SD-WAN Manager 26.1 API changes

Scope

This page compares the OpenAPI specifications for:

• SD-WAN Manager 20.18 — specifications dated 2025-08-15
• SD-WAN Manager 26.1 — specifications dated 2026-01-06

The comparison covers operation paths and methods, deprecated markers, and resolved JSON request schemas. Descriptions and examples were excluded from schema-change detection so that editorial changes do not appear as API changes. The results were then cross-checked against Cisco’s official API changelog, which contains one page for each API category.

The locally available 26.1 specifications are dated earlier than the currently published Cisco changelog. Where the official changelog contains operations that are absent from the local specifications, this page records the official result and calls out the difference.

How to interpret removals

An operation missing from the 26.1 OpenAPI is absent from the published contract. That does not by itself prove that the runtime endpoint has been removed. Test critical migrations against a 26.1 Manager before changing production automation.

Summary

Change	Result
New or replacement operation signatures	54
Operations newly marked deprecated	76
Operations absent without a direct replacement	16
Existing lab workflows with a breaking path change	0

The largest shift is in monitoring: 26.1 adds Packet Path Lifecycle (PPL), security advisory, DNS defense, cellular, and wireless operations while marking several older statistics families as deprecated. The UX 2.0 profile and group workflows used by this lab retain their operation sets.

Fifteen raw add/remove pairs are parameter-name corrections rather than URL changes. Fourteen nested Service and Transport POST operations rename the WAN or LAN VPN parameter from {vpnId} to {vpnParcelId}. The software-package upload operation similarly renames {fileName} to {imageType}.

Cisco compatibility classification

Cisco classifies every one of the 13 API categories as containing changes that break backward compatibility. This is broader than the lab-specific assessment above: the current lab does not exercise the removed operations or payload constraints that would cause those breaks.

Updates

UX 2.0 feature profiles and groups

Area	26.1 update
System Basic	Adds a ppl configuration block for flow splitting, reordering, CTG selection, local colors, and latency offset.
System Global	Adds globalOtherSettingsIntfPerMin.
System OMP	Increases the variable gracefulRestartTimer maximum from 604800 to 31556952 and documents an ecmpLimit variable maximum of 16.
Service DHCP server	Adds optional dhcpHaEnable, defaulting to false.
Service LAN VPN	Makes the valid global VPN ranges explicit as 1–511 and 513–65527; the 20.18 default-value branch is no longer present.
Service and Transport Ethernet	Adds 40-Gbps and 100-Gbps speed values and fills gaps in the IPv4 subnet-mask enumeration.
Transport Ethernet	Tightens tunnel.bandwidthPercent from a maximum of 100 to 99.
CLI profile	No path or request-schema change detected.
Configuration and Policy preview	Keeps the same paths, but the 26.1 spec no longer defines the JSON request-body schema for per-device preview.
Configuration, Policy, and Topology groups	No operation was added, removed, or deprecated.

The Feature Profiles: Others specification also adds two read-only referenced-by operations for policy-object lists and unified security profile parcels.

Monitoring and platform APIs

The 26.1 specifications add the following operation families:

• PPL CTG and packet-reordering statistics, including query, aggregation, pagination, field, CSV, and document-count operations.
• Insecure-configuration summary through GET /advisories/insecure-config/summary.
• A shorter statistics-download operation at GET /statistics/download/{processType}/file/{token}/{fileName}.
• Insecure-configuration advisories and per-device insecure-configuration data.
• Cellular URSP routes and rules, wireless status, and device feature-support data.
• DNS Defense registration and information operations.
• Identity-provider certificate lifecycle and web-certificate CSR/async operations.
• Tenant capacity, tenant deletion, and plural vSmart assignment.
• PPL dashboard/detail operations and SD-AVC SaaS tenant publishing.

The first two operations above appear in Cisco’s current official Monitoring and Troubleshooting changelog but not in the locally available 26.1 specification.

Partner Integrations

Cisco’s official Partner Integrations changelog adds two Cloud OnRamp for SaaS application-settings status operations:

• GET /v1/cloudonramp/saas/appSettingsStatus
• PUT /v1/cloudonramp/saas/appSettingsStatus

The local 26.1 specification bundle does not include a Partner Integrations specification, so these additions cannot be derived from the local files alone.

Deprecations

The 26.1 OpenAPI newly marks 76 operations as deprecated:

Specification	Count	Deprecated area
Monitoring and Troubleshooting	48	Regional access/refresh/token operations and the BFD, cflowd, device, and system-stats statistics families.
Others	18	Smart licensing, SD-AVC cloud connector, MSLA, legacy web-certificate, tenant vSmart, cluster readiness, HSEC, and selected device action operations.
SD-WAN Services	6	DCA settings, attached configuration, application-route policy, VPN list, edge policy, and vSmart policy operations.
Administration and Settings	2	DCA analytics configuration and user locking.
UX 1.0 Configuration	2	Webex policy-list create and update operations.

The deprecated monitoring families are:

• GET and POST /statistics/bfd plus their aggregation, page, document-count, field, query-field, and CSV variants where defined.
• GET and POST /statistics/cflowd plus the same supporting variants.
• GET and POST /statistics/device plus the same supporting variants.
• GET and POST /statistics/system/stats plus the same supporting variants.
• The regional /accesstoken, /refreshtoken, /token, and /device_authorization operations.

Deprecation is not removal

These operations remain present in the 26.1 specification. Avoid introducing new dependencies on them and plan migrations, but do not treat them as unavailable.

Removals and replacements

20.18 operation	26.1 status
GET /statistics/cflowd/applications	Absent; no direct replacement is declared in the spec.
GET /statistics/cflowd/applications/summary	Absent; no direct replacement is declared in the spec.
GET /statistics/cflowd/device/applications	Absent; no direct replacement is declared in the spec.
POST /device/tier/{tierName}	Replaced by POST /device/tier; callers must review the 26.1 request contract.
POST /device/action/software/package/{fileName}	Parameter label changed to {imageType}; the concrete URL shape is unchanged.

Cisco’s official Partner Integrations changelog also deletes 13 ISE diagnostic and test operations without declaring direct replacements:

• GET /ise/GetAllConnectionInfo
• GET /ise/GetIseProxyDebugInfo
• POST /ise/GetTenantConnectionInfo
• GET /ise/TestBulkDownload
• GET /ise/TestIseWebsocketConnection
• POST /ise/TestLargeData
• POST /ise/TestLargeDataOnvAnalytics
• GET /ise/TestNamespaceSwitching
• GET /ise/TestSgtIP
• GET /ise/TestUserGroup
• GET /ise/TestUserIp
• POST /ise/TestVAnalyticsControlMsg
• GET /ise/websocketstatus

These removals are not visible in the local comparison because the local 26.1 bundle has no Partner Integrations specification. The official Cisco changelog is therefore the source for this category.

Lab guide impact

Lab area	Impact	Assessment
Authentication, status, and devices	None	/client/token, /client/about, and /device remain present and are not marked deprecated.
System feature profile	Low	The operation set is unchanged. New PPL/Global fields are optional, and the Bruno AAA, Basic, BFD, Global, Logging, and OMP payload values remain within 26.1 constraints.
Transport feature profile	Low	No concrete URL changes. The guide already uses <vpnParcelId>. New speed/mask values are additive; the lab does not set bandwidthPercent.
CLI feature profile	None	No path or request-schema change was detected.
Service feature profile	Low	No concrete URL changes. dhcpHaEnable is optional, and the lab uses a global VPN ID, so removal of the default VPN-ID branch does not affect it.
Service VRF sub-interfaces	None	No new encapsulation field was added to the Ethernet parcel schema; the guide’s 20.18 modeling remains accurate for 26.1.
Configuration group create/deploy	Low	Paths are stable. The preview request schema is no longer described, but the guide’s empty {} body does not depend on the removed schema fields.
Policy and topology groups	Low/None	Policy preview has the same documentation-only schema gap as configuration preview. Topology operations are unchanged.
Monitoring guides	None now	The lab uses /statistics/system/, /statistics/interface/aggregation, /statistics/approute, and /data/device/statistics/..., not the newly deprecated or removed paths. The v2 spec still exposes only interfacestatistics.
Partner Integrations	None	The lab does not use the removed ISE diagnostic/test operations or the new Cloud OnRamp for SaaS status operations.
Bruno collection	None	No current request URL or payload requires a 26.1 compatibility edit based on the static spec comparison.

The existing guides can therefore remain targeted at 20.18 while also being used as a 26.1 migration baseline. Runtime smoke testing is still required before claiming full 26.1 validation.

Recommended follow-up

1. Run the Bruno create, associate, preview, deploy, and clean workflows against a 26.1 Manager and record the tested build number.
2. Add focused lab coverage for System PPL and Service DHCP HA if those 26.1 capabilities are in scope.
3. Avoid new examples based on the deprecated generic BFD, cflowd, device, or system-stats families.
4. Review any automation outside this repository that calls the three removed cflowd application endpoints, POST /device/tier/{tierName}, or the 13 removed ISE diagnostic/test operations.
5. Obtain the matching 26.1 Partner Integrations specification and a refreshed Monitoring and Troubleshooting specification so the local bundle includes the changes currently documented by Cisco.