26.10.0 - Oct 20

Released: 2026-10-20

We’re pleased to announce the following updates to the Forward Networks API as part of release 26.10.0.

See also the full release notes for Forward Enterprise version 26.10.0.

---

Breaking changes

• FWD-52020, FWD-52021 These deprecated legacy collection operations have been removed. If you used them, see How to use the Collector Tasks API for detailed guidance on switching to newer APIs.
  • Removed operations:
    • GET /api/networks/{networkId}/collector/status (Get Collector status)
    • POST /api/networks/{networkId}/startcollection (Trigger a network collection)
    • POST /api/networks/{networkId}/cancelcollection (Cancel a network collection)

---

Scheduled breaking changes

• FWD-57483 The Snapshot-scoped link override operations have been deprecated for removal in release 26.11. Use the network-scoped link override operations introduced in release 26.8 instead. For detailed guidance on switching, see Migrating to the new link overrides API.

  • Deprecated operations:
    • GET /api/snapshots/{snapshotId}/topology/overrides (Get link overrides for a Snapshot)
    • POST /api/snapshots/{snapshotId}/topology/overrides (Edit link overrides at a Snapshot)
    • PUT /api/snapshots/{snapshotId}/topology/overrides (Replace link overrides at a Snapshot)

• FWD-58049 GET /api/networks/{networkId}/snapshots/latestProcessed has been deprecated for removal in release 26.12. Use List network Snapshots with ?state=PROCESSED&limit=1 instead. Unlike the deprecated operation, it responds 200 OK with an empty snapshots list rather than 404 Not Found or 409 Conflict when the network has no matching Snapshot.

  • Deprecated operation:
    • GET /api/networks/{networkId}/snapshots/latestProcessed (Get the latest processed Snapshot)

---

Non-breaking changes

• FWD-58071 Added two operations labeled experimental that get a device’s interfaces, as modeled from the configuration and state collected from it. These operations use paths that previously served unpublished operations, whose responses had a slightly different shape. If you used them, see Migrating to the new device interfaces API.

  • New operations:
    • GET /api/networks/{networkId}/devices/{deviceName}/interfaces (List a device’s interfaces)
    • GET /api/networks/{networkId}/devices/{deviceName}/interfaces/{interfaceName} (Get a device interface)

• FWD-56665 Added a device diffs operation labeled experimental that reports each device added, removed, or modified (with details) between two Snapshots of a network.

  • New operation:
    • GET /api/networks/{networkId}/device-diffs/{before}/{after} (Get device diffs)

• FWD-59629 Added the Controller-Managed Setups API, consisting of 15 operations, all labeled experimental. A controller-managed setup groups an SDN controller cluster (such as a Cisco APIC cluster or an SD-WAN orchestrator) with the devices it manages so that they’re collected together.

• FWD-37393 Documented the queryId and queryResult properties of synthetic devices, which define and report connections computed from an NQE query, and the source and error properties of their connections. See Automated Setup with NQE to learn more about the feature.

  • Affected APIs:
    • Internet Node
    • Intranet Nodes
    • L3VPNs
    • L2VPNs

• FWD-57003, FWD-56272 Added the DeviceType values "GCP_CLOUD_ROUTER" and "AZURE_ROUTE_SERVER" and the VendorOs values "gcp_cloud_router" and "azure_route_server".

  • Affected operations:
    • GET /api/networks/{networkId}/devices (Get all network devices)
    • GET /api/networks/{networkId}/devices/{deviceName} (Get a network device)

• FWD-58074 Many schemas now identify their required properties, meaning those that are always present in responses (though possibly null). Request and response contents are unchanged.

---

Appendix: Migrating to the new device interfaces API

Any clients that used these previously unpublished operations will receive interfaces in a slightly different shape starting in this release:

• GET /api/networks/{networkId}/devices/{deviceName}/interfaces
• GET /api/networks/{networkId}/devices/{deviceName}/interfaces/{interfaceName}

Interface property changes

This table lists all changes to existing properties.

Property	Before	Now
type	A display name, such as "Access Interface"	An enum value, such as "ACCESS" (see Interface types)
parentIface	The parent interface’s name, present only for sub-interfaces	Renamed to parentInterface, present for sub-interfaces, switch sub-interfaces, and demux interfaces
aliases	Includes name	Excludes name
accessVlan, voiceVlan, defaultVlan, nativeVlan, vlan	A string, such as "10", "untagged", "undefined", or "none"	An integer VLAN tag, such as 10, or absent if there’s no tag
innerVlan	A string, present only for sub-interfaces	An integer, present for sub-interfaces and bridge interfaces
trunkVlans	Could include the reserved VLANs 0 and 4095, as in ["1-4095"]	Excludes them, as in ["1-4094"]
fileLines	An object keyed by file name	An array of objects with file and lines properties
neighbors	"device port" strings, present when listing interfaces that have neighbors	Objects with device and port properties, present only with ?with=neighbors
coveredTopo	Present when getting one interface	Removed
macAddress	"fc:ff:ff:ff:ff:ff" or "00:00:00:00:00:00" when unknown	Absent when unknown
vrfName	Could be "_undefined_", "Base", or "invalid-vrf"	Absent in those cases
inAclNames, outAclNames	Could include policy-based routing filters, such as route-maps	Include only ACLs
srcAddresses, dstAddresses	Could include "0.0.0.0", "0.0.0.0/0", or "::/0" when unknown	Exclude unknown tunnel endpoints

Update a client script as follows if it uses any of these properties:

• type: Compare against the new enum values.

• parentIface: Read parentInterface instead.

• aliases: Add name to the list if you need every name of the interface.

• VLAN properties: These are now numbers (10) rather than strings ("10"). If you checked specifically for "untagged", "undefined", or "none", check instead whether the property is absent.

• macAddress, srcAddresses, dstAddresses: If you checked for the values listed above, check instead whether the property is absent or the list is empty.

• vrfName: If you checked for any of these values, check instead whether the property is absent:

  • "_undefined_", for a PAN-OS interface in no virtual router
  • "Base", for the Nokia SR-OS global routing table
  • "invalid-vrf", for a tunnel that carries traffic for any VRF. Such a tunnel has the new carriesAnyVrf property set to true.

• fileLines: Iterate over the array rather than over the object’s entries, as in this example:

  Before:

  "fileLines": {
    "atl-edge-fw01,configuration.txt": [{"start": 42, "end": 43}]
  }

  Now:

  "fileLines": [
    {"file": "atl-edge-fw01,configuration.txt", "lines": [{"start": 42, "end": 43}]}
  ]

• neighbors: Add ?with=neighbors to the request URL. Each neighbor is now an object:

  Before:

  "neighbors": ["atl-isp-edge01 ge-0/0/3"]

  Now:

  "neighbors": [{"device": "atl-isp-edge01", "port": "ge-0/0/3"}]

Responses also omit the interfaces that Forward adds to each device to model traffic that the device itself sends and receives, named self, self.<vrf>, or self.zone.<zone>/<vrf>. A request for one of these by name returns 404 Not Found.

Two other differences affect which properties are present:

• An array property that applies to the interface’s type is present even when empty. Before, empty arrays were always omitted.
• A property is absent on interface types it doesn’t apply to. For example, speedMbps and fullDuplex appear only on types that can be physical ports. memberPorts and configuredMemberPorts appear only on aggregate interfaces (plus memberPorts on SWITCHED_VLAN and BRIDGE interfaces).

New Interface properties

The Interface model has these new properties:

Property	Interface types
isLoopback	All
vlans	SWITCH_SUBINTERFACE, DEMUX
innerVlans	SWITCH_SUBINTERFACE, DEMUX
exactVlanMatch	SWITCH_SUBINTERFACE
defaultMatch	SWITCH_SUBINTERFACE
allowedVlans	L3
allowsUntagged	TRUNK, L3, SWITCH_SUBINTERFACE, SUBINTERFACE, DEMUX
egressVlan	L3
allowedInnerVlans	ACCESS
tunnelType	TUNNEL
carriesAnyVrf	TUNNEL
dstIp	TE_TUNNEL
pairedInterface	INTER_VRF

See Get a device interface for a description of each property.

Interface types

Here’s a complete list of values that type can have.

Before	Now
"Generic Interface"	"GENERIC"
"Access Interface"	"ACCESS"
"Trunk Interface"	"TRUNK"
"FabricPath Interface"	"FABRICPATH"
"Switch Sub-Interface"	"SWITCH_SUBINTERFACE"
"L3 Interface"	"L3"
"Switched VLAN Interface"	"SWITCHED_VLAN"
"Sub-Interface"	"SUBINTERFACE"
"Bridge Interface"	"BRIDGE"
"Demux Interface"	"DEMUX"
"Tunnel Interface"	"TUNNEL"
"Virtual L3 Tunnel Interface"	"TE_TUNNEL"
"Inter-VRF Interface"	"INTER_VRF"