diff --git a/client.yml b/client.yml
index d2453e18..c5a65e35 100644
--- a/client.yml
+++ b/client.yml
@@ -15,7 +15,7 @@ info:
   license:
     name: Apache 2.0
     url: https://www.apache.org/licenses/LICENSE-2.0.html
-  version: 0.26.26
+  version: 0.26.27
 host: demo.ziti.dev
 basePath: /edge/client/v1
 paths:
@@ -3804,6 +3804,7 @@ definitions:
       - isMfaRequired
       - isMfaComplete
       - authenticatorId
+      - isCertExtendable
       properties:
         authQueries:
           $ref: '#/definitions/authQueryList'
@@ -3822,6 +3823,8 @@ definitions:
           type: string
         ipAddress:
           type: string
+        isCertExtendable:
+          type: boolean
         isMfaComplete:
           type: boolean
         isMfaRequired:
@@ -3908,6 +3911,8 @@ definitions:
           $ref: '#/definitions/entityRef'
         identityId:
           type: string
+        isIssuedByNetwork:
+          type: boolean
         method:
           type: string
         username:
diff --git a/go.mod b/go.mod
index 077bdc7c..5de05240 100644
--- a/go.mod
+++ b/go.mod
@@ -34,9 +34,9 @@ require (
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/opentracing/opentracing-go v1.2.0 // indirect
 	go.mongodb.org/mongo-driver v1.16.1 // indirect
-	go.opentelemetry.io/otel v1.28.0 // indirect
-	go.opentelemetry.io/otel/metric v1.28.0 // indirect
-	go.opentelemetry.io/otel/trace v1.28.0 // indirect
+	go.opentelemetry.io/otel v1.29.0 // indirect
+	go.opentelemetry.io/otel/metric v1.29.0 // indirect
+	go.opentelemetry.io/otel/trace v1.29.0 // indirect
 	golang.org/x/sync v0.8.0 // indirect
 	golang.org/x/sys v0.24.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index b09409d5..9c62c7cc 100644
--- a/go.sum
+++ b/go.sum
@@ -67,14 +67,14 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 go.mongodb.org/mongo-driver v1.16.1 h1:rIVLL3q0IHM39dvE+z2ulZLp9ENZKThVfuvN/IiN4l8=
 go.mongodb.org/mongo-driver v1.16.1/go.mod h1:oB6AhJQvFQL4LEHyXi6aJzQJtBiTQHiAd83l0GdFaiw=
-go.opentelemetry.io/otel v1.28.0 h1:/SqNcYk+idO0CxKEUOtKQClMK/MimZihKYMruSMViUo=
-go.opentelemetry.io/otel v1.28.0/go.mod h1:q68ijF8Fc8CnMHKyzqL6akLO46ePnjkgfIMIjUIX9z4=
-go.opentelemetry.io/otel/metric v1.28.0 h1:f0HGvSl1KRAU1DLgLGFjrwVyismPlnuU6JD6bOeuA5Q=
-go.opentelemetry.io/otel/metric v1.28.0/go.mod h1:Fb1eVBFZmLVTMb6PPohq3TO9IIhUisDsbJoL/+uQW4s=
+go.opentelemetry.io/otel v1.29.0 h1:PdomN/Al4q/lN6iBJEN3AwPvUiHPMlt93c8bqTG5Llw=
+go.opentelemetry.io/otel v1.29.0/go.mod h1:N/WtXPs1CNCUEx+Agz5uouwCba+i+bJGFicT8SR4NP8=
+go.opentelemetry.io/otel/metric v1.29.0 h1:vPf/HFWTNkPu1aYeIsc98l4ktOQaL6LeSoeV2g+8YLc=
+go.opentelemetry.io/otel/metric v1.29.0/go.mod h1:auu/QWieFVWx+DmQOUMgj0F8LHWdgalxXqvp7BII/W8=
 go.opentelemetry.io/otel/sdk v1.24.0 h1:YMPPDNymmQN3ZgczicBY3B6sf9n62Dlj9pWD3ucgoDw=
 go.opentelemetry.io/otel/sdk v1.24.0/go.mod h1:KVrIYw6tEubO9E96HQpcmpTKDVn9gdv35HoYiQWGDFg=
-go.opentelemetry.io/otel/trace v1.28.0 h1:GhQ9cUuQGmNDd5BTCP2dAvv75RdMxEfTmYejp+lkx9g=
-go.opentelemetry.io/otel/trace v1.28.0/go.mod h1:jPyXzNPg6da9+38HEwElrQiHlVMTnVfM3/yv2OlIHaI=
+go.opentelemetry.io/otel/trace v1.29.0 h1:J/8ZNK4XgR7a21DZUAsbF8pZ5Jcw1VhACmnYt39JTi4=
+go.opentelemetry.io/otel/trace v1.29.0/go.mod h1:eHl3w0sp3paPkYstJOmAimxhiFXPg+MMTlEh3nsQgWQ=
 golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
 golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
 golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
diff --git a/management.yml b/management.yml
index 289b39cc..30175bb5 100644
--- a/management.yml
+++ b/management.yml
@@ -15,7 +15,7 @@ info:
   license:
     name: Apache 2.0
     url: https://www.apache.org/licenses/LICENSE-2.0.html
-  version: 0.26.26
+  version: 0.26.27
 host: demo.ziti.dev
 basePath: /edge/management/v1
 paths:
@@ -16054,6 +16054,7 @@ definitions:
       - isMfaRequired
       - isMfaComplete
       - authenticatorId
+      - isCertExtendable
       properties:
         authQueries:
           $ref: '#/definitions/authQueryList'
@@ -16072,6 +16073,8 @@ definitions:
           type: string
         ipAddress:
           type: string
+        isCertExtendable:
+          type: boolean
         isMfaComplete:
           type: boolean
         isMfaRequired:
@@ -16391,6 +16394,8 @@ definitions:
           $ref: '#/definitions/entityRef'
         identityId:
           type: string
+        isIssuedByNetwork:
+          type: boolean
         method:
           type: string
         username:
diff --git a/rest_client_api_server/doc.go b/rest_client_api_server/doc.go
index d943df37..f7169090 100644
--- a/rest_client_api_server/doc.go
+++ b/rest_client_api_server/doc.go
@@ -30,7 +30,7 @@
 //    https
 //  Host: demo.ziti.dev
 //  BasePath: /edge/client/v1
-//  Version: 0.26.26
+//  Version: 0.26.27
 //  License: Apache 2.0 https://www.apache.org/licenses/LICENSE-2.0.html
 //  Contact: OpenZiti<help@openziti.org> https://openziti.discourse.group
 //
diff --git a/rest_client_api_server/embedded_spec.go b/rest_client_api_server/embedded_spec.go
index c2186fcc..0a839238 100644
--- a/rest_client_api_server/embedded_spec.go
+++ b/rest_client_api_server/embedded_spec.go
@@ -64,7 +64,7 @@ func init() {
       "name": "Apache 2.0",
       "url": "https://www.apache.org/licenses/LICENSE-2.0.html"
     },
-    "version": "0.26.26"
+    "version": "0.26.27"
   },
   "host": "demo.ziti.dev",
   "basePath": "/edge/client/v1",
@@ -5205,7 +5205,8 @@ func init() {
             "cachedUpdatedAt",
             "isMfaRequired",
             "isMfaComplete",
-            "authenticatorId"
+            "authenticatorId",
+            "isCertExtendable"
           ],
           "properties": {
             "authQueries": {
@@ -5233,6 +5234,9 @@ func init() {
             "ipAddress": {
               "type": "string"
             },
+            "isCertExtendable": {
+              "type": "boolean"
+            },
             "isMfaComplete": {
               "type": "boolean"
             },
@@ -5362,6 +5366,9 @@ func init() {
             "identityId": {
               "type": "string"
             },
+            "isIssuedByNetwork": {
+              "type": "boolean"
+            },
             "method": {
               "type": "string"
             },
@@ -7665,7 +7672,7 @@ func init() {
       "name": "Apache 2.0",
       "url": "https://www.apache.org/licenses/LICENSE-2.0.html"
     },
-    "version": "0.26.26"
+    "version": "0.26.27"
   },
   "host": "demo.ziti.dev",
   "basePath": "/edge/client/v1",
@@ -12888,7 +12895,8 @@ func init() {
             "cachedUpdatedAt",
             "isMfaRequired",
             "isMfaComplete",
-            "authenticatorId"
+            "authenticatorId",
+            "isCertExtendable"
           ],
           "properties": {
             "authQueries": {
@@ -12916,6 +12924,9 @@ func init() {
             "ipAddress": {
               "type": "string"
             },
+            "isCertExtendable": {
+              "type": "boolean"
+            },
             "isMfaComplete": {
               "type": "boolean"
             },
@@ -13045,6 +13056,9 @@ func init() {
             "identityId": {
               "type": "string"
             },
+            "isIssuedByNetwork": {
+              "type": "boolean"
+            },
             "method": {
               "type": "string"
             },
diff --git a/rest_management_api_server/doc.go b/rest_management_api_server/doc.go
index a6358dd6..2aa87564 100644
--- a/rest_management_api_server/doc.go
+++ b/rest_management_api_server/doc.go
@@ -30,7 +30,7 @@
 //    https
 //  Host: demo.ziti.dev
 //  BasePath: /edge/management/v1
-//  Version: 0.26.26
+//  Version: 0.26.27
 //  License: Apache 2.0 https://www.apache.org/licenses/LICENSE-2.0.html
 //  Contact: OpenZiti<help@openziti.org> https://openziti.discourse.group
 //
diff --git a/rest_management_api_server/embedded_spec.go b/rest_management_api_server/embedded_spec.go
index 2950875f..201c2fc4 100644
--- a/rest_management_api_server/embedded_spec.go
+++ b/rest_management_api_server/embedded_spec.go
@@ -64,7 +64,7 @@ func init() {
       "name": "Apache 2.0",
       "url": "https://www.apache.org/licenses/LICENSE-2.0.html"
     },
-    "version": "0.26.26"
+    "version": "0.26.27"
   },
   "host": "demo.ziti.dev",
   "basePath": "/edge/management/v1",
@@ -22177,7 +22177,8 @@ func init() {
             "cachedUpdatedAt",
             "isMfaRequired",
             "isMfaComplete",
-            "authenticatorId"
+            "authenticatorId",
+            "isCertExtendable"
           ],
           "properties": {
             "authQueries": {
@@ -22205,6 +22206,9 @@ func init() {
             "ipAddress": {
               "type": "string"
             },
+            "isCertExtendable": {
+              "type": "boolean"
+            },
             "isMfaComplete": {
               "type": "boolean"
             },
@@ -22666,6 +22670,9 @@ func init() {
             "identityId": {
               "type": "string"
             },
+            "isIssuedByNetwork": {
+              "type": "boolean"
+            },
             "method": {
               "type": "string"
             },
@@ -28510,7 +28517,7 @@ func init() {
       "name": "Apache 2.0",
       "url": "https://www.apache.org/licenses/LICENSE-2.0.html"
     },
-    "version": "0.26.26"
+    "version": "0.26.27"
   },
   "host": "demo.ziti.dev",
   "basePath": "/edge/management/v1",
@@ -50719,7 +50726,8 @@ func init() {
             "cachedUpdatedAt",
             "isMfaRequired",
             "isMfaComplete",
-            "authenticatorId"
+            "authenticatorId",
+            "isCertExtendable"
           ],
           "properties": {
             "authQueries": {
@@ -50747,6 +50755,9 @@ func init() {
             "ipAddress": {
               "type": "string"
             },
+            "isCertExtendable": {
+              "type": "boolean"
+            },
             "isMfaComplete": {
               "type": "boolean"
             },
@@ -51208,6 +51219,9 @@ func init() {
             "identityId": {
               "type": "string"
             },
+            "isIssuedByNetwork": {
+              "type": "boolean"
+            },
             "method": {
               "type": "string"
             },
diff --git a/rest_model/api_session_detail.go b/rest_model/api_session_detail.go
index 545409ea..a1ac64be 100644
--- a/rest_model/api_session_detail.go
+++ b/rest_model/api_session_detail.go
@@ -72,6 +72,10 @@ type APISessionDetail struct {
 	// Required: true
 	IPAddress *string `json:"ipAddress"`
 
+	// is cert extendable
+	// Required: true
+	IsCertExtendable *bool `json:"isCertExtendable"`
+
 	// is mfa complete
 	// Required: true
 	IsMfaComplete *bool `json:"isMfaComplete"`
@@ -114,6 +118,8 @@ func (m *APISessionDetail) UnmarshalJSON(raw []byte) error {
 
 		IPAddress *string `json:"ipAddress"`
 
+		IsCertExtendable *bool `json:"isCertExtendable"`
+
 		IsMfaComplete *bool `json:"isMfaComplete"`
 
 		IsMfaRequired *bool `json:"isMfaRequired"`
@@ -140,6 +146,8 @@ func (m *APISessionDetail) UnmarshalJSON(raw []byte) error {
 
 	m.IPAddress = dataAO1.IPAddress
 
+	m.IsCertExtendable = dataAO1.IsCertExtendable
+
 	m.IsMfaComplete = dataAO1.IsMfaComplete
 
 	m.IsMfaRequired = dataAO1.IsMfaRequired
@@ -175,6 +183,8 @@ func (m APISessionDetail) MarshalJSON() ([]byte, error) {
 
 		IPAddress *string `json:"ipAddress"`
 
+		IsCertExtendable *bool `json:"isCertExtendable"`
+
 		IsMfaComplete *bool `json:"isMfaComplete"`
 
 		IsMfaRequired *bool `json:"isMfaRequired"`
@@ -198,6 +208,8 @@ func (m APISessionDetail) MarshalJSON() ([]byte, error) {
 
 	dataAO1.IPAddress = m.IPAddress
 
+	dataAO1.IsCertExtendable = m.IsCertExtendable
+
 	dataAO1.IsMfaComplete = m.IsMfaComplete
 
 	dataAO1.IsMfaRequired = m.IsMfaRequired
@@ -251,6 +263,10 @@ func (m *APISessionDetail) Validate(formats strfmt.Registry) error {
 		res = append(res, err)
 	}
 
+	if err := m.validateIsCertExtendable(formats); err != nil {
+		res = append(res, err)
+	}
+
 	if err := m.validateIsMfaComplete(formats); err != nil {
 		res = append(res, err)
 	}
@@ -360,6 +376,15 @@ func (m *APISessionDetail) validateIPAddress(formats strfmt.Registry) error {
 	return nil
 }
 
+func (m *APISessionDetail) validateIsCertExtendable(formats strfmt.Registry) error {
+
+	if err := validate.Required("isCertExtendable", "body", m.IsCertExtendable); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func (m *APISessionDetail) validateIsMfaComplete(formats strfmt.Registry) error {
 
 	if err := validate.Required("isMfaComplete", "body", m.IsMfaComplete); err != nil {
diff --git a/rest_model/authenticator_detail.go b/rest_model/authenticator_detail.go
index fe250159..344fbfe7 100644
--- a/rest_model/authenticator_detail.go
+++ b/rest_model/authenticator_detail.go
@@ -58,6 +58,9 @@ type AuthenticatorDetail struct {
 	// Required: true
 	IdentityID *string `json:"identityId"`
 
+	// is issued by network
+	IsIssuedByNetwork bool `json:"isIssuedByNetwork,omitempty"`
+
 	// method
 	// Required: true
 	Method *string `json:"method"`
@@ -85,6 +88,8 @@ func (m *AuthenticatorDetail) UnmarshalJSON(raw []byte) error {
 
 		IdentityID *string `json:"identityId"`
 
+		IsIssuedByNetwork bool `json:"isIssuedByNetwork,omitempty"`
+
 		Method *string `json:"method"`
 
 		Username string `json:"username,omitempty"`
@@ -101,6 +106,8 @@ func (m *AuthenticatorDetail) UnmarshalJSON(raw []byte) error {
 
 	m.IdentityID = dataAO1.IdentityID
 
+	m.IsIssuedByNetwork = dataAO1.IsIssuedByNetwork
+
 	m.Method = dataAO1.Method
 
 	m.Username = dataAO1.Username
@@ -126,6 +133,8 @@ func (m AuthenticatorDetail) MarshalJSON() ([]byte, error) {
 
 		IdentityID *string `json:"identityId"`
 
+		IsIssuedByNetwork bool `json:"isIssuedByNetwork,omitempty"`
+
 		Method *string `json:"method"`
 
 		Username string `json:"username,omitempty"`
@@ -139,6 +148,8 @@ func (m AuthenticatorDetail) MarshalJSON() ([]byte, error) {
 
 	dataAO1.IdentityID = m.IdentityID
 
+	dataAO1.IsIssuedByNetwork = m.IsIssuedByNetwork
+
 	dataAO1.Method = m.Method
 
 	dataAO1.Username = m.Username
diff --git a/source/client.yml b/source/client.yml
index e6078f47..f59dc7c6 100644
--- a/source/client.yml
+++ b/source/client.yml
@@ -1,7 +1,7 @@
 ---
 swagger: '2.0'
 info:
-  version: 0.26.26
+  version: 0.26.27
   title: Ziti Edge Client
   description: OpenZiti Edge Client API
   contact:
diff --git a/source/management.yml b/source/management.yml
index e57d025c..2cb0ddb8 100644
--- a/source/management.yml
+++ b/source/management.yml
@@ -1,7 +1,7 @@
 ---
 swagger: '2.0'
 info:
-  version: 0.26.26
+  version: 0.26.27
   title: Ziti Edge Management
   description: OpenZiti Edge Management API
   contact:
diff --git a/source/shared/api-sessions.yml b/source/shared/api-sessions.yml
index 8874ce6c..9a200a60 100644
--- a/source/shared/api-sessions.yml
+++ b/source/shared/api-sessions.yml
@@ -41,6 +41,7 @@ definitions:
           - isMfaRequired
           - isMfaComplete
           - authenticatorId
+          - isCertExtendable
         properties:
           token:
             type: string
@@ -67,4 +68,6 @@ definitions:
             type: string
             format: date-time
           authenticatorId:
-            type: string
\ No newline at end of file
+            type: string
+          isCertExtendable:
+            type: boolean
\ No newline at end of file
diff --git a/source/shared/authenticators.yml b/source/shared/authenticators.yml
index a39991a1..69f732f8 100644
--- a/source/shared/authenticators.yml
+++ b/source/shared/authenticators.yml
@@ -82,6 +82,8 @@ definitions:
             type: string
           username:
             type: string
+          isIssuedByNetwork:
+            type: boolean
   authenticatorUpdate:
     description: All of the fields on an authenticator that will be updated
     type: object