Retool is deprecating the dedicated BigID resource type.

Retool will remove the resource type in Q1 2027, after two quarterly Stable releases. After removal, BigID resources will stop working. Queries in apps and workflows that still point at those resources will fail. Cloud and self-hosted organizations will not have a BigID connection option after removal.

Organizations can keep querying BigID after removal by creating an OpenAPI or REST API resource. Retool will not migrate BigID resources or their query references automatically.

1. Create an OpenAPI resource with specification URL https://sandbox.apps.mybigid.com/BigAPI.yaml or the BigAPI.yaml URL for your BigID instance, and environment server variable set to your BigID hostname. For REST API, set the base URL to https://HOSTNAME/api/v1.
2. Set Authentication to Custom Auth. Add an API Request step that sends POST /api/v1/refresh-access-token with your BigID user token in the Authorization header. Add a Define a variable step named SYSTEM_TOKEN with value {{ http1.body.systemToken }}. Add an Authorization header on the resource that uses {{ SYSTEM_TOKEN }}. Enable Run this custom auth workflow without prompting the user. Configure a refresh auth workflow that repeats the exchange after a non-200 response. Generate the user token in the BigID UI and exchange it as described in BigID's token authentication.
3. Open each app, workflow, and Query Library query that uses the BigID resource. Change the query to use the new resource, then test it. For OpenAPI, select the same operation. For REST API, recreate the request as method and path, such as GET /ds-connections. If the OpenAPI query editor shows an Authorization parameter, leave it empty.

Custom authentication is not supported in public apps. If you have a large number of BigID queries and need help finding them, contact Retool Support.

Enterprise organizations can use access policies to define which data each group of users can read or write on a resource. Retool enforces access policies on every query that runs against the resource. A policy can grant access to whole tables, specific columns, or specific rows.

For example, you can use an access policy to restrict an EMEA group's access on a table to only the customer rows for their own region. Retool applies that restriction to every query the group runs against the resource, so it holds regardless of which app, query, or agent the request comes from.

One policy covers queries from apps, the query library, raw SQL, and agents. Workflow queries against an enforced resource are blocked, so account for any workflows using the resource before you turn enforcement on. Retool supports access policies on PostgreSQL resources.

Access policies are enabled by default on cloud instances. On self-hosted instances, navigate to Settings > Beta and toggle on the feature flag for Enforce data security using access policies. To create a policy:

1. Open a PostgreSQL resource and select the Access Enforcement tab.
2. Turn on Data access enforcement.
3. Create a policy, choose the groups and environments it covers, and define its rules.
4. Activate the policy, then click Save changes.

Turning on data access enforcement closes the resource by default in every resource environment. Access policies apply only to the resource environments you select, so grant broad access first and narrow it once your policies are in place. Refer to Configure access policies for more details.

Access policies operate by granting access, not denying access. Refer to Access policies and Data access enforcement for more information.

Admins on the Enterprise plan can now complete each step in the Get started section of the Overview page using guided step-by-step wizards instead of navigating through separate Settings pages to complete configuration.

You can now directly configure from the Overview page:

• SSO
• Resources
• Source control
• Spaces
• Permissions

The Get started section is aimed at providing a better onboarding experience for admins of new organizations, and will help identify what configurations still need to be set up for admins or existing organizations. For example, setting up spaces walks you through choosing custom spaces or a Dev/Staging/Prod environment split, naming and configuring each space, and optionally copying over your existing SSO settings, before creating every space at once.

The Overview page also includes an Action center that contains important notifications and pending join requests, suggested users, and seat upgrade requests, so admins can act on what needs attention, as well an at-a-glance overview of your organization stats, such as total users, apps, workflows, and AI credit usage.

Retool is deprecating versions 1.0 and 2.0 of the Microsoft SQL integration. Organizations with Microsoft SQL resources still using these versions must update their resource configuration to use version 3.0.

This deprecation will first take effect on cloud instances on August 24, 2026. It will then take effect in the next edge and stable releases that follow.

Version 3.0 has been available since February 2, 2026 for cloud instances and the 3.334 stable release. If you haven't intentionally created a resource on an older integration version, your resource is likely already on version 3.0 and requires no changes.

To upgrade an existing resource, open its settings from the Resources page, change Connector version to Version 3.0, and save your changes.

Versions 1.0 and 2.0 will be removed entirely from cloud instances in Q4 2026, followed by the subsequent edge and stable releases. After that, apps, workflows, and queries that depend on Microsoft SQL resources still using version 1.0 or 2.0 will stop working.

The Settings navigation is reorganized into clearer, task-based groups so you can find what you need more quickly.

Settings are now grouped under the following sections: Management, Monitoring, Permissions, Authentication, Features, and Customization. For example, Users, Groups, Roles, and User attributes are grouped under Permissions, while Single sign-on (SSO) and IAM credentials are grouped under Authentication.

Admins can now use the Overview page in Settings to set up their Retool organization and respond to pending user requests.

The Get started section guides you through configuring the core areas of your organization, including single sign-on (SSO), resources, permissions, spaces, source control, and the Retool API.

Retool marks each step as complete once you configure it, and you can mark any step that does not apply as not relevant. The module is hidden once you complete the Get started steps.

The Overview also surfaces pending join requests and suggested users, so you can approve new members without leaving the page.

You can now select the Python version used by a workflow from the Languages & Libraries tab. Click ... next to Python, select Update version, and choose between Python 3.10 and 3.14.

Python 3.14 does not include built-in libraries. When you upgrade, Retool automatically identifies any built-in libraries your workflow uses and installs them as custom libraries.

You can now unpublish workflow releases from the Releases tab.

This feature is also available for workflows protected with Source Control. When unpublishing a release on a protected workflow, the latest saved version on the main branch will be live to users.

The Agent-to-agent (A2A) protocol provides standardized and secure communication between external agents and agents built with Retool, so you can trigger your agent from an external agent, or embed agents in your own systems.

Retool has implemented the core set of A2A functionality, so you can:

• View an agent card.
• Send a message.
• Poll for updates on tasks.
• Stream processing or task updates via Server-Sent Events (SSE).
• Cancel tasks.

To allow external agents to communicate with Retool agents, you can enable the A2A trigger on your agent's configuration page, and copy the endpoint and API key into your A2A client. The A2A client then sends messages via common messaging formats like the HTTP+REST and JSON-RPC APIs, and Server-Sent Events (SSE) for long-running streaming updates.

Explore the following pages for more information:

• Set up an A2A trigger to learn how to enable the A2A trigger.
• A2A endpoints to learn how to cURL for endpoint responses.
• A2A tutorial to learn how to trigger your agent from an external agent.

You can now unpublish workflow releases from the Releases tab.

This feature is also available for workflows protected with Source Control. When unpublishing a release on a protected workflow, the latest saved version on the main branch will be live to users.