AXIS OS 13 doesn't warn you. It rolls back.

Every installed ACAP must declare which AXIS OS major versions it is compatible with. An application without the declaration is treated as incompatible.

What it does to you. The upgrade fails and the device rolls back. Axis's own guidance is that the user must remove the application before upgrading.

During the OS upgrade every installed ACAP is re-installed. If any one of them errors, AXIS OS initiates a rollback of the whole upgrade.

What it does to you. This is the rule the product exists for. One stale application on one camera reverts that camera, with no per-camera explanation of which application caused it.

Applications must use manifest schema v2 to declare their access rights. package.conf is no longer supported — those applications are handled by an older ACAP framework that is gone. Applications are restricted to running as their own dynamically created user or as the sdk user.

What it does to you. A pre-schema-v2 or package.conf application will not re-install, which triggers A2.

Only signed ACAP applications are accepted. The AllowUnsigned escape hatch is removed.

What it does to you. Any unsigned application currently running on a camera that had AllowUnsigned set will fail re-installation, which triggers A2.

AXIS OS 13 moves to 64-bit time_t and 64-bit time APIs in glibc and the kernel. On 32-bit products this is an ABI break: ACAP applications and internal services must be recompiled.

What it does to you. On the listed models, any ACAP not rebuilt against the new ABI must be removed before the upgrade or the device rolls back.

Scripts must have executable permission, must complete within 5 minutes, shell scripts must start with #!/bin/sh, umask is set to 022, and a non-zero exit from the post-install script fails the installation.

What it does to you. A script that used to pass sloppily now fails the re-installation, which triggers A2.

See also L14.

Support for installing and running ACAP applications from the SD card is removed entirely.

What it does to you. An SD-card-resident application will not come back after the upgrade, and its re-installation failure triggers A2.

An application using the deep-learning processing unit must declare that use in its manifest.

What it does to you. An undeclared analytics application is a re-installation risk, and a rollback candidate under A2.

The .larod model container is gone. Models must be .tflite.

What it does to you. An analytics application shipping .larod models installs but cannot load its model.

Only larod version 3 is supported. Applications on v1 or v2 must be migrated.

What it does to you. Inference fails at runtime after an otherwise clean upgrade.

A process with an executable stack crashes immediately with a segmentation fault.

What it does to you. The application installs and then dies on start. Hardest failure in the set to attribute, because nothing in the logs points at the cause.

The message-broker interface is gone. The replacement device data hub API is available from ACAP SDK 12.10.

What it does to you. Applications publishing or subscribing over message-broker lose their event path silently.

The three guard applications are removed. AXIS Object Analytics is the replacement.

What it does to you. Two failures at once: the analytic stops, and anything subscribing to its VAPIX events or endpoints stops with it.

The application is removed from AXIS OS 13.

What it does to you. Same shape as B5 — analytic and its event consumers both stop.

The MotionRegionDetector / Motion tampering event is removed. AXIS Image Health Analytics is the replacement.

What it does to you. Event rules and VMS triggers bound to the tampering event stop firing.

vdo_frame_get_is_last_buffer, vdo_frame_get_fd and vdo_frame_get_opaque are removed. Crop settings, deprecated since 11.11, are no longer available to ACAPs.

What it does to you. Video-pipeline applications built against the old functions fail to run.

Only uint32_t is supported for VDO_TIMESTAMP.

What it does to you. Timestamp handling breaks in applications still using the 16-bit form.

The overlay enumerations are removed from the VDO ACAP API.

What it does to you. Overlay-drawing applications built against them fail to compile or run.

Only 127.0.0.1, 127.0.0.4 and 127.0.0.12 remain.

What it does to you. An ACAP binding any other loopback address fails to bind after the upgrade.

Root-privileged access for ACAP applications was removed indefinitely, with no way to re-enable it.

What it does to you. Applications that need root do not work. This includes on-camera VPN clients — Tailscale, ZeroTier, WireGuard, OpenVPN, IPsec — which are the usual real-world casualties.

Already in force since AXIS OS 12.0. A fleet still on 11.x meets this and everything in 13 at the same time.

Applications must link OpenSSL 3.x.

What it does to you. TLS calls from the application fail.

Password complexity enforcement is enabled by default for new and edited accounts created via SSH, VAPIX, ONVIF and SNMP, and it applies to the web interface too. Profile 1 requires 15 characters; Profile 2 requires 12 characters plus numbers, capitals and specials. Axis states the behaviour cannot be disabled.

What it does to you. This is the rule that breaks automated onboarding. Middleware or a VMS that provisions cameras with a standard non-compliant service password fails at the account-creation step — on every new or reset device, every time, with no switch to turn off. Existing accounts are the quiet half: they are not re-validated and keep working, so the failure only shows up on new and reset devices, which is exactly where an integrator is least likely to be watching. Axis is explicit that existing accounts need adjusting manually.

Ordered first in Tier C because it has the widest blast radius of anything here for anyone who onboards cameras programmatically. It is not a camera failure, which is why it sits in C rather than A.

System.BoaGroupPolicy.admin, .operator and .viewer move from both to https. Port 80 is disabled by default after a factory reset.

What it does to you. Middleware, scripts and VMS integrations calling http:// stop working. Note the wording carefully: this is the factory-default state, so an upgraded device that keeps its configuration is not necessarily affected — a reset one is.

AXIS OS 12.1 introduced a new authentication policy mode, described by Axis as “Recommended”, which uses basic authentication over HTTPS.

What it does to you. Clients hardcoded to digest may need to change. Whether digest stops working depends on which policy the device is actually set to.

Correction. The plan said digest-over-HTTPS stops working by default from 12.1; ruleset 2.x softened that to 'the source doesn't say so'. Bench evidence lands between the two: on Q1656/12.11.77 (policy=recommended) and M1137/10.12.300 (policy=basic), digest returned 401 and basic-over-HTTPS returned 200. Digest is refused in practice under both policies observed — the plan's instinct was right, but the mechanism is the AuthenticationPolicy parameter, not a blanket 12.1 default change. A client hardcoded to digest fails today, before OS 13.

Image.I0.MPEG.SignedVideo.Enabled changes from no to yes.

What it does to you. Axis notes a slight bitrate increase in specific situations. A storage and bandwidth planning item, not a failure.

Network.UPnP.Enabled is removed. UPnP was already disabled by default in 12.1.

What it does to you. Discovery tooling that finds cameras over UPnP stops finding them.

Recording IDs are capped at 24 hours with a 1 hour default and a continuous sequence now spans multiple IDs. record/list.cgi returns more IDs. exportrecording.cgi is extended for trailing IDs. H.264 header timestamps are not implemented in the new system. Ongoing recordings cannot be removed directly — they must be stopped first. Recording files moved to a new on-disk location with a new naming scheme. RTSP failoverrecordinglength is no longer supported. EstimatedFileSize is removed from the export API.

What it does to you. The largest single item on the page for anyone with a recording integration. Several independent ways to break at once.

Replaced by the event system recording, or record/continuous/addconfiguration.cgi.

What it does to you. Any script starting or stopping a recording directly stops working.

root.StreamCache.Size is removed on the listed non-video products.

What it does to you. Configuration tooling touching the parameter on these models errors.

The legacy SNMP parameter group is removed.

What it does to you. SNMP configuration through param.cgi stops working. Configure via the current API instead.

The Layout parameter group is removed.

What it does to you. Low real-world exposure. Most integrators never touch these.

Only DiskID, Enabled, ExtraMountOptions, FriendlyName and MountOnBoot remain in the Storage.Sn group.

What it does to you. Storage provisioning scripts that set the removed parameters error out.

A set of legacy image and streaming parameters is removed.

What it does to you. Stream-profile provisioning scripts break.

Time.POSIXTimeZone and Time.DST.Enabled are removed. Image.PrivacyMaskType is removed, replaced by root.Properties.PrivacyMask.PrivacyMask.

What it does to you. Time provisioning and privacy-mask configuration scripts break.

Image.I#.Appearance.Rotation and Image.I#.Appearance.AutoRotationEnabled are removed, replaced by ImageSource.I#.Rotation. ImageSource.I#.SourceRotation now reports yes on all supported products.

What it does to you. Rotation is a common provisioning step, which makes this a more likely break than most of the bulk removals.

Network.HTTP.AuthenticationPolicy and Network.HTTP.AuthenticationWithQop are removed, replaced by the Virtual Host VAPIX API. RTSP and RTSPS authentication modes are hardcoded.

What it does to you. Authentication provisioning has to move to the new API.

System.HTTPAuthRTSPOverHTTP moves from no to yes and Network.RTSP.AuthenticateRTSPOverHTTP from yes to no.

What it does to you. Clients tunnelling RTSP over HTTP need to authenticate differently.

PTZ.Support.S#.JoyStickEmulation and PTZ.Support.S#.GenericHTTP are removed. PTZ.Various.V#.HomePresetSet is removed, replaced by PTZ.Preset.HomePosition. ptzcoordcalc.cgi is removed. The PTZ-Autotracking 2.x legacy .fcgi URLs move to /axis-cgi/ptz-autotracking/*.cgi.

What it does to you. PTZ integrations and autotracking clients break in several small ways at once.

/config/rest/best-snapshot becomes /config/rest/object-snapshot.

What it does to you. A pure rename, which makes it a silent client failure — nothing on the camera looks wrong.

The statistics.* fields are removed from VDO stream info.

What it does to you. Monitoring and dashboard code reading per-stream statistics loses its input.

upload_file.cgi, local_del.cgi, local_list.cgi and file_upload.cgi are removed.

What it does to you. Any tooling pushing files onto the camera over these endpoints stops.

Data is now sent as a sequence of length-delimited buffers, response headers are updated, and Transfer-Encoding: chunked is implemented.

What it does to you. Parsers written against the old response shape break.

The audiooutput parameter is removed from the Media Clip API, replaced by audiodeviceid and audioouputid. The tenBandGraphicDspEqualizer audio mixer plugin is replaced by tenBandGraphicEqualizer.

What it does to you. Audio integration calls need updating.

View areas no longer synchronise with the digital PTZ home position, and the behaviour of root.PTZ.Various.V2.Locked is modified.

What it does to you. Multi-view-area setups behave differently after the upgrade. Nothing errors.

Only version 2 of the SSH Management API is supported.

What it does to you. Provisioning scripts using the v1 API break.

AXIS OS image files use zstd compression.

What it does to you. External tooling that unpacks or parses firmware images needs adapting.

A PTZ camera no longer pans indefinitely; continuous pan stops automatically after 10 minutes.

What it does to you. Guard-tour and continuous-scan setups change behaviour. Nothing errors, which is what makes it easy to miss.

In the factory-default state, TLS 1.0/1.1 SIP communication is no longer supported. Already in force since 12.10.

What it does to you. Legacy SIP endpoints fail to negotiate.

SD cards were delivered with vFAT as the standard file system; it is no longer used.

root.Network.UPnP.Enabled defaults to disabled. Fully removed in 13 — see C4.

See also C4.

The legacy web interface is gone.

Redirects from port 80 no longer happen. See C1 for the 13.0 escalation.

See also C1.

root.HTTPS.AllowTLS1 and root.HTTPS.AllowTLS11 are removed.

The fixed default IP is gone and link-local address behaviour changed.

WebService.DiscoveryMode.Discoverable defaults to disabled.

The API can now be turned off, which discovery tooling must tolerate.

axis-release/releaseinfo.cgi is gone.

axis-cgi/prod_brand_info/getbrand.cgi is gone.

The Network.Filter parameter group is removed.

Network share recording over SMB 1 or 2 no longer works.

Signing was introduced with AllowUnsigned as the escape hatch. AXIS OS 13 removes the escape hatch — see A4.

See also A4.

A post-install script exiting 77 aborts the installation. AXIS OS 13 tightens this further — see A6.

See also A6.

/axis-cgi/certappmgmt.cgi and /axis-cgi/certmgmt.cgi are removed in AXIS OS 14, September 2028.

The time.cgi VAPIX API is removed in AXIS OS 14.

The axhttp library goes, and the manifest schema removes the transferCgi option.

SMB goes entirely on the S30 and S40 recorders in AXIS OS 14.