Stronger Security for Regulated Integrations

OutSystems O11 Cloud now supports mutual TLS (mTLS) passthrough for REST API endpoints, letting applications authenticate calling clients by certificate instead of relying on credentials alone. The feature is available on request and is aimed at regulated industries, B2B integrations and zero-trust architectures.

‍

What changed

Announced on July 31, 2026, this update lets O11 REST APIs verify the identity of every incoming connection using client certificates, not just encryption or shared credentials. In practice:

• Every client calling the API must present a valid certificate to be authenticated, on top of standard encryption.
• The feature is built for compliance-driven environments, partner integrations and zero-trust setups where "encrypted" is not treated as equivalent to "trusted".
• It's available on request for O11 Cloud environments, and documented for teams that need to configure TLS client certificate authentication for REST API callers.

‍

Moxie's perspective

Most API security conversations stop at "is it encrypted?". For banks, insurers and public sector clients, that question was settled years ago. What they actually ask is: "Can you prove, cryptographically, who's calling this endpoint before you process anything?" mTLS answers that question at the transport layer, before the request even reaches application logic.

We see this most often in B2B integration projects, where a client's partner ecosystem (other banks, payment processors, government systems) requires certificate-based mutual authentication as a non-negotiable security baseline. Having it natively supported in O11, instead of engineered around with custom middleware, removes a recurring point of friction in exactly those projects.

‍

Frequently asked questions

What is mTLS, and how is it different from standard TLS? Standard TLS encrypts traffic and lets the client verify the server's identity. Mutual TLS (mTLS) adds the reverse: the server also verifies the client's identity via a certificate, so both sides authenticate each other.

Who needs mTLS support in O11? Organizations in regulated industries, or with partner and B2B integrations, that require certificate-based authentication as part of their zero-trust or compliance requirements.

Is mTLS support available by default? No. It's available on request for O11 Cloud environments.

‍

Planning a regulated integration on OutSystems? Talk to our team.

‍

Sources - OutSystems Product Updates, "mTLS support for API endpoints in O11," July 31, 2026

‍