Skip to main content

26.8.0 - Aug 18

Released: 2026-08-18

We’re pleased to announce the following updates to the Forward Networks API as part of release 26.8.0.

See also the full release notes for Forward Enterprise version 26.8.0.

Breaking changes​

  • FWD-54052 The MissingDevice property possibleTypes has been removed. Use vendor instead.

    • Affected operations:
      • GET /api/networks/{networkId}/missing-devices (Get missing network devices)

  • FWD-56993 The ClassicDeviceType value "mist_dashboard_api" has been removed. A Mist dashboard (a Tech Preview device type) is now collected as a cloud-managed source rather than as a classic device. The classic device operations no longer accept that type.

    • Affected operations:
      • POST /api/networks/{networkId}/classic-devices (Add a new classic device)
      • PATCH /api/networks/{networkId}/classic-devices (Update specific classic devices)
      • POST /api/networks/{networkId}/classic-devices?action=addBatch (Add new classic devices)
      • POST /api/networks/{networkId}/classic-devices?action=putBatch (Add or update classic devices)
      • PUT /api/networks/{networkId}/classic-devices/{deviceName} (Add or update a classic device)
      • PATCH /api/networks/{networkId}/classic-devices/{deviceName} (Update a classic device)

Scheduled breaking changes​

  • FWD-52020 These deprecated operations will be removed in release 26.10. If you use them, see How to use the Collector Tasks API for detailed guidance on switching to newer APIs.

    • Deprecated operations:
      • GET /api/networks/{networkId}/collector/status (Get Collector status)
      • POST /api/networks/{networkId}/startcollection (Trigger a network collection)
      • POST /api/networks/{networkId}/cancelcollection (Cancel a network collection)

  • FWD-57483 The Snapshot-scoped link override operations have been deprecated for removal in release 26.11. Use the network-scoped link override operations mentioned in New operations instead. For detailed guidance on switching, see Migrating to the new link overrides API.

    • Deprecated operations:
      • GET /api/snapshots/{snapshotId}/topology/overrides (Get link overrides for a Snapshot)
      • POST /api/snapshots/{snapshotId}/topology/overrides (Edit link overrides at a Snapshot)
      • PUT /api/snapshots/{snapshotId}/topology/overrides (Replace link overrides at a Snapshot)

New operations​

  • FWD-56664 Data Connectors: A data connector brings data from an HTTP(S) service outside the network, such as an IPAM, CMDB, or asset inventory, into a network Snapshot, where NQE queries can read it. See Data Connectors to learn more about the feature.

    • GET /api/networks/{networkId}/data-connectors (Get a network’s data connectors)
    • POST /api/networks/{networkId}/data-connectors (Add a data connector)
    • GET /api/networks/{networkId}/data-connectors/{name} (Get a data connector)
    • PATCH /api/networks/{networkId}/data-connectors/{name} (Update a data connector)
    • POST /api/networks/{networkId}/data-connectors/{name}?action=test (Test a data connector)
    • DELETE /api/networks/{networkId}/data-connectors/{name} (Delete a data connector)

  • FWD-56098 Vulnerability Analysis: A custom CVE analysis overrides the automatically computed vulnerability status of specific devices for one CVE and OS. An analysis holds up to four rules, each specifying device criteria plus the label, comment, and optional status to apply to its matching devices.

    • GET /api/networks/{networkId}/vulnerabilities/{cveId}/analyses (Get custom CVE analyses)
    • GET /api/networks/{networkId}/vulnerabilities/{cveId}/analyses/{os} (Get a custom CVE analysis)
    • PUT /api/networks/{networkId}/vulnerabilities/{cveId}/analyses/{os} (Set a custom CVE analysis)
    • POST /api/networks/{networkId}/vulnerabilities/{cveId}/analyses/{os}/rules (Append a CVE analysis rule)
    • DELETE /api/networks/{networkId}/vulnerabilities/{cveId}/analyses/{os} (Delete a custom CVE analysis)

  • FWD-57482 Network Topology: Changes to link overrides can now be staged for the network’s next Snapshot without invalidating (requiring reprocessing of) any existing Snapshots. These new operations replace the now-deprecated Snapshot-specific link override operations listed under Scheduled breaking changes.

    • GET /api/networks/{networkId}/link-overrides (Get the network’s link overrides)
    • PUT /api/networks/{networkId}/link-overrides (Set the network’s link overrides)
    • PATCH /api/networks/{networkId}/link-overrides (Edit the network’s link overrides)
    • GET /api/networks/{networkId}/link-overrides?view=snapshot (Get a Snapshot’s link overrides)
    • GET /api/networks/{networkId}/link-overrides?view=staged (Get recent link override changes)
    • POST /api/networks/{networkId}/link-overrides?action=backdate (Apply recent link override changes)

Model changes​

  • ClassicDeviceType

    • FWDN-12653 Added value "checkpoint_spark_ssh_with_manager", a Check Point Quantum Spark gateway collected through its manager (Tech Preview)
    • FWD-56077 Added value "vine_api", a Viasat VINE encryptor manager (Tech Preview)
    • FWD-56993 Removed value "mist_dashboard_api" (see Breaking changes)
    • Affected operations:
      • GET /api/networks/{networkId}/classic-devices
      • GET /api/networks/{networkId}/classic-devices/{deviceName}
      • GET /api/networks/{networkId}/endpoints
      • GET /api/networks/{networkId}/endpoints/{endpointName}

  • ConnectivityTestError

    • FWD-57578 Added value "VSH_AUTHORIZATION_FAILED", reported when a multi-site Cisco ACI spine does not grant access to the vsh commands. Single-site ACI collection does not check for that access, since the vsh commands are only meaningful on multi-site spines.
    • Affected operations:
      • GET /api/networks/{networkId}/classic-devices
      • GET /api/networks/{networkId}/classic-devices/{deviceName}
      • GET /api/networks/{networkId}/endpoints
      • GET /api/networks/{networkId}/endpoints/{endpointName}

  • DeviceCollectionError

    • FWD-57578 Added value "VSH_AUTHORIZATION_FAILED" (see ConnectivityTestError above).
    • Affected operations:
      • GET /api/networks/{networkId}/devices
      • GET /api/networks/{networkId}/devices/{deviceName}

  • CveOsInfo

    • FWD-56821 The vendor and os properties now reference VulnerabilityVendor (32 values) and VulnerabilityVendorOs (60 values), the CVE-relevant subsets of Vendor (41 values) and VendorOs (131 values). The set of values these properties can actually hold is unchanged.
    • FWD-56821 Marked vendor, os, and severity required, since they are always present.
    • Affected operations:
      • GET /api/networks/{networkId}/vulnerabilities?v=2 (Get vulnerabilities)
      • GET /api/networks/{networkId}/vulnerabilities/{cveId} (Get a vulnerability)

  • Link

    • FWD-57475 Network Topology: In responses, each Link is now normalized so that port1 ≤ port2.
    • Affected operations:
      • GET /api/snapshots/{snapshotId}/topology/overrides (Get link overrides for a Snapshot)

  • NqeExecutionRequest, NqeQueryRunRequest

    • FWD-56527, FWD-56528 Added the useLatestDataFiles option, which evaluates the query against the latest uploaded data files rather than the versions captured in the Snapshot. Defaults to false.
    • Affected operations:
      • POST /api/nqe (Run an NQE query)
      • POST /api/networks/{networkId}/nqe-executions (Request an NQE query execution)

  • SyntheticConnections

    • FWD-41637 Synthetic Devices: Split SyntheticConnections into L3SyntheticWanConnections and L2VpnConnections for better specificity. Every operation returning a connection list now returns exactly one concrete connection type. The JSON responses are unchanged.
    • Affected operations:
      • GET /api/networks/{networkId}/internet-node/connections (Get the internet node’s connections)
      • GET /api/networks/{networkId}/intranet-nodes/{nodeName}/connections (Get an intranet node’s connections)
      • GET /api/networks/{networkId}/l2-vpns/{l2VpnName}/connections (Get an L2VPN’s connections)
      • GET /api/networks/{networkId}/l3-vpns/{l3VpnName}/connections (Get an L3VPN’s connections)

  • VendorOs

    • Added 10 values, most of them for controller, manager, and orchestrator appliances that Forward models as non-forwarding devices so that their collected state and OS version are visible in the model:
      • FWDN-12633 "128t_conductor", the 128T Conductor, distinct from the in-path 128T router ("128t")
      • FWDN-12644 "checkpoint_manager", a Check Point management server
      • FWDN-12658 "cisco_fmc", a Cisco Firepower Management Center
      • FWDN-12628 "cloud_genix_portal", the Prisma SD-WAN controller portal, distinct from the in-path ION edge device ("cloud_genix")
      • FWDN-12630 "nsx_t" and "nsx_t_manager", NSX-T forwarding devices and the NSX-T controller
      • FWDN-12629 "silver_peak_orchestrator", the Silver Peak Unity Orchestrator, distinct from the in-path EdgeConnect device ("silver_peak_edgeconnect")
      • FWDN-12609 "vcenter_api", a vCenter
      • FWDN-12613 "velocloud", a VeloCloud Orchestrator
      • FWD-56676 "alkira_cxp", an Alkira CXP
    • Affected operations:
      • GET /api/networks/{networkId}/devices (Get all network devices)
      • GET /api/networks/{networkId}/devices/{deviceName} (Get a network device)

Documentation changes​

  • FWD-57598 The API documentation has been reorganized into a folder hierarchy. Some pages have moved.

Notable changes to unpublished APIs​

This section describes some changes to API operations that are not published in the Forward API documentation and so have no stability guarantees. This section is included as a courtesy to anyone who might be interested. It isn’t a complete change log.

  • FWD-56652 Moved the API operation that returns the BGP collection requirements imposed by synthetic devices. Its response format changed too.
    • GET /api/networks/{networkId}/devicesRequiringBgpCollection → GET /api/networks/{networkId}/bgp-collection-requirements

A link override forces a link to be present or absent in the network model, taking precedence over the links Forward discovers and infers. Link override write operations used to require specifying a target Snapshot, and they invalidated the Snapshot. That meant the Snapshot had to be reprocessed before you could continue using it.

Link override write operations now accumulate until the network’s next Snapshot. They leave existing Snapshots alone so you can make adjustments as often as you like without invalidating a Snapshot unless you choose to apply edits to one.

Operation mapping​

  • To read the overrides in effect for a Snapshot, use Get a Snapshot’s link overrides instead of Get link overrides for a Snapshot.
  • To replace all of a network’s overrides, use Set the network’s link overrides instead of Replace link overrides at a Snapshot.
  • To change some of them, use Edit the network’s link overrides instead of Edit link overrides at a Snapshot.

The LinkOverrides and LinkOverridesEdit request and response bodies are unchanged. Two things to expect when you switch:

  • The write operations respond 204 No Content rather than 200 with an empty JSON object.
  • They apply to the network’s next Snapshot, not any existing Snapshot.

The following sections cover new operations in more detail.

To read the overrides that the network’s next Snapshot will use, use Get the network’s link overrides as in the following example:

Request:

GET /api/networks/12345/link-overrides

Response:

{
  "present": [
    {"port1": "atl-core-01 Ethernet2/3", "port2": "atl-edge-01 Ethernet1/1"}
  ],
  "absent": [
    {"port1": "sjc-core-01 Ethernet1/4", "port2": "sjc-core-02 Ethernet1/4"}
  ]
}

Each port is a device name and an interface name joined by a space. Swapping port1 and port2 has no effect; in a response, a link is always normalized so that port1 ≤ port2.

To read the overrides in effect for a particular Snapshot instead, add ?view=snapshot:

GET /api/networks/12345/link-overrides?view=snapshot&snapshotId=631772

The snapshotId parameter is optional. If you omit it, the network’s latest processed Snapshot is used. Unlike the deprecated operation, this one works even while the Snapshot is being processed—no 409 Conflict response during Snapshot processing.

To change some of a network’s overrides, use Edit the network’s link overrides as in the following example:

Request:

PATCH /api/networks/12345/link-overrides

{
  "presentAdditions": [
    {"port1": "atl-core-02 Ethernet2/3", "port2": "atl-edge-02 Ethernet1/1"}
  ],
  "absentRemovals": [
    {"port1": "sjc-core-01 Ethernet1/4", "port2": "sjc-core-02 Ethernet1/4"}
  ]
}

Response:

204 No Content

Adding a link as present removes any absent override on it, and vice versa. Removing an override lets Forward decide whether the link exists.

To replace every override in one call, use Set the network’s link overrides with a full LinkOverrides body instead. Any override you leave out is dropped.

note

Neither operation affects an existing Snapshot. The network’s next collected Snapshot will use the updated overrides.

Applying edits to an existing Snapshot​

To make an existing Snapshot reflect the edits you have made since it was collected, use Apply recent link override changes as in the following example:

Request:

POST /api/networks/12345/link-overrides?action=backdate&snapshotId=631772

Response:

204 No Content

The edits are applied to the Snapshot you name and to every newer one, which invalidates those Snapshots: they require reprocessing before their topology, paths, and checks reflect the change.

Reviewing edits before applying them​

To see what has changed since the network’s most recent Snapshot, use Get recent link override changes as in the following example:

Request:

GET /api/networks/12345/link-overrides?view=staged

Response:

{
  "presentAdditions": [
    {"port1": "atl-core-02 Ethernet2/3", "port2": "atl-edge-02 Ethernet1/1"}
  ],
  "presentRemovals": [],
  "absentAdditions": [],
  "absentRemovals": [
    {"port1": "sjc-core-01 Ethernet1/4", "port2": "sjc-core-02 Ethernet1/4"}
  ]
}

The response is a LinkOverridesEdit describing exactly what ?action=backdate would apply. All four lists are always present; when all four are empty, the most recent Snapshot is already up to date.

Key takeaways​

  • Address link overrides by network, not by Snapshot.
  • Editing overrides no longer invalidates a Snapshot. Only ?action=backdate does.
  • A workflow that edits overrides and then collects a new Snapshot does not need ?action=backdate at all.