zuplo 6.72.3 → 6.72.8

package/docs/policies/mcp-token-exchange-inbound/schema.json

@@ -34,6 +34,38 @@
           "description": "The options for this policy.",
           "additionalProperties": false,
           "required": ["displayName", "authMode"],
+          "if": {
+            "properties": {
+              "authMode": {
+                "const": "id-jag"
+              }
+            },
+            "required": ["authMode"]
+          },
+          "then": {
+            "required": ["idJag"],
+            "not": {
+              "anyOf": [
+                {
+                  "required": ["scopes"]
+                },
+                {
+                  "required": ["scopeDelimiter"]
+                },
+                {
+                  "required": ["prompt"]
+                },
+                {
+                  "required": ["clientRegistration"]
+                }
+              ]
+            }
+          },
+          "else": {
+            "not": {
+              "required": ["idJag"]
+            }
+          },
           "properties": {
             "id": {
               "type": "string",
@@ -50,15 +82,10 @@
               "examples": ["Native Linear remote MCP server."],
               "description": "Optional human-readable summary of the upstream, shown on the consent page."
             },
-            "protectedResourceMetadataUrl": {
-              "type": "string",
-              "format": "uri",
-              "description": "Optional override for the upstream's OAuth protected-resource metadata URL. Defaults from the route handler's rewritePattern."
-            },
             "authMode": {
               "type": "string",
-              "enum": ["user-oauth", "shared-oauth"],
-              "description": "Authentication mode. `user-oauth` performs per-user OAuth federation; `shared-oauth` uses a gateway-wide OAuth grant."
+              "enum": ["user-oauth", "shared-oauth", "id-jag"],
+              "description": "Authentication mode. `user-oauth` performs per-user OAuth federation; `shared-oauth` uses a gateway-wide OAuth grant; `id-jag` exchanges the caller's identity assertion at the configured IdP for an ID-JAG (Identity Assertion JWT Authorization Grant, also known as Cross-App Access / XAA), then redeems it at the upstream Resource Authorization Server for an upstream access token."
             },
             "scopes": {
               "type": "array",
@@ -67,11 +94,19 @@
                 "type": "string"
               }
             },
+            "protectedResourceMetadataUrl": {
+              "type": "string",
+              "format": "uri",
+              "x-advanced": true,
+              "description": "Optional override for the upstream's OAuth protected-resource metadata URL. Defaults from the route handler's rewritePattern."
+            },
             "scopeDelimiter": {
               "type": "string",
+              "x-advanced": true,
               "description": "Delimiter used to join scopes in the OAuth authorization request. Defaults to a single space."
             },
             "prompt": {
+              "x-advanced": true,
               "description": "Overrides the OIDC `prompt` parameter on upstream authorization requests. The MCP SDK adds `prompt=consent` whenever the requested scope includes `offline_access`, which forces a consent screen on every authorization on providers like Microsoft Entra ID even after a tenant admin has granted org-wide admin consent. Leave unset to keep the SDK's behavior; set to `false` to strip the `prompt` parameter; set an explicit value to replace it. Warning: stripping `prompt=consent` while requesting `offline_access` can silently prevent refresh-token issuance on providers that require a fresh consent grant for offline access (e.g. Google) — only use this when the provider grants offline access via pre-authorized/admin consent (e.g. Entra tenant admin consent).",
               "oneOf": [
                 {
@@ -85,6 +120,7 @@
               ]
             },
             "clientRegistration": {
+              "x-advanced": true,
               "description": "OAuth client registration mode. Defaults to `auto`, which uses Client ID Metadata Documents when the upstream advertises support and falls back to Dynamic Client Registration otherwise.",
               "oneOf": [
                 {
@@ -126,6 +162,244 @@
                   }
                 }
               ]
+            },
+            "idJag": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["idp", "resourceAs"],
+              "x-advanced": true,
+              "description": "ID-JAG (Cross-App Access / XAA) token-exchange configuration. Required when `authMode` is `id-jag`; not used by the OAuth modes.",
+              "properties": {
+                "scopes": {
+                  "type": "array",
+                  "default": [],
+                  "description": "Scopes to request on the ID-JAG token exchange at the IdP.",
+                  "items": {
+                    "type": "string"
+                  }
+                },
+                "scopeDelimiter": {
+                  "type": "string",
+                  "default": " ",
+                  "description": "Delimiter used to join scopes in the token-exchange request. Defaults to a single space."
+                },
+                "idp": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["tokenUrl", "clientAuth"],
+                  "description": "The identity provider that exchanges the caller's identity assertion for an ID-JAG.",
+                  "properties": {
+                    "tokenUrl": {
+                      "type": "string",
+                      "format": "uri",
+                      "description": "The IdP token endpoint used for the ID-JAG token exchange."
+                    },
+                    "clientAuth": {
+                      "description": "Client authentication used at the token endpoint.",
+                      "oneOf": [
+                        {
+                          "type": "object",
+                          "additionalProperties": false,
+                          "required": ["method", "clientId", "clientSecret"],
+                          "properties": {
+                            "method": {
+                              "type": "string",
+                              "const": "client_secret_post"
+                            },
+                            "clientId": {
+                              "type": "string"
+                            },
+                            "clientSecret": {
+                              "type": "string",
+                              "examples": ["$env(IDP_CLIENT_SECRET)"],
+                              "description": "OAuth client secret. Use `$env(VAR_NAME)` to source from an environment variable."
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "additionalProperties": false,
+                          "required": ["method", "clientId", "clientSecret"],
+                          "properties": {
+                            "method": {
+                              "type": "string",
+                              "const": "client_secret_basic"
+                            },
+                            "clientId": {
+                              "type": "string"
+                            },
+                            "clientSecret": {
+                              "type": "string",
+                              "examples": ["$env(IDP_CLIENT_SECRET)"],
+                              "description": "OAuth client secret. Use `$env(VAR_NAME)` to source from an environment variable."
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "additionalProperties": false,
+                          "required": ["method", "clientId", "privateKeyPem"],
+                          "properties": {
+                            "method": {
+                              "type": "string",
+                              "const": "private_key_jwt"
+                            },
+                            "clientId": {
+                              "type": "string"
+                            },
+                            "privateKeyPem": {
+                              "type": "string",
+                              "examples": ["$env(IDP_PRIVATE_KEY_PEM)"],
+                              "description": "PEM-encoded private key used to sign the client assertion. Use `$env(VAR_NAME)` to source from an environment variable."
+                            },
+                            "algorithm": {
+                              "type": "string",
+                              "enum": [
+                                "RS256",
+                                "RS384",
+                                "RS512",
+                                "ES256",
+                                "ES384",
+                                "ES512"
+                              ],
+                              "default": "RS256",
+                              "description": "JWS algorithm used to sign the client assertion."
+                            },
+                            "keyId": {
+                              "type": "string",
+                              "description": "Optional `kid` header set on the client assertion, for providers that select the verification key by key id."
+                            },
+                            "audience": {
+                              "type": "string",
+                              "format": "uri",
+                              "description": "Optional override for the client assertion `aud` claim. Defaults to the token endpoint URL."
+                            },
+                            "expiresInSeconds": {
+                              "type": "integer",
+                              "default": 300,
+                              "minimum": 1,
+                              "maximum": 3600,
+                              "description": "Client assertion lifetime in seconds."
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  }
+                },
+                "resourceAs": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["tokenUrl", "audience", "clientAuth"],
+                  "description": "The upstream Resource Authorization Server that redeems the ID-JAG for an upstream access token.",
+                  "properties": {
+                    "tokenUrl": {
+                      "type": "string",
+                      "format": "uri",
+                      "description": "The Resource Authorization Server token endpoint where the gateway redeems the ID-JAG via the jwt-bearer grant."
+                    },
+                    "audience": {
+                      "type": "string",
+                      "description": "The `audience` value sent on the ID-JAG token exchange, identifying the Resource Authorization Server (typically its issuer)."
+                    },
+                    "resource": {
+                      "type": "string",
+                      "description": "Optional `resource` indicator sent on the token exchange, identifying the upstream MCP resource. Defaults to the upstream MCP server URL from the route handler's rewritePattern."
+                    },
+                    "clientAuth": {
+                      "description": "Client authentication used at the token endpoint.",
+                      "oneOf": [
+                        {
+                          "type": "object",
+                          "additionalProperties": false,
+                          "required": ["method", "clientId", "clientSecret"],
+                          "properties": {
+                            "method": {
+                              "type": "string",
+                              "const": "client_secret_post"
+                            },
+                            "clientId": {
+                              "type": "string"
+                            },
+                            "clientSecret": {
+                              "type": "string",
+                              "examples": ["$env(IDP_CLIENT_SECRET)"],
+                              "description": "OAuth client secret. Use `$env(VAR_NAME)` to source from an environment variable."
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "additionalProperties": false,
+                          "required": ["method", "clientId", "clientSecret"],
+                          "properties": {
+                            "method": {
+                              "type": "string",
+                              "const": "client_secret_basic"
+                            },
+                            "clientId": {
+                              "type": "string"
+                            },
+                            "clientSecret": {
+                              "type": "string",
+                              "examples": ["$env(IDP_CLIENT_SECRET)"],
+                              "description": "OAuth client secret. Use `$env(VAR_NAME)` to source from an environment variable."
+                            }
+                          }
+                        },
+                        {
+                          "type": "object",
+                          "additionalProperties": false,
+                          "required": ["method", "clientId", "privateKeyPem"],
+                          "properties": {
+                            "method": {
+                              "type": "string",
+                              "const": "private_key_jwt"
+                            },
+                            "clientId": {
+                              "type": "string"
+                            },
+                            "privateKeyPem": {
+                              "type": "string",
+                              "examples": ["$env(IDP_PRIVATE_KEY_PEM)"],
+                              "description": "PEM-encoded private key used to sign the client assertion. Use `$env(VAR_NAME)` to source from an environment variable."
+                            },
+                            "algorithm": {
+                              "type": "string",
+                              "enum": [
+                                "RS256",
+                                "RS384",
+                                "RS512",
+                                "ES256",
+                                "ES384",
+                                "ES512"
+                              ],
+                              "default": "RS256",
+                              "description": "JWS algorithm used to sign the client assertion."
+                            },
+                            "keyId": {
+                              "type": "string",
+                              "description": "Optional `kid` header set on the client assertion, for providers that select the verification key by key id."
+                            },
+                            "audience": {
+                              "type": "string",
+                              "format": "uri",
+                              "description": "Optional override for the client assertion `aud` claim. Defaults to the token endpoint URL."
+                            },
+                            "expiresInSeconds": {
+                              "type": "integer",
+                              "default": 300,
+                              "minimum": 1,
+                              "maximum": 3600,
+                              "description": "Client assertion lifetime in seconds."
+                            }
+                          }
+                        }
+                      ]
+                    }
+                  }
+                }
+              }
             }
           }
         }
@@ -137,6 +411,12 @@
           "options": {
             "displayName": "Linear",
             "id": "linear",
+            "idJag": {
+              "idp": {},
+              "resourceAs": {},
+              "scopeDelimiter": " ",
+              "scopes": []
+            },
             "scopes": [],
             "summary": "Native Linear remote MCP server."
           }

package/docs/policies/mcp-workos-oauth-inbound/schema.json

@@ -52,6 +52,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -74,8 +75,88 @@
                 }
               }
             },
+            "idJag": {
+              "x-advanced": true,
+              "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
+              "oneOf": [
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["enabled"],
+                  "properties": {
+                    "enabled": {
+                      "const": false,
+                      "description": "Disable ID-JAG support."
+                    }
+                  }
+                },
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": ["enabled"],
+                  "properties": {
+                    "enabled": {
+                      "const": true,
+                      "description": "Enable ID-JAG support."
+                    },
+                    "trustedIssuers": {
+                      "type": "array",
+                      "minItems": 1,
+                      "description": "Trusted ID-JAG issuers. These values are never published in OAuth metadata. Omit to trust this policy's browser-login IdP.",
+                      "items": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "dependentRequired": {
+                          "issuer": ["jwksUrl"],
+                          "jwksUrl": ["issuer"]
+                        },
+                        "properties": {
+                          "issuer": {
+                            "type": "string",
+                            "format": "uri",
+                            "description": "Exact issuer URL expected in the ID-JAG iss claim. Provide together with jwksUrl, or omit both to default to this policy's browser-login IdP."
+                          },
+                          "jwksUrl": {
+                            "type": "string",
+                            "format": "uri",
+                            "description": "JWKS URL used to verify ID-JAG signatures from this issuer. Provide together with issuer, or omit both to default to this policy's browser-login IdP."
+                          },
+                          "expectedClientIds": {
+                            "type": "array",
+                            "items": {
+                              "type": "string",
+                              "minLength": 1
+                            },
+                            "description": "Optional allow-list of client IDs accepted from this issuer. The ID-JAG client_id must still match the authenticated token-endpoint client."
+                          },
+                          "subjectMapping": {
+                            "type": "string",
+                            "enum": [
+                              "iss_prefix",
+                              "iss_tenant_prefix",
+                              "sub_id_only"
+                            ],
+                            "default": "iss_prefix",
+                            "description": "How the ID-JAG subject is mapped into the gateway subject ID."
+                          }
+                        }
+                      }
+                    },
+                    "authorizationDetailsTypesAllowed": {
+                      "type": "array",
+                      "items": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "description": "Optional allow-list of RFC 9396 authorization_details type values accepted from ID-JAGs."
+                    }
+                  }
+                }
+              ]
+            },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/monetization-inbound/schema.json

@@ -35,37 +35,47 @@
           "additionalProperties": false,
           "required": [],
           "properties": {
+            "meters": {
+              "type": "object",
+              "examples": [
+                {
+                  "api_requests": 1
+                }
+              ],
+              "additionalProperties": {
+                "type": "number"
+              },
+              "description": "The meters to be used by the policy against the subscription quota."
+            },
+            "requiredEntitlements": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
+              "description": "A list of entitlement keys that the subscription must have access to (hasAccess=true) for the request to be allowed. If any required entitlement is missing or does not have access, the request will be rejected with a 403 Forbidden.",
+              "examples": [["custom_domains"]]
+            },
             "authHeader": {
               "type": "string",
               "default": "Authorization",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The name of the header with the key."
             },
             "authScheme": {
               "type": "string",
               "default": "Bearer",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The scheme used on the header."
             },
             "cacheTtlSeconds": {
               "type": "number",
               "default": 60,
+              "x-advanced": true,
               "description": "The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc."
             },
-            "meters": {
-              "type": "object",
-              "examples": [
-                {
-                  "api_requests": 1
-                }
-              ],
-              "patternProperties": {
-                "^.*$": {
-                  "type": "number"
-                }
-              },
-              "description": "The meters to be used by the policy against the subscription quota."
-            },
             "meterOnStatusCodes": {
               "oneOf": [
                 {
@@ -79,18 +89,10 @@
                 }
               ],
               "x-show-example": false,
+              "x-advanced": true,
               "description": "A list of successful status codes and ranges \"200-299, 304\" that should trigger a metering call.",
               "default": "200-299",
               "examples": ["200-399"]
-            },
-            "requiredEntitlements": {
-              "type": "array",
-              "items": {
-                "type": "string",
-                "minLength": 1
-              },
-              "description": "A list of entitlement keys that the subscription must have access to (hasAccess=true) for the request to be allowed. If any required entitlement is missing or does not have access, the request will be rejected with a 403 Forbidden.",
-              "examples": [["custom_domains"]]
             }
           }
         }

package/docs/policies/mtls-auth-inbound/schema.json

@@ -35,15 +35,16 @@
           "additionalProperties": false,
           "required": [],
           "properties": {
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Allows requests to continue even when mTLS verification fails, no client certificate is presented, or the certificate metadata cannot be parsed. Defaults to false."
-            },
             "certIssuerDN": {
               "type": "string",
               "description": "Fully qualified issuer distinguished name to require on the client certificate. The policy rejects certificates whose parsed issuer DN does not match this string exactly. Required unless `allowUnauthenticatedRequests` is `true`. The expected format matches the parsed metadata issuer, e.g. \"CN=example-ca, O=Example, C=US\".",
               "examples": ["CN=example-ca, O=Example, C=US"]
+            },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Allows requests to continue even when mTLS verification fails, no client certificate is presented, or the certificate metadata cannot be parsed. Defaults to false."
             }
           },
           "anyOf": [

package/docs/policies/okta-fga-authz-inbound/schema.json

@@ -56,12 +56,6 @@
               "description": "The ID of the authorization model.",
               "examples": ["$env(FGA_MODEL_ID)"]
             },
-            "allowUnauthorizedRequests": {
-              "type": "boolean",
-              "default": false,
-              "x-show-example": false,
-              "description": "Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response."
-            },
             "credentials": {
               "type": "object",
               "required": ["clientId", "clientSecret"],
@@ -81,6 +75,13 @@
                   "clientSecret": "$env(FGA_CLIENT_SECRET)"
                 }
               ]
+            },
+            "allowUnauthorizedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response."
             }
           }
         }

package/docs/policies/okta-jwt-auth-inbound/schema.json

@@ -35,11 +35,6 @@
           "additionalProperties": false,
           "required": ["issuerUrl"],
           "properties": {
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
-            },
             "issuerUrl": {
               "type": "string",
               "examples": ["https://dev-12345.okta.com/oauth2/abc"],
@@ -50,9 +45,16 @@
               "examples": ["api://my-api"],
               "description": "The Okta audience of your API, for example `api://my-api`."
             },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
+            },
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           }