previously, unexpected exceptions during token-authenticated service calls were incorrectly mapped to “401 Unauthorized”. This issue has been fixed. The Java SDK now correctly propagates the original error status and metadata, ensuring accurate debugging and preventing misleading authentication alerts.

New REST endpoints for inventory bulk create and update operations

Cumulocity now provides new REST API endpoints for creating and updating inventory managed objects in bulk. These endpoints allow you to perform batch operations on multiple managed objects in a single request, improving efficiency and reducing the number of API calls needed for large-scale inventory management.

For details, refer to the bulk create and bulk update operations in the Cumulocity OpenAPI Specification.

Actility service improvements in endpoint authorization and permissions

To improve security and access control for Actility device connectivity, the permission requirements for managing Actility connections have been clarified and enforced. Users now need specific Actility permissions to work with connections under Administration > Connectivity. To view Actility connections, users require READ permission for the “Actility” permission type, while creating, updating, or deleting connections requires ADMIN permission for the “Actility” permission type. Administrators can assign the necessary permissions to users in Administration > Accounts > User, Roles.

Cockpit application utilizes the asset navigator and subassets implementations from the DTM plugin

Previously, the Cockpit application utilized the asset navigator and subassets implementations provided by the Web SDK. With this change, the Cockpit application utilizes the corresponding implementations provided by the DTM (Digital Twin Manager) plugin instead.

Functionality-wise, the behavior stays mostly unchanged with only smaller enhancements. Further enhancements are expected to follow in upcoming releases of the DTM plugin.

April 27, 2026

Decimal places can now be configured for computed properties

You can now configure the number of decimal places displayed for computed properties in the asset selector when selecting data points, allowing you to control the display precision to match your specific requirements. This enhancement is available in widgets that use this component, such as the HTML widget and the preview version of the Asset table widget.

Expose loadMore options via operations-timeline and events-timeline components

The operations-timeline and events-timeline components previously did not expose options to customize the load more behavior when retrieving additional timeline entries. You can now configure loadMore options directly through these components, giving you more control over how additional operations and events are loaded and displayed in your applications. This change allows you to customize pagination and loading behavior to better match your application’s requirements and user experience needs.

Output JSON schemas of Web SDK-based applications as separate JSON artifacts

The functionality in the Web SDK to generate a JSON schema based on a TypeScript type has been enhanced to store all generated schemas in a single c8y-schemas.json per application. The file can, for example, be retrieved from /apps/cockpit/c8y-schemas.json for the Cockpit application. The different schemas are grouped by type if a type has been provided.

This allows, for example, an AI to utilize these schemas and make configuration changes to the objects that use these schemas.

April 24, 2026

Asset property mappings and time context integration in HTML widget

The “HTML” widget has been enhanced with the following features:

  • Asset properties configuration: Instead of a read-only list of properties from the currently selected asset, you can now browse and assign properties (asset, custom, and computed ones) to named keys - sourced not only from the main selected asset but also from its descendants. These keys can then be inserted into the HTML code editor as expressions.
  • Time context integration: The widget can now be controlled by the dashboard’s global time context settings or by widget’s local settings; both the c8yContext object and the new c8yProperties object update automatically when the auto-refresh mode is enabled.

For details, refer to the HTML widget documentation.

Enhanced Event list view and widget

The event list view and the “Event list” widget have been migrated to Angular and enhanced to improve usability and performance, providing a modern, consistent foundation with the current UI framework. Updates include:

  • Events page in Cockpit: An Events page is now available in the Cockpit application, not only in the Device Management application.
  • Events tab in Cockpit groups: The Events tab with the events list is now available for Cockpit groups.
  • Auto-refresh: Integrated with the global time context to enable real-time updates that reflect the dashboard’s selected time range.
  • Child device events: Optionally display events from child devices, mirroring functionality from the “Alarms” widget — enabled by default in groups.
  • Image preview: Binary image attachments can be previewed inline with consistent dimensions, without opening the full event view.
  • Custom metadata preview: Custom event properties are displayed consistently with the Alarms page.
  • Shareable events: Each event has a direct URL that can be copied from the browser address bar and shared. Opening the link takes the recipient straight to that event’s details; the same pattern as used for alarms.

Full export disabled for users with inventory rights only

The Full export option is now disabled for users who only have inventory rights. Previously, data could be exported without even an error message being displayed in the UI. This issue is now fixed.

April 21, 2026

New valueAsText placeholder for OPC UA custom actions

A new ${valueAsText} placeholder is now available in the body template for OPC UA custom actions. Unlike the existing ${value} placeholder which inserts the JSON-serialized value, ${valueAsText} provides a plain text representation of the node value. This is useful for embedding values directly in strings without JSON formatting. The placeholder is available for both HTTP POST custom actions and MQTT forwarding custom actions.

Improved deletion of assets in hierarchies

Previously, the deletion of an asset caused cascaded deletion of all subassets and assigned devices, even if they were still used in a different asset or hierarchy. This could cause unwanted side effects to other parts of the asset hierarchy. This behavior has been improved and now only subassets that are exclusively used in the hierarchy of the asset are removed. Other subassets will remain unchanged, and the whole hierarchy will stay intact.

Furthermore, a new query parameter deleteDevices has been added to control the deletion of assigned devices. If set to true, all exclusively assigned devices will be removed. Devices that are still assigned to other assets, will not be removed. If set to false, no devices will be removed.

LinkedSeries source.id now rejects blank values

The LinkedSeries source.id field is optional, but previously accepted blank values such as empty strings ("") or whitespace-only strings (" "). This could lead to inconsistent data and unexpected behavior when processing linked series data.

The Asset API now validates the source.id field and rejects blank values while still allowing the field to be omitted entirely. If you send a LinkedSeries request with a blank source.id value, the request returns a validation error instead of accepting the invalid data.

Existing LinkedSeries with a blank source.id are not updated automatically.

April 20, 2026

Stricter validation of user email addresses

We are introducing stricter validation for user email addresses. The part of the domain name following the ‘@’ symbol may now only contain alphanumeric characters, hyphens, and dots.

This change ensures that system notifications - such as password resets or smart rule alerts - are delivered reliably.

Existing users will not be impacted by this change, however when setting up new users the updated checks will be applied.

April 14, 2026

Improved API documentation for the tenant option assets.permission.mode

The API documentation for the tenant option assets.permission.mode has been improved to allow a better understanding of the available settings and its impact on the API’s permission checks.

April 13, 2026

Digital Twin Manager Asset and Definition API support in asset properties selector

Digital Twin Manager enables schema-based modeling in Cumulocity by allowing you to create asset definitions that define the structure and constraints for asset instances. The Asset API lets you manage asset instances based on these predefined asset definitions. When you use the asset properties selector, the system now requests the relevant definition for any asset created with Digital Twin Manager and displays the properties from that definition. This ensures that asset instances created from an asset model inherit and display the correct structure and constraints defined in the model. For more information about the Digital Twin Manager API, refer to the Cumulocity OpenAPI Specification.

KPI widget now supports global context and history mode

Previously, the KPI widget configuration lacked a global time context section, preventing users from setting a time range, auto-refresh interval, or history mode from the widget configuration panel. With this change, the KPI widget has been migrated to the shared time context, and the time context section has been added to its configuration. Users can now select a time range and auto-refresh interval, and enable history mode to display KPI values over a selected historical date range.

New Dremio version 26

Cumulocity DataHub now leverages version 26.1 of Dremio as its internal query engine.

April 9, 2026

Asset API now handles device groups as assets and offers the includeGroups query parameter

The Asset API has been changed to treat groups as assets. Previously, an asset was identified solely by the presence of the c8y_IsAsset fragment. Now, the presence of c8y_IsDeviceGroup is also sufficient to classify an entity as an asset.

A new query parameter includeGroups (default: false) has been introduced for the /assets and /assets/count endpoints:

  • When set to true, the results include entities with either c8y_IsAsset or c8y_IsDeviceGroup.
  • When set to false, the results are limited to entities with c8y_IsAsset only.

Asset Instance API and Definition API generally available

The Asset Instance API and Definition API are now generally available. Previously, these APIs required feature flags to be active before use. Feature flags are no longer required, and all users can access both APIs by default without additional configuration.

c8y_SharedDefinition fragment added when a definition is shared from the Enterprise tenant

When the sharing mode is enabled, all definitions are shared from the Enterprise tenant. When a definition is requested from a subtenant, the fragment c8y_SharedDefinition is added to the response entity to indicate this to the caller.

Improved performance when creating or updating linked data points

When creating or updating linked data points via the API, the endpoint previously made separate Inventory API calls to look up the source device and resolve the corresponding opposite-series entries. This increased latency, particularly in environments with large asset hierarchies containing many linked data points.

The Digital Twin Manager now consolidates the device and opposite series lookups into a single Inventory API call. Fewer backend requests result in faster response times when you create or update linked data points. No action is required on existing installations.

Multitenant sharing mode controls for asset and property definitions

In subtenants in Enterprise tenant setups, the Digital Twin Manager previously lacked controls to reflect the active multitenant sharing configuration. This meant subtenants could attempt to create or modify definitions regardless of the sharing mode configured at the Enterprise tenant level.

The Add asset definition and Add property definition buttons are now disabled when the definitions.multitenant.sharing.mode tenant option is set to enabled. Hovering over either button displays a tooltip explaining why the action is not allowed. When the mode is set to invalid, the buttons are also disabled and a tooltip indicates that the sharing mode setting is invalid. When the mode is disabled, both buttons are enabled and standard permission checks apply. Users will see an info message in the definition view indicating that the definition is shared from the Enterprise tenant/Management tenant.

These changes affect users working in subtenants of an Enterprise tenant setup.

New tenant option for sharing asset and property definitions from the Enterprise tenant

Managing asset definitions across multiple subtenants previously required each tenant to maintain its own independent set of definitions. The new tenant option definitions.multitenant.sharing.mode lets you configure from where asset definitions and MEA definitions are stored and retrieved across your Enterprise tenant hierarchy.

For more details, refer to the DTM documentation.

Transformed DTM homepage into a customizable dashboard

The Digital Twin Manager homepage has been enhanced from a static overview page to a fully customizable dashboard, consistent with the dashboards available in Cockpit and Device Management.

Users can now add and configure widgets to display relevant information, tailor terminology to match their domain, and design the homepage based on their operational requirements. This provides greater flexibility and enables teams to focus on the data that matters most to them.

April 7, 2026

MQTT Service is now generally available

Cumulocity is pleased to announce that the Cumulocity MQTT Service is now generally available.

The MQTT Service provides a single, unified endpoint for integrating MQTT devices with the Cumulocity platform that is simple, secure, and scalable.

Simple

  • Connect any MQTT device with any payload and topic structure, using MQTT version 3.1.1 or 5.0.
  • Devices using the Cumulocity core MQTT protocols, SmartREST and JSON-over-MQTT, are supported alongside generic devices with their own application-layer protocols.

Secure

  • Full device isolation and bi-directional TLS support by default.
  • Works with the Cumulocity Certificate Authority, or with your existing external CA.

Scalable

  • Optimized for high message throughput with large numbers of connected devices.
  • Validated with 100 million connected devices publishing 1 million unique messages per second.

See the user documentation for more details of the MQTT Service architecture and how to integrate your devices and applications with it.

Availability

The MQTT Service is available to all tenants in Cumulocity environments following the Continuous Delivery (CD) release line, and in the 2026 annual release.

Usage of the service is billable, as described in the license metrics documentation.

Per-tenant usage quotas are enforced to ensure reliable operation of Cumulocity’s shared environments. These quotas can be adjusted to support larger use cases in shared and dedicated environments. See service quotas for details of the applicable quotas.

Migrating from the Public Preview

Some features were deprecated and replaced during the Public Preview of the MQTT Service. These features are not supported after the transition to General Availability. Users migrating from the Public Preview must ensure that all their applications and devices have been updated to use only Generally Available features.

See the previous announcement for details of these features that have been removed:

  • Tenant-level isolation
  • MQTT Service Java client SDK
  • Non-TLS endpoint on shared environments
  • Basic authentication for users without the Mqtt-service ADMIN permission

Limitations

The first generally available release of the MQTT Service has some limitations that will be addressed in future updates:

  • Support for Core MQTT devices using SmartREST or JSON-over-MQTT is still in Public Preview status and subject to breaking changes before it becomes generally available. See Core MQTT device support for details of these specific limitations:
    • Structured client identifiers allowed by the Cumulocity core MQTT endpoint are not supported.
    • Pending operations must be explicitly requested by a device when it connects.
    • Messages may be acknowledged by the MQTT Service before they have been processed by the Cumulocity core.
    • Devices are not automatically disconnected after sending invalid Core MQTT messages.
    • Availability monitoring is not supported for “push connection” traffic to devices.
    • The “delivery” fragment on an operation is not updated after the operation is delivered to the device.
  • WebSocket connections to the MQTT Service are not supported.
  • Retained messages are not supported.
  • Last Will messages are not sent when devices disconnect from the MQTT Service.
  • Messages using the Correlation Data field are not forwarded to the Messaging Service.
April 2, 2026

Sigfox service improvements in endpoint authorization and permissions

To improve security and access control for Sigfox device connectivity, the permission requirements for managing Sigfox connections have been clarified and enforced. Users now need specific Sigfox permissions to work with connections under Administration > Connectivity. To view Sigfox connections, users require the Sigfox READ permission, while creating, updating, or deleting connections requires the Sigfox ADMIN permission. Additionally, Sigfox callback endpoints such as sigfoxDataCallback and sigfoxErrorCallback now require either the Sigfox ADMIN permission or the Inventory READ permission. This change affects users accessing the LPWAN configuration tab in device details within the Device Management application, as viewing the Current connection field now requires READ permission. Administrators can assign the necessary permissions to users in Administration > Accounts > User, Roles. For details, see Sigfox.

March 31, 2026

AI Agent Manager now available in Public Preview

Feature preview
This feature is in Public Preview, that is, it is not enabled by default and may be subject to change in the future.

The AI Agent Manager introduces a new capability to create, configure, and run AI-powered agents directly within a tenant through an intuitive user interface.

Agents can analyze device data and execute actions based on configurable logic. They can be granted access to Cumulocity data such as inventory, events, alarms, and measurements, enabling seamless integration with existing IoT applications without additional setup. Agents can be extended with custom tools or MCP servers, and their behavior can be validated before being enabled for real-time automation and complex operational workflows.

Important: Administrators must enable the AI Agents permission in the user’s global role and configure LLM providers using their own API keys to use this application.

March 30, 2026

Enhanced Data point list widget

The “Data point list” widget has been migrated to Angular and enhanced to improve usability and performance, providing a modern, consistent foundation with the current UI framework. Updates include:

  • Decimal place configuration: Specify decimal places for numerical values, with a default of 2 to align with other Cumulocity IoT widgets.
  • Global time context integration: The widget now responds to dashboard time context changes, automatically updating to show the last measurement value for the selected time range.
  • Asset icon display: Asset icons are now shown alongside asset names for easier visual identification.
  • Export capabilities: Export displayed data in CSV and XLSX formats for external use.
  • Field arrangement: Customize the display order of fields within the widget.
  • Performance optimization: Improved rendering performance through virtual scrolling — only visible rows are rendered, ensuring smooth operation even with large datasets.
March 26, 2026

New REST endpoint for reconciling the opposite child additions of a linked series

When an asset links to a measurement source on a device, the platform maintains a reverse index (c8y_LinkedSeriesReverseIndex) on the device that tracks which assets reference it. Previously, if this index became out of sync with the asset-side configuration, there was no dedicated API endpoint to correct it.

The Digital Twin Manager REST API now includes a new endpoint to reconcile the opposite ChildAddition of a LinkedSeries (also known as MeasurementSourceLink): PUT /assets/{assetId}/linkedSeries/{fragment}/{series}/opposite. The endpoint updates the c8y_LinkedSeriesReverseIndex managed object on the device side to accurately reflect the asset-side source reference. The optional query parameter removeMissingSourceId removes the source.id if the linked device no longer exists. If the device is not found and the parameter is not set, the endpoint returns a 422 error.

Developers and administrators can use this endpoint to programmatically correct synchronization issues in linked data point configurations without manual intervention.

March 19, 2026

Improvements in endpoint authorization and permissions

The required user permissions to read, create, or update Loriot connections under Administration > Connectivity have been updated. To read Loriot connections, users must have at least the Loriot READ permission, and to create/update/delete connections, users require the Loriot ADMIN permission. In the Device Management application, this affects the LPWAN configuration tab in the Loriot device details, as the Current connection field requires READ permission. You can assign the necessary permissions to users in Administration > Accounts > Users/Roles.

Marked the REST API endpoint for getting opposite assets as deprecated

A newer, high-performance variant of the endpoint for querying opposite assets was introduced in DTM version 1024.1.0. To align with this improvement and maintain a consistent API, the original endpoint variant is now deprecated.

The REST API endpoint /service/dtm/assets/linkedSeries/opposites/{deviceId} used with the default Accept header application/json is deprecated and will be removed in a future version. Use the Accept header application/vnd.com.nsn.cumulocity.linkedassetscollection+json instead, which provides better performance and additional filter parameters.

Update any integrations or custom applications that call this endpoint with the application/json header to use the new Accept header application/vnd.com.nsn.cumulocity.linkedassetscollection+json to avoid disruption when the deprecated variant is removed.

March 13, 2026

Widget sections are now more organized and easier to use

Widgets previously displayed all settings under a single settings section, making it difficult to find and manage specific widget configurations. Sections are now organized more cleanly with improved visual separation and structure, allowing you to configure widget settings more easily and efficiently. This enhancement improves the overall user experience when working with widgets by providing a clearer, more intuitive layout that reduces cognitive load and makes information easier to locate.

March 12, 2026

Added configuration option to strip control characters during JSON deserialization in Java SDK

A new configuration option has been introduced in the Java SDK that allows stripping control characters from JSON strings when deserializing responses from the API. This option can be enabled by adding the property c8y.svenson.stripControlCharacters=true to the configuration file. The default value is false to maintain backward compatibility. Enabling this option can help in situations where API responses contain unexpected control characters that cause the internal Svenson JSON library to throw an exception during JSON deserialization. This internal exception results in an empty API response being returned.

Devices are now correctly added to initial device group

An issue has been resolved affecting the initial group assignment during single device registration when using the “create device certificates during device registration” option with Cumulocity CA certificates.

Previously, devices registered individually were not correctly added to their designated initial device group upon first connection.

With this update, when a single device is registered and an initial device group is specified, the device is now properly assigned to the target group upon its first connection.

Enhanced SSO user name validation

Validation has been added for the “User/App ID – Constant value” field used during SSO authentication when the “Use constant value” option is enabled.

When a constant username is configured for SSO users (optional setting), it now follows the same validation rules as a standard username:

Validation Rules

  • String length: 1–1000 characters
  • Must not contain:
    • Whitespace
    • Slashes
    • Any of the following characters: +, $, :

This change ensures consistency in username validation and prevents invalid values from being configured for shared SSO accounts.

Improved Java SDK support for external IAM tokens with user scope API beans

Previously, when users authenticated in the Java SDK using external IAM JWT tokens together with API service beans configured with the qualifier for user scope, the authentication process could fail to identify the tenant and user correctly. With this improvement, service beans using the qualifier for user scope can now authenticate correctly when external IAM JWT tokens are used. Their behavior is now consistent with other supported authentication methods.

Device enrolment plugin now provided by default

The Device enrolment plugin is now a standard Device Management plugin included by default. It provides a quick link to the thin-edge.io setup wizard, available in both the new welcome widget and the “Quick links” widget.

The four-step wizard simplifies the connection of physical Linux devices or Docker containers by providing a generated curl command that automates installation and cloud configuration. This process streamlines registration through guided device naming and automated certificate handling, concluding with instant verification of connectivity and data transmission to the platform.

Device Management application homepage refresh

The Device Management application homepage has been refreshed by removing the standard “Alarm” and “Quick links” widgets to make room for a new welcome widget. This update provides a more intuitive entry point for users and includes a direct link to the thin-edge.io setup wizard.

Added new computed property - Fieldbus item status

This change introduces a new “Fieldbus item status” computed property with the following configuration options:

  • Fieldbus item: Select a coil or register from the device protocol associated with a device.
  • Result type: Select whether to display the raw value or a transformed value using enum values defined in the item’s settings.

The new computed property makes it possible to display the status of Fieldbus items (including their enum values) in widgets such as the “Asset table”. This functionality will be progressively made available in other widgets, too.

March 11, 2026

MQTT Service will require an explicit role for basic authentication

Caution

This change only affects the new Cumulocity MQTT Service capability.

The existing Cumulocity Core MQTT capability is not affected.

Introduction

To strengthen security and prevent client spoofing, the Cumulocity MQTT Service will soon require the ADMIN permission for the “Mqtt service” permission type for clients connecting via basic authentication.

Currently, basic authentication lacks a strict binding between the authenticated user and the MQTT clientId. This could allow a user with valid Cumulocity credentials to connect using any clientId and impersonate other devices. This change ensures that only explicitly authorized users and devices can use basic authentication to connect to the MQTT Service.

What is changing?

  • Required role: A specific authorization role will be required for any user or device attempting to authenticate to the MQTT Service using basic authentication.
  • No default assignment: To maintain a strict security posture, this role will not be added to any global roles by default.
  • Message broker properties: The authentication type and username will now be passed as Pulsar message properties (tx.clientUsername and tx.clientAuthType). This allows downstream consumers to validate the clientId against the authenticated username.

Clients connecting via certificate authentication are not affected by this change.

Impact on existing MQTT clients

This is a breaking change for clients utilizing basic authentication.

Once this change is deployed, any existing clients relying on basic authentication without the required explicit role will fail to connect. Administrators will need to manually assign the ADMIN permission for the “Mqtt service” permission type to the specific users or devices that legitimately require basic authentication access.

Roll-out plan

This change will take effect when the MQTT Service reaches General Availability (GA). Please update your user or device roles accordingly to ensure uninterrupted service.

Info
Because the Cumulocity MQTT Service is currently in Public Preview, it is not subject to the standard 6-month compatibility notice period defined in the Cumulocity Compatibility policy.

Added nearby clustering to cluster map

When viewing cluster maps with many nearby data points, the map can become cluttered and difficult to read. The Cockpit application now automatically groups nearby clusters, allowing you to see the overall distribution of your devices and assets more clearly. As you zoom in on the map, the nearby clusters automatically expand to show individual data points, providing a better user experience when working with dense datasets on cluster maps. If a device or asset is placed in the same position, the user can click on the marker to see more clearly which markers are placed. Warning colors for alarms are merged, and the most critical alarm is shown. This improvement applies to all existing map widgets and to customized Web SDK-based cluster map implementations in your applications without requiring any configuration changes.