Firezone

No entries match these filters. Clear filters

1. announced Nov 3, 2026 · issue 130

   Firezone adds an EU-region cloud deployment hosting identity data, access policies, and audit logs exclusively in the European Union⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Connect a Firezone Client to the new EU region to keep all identity and policy data within the European Union.
   📍In the Firezone Client, go to Settings → Control plane → Firezone Cloud (EU), then sign in. The client will authenticate against wss://eu.api.firezone.dev and the admin portal will be at https://eu.app.firezone.dev.
   • Switch Clients to the EU control plane by setting Settings → Control plane → Firezone Cloud (EU) before signing in, connecting to wss://eu.api.firezone.dev with the admin portal at https://eu.app.firezone.dev.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Firezone now offers an EU-region account option with identity data, access policies, and audit logs stored exclusively in Sweden and France on Azure infrastructure, available on all plans including Starter.

   2 details in Everything

2. Gateway 1.6.4 (2026-10-29) Oct 29, 2026 · issue 125

   Firezone Gateway now parallelizes WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. encryption and decryption across worker threads for greater tunnel throughput⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

3. Linux GUI 1.5.20 (2026-10-29) Oct 29, 2026 · issue 125

   Firezone Linux GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. 1.5.20 adds a redesigned Settings screen to select between US and EU control planes, and now parallelizes WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. encryption across worker threads for hi⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Select the EU control plane endpoint if your organization's data must stay in European infrastructure.
   📍In the Firezone Linux GUI, go to Settings and select EU under the control plane region selector.
   • Switch between the Firezone US or EU control plane from a redesigned Settings screen.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Packet-routing performance now benefits from caching of route resolution for established flows.
   • Switch between the Firezone US or EU control plane from a redesigned Settings screen.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

4. 1.0.0 Oct 23, 2026 · issue 117

   API surface changed: +19 endpoints, 8 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   API change

   API surface changed: +19 endpoints, 8 modified⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • + DELETE /defender_posture_providers/{id}
   • + DELETE /intune_posture_providers/{id}
   • + DELETE /iru_posture_providers/{id}
   • + DELETE /santa_posture_providers/{id}
   • + DELETE /sentinelone_posture_providers/{id}
   • + DELETE /sophos_posture_providers/{id}
   • + GET /posture_fields
   • + PATCH /defender_posture_providers/{id}
   • + PATCH /intune_posture_providers/{id}
   • + PATCH /iru_posture_providers/{id}
   • + PATCH /santa_posture_providers/{id}
   • + PATCH /sentinelone_posture_providers/{id}
   • + PATCH /sophos_posture_providers/{id}
   • + PUT /defender_posture_providers/{id}
   • + PUT /intune_posture_providers/{id}
   • + PUT /iru_posture_providers/{id}
   • + PUT /santa_posture_providers/{id}
   • + PUT /sentinelone_posture_providers/{id}
   • + PUT /sophos_posture_providers/{id}
   • ~ DELETE /groups/{id}: response schema changed
   • ~ GET /clients: param actor_id (query) added; param client_type (query) added; param last_seen_after (query) added; param last_seen_before (query) added; param online (query) added
   • ~ GET /groups: response schema changed
   • ~ GET /groups/{group_id}/memberships: response schema changed
   • ~ GET /groups/{id}: response schema changed
   • ~ PATCH /groups/{id}: response schema changed
   • ~ POST /groups: response schema changed
   • ~ PUT /groups/{id}: response schema changed
   • New endpoint DELETE /defender_posture_providers/{id}⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • New endpoint DELETE /intune_posture_providers/{id}
   • New endpoint DELETE /iru_posture_providers/{id}
   • New endpoint DELETE /santa_posture_providers/{id}
   • New endpoint DELETE /sentinelone_posture_providers/{id}

   +5 more show less

   • New endpoint DELETE /sophos_posture_providers/{id}
   • New endpoint GET /posture_fields
   • New endpoint PATCH /defender_posture_providers/{id}
   • New endpoint PATCH /intune_posture_providers/{id}
   • New endpoint PATCH /iru_posture_providers/{id}

   10 details in Everything

5. changelog Oct 20, 2026 · issue 114

   Firezone: Improves Apple client tunnel throughput by coalescing consecutive TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. segments before writing them to the system tunnel.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

6. Android 1.5.16 (2026-10-19) Oct 19, 2026 · issue 113

   Android 1.5.16 brings a unified Compose-based settings UI, device pool grouping in the resource list, and multiple packet-processing performance improvements.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Shows device pools in the resource list instead of a flat view of all connected devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Improves packet-processing performance when flow logging is enabled.
   • Improves packet-processing performance by speeding up peer and route lookups.
   • Improves packet processing performance by reducing allocations and packet moves during network writes.
   • Shows device pools in the resource list instead of a flat view of all connected devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

7. macOS / iOS 1.5.22 (2026-10-14) Oct 14, 2026 · issue 109

   Firezone macOS/iOS 1.5.22 adds device pool grouping in the resource list and improves packet-processing performance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Sends a notification instead of displaying an alert when the session ends.
   • Improves packet-processing performance when flow logging is enabled.
   • Improves packet-processing performance by speeding up peer and route lookups.
   • Improves Apple client tunnel throughput by coalescing consecutive TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. segments before writing them to the system tunnel.
   • Improves packet processing performance by reducing allocations and packet moves during network writes.

   5 more in Everything

8. Linux GUI 1.5.19 (2026-10-14) Oct 14, 2026 · issue 108

   Linux GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. 1.5.19 replaces the disconnection alert with a notification and shows device pools in the resource list.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Replaces the Firezone disconnected alert with a notification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Shows device pools in the resource list instead of all connected devices in one view.
   • Replaces the Firezone disconnected alert with a notification.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

9. docs update Oct 4, 2026 · issue 094

   Firezone adds Device Trust: mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. certificate attestation gates Resource access by cryptographic device identity⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Enable Device Trust attestation on a Resource Policy so only Clients holding a certificate from your PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. can connect.
   📍In the Firezone admin portal, go to Policies › [select or create a Policy] › Conditions, add the Device Trust attestation condition, and configure your trust anchor (CA certificate). Save the Policy — Clients must now complete mutual TLS attestation before traffic is allowed.
   • Adds Device Trust, a mutual TLS attestation layer that requires a Client to prove possession of a hardware-backed private key (via TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake., Keychain, CNG, Android KeyChain, or PKCS#11PKCS#11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware.) before a Policy grants access to a Resource.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports per-platform key storage: Windows via CNG in the local computer store, Apple platforms via a Keychain identity linked to the managed VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. configuration, Android via the KeyChain, and Linux via a PKCS#11 provider (TPM, smart card, or HSMHSMA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them.).
   • Validates device certificates against administrator-configured trust anchors, checking chain, lifetime, intended usage, and device identifier from the Subject Alternative Name — compatible with certificates provisioned by any MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. or PKI via SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention. or ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction..
   • Introduces a Policy condition that grants access only while the Client connection remains attested, layerable alongside existing compliance checks.

   4 details in Everything

10. 1.0.0 Oct 3, 2026 · issue 093

    API surface changed: +6 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: +6 endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • + GET /github_auth_providers
    • + GET /github_auth_providers/{id}
    • + GET /sophos_devices
    • + GET /sophos_devices/{id}
    • + GET /sophos_posture_providers
    • + GET /sophos_posture_providers/{id}
    • New endpoint GET /github_auth_providers⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • New endpoint GET /github_auth_providers/{id}
    • New endpoint GET /sophos_devices
    • New endpoint GET /sophos_devices/{id}
    • New endpoint GET /sophos_posture_providers

    +1 more show less

    • New endpoint GET /sophos_posture_providers/{id}

    6 details in Everything

11. announced Oct 3, 2026 · issue 095

    Firezone introduces a new Business self-serve pricing tier at $8/seat/month, with active-seat billing based on Client sign-ins in the prior 30 days.

    • New integration Directory sync integrations
    • New integration Device posture check integrations
    • New integration Log sink integrations for audit log streaming
12. changelog Sep 26, 2026 · issue 086
    └──▷ TRY IT
    Authenticate a gateway using the new built-in subcommand now that it lives in firezone-gateway rather than the separate firezone CLI.
    copy

    $ firezone-gateway authenticate

    Enable the gateway service without needing the separate firezone CLI binary.
    copy

    $ firezone-gateway enable-service

    └──▷ BREAKING ON UPGRADE

    • !The authenticate, enable-service, and disable-service commands have moved from the firezone CLI to firezone-gateway; any scripts or service configs invoking them via firezone must be updated to use firezone-gateway instead.
13. docs update Sep 26, 2026 · issue 086

    Firezone launches an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server at https://rest-api.firezone.dev/mcp, letting Claude and other AI assistants read and manage your account.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Register the Firezone MCP server in Claude Code so you can query and manage your Firezone account from the terminal.
    copy

    $ claude mcp add --transport http firezone https://rest-api.firezone.dev/mcp

    Revoke an AI assistant's access to Firezone immediately after an incident or when rotating integrations.
    📍In the Firezone admin portal: select your user avatar (upper right) → Your settings → Connected apps → find the assistant → select Disconnect.
    • Adds an MCP server at https://rest-api.firezone.dev/mcp supporting Streamable HTTPStreamable HTTPAn MCP transport protocol that lets a client send JSON-RPC requests over HTTP POST while the server streams responses back using Server-Sent Events, replacing the older stdio and SSE transports for remote tool communication. transport and OAuth, enabling any compatible AI assistant to manage Firezone Resources, Policies, Sites, Gateways, Groups, Actors, Clients, and logs via plain-language prompts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds Claude Code integration via claude mcp add --transport http firezone https://rest-api.firezone.dev/mcp, letting practitioners automate Firezone administration from the Claude Code CLI.
    • Exposes granular read/write permission scoping at connect time — read permissions are selected by default, and write permissions (create, change, delete) must be explicitly granted per object type.
    • All MCP tool calls appear in Logs → API Request Logs in the admin portal, providing a full audit trail of assistant activity subject to the same rate limits as the REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services..

    4 details in Everything

14. docs update Sep 26, 2026 · issue 086

    Firezone adds a Terraform provider, cloud Gateway modules (AWS/GCP/Azure), a REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., and an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server for AI assistant integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds the Firezone Terraform Provider to manage Portal configuration — Sites, Resources, Policies, Groups, and Gateways — as code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds cloud-specific Terraform Gateway Modules for AWS, GCP, and Azure to deploy a scalable Gateway cluster behind a cloud NAT with a single egress IP.
    • Adds a REST API for programmatic management of Resources, Policies, Gateways, and more without Terraform.
    • Adds the Firezone MCP server to connect Claude or other AI assistants to a Firezone account.

    4 details in Everything

15. changelog Sep 25, 2026 · issue 085

    Firezone: Recognizes iru-id SAN claims in device attestation certificates as an alias for kandji-id.

    └──▷ TRY IT
    Authenticate a gateway and manage its service lifecycle without needing the separate firezone CLI binary.
    copy

    $ firezone-gateway authenticate
    firezone-gateway enable-service
    firezone-gateway disable-service

16. changelog Sep 24, 2026 · issue 084

    Firezone: Recognizes iru-id SAN claims in device attestation certificates as an alias for kandji-id.

    └──▷ TRY IT
    Authenticate a gateway token directly from firezone-gateway without needing the separate firezone CLI.
    copy

    $ firezone-gateway authenticate

    Enable the gateway as a system service using the now-consolidated firezone-gateway CLI.
    copy

    $ firezone-gateway enable-service

17. docs update Sep 24, 2026 · issue 084

    Firezone Terraform Provider lets you manage Sites, Resources, Policies, Groups, Actors, and Gateways as code via firezone/firezone.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Bootstrap the Firezone provider for a self-hosted Portal without writing credentials into Terraform config.
    copy

    $ export FIREZONE_TOKEN="<your-api-token>"
    export FIREZONE_ENDPOINT="https://firezone.corp.example.com"
    terraform init && terraform plan

    Declare a Site, a TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./443 DNS resource, and a policy granting a directory-synced group access — the core access-control pattern.
    hcl copy

    resource "firezone_site" "production" {
      name = "production"
    }
    
    resource "firezone_resource" "internal_app" {
      site_id = firezone_site.production.id
      name    = "internal-app"
      type    = "dns"
      address = "app.internal.example.com"
      filters {
        protocol = "tcp"
        ports    = ["443"]
      }
    }
    
    data "firezone_group" "engineering" {
      name = "Engineering"
    }
    
    resource "firezone_policy" "engineering_app" {
      group_id    = data.firezone_group.engineering.id
      resource_id = firezone_resource.internal_app.id
      description = "Engineering access to the internal application"
    }

    Adopt an existing Firezone Site into Terraform management without recreating it.
    copy

    $ terraform import firezone_site.production <site-id>

    • Adds the firezone/firezone Terraform provider, sourced via the firezone/firezone registry path, enabling infrastructure-as-code management of Firezone Portal objects alongside Gateway infrastructure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports FIREZONE_TOKEN and FIREZONE_ENDPOINT environment variables for provider authentication and endpoint configuration without hardcoding secrets.
    • Provides firezone_site, firezone_resource, firezone_policy, firezone_gateway, and group/actor/membership resources for declarative access configuration.
    • Provides data sources for existing Sites, Groups, Actors, Clients, authentication providers, and Entra, Google Workspace, or Okta directories.
    • Adds token_rotation_trigger field on firezone_gateway to rotate Gateway tokens by changing the field value, triggering Terraform to expose a replacement token.

    +3 more show less

    • Supports terraform import for Sites, Resources, Policies, Groups, Actors, memberships, Gateways, and static device-pool memberships to bring existing Portal objects under Terraform management.
    • Integrates with Firezone Gateway modules for AWS, Azure, and Google Cloud, and custom Docker, Kubernetes, or VM deployments via the sensitive token output of firezone_gateway.
    • Sets the endpoint provider argument (or FIREZONE_ENDPOINT) to target either Firezone Cloud (https://rest-api.firezone.dev) or a self-hosted Portal API.

    8 details in Everything

18. announced Sep 24, 2026 · issue 089

    Firezone desktop clients (macOS, Windows, Linux) now ship with a firezone CLI for tunnel control and unattended service-account sign-in.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Authenticate a headless server or CI runner with a service-account token without interactive prompts.
    copy

    $ echo "$SERVICE_ACCOUNT_TOKEN" | firezone connect
    # or
    export FIREZONE_TOKEN="$SERVICE_ACCOUNT_TOKEN"
    firezone connect

    • Adds firezone connect command that reads a service-account token from stdin or the FIREZONE_TOKEN environment variable, enabling unattended/headless tunnel connections that were not officially supported before.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds the firezone CLI to macOS (v1.5.21+), Windows, and Linux (v1.5.18+) desktop clients for managing tunnel state, viewing Resources, and enabling or disabling the Internet Resource.
    • Exposes a macOS-only firezone subcommand for managing the system extension.

    3 details in Everything

19. Android 1.5.15 (2026-09-24) Sep 24, 2026 · issue 085

    Firezone Android 1.5.15 adds iru-id SAN claim support in device attestation and improves resume-from-sleep connectivity restoration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Recognizes iru-id SAN claims in device attestation certificates as an alias for kandji-id.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

20. Gateway 1.6.2 (2026-09-24) Sep 24, 2026 · issue 084

    Firezone Gateway 1.6.2 moves authenticate, enable-service, and disable-service commands into firezone-gateway itself.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Authenticate a gateway and bring it into service using the consolidated firezone-gateway binary instead of the old separate firezone CLI.
    copy

    $ firezone-gateway authenticate && firezone-gateway enable-service

    └──▷ BREAKING ON UPGRADE

    • !The authenticate, enable-service, and disable-service commands have moved from the firezone CLI binary into firezone-gateway — any scripts or service definitions calling firezone authenticate, firezone enable-service, or firezone disable-service must be updated to use firezone-gateway authenticate, firezone-gateway enable-service, and firezone-gateway disable-service instead.
21. Windows GUI 1.5.18 (2026-09-24) Sep 24, 2026 · release notes

    Firezone Windows GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. 1.5.18 adds device attestation for Intune Kandji ID and improved resume connectivity.

    └──▷ HOW TO FIND IT
    Re-establish the tunnel immediately after waking from sleep, bypassing OS notification failures.
    📍Sleep device -> Wake device -> Verify tunnel reconnects automatically.
    • iru-id SAN claims are now recognized as an alias for kandji-id in device attestation certificates

    1 detail in Everything

22. 1.0.0 Sep 22, 2026 · issue 082

    API surface changed: 27 modified, 3 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    API change

    API surface changed: 27 modified, 3 deprecated⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • ~ DELETE /clients/{id}: response schema changed
    • ~ DELETE /policies/{id}: response schema changed
    • ~ DELETE /resources/{id}: response schema changed
    • ~ GET /clients: response schema changed
    • ~ GET /clients/{id}: response schema changed
    • ~ GET /defender_devices: response schema changed
    • ~ GET /defender_devices/{id}: response schema changed
    • ~ GET /intune_devices: response schema changed
    • ~ GET /intune_devices/{id}: response schema changed
    • ~ GET /policies: response schema changed
    • ~ GET /policies/{id}: response schema changed
    • ~ GET /resources: response schema changed
    • ~ GET /resources/{id}: response schema changed
    • ~ GET /santa_devices: response schema changed
    • ~ GET /santa_devices/{id}: response schema changed
    • ~ GET /sentinelone_devices: response schema changed
    • ~ GET /sentinelone_devices/{sentinelone_agent}: response schema changed
    • ~ PATCH /clients/{id}: request body changed; response schema changed
    • ~ PATCH /policies/{id}: request body changed; response schema changed
    • ~ PATCH /resources/{id}: request body changed; response schema changed
    • ~ POST /policies: request body changed; response schema changed
    • ~ POST /resources: request body changed; response schema changed
    • ~ PUT /clients/{id}: request body changed; response schema changed
    • ~ PUT /clients/{id}/unverify: response schema changed
    • ~ PUT /clients/{id}/verify: response schema changed
    • ~ PUT /policies/{id}: request body changed; response schema changed
    • ~ PUT /resources/{id}: request body changed; response schema changed
    • ⚠ GET /resources/{resource_id}/pool_members
    • ⚠ PATCH /resources/{resource_id}/pool_members
    • ⚠ PUT /resources/{resource_id}/pool_members
    └──▷ BREAKING ON UPGRADE

    • !Deprecated endpoint GET /resources/{resource_id}/pool_members (still works)
    • !Deprecated endpoint PATCH /resources/{resource_id}/pool_members (still works)
    • !Deprecated endpoint PUT /resources/{resource_id}/pool_members (still works)
23. changelog Sep 15, 2026 · issue 075

    Firezone adds a native ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. installer for Windows on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. devices.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

24. docs update Sep 15, 2026 · issue 075

    Firezone Windows client now supports native ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. (aarch64) devices alongside x86-64.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

25. macOS / iOS 1.5.20 (2026-09-15) Sep 15, 2026 · issue 076

    Firezone macOS/iOS 1.5.20 adds X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificate-backed device trust⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds support for device trust backed by X.509 certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

26. announced Sep 14, 2026 · issue 078

    Firezone launches an official Terraform provider, enabling infrastructure-as-code management of Sites, Resources, Policies, and Gateways.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Bootstrap the provider using an API client token from the Firezone Portal so all subsequent terraform apply runs authenticate automatically.
    main.tf copy

    terraform {
      required_providers {
        firezone = {
          source = "firezone/firezone"
        }
      }
    }
    
    provider "firezone" {
      endpoint = "https://rest-api.firezone.dev"
    }
    
    # Set FIREZONE_TOKEN in your environment:
    # export FIREZONE_TOKEN=<token-from-portal-settings>

    Lock down a sensitive resource to Okta-authenticated Engineering members during business hours on attested devices — defined entirely in code so the policy is reviewable in a PR.
    main.tf copy

    resource "firezone_resource" "database" {
      site_id = firezone_site.main.id
      name    = "postgres-prod"
      type    = "ip"
      address = "10.0.0.100"
      filters {
        protocol = "tcp"
        ports    = ["5432"]
      }
    }
    
    resource "firezone_policy" "engineering_db" {
      group_id    = data.firezone_group.engineering.id
      resource_id = firezone_resource.database.id
      condition {
        property = "auth_provider_id"
        operator = "is_in"
        values   = [data.firezone_okta_auth_provider.corp.id]
      }
      condition {
        property = "current_utc_datetime"
        operator = "is_in_day_of_week_time_ranges"
        values   = ["M/09:00-17:00/America/New_York", "F/09:00-17:00/America/New_York"]
      }
      condition {
        property = "device_attested"
        operator = "is"
        values   = ["true"]
      }
    }

    Rotate a Gateway token on a schedule by updating token_rotation_trigger — the old token stays valid until the Gateway reconnects with the new one.
    main.tf copy

    resource "firezone_gateway" "gw" {
      for_each = {
        "a" = { name = "gw-us-east-1a", rotated = "2026-09-14" }
      }
      site_id              = firezone_site.main.id
      name                 = each.value.name
      token_rotation_trigger = each.value.rotated
    }

    • Adds the official firezone/firezone Terraform provider, available on the Terraform Registry, enabling Sites, Resources, Policies, and Gateways to be managed as code.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds FIREZONE_TOKEN environment variable and endpoint provider config key (defaulting to https://rest-api.firezone.dev) for authenticating the Terraform provider via an API client token created in the Portal under Settings.
    • Adds firezone_site, firezone_resource, firezone_policy, and firezone_gateway Terraform resources for managing the core Firezone access model.
    • Adds firezone_resource with support for cidr, ip, and dns resource types, with filters blocks for protocol and port restrictions, and ip_stack for DNS resources.
    • Adds firezone_policy with condition blocks supporting auth_provider_id, current_utc_datetime (day-of-week/time-range windows in any IANA timezone), device_attested, device region, and remote IP (CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network.) match properties.

    +2 more show less

    • Adds firezone_gateway with a token_rotation_trigger attribute that rotates the enrollment token whenever its value changes, storing the sensitive token in Terraform state.
    • Adds firezone_group and firezone_okta_auth_provider Terraform data sources for referencing existing groups and auth provider integrations in Policies.

    7 details in Everything

27. docs update Sep 11, 2026 · issue 071

    Firezone adds Device Trust setup: X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols.-based device attestation with MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies., SCEPSCEPSimple Certificate Enrollment Protocol, an IETF-standardized protocol for automating X.509 certificate issuance and renewal over HTTP, letting cyber tools request PKI certificates from a CA without manual intervention., ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction., PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets., and PKCS#11/TPM support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enforce device attestation on a sensitive resource so that only clients presenting a valid MDM-issued certificate can connect.
    📍In the Firezone admin portal: Settings → Trust Anchors → Add Trust Anchor → paste the issuing CA certificate (PEM or DER). Then open the Policy for the protected Resource, add the Require attestation condition, and save.
    Provision a TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake.-backed device identity on Linux without an MDM, then verify the Client can attest before enforcing the policy broadly.
    📍Issue a certificate with subject CN=dev.firezone.device-trust and URI SAN firezone://serial/<serial-number>, provision it via a PKCS#11 provider backed by the TPM, configure the Firezone Linux Client to use that PKCS#11 provider, then confirm Settings → Device Trust shows a valid chain and private key access before enabling Require attestation in the Policy.
    • Adds Settings → Trust Anchors in the admin portal to upload CA certificates (PEM or DER) that Firezone uses to validate client device identity certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Require attestation condition to Policies, letting admins enforce that only clients presenting a valid, chained device certificate can access a protected Resource.
    • Adds Settings → Device Trust in the Firezone Client for verifying that a device certificate is selected, the chain is valid, and the private key is accessible.
    • Supports PKCS#11PKCS#11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware. providers on Linux (including TPM-backed keys) so the TPM can hold and sign with the device key without exporting it.
    • Adds MDM-specific Device Trust setup guides for Microsoft Intune (Windows, macOS, iOS/iPadOS, Android), Kandji (Windows, macOS, iOS/iPadOS), and Jamf Pro (macOS, iOS/iPadOS).

    +1 more show less

    • Adds a universal Device Trust setup path for Linux and any certificate provisioning system, requiring a certificate with CN=dev.firezone.device-trust subject and a firezone://serial/<serial-number> URI SAN as a device identifier.

    6 details in Everything

28. docs update Sep 11, 2026 · issue 071

    Firezone adds cryptographic device trust via mTLSmTLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. client certificates, supporting CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live./OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. revocation and PKCS#11PKCS#11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware. on Linux⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ USE IT
    Encode an Intune device ID as a typed URI SAN in a certificate profile so Firezone can use it as the per-device identity claim.
    ini copy

    subjectAltName = URI:firezone://intune-id/00000000-0000-0000-0000-000000000001

    • Adds firezone://serial/<value>, firezone://udid/<value>, firezone://smbios-uuid/<value>, firezone://intune-id/<value>, firezone://ws1-uuid/<value>, firezone://jamf-id/<value>, and firezone://kandji-id/<value> typed URI SAN formats for embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. per-device identity claims in client certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports device trust via mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. (mTLS): at connection time the Firezone Client presents an X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificate issued by your MDMMDMMobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. or enterprise PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. and proves possession of the private key before access is granted.
    • Adds a Require attestation policy condition that grants access only while a Client connection remains attested by a valid, trusted device certificate.
    • Supports PKCS#11 on Linux, allowing the private key and certificate to be held by a TPMTPMA dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake., smart card, HSMHSMA tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them., or software token with signing delegated to the PKCS#11 provider.
    • Uses the Windows local computer personal store (LocalMachine\My) and Windows CNG for certificate and key operations on Windows, with optional TPM-backed keys.

    +2 more show less

    • Supports certificate revocation checking via both Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP), discovered automatically from endpoints advertised in device certificates; disconnects and blocks Clients upon detecting a revoked certificate.
    • Selects the certificate with the most recent NotBefore date when multiple valid certificates are present, enabling seamless certificate renewal without identity disruption.

    7 details in Everything

29. Android 1.5.14 (2026-09-11) Sep 11, 2026 · issue 071

    Firezone Android 1.5.14 adds device trust via X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificates and a refreshed app icon.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds support for device trust backed by X.509 certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Updates the app icon and other in-app logos to the new F mark.
    • Adds support for device trust backed by X.509 certificates.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

30. PreviousAndroidversions Sep 11, 2026 · release notes

    Firezone v1.5.14 adds X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. device trust and improves DNS reliability

    • Adds support for device trust backed by X.509 certificates.
    • Updates the app icon and other in-app logos to the new F mark.

    2 details in Everything

31. changelog Sep 8, 2026 · issue 068

    Firezone adds X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificate-backed device trust and removes the FIREZONE_NAME/-n Gateway option in favour of Admin Portal configuration.

    • Improves update notifications to appear once per Client launch instead of only once per new version; on Linux, update notifications now also trigger the download of the new package right away.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The FIREZONE_NAME flag (-n) has been removed from the Gateway; Gateways that set their name via this option must now set the name in the Admin Portal instead.
32. 1.0.0 Sep 7, 2026 · issue 067

    API surface changed: 101 modified

    API change

    API surface changed: 101 modified

    • ~ DELETE /actors/{actor_id}/client_tokens: response schema changed
    • ~ DELETE /actors/{actor_id}/client_tokens/{id}: response schema changed
    • ~ DELETE /actors/{actor_id}/external_identities/{id}: response schema changed
    • ~ DELETE /actors/{id}: response schema changed
    • ~ DELETE /clients/{id}: response schema changed
    • ~ DELETE /groups/{id}: response schema changed
    • ~ DELETE /policies/{id}: response schema changed
    • ~ DELETE /resources/{id}: response schema changed
    • ~ DELETE /sites/{site_id}/gateway_tokens: response schema changed
    • ~ DELETE /sites/{site_id}/gateway_tokens/{id}: response schema changed
    • ~ DELETE /sites/{site_id}/gateways/{id}: response schema changed
    • ~ GET /account: response schema changed
    • ~ GET /actors: response schema changed
    • ~ GET /actors/{actor_id}/client_tokens: response schema changed
    • ~ GET /actors/{actor_id}/client_tokens/{id}: response schema changed
    • ~ GET /actors/{actor_id}/external_identities: response schema changed
    • ~ GET /actors/{actor_id}/external_identities/{id}: response schema changed
    • ~ GET /actors/{id}: response schema changed
    • ~ GET /clients: response schema changed
    • ~ GET /clients/{id}: response schema changed
    • ~ GET /defender_devices: response schema changed
    • ~ GET /defender_devices/{id}: response schema changed
    • ~ GET /defender_posture_providers: response schema changed
    • ~ GET /defender_posture_providers/{id}: response schema changed
    • ~ GET /email_otp_auth_providers: response schema changed
    • ~ GET /email_otp_auth_providers/{id}: response schema changed
    • ~ GET /entra_auth_providers: response schema changed
    • ~ GET /entra_auth_providers/{id}: response schema changed
    • ~ GET /entra_directories: response schema changed
    • ~ GET /entra_directories/{id}: response schema changed
    • ~ GET /google_auth_providers: response schema changed
    • ~ GET /google_auth_providers/{id}: response schema changed
    • ~ GET /google_directories: response schema changed
    • ~ GET /google_directories/{id}: response schema changed
    • ~ GET /groups: response schema changed
    • ~ GET /groups/{group_id}/memberships: response schema changed
    • ~ GET /groups/{id}: response schema changed
    • ~ GET /intune_devices: response schema changed
    • ~ GET /intune_devices/{id}: response schema changed
    • ~ GET /intune_posture_providers: response schema changed
    • ~ GET /intune_posture_providers/{id}: response schema changed
    • ~ GET /iru_devices: response schema changed
    • ~ GET /iru_devices/{id}: response schema changed
    • ~ GET /iru_posture_providers: response schema changed
    • ~ GET /iru_posture_providers/{id}: response schema changed
    • ~ GET /logs: response schema changed
    • ~ GET /logs/{log_id}: response schema changed
    • ~ GET /oidc_auth_providers: response schema changed
    • ~ GET /oidc_auth_providers/{id}: response schema changed
    • ~ GET /okta_auth_providers: response schema changed
    • ~ GET /okta_auth_providers/{id}: response schema changed
    • ~ GET /okta_directories: response schema changed
    • ~ GET /okta_directories/{id}: response schema changed
    • ~ GET /policies: response schema changed
    • ~ GET /policies/{id}: response schema changed
    • ~ GET /resources: response schema changed
    • ~ GET /resources/{id}: response schema changed
    • ~ GET /resources/{resource_id}/pool_members: response schema changed
    • ~ GET /santa_devices: response schema changed
    • ~ GET /santa_devices/{id}: response schema changed
    • ~ GET /santa_posture_providers: response schema changed
    • ~ GET /santa_posture_providers/{id}: response schema changed
    • ~ GET /sentinelone_devices: response schema changed
    • ~ GET /sentinelone_devices/{sentinelone_agent}: response schema changed
    • ~ GET /sentinelone_posture_providers: response schema changed
    • ~ GET /sentinelone_posture_providers/{id}: response schema changed
    • ~ GET /sites: response schema changed
    • ~ GET /sites/{id}: response schema changed
    • ~ GET /sites/{site_id}/gateways: response schema changed
    • ~ GET /sites/{site_id}/gateways/{id}: response schema changed
    • ~ GET /x509_auth_provider: response schema changed
    • ~ PATCH /actors/{id}: response schema changed
    • ~ PATCH /clients/{id}: response schema changed
    • ~ PATCH /groups/{group_id}/memberships: response schema changed
    • ~ PATCH /groups/{id}: response schema changed
    • ~ PATCH /policies/{id}: response schema changed
    • ~ PATCH /resources/{id}: request body changed; response schema changed
    • ~ PATCH /resources/{resource_id}/pool_members: response schema changed
    • ~ PATCH /sites/{id}: response schema changed
    • ~ PATCH /sites/{site_id}/gateways/{id}: response schema changed
    • ~ POST /actors: response schema changed
    • ~ POST /actors/{actor_id}/client_tokens: response schema changed
    • ~ POST /groups: response schema changed
    • ~ POST /policies: response schema changed
    • ~ POST /resources: request body changed; response schema changed
    • ~ POST /sites: response schema changed
    • ~ POST /sites/{site_id}/gateway_tokens: response schema changed
    • ~ POST /sites/{site_id}/gateways: response schema changed
    • ~ POST /sites/{site_id}/gateways/{gateway_id}/token: response schema changed
    • ~ POST /sites/{site_id}/gateways/{gateway_id}/token/rotate: response schema changed
    • ~ PUT /actors/{id}: response schema changed
    • ~ PUT /clients/{id}: response schema changed
    • ~ PUT /clients/{id}/unverify: response schema changed
    • ~ PUT /clients/{id}/verify: response schema changed
    • ~ PUT /groups/{group_id}/memberships: response schema changed
    • ~ PUT /groups/{id}: response schema changed
    • ~ PUT /policies/{id}: response schema changed
    • ~ PUT /resources/{id}: request body changed; response schema changed
    • ~ PUT /resources/{resource_id}/pool_members: response schema changed
    • ~ PUT /sites/{id}: response schema changed
    • ~ PUT /sites/{site_id}/gateways/{id}: response schema changed
    • DELETE /actors/{actor_id}/client_tokens: response schema changed
    • DELETE /actors/{actor_id}/client_tokens/{id}: response schema changed
    • DELETE /actors/{actor_id}/external_identities/{id}: response schema changed
    • DELETE /actors/{id}: response schema changed
    • DELETE /clients/{id}: response schema changed

    +96 more show less

    • DELETE /groups/{id}: response schema changed
    • DELETE /policies/{id}: response schema changed
    • DELETE /resources/{id}: response schema changed
    • DELETE /sites/{site_id}/gateway_tokens: response schema changed
    • DELETE /sites/{site_id}/gateway_tokens/{id}: response schema changed
    • DELETE /sites/{site_id}/gateways/{id}: response schema changed
    • GET /account: response schema changed
    • GET /actors: response schema changed
    • GET /actors/{actor_id}/client_tokens: response schema changed
    • GET /actors/{actor_id}/client_tokens/{id}: response schema changed
    • GET /actors/{actor_id}/external_identities: response schema changed
    • GET /actors/{actor_id}/external_identities/{id}: response schema changed
    • GET /actors/{id}: response schema changed
    • GET /clients: response schema changed
    • GET /clients/{id}: response schema changed
    • GET /defender_devices: response schema changed
    • GET /defender_devices/{id}: response schema changed
    • GET /defender_posture_providers: response schema changed
    • GET /defender_posture_providers/{id}: response schema changed
    • GET /email_otp_auth_providers: response schema changed
    • GET /email_otp_auth_providers/{id}: response schema changed
    • GET /entra_auth_providers: response schema changed
    • GET /entra_auth_providers/{id}: response schema changed
    • GET /entra_directories: response schema changed
    • GET /entra_directories/{id}: response schema changed
    • GET /google_auth_providers: response schema changed
    • GET /google_auth_providers/{id}: response schema changed
    • GET /google_directories: response schema changed
    • GET /google_directories/{id}: response schema changed
    • GET /groups: response schema changed
    • GET /groups/{group_id}/memberships: response schema changed
    • GET /groups/{id}: response schema changed
    • GET /intune_devices: response schema changed
    • GET /intune_devices/{id}: response schema changed
    • GET /intune_posture_providers: response schema changed
    • GET /intune_posture_providers/{id}: response schema changed
    • GET /iru_devices: response schema changed
    • GET /iru_devices/{id}: response schema changed
    • GET /iru_posture_providers: response schema changed
    • GET /iru_posture_providers/{id}: response schema changed
    • GET /logs: response schema changed
    • GET /logs/{log_id}: response schema changed
    • GET /oidc_auth_providers: response schema changed
    • GET /oidc_auth_providers/{id}: response schema changed
    • GET /okta_auth_providers: response schema changed
    • GET /okta_auth_providers/{id}: response schema changed
    • GET /okta_directories: response schema changed
    • GET /okta_directories/{id}: response schema changed
    • GET /policies: response schema changed
    • GET /policies/{id}: response schema changed
    • GET /resources: response schema changed
    • GET /resources/{id}: response schema changed
    • GET /resources/{resource_id}/pool_members: response schema changed
    • GET /santa_devices: response schema changed
    • GET /santa_devices/{id}: response schema changed
    • GET /santa_posture_providers: response schema changed
    • GET /santa_posture_providers/{id}: response schema changed
    • GET /sentinelone_devices: response schema changed
    • GET /sentinelone_devices/{sentinelone_agent}: response schema changed
    • GET /sentinelone_posture_providers: response schema changed
    • GET /sentinelone_posture_providers/{id}: response schema changed
    • GET /sites: response schema changed
    • GET /sites/{id}: response schema changed
    • GET /sites/{site_id}/gateways: response schema changed
    • GET /sites/{site_id}/gateways/{id}: response schema changed
    • GET /x509_auth_provider: response schema changed
    • PATCH /actors/{id}: response schema changed
    • PATCH /clients/{id}: response schema changed
    • PATCH /groups/{group_id}/memberships: response schema changed
    • PATCH /groups/{id}: response schema changed
    • PATCH /policies/{id}: response schema changed
    • PATCH /resources/{id}: request body changed; response schema changed
    • PATCH /resources/{resource_id}/pool_members: response schema changed
    • PATCH /sites/{id}: response schema changed
    • PATCH /sites/{site_id}/gateways/{id}: response schema changed
    • POST /actors: response schema changed
    • POST /actors/{actor_id}/client_tokens: response schema changed
    • POST /groups: response schema changed
    • POST /policies: response schema changed
    • POST /resources: request body changed; response schema changed
    • POST /sites: response schema changed
    • POST /sites/{site_id}/gateway_tokens: response schema changed
    • POST /sites/{site_id}/gateways: response schema changed
    • POST /sites/{site_id}/gateways/{gateway_id}/token: response schema changed
    • POST /sites/{site_id}/gateways/{gateway_id}/token/rotate: response schema changed
    • PUT /actors/{id}: response schema changed
    • PUT /clients/{id}: response schema changed
    • PUT /clients/{id}/unverify: response schema changed
    • PUT /clients/{id}/verify: response schema changed
    • PUT /groups/{group_id}/memberships: response schema changed
    • PUT /groups/{id}: response schema changed
    • PUT /policies/{id}: response schema changed
    • PUT /resources/{id}: request body changed; response schema changed
    • PUT /resources/{resource_id}/pool_members: response schema changed
    • PUT /sites/{id}: response schema changed
    • PUT /sites/{site_id}/gateways/{id}: response schema changed

    101 details in Everything

33. Gateway 1.6.1 (2026-09-07) Sep 7, 2026 · issue 068

    Gateway 1.6.1 auto-creates flow-log storage, reports device serial/UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., and moves Gateway naming to the Admin Portal.

    • Removes the FIREZONE_NAME / -n Gateway option; the Gateway's name is now configured in the Admin Portal instead.
    • Auto-creates the /var/lib/firezone directory to ensure that flow logs can be persisted.
    • Now reports the device serial and UUID.
    • Now reports the device serial and UUID.

    2 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The FIREZONE_NAME environment variable and -n CLI flag have been removed from the Gateway; any deployment scripts or container configs that set FIREZONE_NAME or pass -n will break — the Gateway name must now be configured in the Admin Portal.
34. Linux GUI 1.5.17 (2026-09-07) Sep 7, 2026 · issue 068

    Firezone Linux GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. 1.5.17 adds X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificate-backed device trust and auto-download of updates on Linux.

    • Adds support for device trust backed by X.509 certificates.
    • Improves update notifications on Linux to also trigger the download of the new package immediately upon notification.
    • Adds support for device trust backed by X.509 certificates.

    1 more in Everything

35. Windows GUI 1.5.17 (2026-09-07) Sep 7, 2026 · issue 068

    Firezone: Improves update notifications to appear once per Client launch instead of only once per new version, and on Linux now also triggers download of the new package immediately.

36. Windows Headless 1.5.12 (2026-09-07) Sep 7, 2026 · issue 068

    Firezone Windows Headless 1.5.12 adds device trust backed by X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. certificates.

37. Linux Headless 1.5.12 (2026-09-07) Sep 7, 2026 · release notes

    Firezone 1.5.12 adds X.509X.509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. device trust and improves TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. stability on Linux

    • Adds support for device trust backed by X.509 certificates

    1 detail in Everything

38. PreviousGatewayversions Sep 7, 2026 · release notes

    Firezone v1.6.1+ adds flow log persistence, detailed TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. logging, and new config flags for connectivity tuning.

    • Auto-creates the /var/lib/firezone directory to ensure flow logs can be persisted on Linux Gateways
    • Enables detailed flow logs for tunneled TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. connections via the FIREZONE_FLOW_LOGS environment variable or --flow-logs CLI flag
    • Adds the FIREZONE_MAX_PARTITION_TIME environment variable to configure Gateway retry duration before exiting, accepting human-readable durations like 5m or 1h

    3 details in Everything

39. 1.0.0 Aug 31, 2026 · issue 060

    API surface changed: +13 endpoints

    API change

    API surface changed: +13 endpoints

    • + GET /defender_devices
    • + GET /defender_devices/{id}
    • + GET /defender_posture_providers
    • + GET /defender_posture_providers/{id}
    • + GET /santa_devices
    • + GET /santa_devices/{id}
    • + GET /santa_posture_providers
    • + GET /santa_posture_providers/{id}
    • + GET /sentinelone_devices
    • + GET /sentinelone_devices/{sentinelone_agent}
    • + GET /sentinelone_posture_providers
    • + GET /sentinelone_posture_providers/{id}
    • + GET /x509_auth_provider
    • New endpoint GET /defender_devices
    • New endpoint GET /defender_devices/{id}
    • New endpoint GET /defender_posture_providers
    • New endpoint GET /defender_posture_providers/{id}
    • New endpoint GET /santa_devices

    +8 more show less

    • New endpoint GET /santa_devices/{id}
    • New endpoint GET /santa_posture_providers
    • New endpoint GET /santa_posture_providers/{id}
    • New endpoint GET /sentinelone_devices
    • New endpoint GET /sentinelone_devices/{sentinelone_agent}
    • New endpoint GET /sentinelone_posture_providers
    • New endpoint GET /sentinelone_posture_providers/{id}
    • New endpoint GET /x509_auth_provider

    13 details in Everything

40. 1.0.0 Aug 23, 2026 · issue 054

    API surface changed: +6 endpoints, −1 endpoint, 2 modified

    API change

    API surface changed: +6 endpoints, −1 endpoint, 2 modified

    • + GET /intune_posture_providers
    • + GET /intune_posture_providers/{id}
    • + GET /iru_devices
    • + GET /iru_devices/{id}
    • + GET /iru_posture_providers
    • + GET /iru_posture_providers/{id}
    • ~ GET /intune_devices: response schema changed
    • ~ GET /intune_devices/{id}: response schema changed
    • − GET /intune_integration (breaking)
    • New endpoint GET /intune_posture_providers
    • New endpoint GET /intune_posture_providers/{id}
    • New endpoint GET /iru_devices
    • New endpoint GET /iru_devices/{id}
    • New endpoint GET /iru_posture_providers

    +3 more show less

    • New endpoint GET /iru_posture_providers/{id}
    • GET /intune_devices: response schema changed
    • GET /intune_devices/{id}: response schema changed

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed endpoint GET /intune_integration
41. 1.0.0 Aug 16, 2026 · issue 047

    API surface changed: +9 endpoints, 27 modified

    API change

    API surface changed: +9 endpoints, 27 modified

    • + GET /intune_devices
    • + GET /intune_devices/{id}
    • + GET /intune_integration
    • + GET /resources/{resource_id}/pool_members
    • + PATCH /resources/{resource_id}/pool_members
    • + PATCH /sites/{site_id}/gateways/{id}
    • + POST /sites/{site_id}/gateways
    • + PUT /resources/{resource_id}/pool_members
    • + PUT /sites/{site_id}/gateways/{id}
    • ~ DELETE /policies/{id}: response schema changed
    • ~ DELETE /sites/{site_id}/gateways/{id}: response schema changed
    • ~ GET /actors: param email (query) added; param name (query) added; param type (query) added
    • ~ GET /clients: param firezone_id (query) added; param name (query) added
    • ~ GET /email_otp_auth_providers: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • ~ GET /entra_auth_providers: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • ~ GET /entra_directories: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • ~ GET /google_auth_providers: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • ~ GET /google_directories: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • ~ GET /groups: param directory_id (query) added; param entity_type (query) added; param name (query) added
    • ~ GET /oidc_auth_providers: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • ~ GET /okta_auth_providers: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • ~ GET /okta_directories: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • ~ GET /policies: param group_id (query) added; param resource_id (query) added; response schema changed
    • ~ GET /policies/{id}: response schema changed
    • ~ GET /resources: param address (query) added; param ip_stack (query) added; param name (query) added; param site_id (query) added; param type (query) added
    • ~ GET /sites: param name (query) added
    • ~ GET /sites/{site_id}/gateways: param ipv4 (query) added; param ipv6 (query) added; param name (query) added; response schema changed
    • ~ GET /sites/{site_id}/gateways/{id}: response schema changed
    • ~ PATCH /actors/{id}: request body changed
    • ~ PATCH /policies/{id}: request body changed; response schema changed
    • ~ PATCH /resources/{id}: request body changed
    • ~ POST /policies: response schema changed
    • ~ POST /resources: request body changed
    • ~ PUT /actors/{id}: request body changed
    • ~ PUT /policies/{id}: request body changed; response schema changed
    • ~ PUT /resources/{id}: request body changed
    • New endpoint GET /intune_devices
    • New endpoint GET /intune_devices/{id}
    • New endpoint GET /intune_integration
    • New endpoint GET /resources/{resource_id}/pool_members
    • New endpoint PATCH /resources/{resource_id}/pool_members

    +31 more show less

    • New endpoint PATCH /sites/{site_id}/gateways/{id}
    • New endpoint POST /sites/{site_id}/gateways
    • New endpoint PUT /resources/{resource_id}/pool_members
    • New endpoint PUT /sites/{site_id}/gateways/{id}
    • DELETE /policies/{id}: response schema changed
    • DELETE /sites/{site_id}/gateways/{id}: response schema changed
    • GET /actors: param email (query) added; param name (query) added; param type (query) added
    • GET /clients: param firezone_id (query) added; param name (query) added
    • GET /email_otp_auth_providers: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • GET /entra_auth_providers: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • GET /entra_directories: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • GET /google_auth_providers: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • GET /google_directories: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • GET /groups: param directory_id (query) added; param entity_type (query) added; param name (query) added
    • GET /oidc_auth_providers: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • GET /okta_auth_providers: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • GET /okta_directories: param limit (query) added; param name (query) added; param page_cursor (query) added; response schema changed
    • GET /policies: param group_id (query) added; param resource_id (query) added; response schema changed
    • GET /policies/{id}: response schema changed
    • GET /resources: param address (query) added; param ip_stack (query) added; param name (query) added; param site_id (query) added; param type (query) added
    • GET /sites: param name (query) added
    • GET /sites/{site_id}/gateways: param ipv4 (query) added; param ipv6 (query) added; param name (query) added; response schema changed
    • GET /sites/{site_id}/gateways/{id}: response schema changed
    • PATCH /actors/{id}: request body changed
    • PATCH /policies/{id}: request body changed; response schema changed
    • PATCH /resources/{id}: request body changed
    • POST /policies: response schema changed
    • POST /resources: request body changed
    • PUT /actors/{id}: request body changed
    • PUT /policies/{id}: request body changed; response schema changed
    • PUT /resources/{id}: request body changed

    36 details in Everything

42. changelog Aug 16, 2026 · issue 047

    Firezone 1.5.19 adds firezone-cli for headless macOS management; 1.6.0 doubles Linux tunnel throughput with GRO/GSO.

    • Enables GRO and GSO on the TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. device on Linux kernels 6.2 and later, roughly doubling single-stream TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. throughput through the tunnel (1.6.0, #14011).

    1 detail in Everything

43. macOS / iOS 1.5.19 (2026-08-15) Aug 15, 2026 · issue 046

    Firezone macOS/iOS 1.5.19 adds firezone-cli, a command-line interface for unattended and remotely managed Macs.

44. 1.0 Aug 12, 2026 · issue 043

    Firezone now publishes an API — 75 endpoints across 21 areas: Clients, Actors, Groups, …

    • Clients (7 endpoints) — read, update, delete
    • Actors (6 endpoints) — create, read, update, delete
    • Groups (6 endpoints) — create, read, update, delete
    • Policies (6 endpoints) — create, read, update, delete
    • Resources (6 endpoints) — create, read, update, delete

    +4 more show less

    • Sites (6 endpoints) — create, read, update, delete
    • Client Tokens (5 endpoints) — create, read, delete
    • Gateway Tokens (5 endpoints) — create, delete
    • 13 more areas: Externalidentities, Gateways, Memberships, Email Otp Auth Providers, Entra Auth Providers, Entra Directories, Google Auth Providers, Google Directories, Logs, Oidc Auth Providers, Okta Auth Providers, Okta Directories, Account

    9 details in Everything

45. Gateway 1.6.0 (2026-08-10) Aug 10, 2026 · issue 041

    Gateway 1.6.0 enables GRO/GSO on Linux 6.2+ TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. devices, roughly doubling single-stream TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. throughput through the tunnel.

    • Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.
    • Lowers the system-wide net.core.wmem_max to 2 MB and net.core.rmem_max to 16 MB on the Gateway, reducing UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. send and receive socket buffer sizes.
    • Speeds up recovery after all relays are lost by immediately requesting a fresh relay set from the portal.
    • Improves reconnection speed after a network change.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Gateway now sets net.core.wmem_max to 2 MB (down from a previously higher value) and net.core.rmem_max to 16 MB system-wide, which reduces UDP socket buffer sizes and may affect other processes sharing those kernel parameters on the same host.
46. Linux GUI 1.5.16 (2026-08-10) Aug 10, 2026 · issue 041

    Linux GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. 1.5.16 enables GRO/GSO on the TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. device for Linux 6.2+, roughly doubling single-stream TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. tunnel throughput.

    • Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.
    • Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

    2 details in Everything

47. Linux Headless 1.5.11 (2026-08-10) Aug 10, 2026 · issue 041

    Firezone Linux Headless 1.5.11 enables GRO/GSO on TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. devices for Linux 6.2+, roughly doubling single-stream TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. tunnel throughput.

    • Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.
    • Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.
    • Improves reconnection speed after a network change.

    3 details in Everything

48. docs update Jul 24, 2026 · issue 024

    Firezone introduces single-owner Gateway tokens with rotation, revocation, and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. management.

    └──▷ TRY IT
    Mint a new single-owner token for a specific Gateway via the REST API — useful when automating Gateway deployments with Terraform or CI pipelines.
    copy

    $ curl -X POST https://app.firezone.dev/sites/{site_id}/gateways/{gateway_id}/token \
      -H 'Authorization: Bearer <api_token>' \
      -H 'Content-Type: application/json'

    Rotate a Gateway's token without downtime — the current token stays valid for up to 4 hours while you update FIREZONE_TOKEN and restart the Gateway.
    copy

    $ curl -X POST https://app.firezone.dev/sites/{site_id}/gateways/{gateway_id}/token/rotate \
      -H 'Authorization: Bearer <api_token>'

    Upgrade a Gateway from a legacy multi-owner token to a single-owner token through the admin portal.
    📍In the admin portal, go to Sites → <your Site>, expand the Gateway in the Gateways tab, click Upgrade token and confirm. Update the Gateway's FIREZONE_TOKEN environment variable with the new token and restart it. Repeat for each Gateway, then revoke the legacy token under the Legacy tokens tab.
    • Adds single-owner Gateway tokens: each token is bound to exactly one Gateway, replacing the legacy multi-owner token shared across all Gateways in a Site.
    • Supports token rotation via the admin portal or REST API with a 4-hour grace period, keeping the current Gateway connected until it picks up the replacement.
    • Adds an upgrade path from legacy multi-owner tokens to single-owner tokens on a per-Gateway basis, with legacy tokens remaining active until explicitly revoked.
    • Adds REST API endpoints to create (POST /sites/{site_id}/gateways/{gateway_id}/token), rotate (POST /sites/{site_id}/gateways/{gateway_id}/token/rotate), and delete (DELETE /sites/{site_id}/gateway_tokens/{id}) Gateway tokens programmatically.

    4 details in Everything

49. docs update Jul 24, 2026 · docs issue 004

    Firezone introduces single-owner Gateway tokens with rotation, revocation, and REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. management.

    └──▷ TRY IT
    Mint a new single-owner token for a specific Gateway via the REST API — useful when automating Gateway deployments with Terraform or CI pipelines.
    copy

    $ curl -X POST https://app.firezone.dev/sites/{site_id}/gateways/{gateway_id}/token \
      -H 'Authorization: Bearer <api_token>' \
      -H 'Content-Type: application/json'

    Rotate a Gateway's token without downtime — the current token stays valid for up to 4 hours while you update FIREZONE_TOKEN and restart the Gateway.
    copy

    $ curl -X POST https://app.firezone.dev/sites/{site_id}/gateways/{gateway_id}/token/rotate \
      -H 'Authorization: Bearer <api_token>'

    Upgrade a Gateway from a legacy multi-owner token to a single-owner token through the admin portal.
    📍In the admin portal, go to Sites → <your Site>, expand the Gateway in the Gateways tab, click Upgrade token and confirm. Update the Gateway's FIREZONE_TOKEN environment variable with the new token and restart it. Repeat for each Gateway, then revoke the legacy token under the Legacy tokens tab.
    • Adds single-owner Gateway tokens: each token is bound to exactly one Gateway, replacing the legacy multi-owner token shared across all Gateways in a Site.
    • Supports token rotation via the admin portal or REST API with a 4-hour grace period, keeping the current Gateway connected until it picks up the replacement.
    • Adds an upgrade path from legacy multi-owner tokens to single-owner tokens on a per-Gateway basis, with legacy tokens remaining active until explicitly revoked.
    • Adds REST API endpoints to create (POST /sites/{site_id}/gateways/{gateway_id}/token), rotate (POST /sites/{site_id}/gateways/{gateway_id}/token/rotate), and delete (DELETE /sites/{site_id}/gateway_tokens/{id}) Gateway tokens programmatically.

    4 details in Everything

50. macOS / iOS 1.5.18 (2026-06-24) Jun 24, 2026 · issue 014

    Firezone macOS/iOS 1.5.18 brings major UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. and TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. throughput upgrades, cutting CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage and packet loss on high-traffic connections.

    • Adds client-side evaluation of resource traffic filters, dropping disallowed packets locally to prevent repeated flow-creation request loops.
    • Batches TUN device reads and writes into a single syscall per batch on macOS and iOS, improving throughput and reducing CPU on high-traffic connections.
    • Introduces a per-destination UDP socket pool on macOS and iOS that unlocks Darwin's UDP fast path, enabling send batching and kernel congestion (flow advisory) signals.
    • Increases the macOS and iOS TUN read buffer size so the kernel can queue more outbound packets between reads, improving upload throughput.
    • Retries writes to the TUN device when its queue is momentarily full instead of dropping packets, reducing packet loss under bursty load on macOS and iOS.

    5 details in Everything