Release notes

Riversoft® STCP DirectLink API is part of Riversoft STCP DirectLink and follows the same versions. The notes below apply to both.

9.0.1 — November 2026

Instance operational configuration, JWT, SSO and external lock loaded from the configuration database and managed in the Riversoft Console Portal.
Riversoft STCP DirectLink Portal session kept in the secure __Host-dirl_session cookie (HttpOnly, Secure, SameSite=Strict).
Token exchange with validation of the source JWT by the provider given in the provider field or in the X-STCPDIRECTLINK-JWT-ISSUER header.
Long-lived impersonation token for technical integrations, generated in the supervision interface.
Optional Cloudflare Turnstile verification at sign-in, first access and password recovery.

Equivalent /auth/token and /oauth2/token endpoints, issuing tokens by password grant or token exchange, according to the enabled modes.
Identity validation: the user identified by the credentials or claims must exist and match the profile loaded from the configuration.
Host validation: the API rejects with 403 calls made through a host other than the one configured for the service.

The API moves to version v2, with the /directlink/v2 prefix. Version v1 is no longer served: clients must move to v2. See API migration from v1 to v2.
Downloading listed files (/download/file and /download/file/backup) requires the Bearer token or the session cookie of the same user who made the listing. The shared link (/download) does not change.
/auth/change accepts only POST, with the new password in the form body.
The time field of API responses now uses the ISO 8601 (RFC 3339) format, for example 2026-11-07T14:03:21-03:00. Integrations that read this field in the previous format must be adjusted.
Protected routes (upload, listings, report and logout) require a Bearer token and no longer accept Basic. Basic is still accepted only on /auth/login.
The oauthTokenMethodJWT, oauthTokenExpireSeconds, lockProvider.lockType and ssoProviders[] parameters leave config.json and move to the instance configuration in the database.

With download disabled in the service, the listed-file download routes respond 403 and end the request.

Warning

Upgrading from version 8 to version 9 requires migrating the configuration and adapting integrations. See Migration from version 8 to version 9 and Impact on integrations.

Webhook connector, in server and client modes, with the webhook control settings.
Optional MDN encryption when sending and receiving AS2, configurable per user.
Token for user authentication by Bearer in the API, Webhook and AS2 services.
TLS connection to the MySQL database.
$DIRINSTANCE variable.
Several users in the same schedule.
Single distribution for Enterprise Linux 8, 9 and 10.

tls-cipher parameter and : separator between algorithms, compatible with the libmysqlclient library, in connections to the configuration, authentication and administration databases.

User authenticated in the SFTP Server when providing an empty password.
DSN handling in connections to the configuration, administration, authentication and log databases.
Handling of MDNs with errors in AS2.
Empty Content-Type in AS2 when the file extension is not defined in mime.types.
MIC comparison error when the algorithm is given with the old sha256 name instead of sha-256.
Error handling the error MDN sent by Amazon AS2.
Verification error of the application/pkcs7-signature signature when it uses binary Content-Transfer-Encoding.
pkcs7-signature validation error with Amazon AS2, caused by incorrect canonicalization of the message content.
Lock files not removed when the application is interrupted.
Lock file name compatible with Riversoft STCP Gemini.
SFTP client-mode reception or transmission not stopped when the connection is canceled.
Invalid protocol message written to the system log.

FTP/FTPS communication module, integrated into Riversoft STCP DirectLink.
OpenTelemetry integration, with traces, metrics and logs configured at application startup.
2FA authentication in the SFTP protocol.
MFA handling in the SFTP Server service.

Console message timestamps without the time zone.
Identification of the first access of new users.
FTP client that removed the file from the remote server even with the delete option disabled.
Failure sending files through the SFTP Client to AWS Transfer.
Application not shutting down correctly with CTRL-C or the exit command in console mode.
Memory error when running CTRL-C.

Authentication now blocks access when the domain is not configured in LDAP, avoiding an improper fallback to database authentication.
Sign-in failure with LDAP authentication.

Option to write debug events to a file, instead of the console or the Event Viewer.
Option to enable or disable the bucket existence check in S3 communication.
Option to remove the file from the input folder on API reception (upload) when the destination user is given in implicit routing.

AS2 Server and AS2 Client modules integrated into the application core, with full support for receiving files in the different encryption, signature and MDN scenarios.
Asynchronous MDN support, including sending, receiving and error handling.
User configuration parameters for the AS2 protocol, read when messages are received.
Handling of BER-encoded messages.
MIC handling in AS2 messages received encrypted and compressed.
Control of the algorithms accepted for signature, encryption and MIC calculation in AS2.
TLS certificate validation (client and server) in AS2 connections.
Parameters to define the options required when receiving documents (signature, encryption and compression).
Custom headers per connection and per file type in AS2.
Local address and proxy handling in outgoing connections.
Notification events for session start and end, document reception start and end, and log events.
Logging of HTTP/HTTPS requests with the response status.
Timeout handling in client and server connections.

AS2 Server error log messages.
Signature parameter changed from SIGN to SIGN_MULTIPART in the sending and document requirement settings.