App Connect

App Connect

Join this online user group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Applicationintegration
#App Connect
#AppConnect
#Integration
#Automation
 View Only

Explore the new features in App Connect Enterprise 13.0.7.0

By Ben Thompson posted 03/27/26 02:32 PM

  
iStock_000020343379_XXXLarge


We are very pleased to announce the delivery of IBM App Connect Enterprise 13.0.7.0 software.  We aim to provide regular quarterly mod releases for ACE 13 which contain both new features and regular maintenance.

  • IBM App Connect Enterprise 13.0.1.0 was released in September 2024 - more information here
  • IBM App Connect Enterprise 13.0.2.0 was released in December 2024 - more information here
  • IBM App Connect Enterprise 13.0.3.0 was released in March 2025 - more information here
  • IBM App Connect Enterprise 13.0.4.0 was released in June 2025 - more information here
  • IBM App Connect Enterprise 13.0.5.0 was released in September 2025 - more information here
  • IBM App Connect Enterprise 13.0.6.0 was released in December 2025 - more information here
  • IBM App Connect Enterprise 13.0.7.0 has just been released - more information below

This blog post summarizes all the latest and greatest capabilities which are made available in IBM App Connect Enterprise 13.0.7.0:

Exposing Toolkit REST APIs as MCP Tools

An MCP (Model Context Protocol) server provides a standardized method for connecting AI driven applications to external systems. Using MCP Servers (built upon JSON-RPC and Server Sent Events / Streamable HTTP), it becomes an easy task to connect AI applications, agentic coding applications and chat assistants such as IBM Bob, ChatGPT and Claude to a wide range of systems allowing AI to extend its reach and provide for a rich set of tasks and tools. With ACE 13.0.7.0, you can quickly expose an existing ACE Integration server as an MCP Server, and use previously deployed REST APIs as MCP Tools. Consider an example Integration Node named DemoIntegrationNode that owns three integration servers named server1, server2 and server3:

image
On the left side menu ACE 13.0.7.0 introduces a new MCP icon for navigating to a display of your existing MCP Servers:
image
Clicking the Create MCP server button launches a new wizard:
image
You can select one of your existing integration servers from the drop-down list.
image
You can choose which port number the MCP Server should use.
image
The currently deployed REST APIs are displayed. You can select the REST API Operations which you would like to expose as MCP Tools. You can select any combination of the available operations (from the same or different REST APIs that have been deployed to the selected integration server). By clicking the edit buttons, you can also change the MCP Tool Title and MCP Tool Description which will be used:
image
The numbers highlighted in the blue circles show how many Operations have been selected for exposure as MCP Tools within each REST API:
image
The final Summary page lets the user edit the cuggested MCP tool titles and descriptions:
image
On clicking Create, the MCP server is created and displayed as a tile on the MCP servers page:
image
Drilling into the MCP server, shows a summary page with all the information about the server and the MCP Tools that have been exposed:
image
Having exposed your MCP Server, you can then use your own preferred application to list and invoke the available Tools. For example, the picture below shows the MCP Inspector tool being used to invoke the MCP Tool to Get customers:
image

Toolkit - New policy types for WS-Security in Java 17 Integration Servers

At the beginning of 2026, IBM published a new Statement of Direction regarding our plans for the phased adoption of Java 17 in place of Java 1.8 within ACE 13.  This blog lays out the full details of our approach and planned timelines. In line with those aims, ACE 13.0.7.0 is the first version 13 mod release to support WS-Security within integration servers running on Java 17 (ACE has already supported WS-Security within servers running on Java 1.8 for a long time). The ACE 13.0.7.0 product release introduces a dual stack approach with regard to our support of SOAP scenarios which will helps our users phase their adoption of Java 17 and migrate at their own pace. Class-loading code within the integration server process selectively chooses the web service libraries which should be loaded depending on whether the server is running under Java 1.8 or Java 17.


Java 1.8 SOAP stack:  An older SOAP stack, only loaded by integration servers running Java 1.8 (this is the same stack used in previous ACE versions). This stack consists of:

  • WebSphere Application Server (WAS) Axis2
  • Additional WAS libraries
  • Jakarta EE 8 (this version predates the API namespace move from javax to jakarta)

Java 17 SOAP stack: A new SOAP stack, only be loaded by integration servers running Java 17. This stack consists of:

  • Open source Apache Axis2
  • Open source Apache Rampart
  • Jakarta EE 10 (this version no longer uses the javax namespace and uses the jakarta namespace instead)

Due to our adoption of Apache Rampart for the future support of WS-Security in Java 17 servers, it has been necessary for some of the ACE product externals to change in this release, but we have also tried to keep a similar look and feel to help users who may be familiar with this functional area in past versions of the product. The most noticeable change comes in the area of policy sets and bindings files.  In previous ACE versions, web service policy sets and bindings files were defined within a policy project but they did not use the .policyxml file extension and they were not presented in the same way as other policy files. These older web service policy sets and bindings files carried the required ACE configuration for both WS-Security and WS-ReliableMessaging settings, for the SOAP Input, SOAP Reply, SOAP Request, SOAP AsyncRequest, and SOAP AsyncResponse nodes. Starting in ACE 13.0.7.0:

  • WS-ReliableMessaging information has now been separated into its own dedicated policy file with the standard .policyxml file extension (there is a deeper description of this lower down this blog).
  • For the WS-Security information, a Toolkit user will create a new policy with the standard .policyxml file extension. There are two different WS-Security policy types provided in ACE 13.0.7.0: WS-Security Input (which is used by provider message flows that contain SOAP Input and SOAP Reply nodes) and WS-Security Request (which is used by consumer message flows that contain SOAP Request nodes). Each of these policy types has sections for controlling the Message Signing and Message Encryption both for request messages and reply messages.

The diagram below shows a situation where ACE is fulfilling the role of both Web Service Consumer and Web Service Provider. The blue and green arrows and boxes are designed to demonstrate which part of each policy influences which part of the communication between Consumer and Provider.

In this scenario, the four stages below describe what is happening to the data as it flows back and forth:

  1. The Consumer encrypts the data using the Provider’s public certificate, and signs the data using the Consumer’s private key
  2. The Provider decrypts the data using the Provider’s private key, and verifies the data signature using the Consumer’s public key
  3. The Provider encrypts the reply data using the Consumer’s public certificate, and signs the data using the Provider’s private key
  4. The Consumer decrypts the data using the Consumer’s private key, and verifies the data signature using the Provider’s public key

For this example, here is the WS-Security Request Policy:

image

When you click on the Configure button, a new window opens which shows a more detailed set of configuration panels that should be familiar to users of WS-Security in earlier versions of the ACE product. This window can be used to specify further details about the Token types you would like to use, and your chosen configuration if doing Message Part protection. To help explain how this panel could be used when configuring a Web Service Consumer, this example has also been annotated with numbers to match the four stages of flowing data that were defined above.

image

For this example, here is the WS-Security Input Policy:

image

When you click on the Configure button, the same more detailed configuration window opens. To help explain how this panel could be used when configuring a Web Service Provider, this example has also been annotated with the same numbers to match the four stages of flowing data that were defined above.

image
Having configured these policies you will find the following files stored inside your Policy Projects. In this example we have a separate Policy Project for the Web Service Consumer (named DemoConsumerPolicies) and the Web Service Provider (named DemoProviderPolicies):
image
The SOAP Input node in the Provider message flow references the DemoProvider policy:
image
The SOAP Request node in the Consumer message flow references the DemoConsumer policy:
image

WS-Security with X509 and Username Tokens in Java 17 Integration Servers

ACE 13.0.7.0 introduces support for WS-Security in Java 17 Integration Servers when using either X509 or UsernameT okens. Support for SAML, Kerberos and LTPA token types is expected to follow in our next release, ACE 13.0.8.0. The picture below builds upon the example that we introduced in the previous section of this blog. It shows an example of a WS-Security implementation, that helps demonstrate the functional changes which have been delivered in ACE 13.0.7.0 in support of running message flows which use WS-Security with X509 certificates inside integration servers based upon Java 17.

image

There are two message flows shown, one acting as a SOAP Consumer (which contains a SOAP Request node) and the other acting as a SOAP Provider (which contains both a SOAP Input and a SOAP Reply node). In this example, each message flow is deployed to a separate independent integration server. Each of these integration servers has a separate JKS Keystore (to hold their private key certificate), a separate JKS Truststore (containing the certificate exported from the opposite partner in the communication), and a separate ACE External Directory Vault holding credentials. Each integration server's credentials provide the necessary passwords to access the X509 certificates stored in the server's keystore and truststore.


WS-ReliableMessaging in Java 17 Integration Servers

WS-ReliableMessaging (WS-RM) is an OASIS specification that defines how two systems can send SOAP messages between each other reliably even in the event of network or system failures. The IBM documentation provides a good overview of how the SOAP message flow nodes provide for reliable message exchange as conformant to the WS-RM specification.  There is also a detailed interaction example in the IBM Documentation for how two systems can be configured for reliable message exchange.

The purpose of WS-RM is to ensure delivery of messages in situations such as the destination endpoint being temporarily unavailable (for example, in the case of a server restart) or the message path crossing multiple transport connections, any of which might fail (for example, across a firewall). The ACE WS-RM implementation is applicable only to the HTTP transport. If you configure WS-RM on a message flow that uses the JMS transport, the WS-RM settings are not used when the flow is deployed.  Systems that implement WS-RM retransmit messages that have not been successfully delivered and acknowledged and prevent duplicate messages from being delivered to the application destination.

Previous versions of ACE have provided support for using the WS-ReliableMessaging standard inside message flows which are deployed to integration servers running Java 1.8, but from ACE 13.0.7.0 we have extended this support to also provide for flows which are deployed to integration servers running Java 17. As part of these changes, we have added a new policy of type WS-ReliableMessaging to the Toolkit as shown below:

image
The SOAP Request node can be directed to your WS-ReliableMessaging policy using a new optional property on the WS Extensions property tab. If you choose not to create a WS-ReliableMessaging policy (and therefore choose not to fill out this property), you can still use the default settings for WS-ReliableMessaging.  To specify that the SOAP Request node should use WS-ReliableMessaging, select the property Use WS-ReliableMessaging (requires WS-Addressing). You will find that the Toolkit blocks you from selecting this tickbox, unless you have also previously selected the Use WS-Addressing tickbox.  This combination is shown in the picture of the SOAP Request node properties shown below:
image

Designer Batch Flows

You can insert a batch process in to an event-driven flow or a flow for an API when you want to perform a set of operations for each record in a dataset or query where the dataset or query is very large. Batch uses the regular Designer Connector Request RETRIEVEALL operation. Pagination features are used on the connector to operate on a large dataset by iteratively paging through the data. The batch process runs asynchronously outside of the message flow. You can pause, stop, and resume a running batch process.  When authoring a Designer flow in ACE software you will now find a new Batch process option in the Toolbox palette:

image

New Toolkit Discovery Connector Request nodes
Continuing our mission to expand the available Toolkit message flow nodes for easy connection to third party applications, this quarter ACE 13.0.7.0 has added five new Discovery Connector Request Message Flow nodes:
  • Freshservice Request node: Freshservice is a cloud-based IT Service Management (ITSM) and Enterprise Service Management (ESM) platform from Freshworks, to automate workflows, manage IT incidents and assets, and deliver a seamless support experience. Use the Freshservice Request node to connect to Freshservice and issue requests to perform actions on objects such as agent groups, agents, conversations, departments, requester groups, requester, tasks and tickets.
  • Google Analytics Request node: Google Analytics is a web analytics service that provides tools to analyze traffic on websites and applications across your business. Use the Google Analytics Request node to connect to Google Analytics and issue requests to perform actions on objects such as account summaries, accounts, custom dimensions, custom metrics, data streams, key events, properties, and reports.
  • Microsoft Azure DevOps Request node: Microsoft Azure DevOps is a cloud-based platform that provides integrated tools to plan, develop, test, and deploy software. It includes services for work tracking, source control, continuous integration and delivery, testing, and package management to support end-to-end software lifecycle activities. Use the Microsoft Azure DevOps Request node to connect to Microsoft Azure DevOps and issue requests to perform actions on objects such as artifacts, branches, commits, feeds, organizations, pipelines, projects, pull request thread comments, pull request threads, pull requests, pushes, repositories, work item comments, work item types and work items.
  • Microsoft Azure OpenAI Request node: Microsoft Azure OpenAI Service provides enterprise-ready generative AI by offering advanced OpenAI models that help organizations accelerate innovation across text, audio, and vision workloads within the Azure cloud environment. Use the Microsoft Azure OpenAI Request node to connect to Microsoft Azure OpenAI and issue requests to perform actions on objects in the Microsoft Azure OpenAI application such as Chat completions, Embeddings, Files, Input items, Responses, Vectore store files and Vector stores
  • SAP S4 Hana Request node: SAP S/4 Hana is an intelligent, real-time ERP (Enterprise Resource Planning) suite that uses the SAP HANA in-memory platform to simplify data models, accelerate business processes, and deliver integrated analytics. Use the SAP S4 Hana Request node to connect to SAP S/4 Hana and issue requests to perform actions on objects in the SAP S/4 Hana application.
Each new type of connector also has a corresponding new policy type, which helps Toolkit users define configuration properties for easy connection to the applications. These policies also link to credential information that can be encrypted and stored in an ACE vault, enabling the ACE runtime to safely and securely connect to your applications. For example, here's a picture of the new Freshservice policy type:
image

New Toolkit Discovery Connector Input nodes
Continuing our mission to expand the available Toolkit message flow nodes for easy connection to third party applications, this quarter ACE 13.0.7.0 has added four new Discovery Connector Input Message Flow nodes:
  • Amazon SQS Input node: Amazon Simple Queue Service (SQS) is a message queuing service that temporarily stores messages to be processed by web applications and cloud services. Use the Amazon SQS Input node in a message flow to connect to Amazon SQS and monitor and accept input. For example, you can use the Amazon SQS Input node to trigger a flow when a message is written to an Amazon SQS queue.
  • Freshservice Input node: Freshservice is a cloud-based IT Service Management (ITSM) and Enterprise Service Management (ESM) platform from Freshworks, to automate workflows, manage IT incidents and assets, and deliver a seamless support experience.  Use the Freshservice Input node in a message flow to monitor and accept input from Freshservice. For example, you can use the Freshservice Input node to monitor Freshservice for new tickets.
  • Microsoft Azure DevOps Input node: Microsoft Azure DevOps is a cloud-based platform that provides integrated tools to plan, develop, test, and deploy software. It includes services for work tracking, source control, continuous integration and delivery, testing, and package management to support end-to-end software lifecycle activities.  Use the Microsoft Azure DevOps Input node in a message flow to monitor and accept input from Microsoft Azure DevOps. For example, you can use the Microsoft Azure DevOps Input node to monitor Microsoft Azure DevOps for new work items.
  • SAP S4 Hana Input node: SAP S/4 Hana is an intelligent, real-time ERP (Enterprise Resource Planning) suite that uses the SAP HANA in-memory platform to simplify data models, accelerate business processes, and deliver integrated analytics. Use the SAP S4 Hana Input node in a message flow to monitor and accept input from SAP S/4 Hana. For example, you can use the SAP S/4 Hana Input node to monitor SAP S/4 Hana for new sales order events and accept input when the event occurs.

Event Resilience Policies
By default, when a Discovery Connector message flow node retrieves events from an endpoint system, they are captured and added to an in-memory queue within the integration server runtime ready for processing by the downstream nodes in the message flow. If the integration server process crashes for any reason, or for example if you are running ACE in containers then in some circumstances Kubernetes might tear down a container and move it from one physical worker node to another, then these events could be lost.  To protect against possible data loss should this occur, from ACE 13.0.7.0 you can choose to configure greater resiliency by alternatively choosing to place these event messages from the endpoint application in a set of brokers in a Kafka cluster. To consume these event messages for processing in the deployed integration, App Connect Enterprise can automatically write and subscribe to a topic in the nominated Kafka cluster when a new Event Resilience policy is defined. An Event Resilience policy contains connection details that are used when you configure a Discovery Connector node to persist events to Kafka.  The picture below shows the new Event Resilience policy. Currently, the only available Resiliency type is KAFKA, but in future releases we may choose to offer alternatives such as using IBM MQ for example.
image

The Resilience provider policy is associated with a Kafka policy which in turn is used to describe the Kafka connection information. This follows the standard ACE way of defining configurations and enables the maximum possible reuse of policies for different purposes.


Claim Check for Toolkit Discovery Connector Request nodes

The Claim Check design pattern is a commonly practiced method through which integration products or messaging systems can efficiently transfer large payloads between systems. Typically, integration products like ACE operate most efficiently when the flowing messages are of a consistent similar size. Introducing occasional large messages into an architecture like this, can potentially risk exceeding hardware limits and in extreme cases can sometimes degrade the performance of the entire system. The Claim Check pattern avoids these problems and enables large pieces of data to be successfully transferred between endpoint systems whilst avoiding the need to parse the payloads within the intervening middleware product between the endpoint systems. A connector communicates with the application endpoint system where the data originates and generates a claim-check token for the payload. This claim check token can then be carried through the middleware and when required it can then be redeemed and the data directly streamed to the second application endpoint system.

A good analogy for this architectural approach is the process you follow when taking a flight from an airport: You carry your heavy luggage to the check-in desk and exchange it for a "token" (normally a sticky label carrying a unique identifier). Your suitcase is then transported to your destination on your behalf where you can retrieve it from the luggage carousel with your unique token safely avoiding any potential accidental mix-ups.

The IBM App Connect discovery connectors have been built for some time with the wider adoption of the Claim Check architectural pattern in mind. Last summer, this topic was discussed in an article on the IBM Community, which is an excellent source of background information on this subject.
image
  • Node 1: Represents an Input node which triggers the message flow. In this example, this could be a non-Discovery connector node, or it could be a Discovery connector node, but importantly this node itself is not directly involved in the claim check (ie it does not generate a claim check token at all). The Logical message tree which is propagated to Node 2 can be of any shape as it is not directly involved in the large data handling and it does not carry a claim check token.
  • Node 2: Represents a Discovery Connector Request node, which notices that data is available in External System A, and generates a claim check token which is passed in the Logical tree for use by another Discovery Connector downstream
  • Node 3: Represents a Discovery Connector Request node which receives an inbound Logical message tree containing the claim check token created by Node G. This pointer is used to take data directly from External System A and stream it into External System B, without having to spend CPU cycles on creating the Logical Message tree, and without having to spend memory for making the data available to other Toolkit message flow nodes.
  • Node 4: Represents a Toolkit transformation node that converts an inbound Logical message tree into an outbound Logical message tree which may have a different shape in terms of both a different message domain (eg JSON/BLOB/XMLNSC/DFDL etc.) and also potentially a different shape with different fields with different values.
  • Node 5: Represents a Toolkit Output node (non-Discovery connector) which serializes the inbound Logical tree and sends it to the External System C.

The following Discovery Connector Request nodes have been enabled to support the claim check pattern of operation in ACE 13.0.7.0:

  • Amazon S3 Request
  • Dropbox Request
  • Freshservice Request
  • Google Analytics Request
  • Google Cloud Storage Request
  • Microsoft Azure Blob storage Request
  • Microsoft Azure DevOps Request
  • Microsoft Azure OpenAI Request
  • Microsoft SharePoint Request
  • Microsoft Teams Request
  • Salesforce Request
  • SAP S4 Hana Request
  • Slack Request

When the message flow developer adds a Discovery Connector Request node into a message flow, on the node you will find a new properties tab with Claim Check Options. The Binary Data Handling property offers two alternate values:

  • Select Create claim check token to specify that a claim check is to be used. If you select this option, a claim check token will be created by the node and will be passed through the message flow. The data will be streamed directly using the connectors in communication with the endpoint applications, without it being necessary to parse the data into the message flow. The claim check token is what is passed down the flow to any subsequent wired message flow node. If a message tree containing a claim check token arrives at a traditional Toolkit output node, the claim check token is redeemed automatically by the node and the data will be streamed into the message flow and written out. If you were to add a downstream Trace node after the connector request node, the generated Trace will show that a claim check token was flowing.
  • Select Stream data into message tree to specify that the data is to be streamed in the message flow. When data is requested by a discovery connector node in the flow, the data is downloaded into memory and is streamed in full through the flow in the message body. That data is then available to be accessed by subsequent nodes in the flow. You can see the data in full in a Trace node in the flow or in the flow debugger.

To learn more about this feature, check out this page in the documentation.


Support for Kafka OAuth Bearer Tokens

In ACE 13.0.7.0, the KafkaConsumer, KafkaProducer, and KafkaRead nodes have been enhanced to support SASL/OAUTHBEARER authentication. This has not required any changes to the external Toolkit properties of the Kafka nodes themselves, although there are configuration changes in the Kafka Policy and  Kafka credentials have been extended to provide two new Authentication Types of client and clientScoped

image
The new Authentication Types have been reflected in updates to the ibmint set credential command and also when using the Toolkit to interact with an External Directory Vault as shown in the picture below:
image
Summary

This blog post has summarized all the latest and greatest capabilities which are made available in IBM App Connect Enterprise 13.0.7.0.  To explore further, we recommend checking out the following links:

0 comments
244 views

Permalink