Back to changelog
Gateway
October 16, 2026
https://www.merge.dev/changelog/october-16-2026-gateway

Management API coverage for settings, rules, and credentials

The management API covers organization settings, security rules, and provider credentials

Automate Gateway configuration and security rules with a management API key.

  • Organization settings and prompt injection protection settings
  • DLP rules and blocklist rules
  • Provider credentials for your own vendor keys
  • Read-only lookups for models, model aliases, vendors, guardrails, credits, and members

Audit logs name the management key behind each change.

Read more in the Gateway Management API docs.

Encrypted OpenAI reasoning carries across turns on the Responses endpoints

Reasoning returns even when a call ends before producing a message. /v1/models adds a supports_reasoning_item_replay capability that shows which routes carry reasoning items across turns. Read more in the Gateway reasoning docs.

/v1/decisions accepts OpenAI's Decisions API request format

Send a request in OpenAI's Decisions format or TypeSafe's, and Gateway translates both the request and the response. Read more in the Gateway decisions docs.

Improvements

  • Anthropic-compatible endpoint - Claude Code auto-mode safeguards and thinking display updates pass through to Anthropic
  • API keys - Dashboard expiration dates apply on the chosen date, and past dates are rejected
  • Customer API keys - A per-customer creation rate limit replaces the five-key cap
  • Gemini 3, Gemini 4 - Reasoning effort maps to a thinking level each model accepts
  • Image inputs - Server-side image URL fetches check destinations before they run
  • Intelligent routing
    • Agent sessions stay on their current model when a request cannot be scored
    • Long prompts score within the routing time budget
    • Reasoning levels on gpt-6-luna, gpt-6-sol, and claude-opus-5-5 steer the model pick
    • Cached complexity scores stay scoped to a single session
  • Invoices - Monthly usage line items name Merge Gateway
  • Management API
    • Deleting a routing policy that is still in use is refused
    • Pausing or deleting a project applies right away
    • Setting an API key's limit to null removes its spending limit
    • Invalid project updates and DLP rule conflicts return 409 and 422 errors
  • Model validation - Direct calls and routing policy slots serve only catalog models, returning model_not_in_catalog otherwise
  • OpenAI Responses API
    • prompt_cache_key carries through on bridged requests
    • Named tool choices pass through
    • Streams report incomplete or failed status, and responses return the served service tier
  • Public models API - Adds vendor names, vendor logos, and a vendor ranking for each model
  • Reasoning streams - Keepalives hold long-thinking streams open before the first token
  • Request errors - Anthropic conversion errors return without prompt content
  • Routing policies - Gateway API keys get read-only policy access, with changes requiring a management key
  • Signup - Phone verification opens as a dialog
  • Refined multi-turn tool calling and request handling across DeepSeek, Luminal, Moonshot Kimi, and Pareto models.