As API ecosystems grow more complex, maintaining visibility and security shouldn't be a hurdle. Kong Gateway 3.13 simplifies these challenges with expanded OpenTelemetry support and more flexible orchestration. These new capabilities not only make your APIs more observable but also make it easier to implement orchestration.

The following are some of the highlights of Kong API Gateway 3.13:

• - Detailed Metrics and API Transaction Logs are now natively supported by the OpenTelemetry plugin
• - Full support for cloud-native authentication
• - Easier orchestration via DataKit plugin, including new node types in DataKit editor and XML/JSON translation

Not only that, we’re excited to share that Kong Konnect and Kong Cloud Gateways have received PCI DSS 4.0 attestation! This will give confidence to those of you building PCI-aligned architectures.

Metrics, Logs, and Traces are fundamental signals in observability, each providing a different perspective on your system’s health. They are most effective when used together to reduce Mean Time to Resolution (MTTR), ensuring that systems are not just "monitored" but truly "observable" (i.e., understanding why they behave the way they do).

With Gateway 3.13, the Kong OpenTelemetry plugin now natively supports detailed metrics and API transaction logs, in addition to traces and runtime/error logs. This consolidates what previously required three separate plugins, a logging plugin, the Prometheus plugin, and the OpenTelemetry plugin, into a single, unified plugin configuration. By reducing plugin sprawl, you can simplify your observability setup and reduce maintenance overhead.

Metrics that you can choose to expose include those related to latency, bandwidth, and more. API transaction logs include trace-related fields to help narrow down the scope of an investigation.

With the Kong OpenTelemetry plugin now natively supporting the metrics, logs, and traces, getting the insights you need to ensure system reliability and quick troubleshooting is now easier than ever!

As the leading cloud-agnostic unified API platform, we are committed to ensuring that customers can easily and securely deploy all components of Kong Gateway in any cloud environment. This includes leveraging Identity Access Management (IAM) solutions of the customer’s choice, including those provided natively by the cloud providers.

With Gateway 3.13, we now fully support leveraging Amazon IAM, Azure IAM, and Google Cloud IAM across all components of the Kong Gateway. Specifically, in Gateway 3.13, we’ve completed the IAM support matrix for Redis and Postgres. Additionally, we now also support JSON Web Token (JWT) authentication when a customer uses a self-managed HashiCorp Vault secrets manager.

Kong Konnect and Kong Cloud Gateways have achieved PCI DSS 4.0 attestation. This is a significant step forward for customers operating in highly regulated industries — especially financial services, payments, and any organization handling cardholder data. PCI DSS 4.0 introduces more rigorous requirements around security controls, monitoring, and risk management, and this attestation demonstrates that Kong’s managed cloud platform meets those standards.

For teams building payment flows, banking APIs, or compliance-sensitive services, this means Kong Cloud Gateways can be confidently used as part of a PCI-aligned architecture.

Just as a recap, earlier this year, we announced the availability of Datakit, which is a Kong Gateway plugin that lets you define workflows without custom code. You can connect multiple APIs, transform their responses, and build dynamic data pipelines all within the gateway layer. To define these workflows, you can either create and edit configuration files or use the Datakit Flow editor, which provides a visual interface. 

*Additional node types in Datakit Flow editor*

In Gateway 3.12, we introduced 3 new node types (which are the building blocks of workflows). Leveraging these nodes required direct edits to the configuration file.

• - **branch**: conditionally execute different nodes based on input conditions (i.e., if -then-else)
• - **cache**: store and fetch cached data
• - **vault**: vault reference to hold secret values

With Gateway 3.13, these nodes are now available as a building block in the Datakit Flow editor, enabling teams to build more sophisticated workflows faster.

*Additional nodes for XML ←→ JSON translation*

A common requirement for any API workflow that involves a hybrid of modern and legacy applications (e.g., mobile app interacting with banking core systems) is JSON to XML translation. To facilitate achieving this within a workflow defined in Datakit, we have introduced two new nodes:

• - **xml_to_json**: translate from xml to json format
• - **json_to_xml**: translate from json to xml format

In Gateway 3.13, these nodes can be added to a workflow by editing a configuration file. We expect to add this node type to the Datakit Flow editor soon; watch this space!

If you are on the Kong Konnect SaaS platform, these enhancements (and more!) are already available for you to use today! Otherwise, Kong Gateway 3.13 is available for you to [download](https://developer.konghq.com/gateway/install/)download and install in your own environment.

Want to learn more? Check out the [release notes. ](https://developer.konghq.com/gateway/changelog)release notes. Also, check out [this blog](https://konghq.com/blog/product-releases/kong-cloud-gateways-2025-news-recap)this blog for an annual recap of the advancements in the Kong Cloud Gateway.