zuplo 6.72.7 → 6.72.8

package/docs/articles/ddos-protection.mdx

@@ -14,8 +14,8 @@ real-time, ensuring your APIs remain available even under attack.
 Zuplo Managed DDoS is only available for customers using Zuplo's managed edge
 deployment model. Customers using managed dedicated deployments should refer to
 the
-[Managed Dedicated WAF Options](./zuplo-waf.mdx#managed-dedicated-waf-options)
-document.
+[Managed Dedicated and Self-hosted Deployments](./waf-ddos.mdx#managed-dedicated-and-self-hosted-deployments)
+guidance.
 
 :::
 

package/docs/articles/limits.mdx

@@ -31,6 +31,18 @@ environments.
 | Subrequests                   | The maximum number of subrequests per request                   | 1,000                                                                                                                                                                |
 | Simultaneous Open Connections | The maximum number of simultaneous open connections per request | 6                                                                                                                                                                    |
 
+## Logs and tracing
+
+Logs and tracing are included with every plan. On non-enterprise plans, log and
+trace ingestion is included for use within your plan's request volume. On
+enterprise plans, logs and tracing are included as well, though log and trace
+ingestion beyond typical usage may incur additional charges.
+
+As with other features, usage is subject to "fair use" policies, meaning Zuplo
+may limit usage that is deemed excessive. If you require specific limits,
+contact sales to discuss pricing plans. Enterprise agreements govern feature
+availability, refer your contract for specifics.
+
 ## HTTP connections
 
 In Zuplo's managed edge environment, HTTP connections have timeouts to ensure

package/docs/articles/local-development-troubleshooting.mdx

@@ -4,11 +4,20 @@ title: "Troubleshooting"
 
 ## Changing the port numbers
 
-By default the Zuplo local server runs on port 9000 and route designer runs on
-port 9100. To change the port number, you can call
+By default the Zuplo local server runs on port 9000, the route designer runs on
+port 9100, and the docs server runs on port 9200. To change any of these port
+numbers, you can call
 
 ```sh
-npx zuplo dev --port <port number> --editor-port <editor port number>
+npx zuplo dev --port <port number> --editor-port <editor port number> --docs-port <docs port number>
+```
+
+Each flag is independent, so you only need to pass the one for the port you want
+to change. For example, if port 9200 is already in use, you can move just the
+docs server:
+
+```sh
+npx zuplo dev --docs-port 9201
 ```
 
 ## Certificates Errors

package/docs/articles/waf-ddos.mdx

@@ -9,9 +9,6 @@ customers today using Azure, AWS, Akamai, CloudFlare and many other options.
 However, there are some things to consider depending on how you host Zuplo
 (edge, dedicated, or self-hosted).
 
-If for some reason these don't work for you - we can also offer a managed WAF as
-part of your Zuplo Enterprise agreement; contact sales to discuss.
-
 More details on some third-party WAF solutions are included below.
 
 ## Managed Edge Deployments
@@ -26,24 +23,7 @@ Customers typically use a WAF offered by their selected hosting platform (e.g.
 Azure, Akamai, AWS, etc.) to simplify management, improve latency and reduce
 bandwidth costs.
 
-## Zuplo Managed WAF
-
-Zuplo offers different WAF solutions based on your deployment model:
-
-**Managed Edge Deployment:** Customers on Zuplo's enterprise plans using our
-managed edge deployment can use Zuplo Managed WAF. This provides
-enterprise-grade protection for your API Gateway with minimal configuration
-required, including OWASP Core Ruleset, OFAC sanctions compliance, DDoS
-protection, and custom rule capabilities.
-
-**Managed Dedicated Deployment:** Customers using Zuplo's managed dedicated
-deployment model can leverage custom WAF and DDoS configurations based on the
-capabilities of their chosen cloud provider (AWS, Azure, GCP). Our team will
-work with you to configure the appropriate security services available in your
-cloud environment.
-
-For detailed information about Zuplo Managed WAF for managed edge deployments,
-see our [Zuplo Managed WAF guide](./zuplo-waf.mdx).
+## WAF functions built into Zuplo
 
 :::tip
 
@@ -64,9 +44,6 @@ while providing powerful security capabilities.
 
 :::
 
-Contact our [sales team](mailto:sales@zuplo.com) to discuss which WAF solution
-is right for your deployment model.
-
 ## Third-Party WAF Solutions
 
 If you require the ability to finely control your WAF Rules or are using a

package/docs/policies/akamai-ai-firewall/schema.json

@@ -51,6 +51,7 @@
             "streamingAccumulation": {
               "type": "object",
               "title": "Streaming Accumulation Settings",
+              "x-advanced": true,
               "description": "Configuration for accumulating and validating streaming responses.",
               "properties": {
                 "enabled": {

package/docs/policies/akamai-firewall-for-ai-inbound/schema.json

@@ -108,11 +108,13 @@
             "throwOnError": {
               "type": "boolean",
               "default": true,
+              "x-advanced": true,
               "description": "If true (the default), the policy throws when the Akamai detect call itself fails (network error, 5xx, malformed response). Set to false to fail open and allow the request through when Akamai is unreachable."
             },
             "detectUrl": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "Override the Akamai Firewall for AI detect endpoint URL. The literal `{configurationId}` is replaced with the configured ID. Defaults to `https://aisec.akamai.com/fai/v1/fai-configurations/{configurationId}/detect`. Useful for regional Akamai endpoints or for pointing tests at a mock server."
             }
           }

package/docs/policies/akamai-firewall-for-ai-outbound/schema.json

@@ -108,11 +108,13 @@
             "throwOnError": {
               "type": "boolean",
               "default": true,
+              "x-advanced": true,
               "description": "If true (the default), the policy throws when the Akamai detect call itself fails (network error, 5xx, malformed response). Set to false to fail open and allow the response through when Akamai is unreachable."
             },
             "detectUrl": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "Override the Akamai Firewall for AI detect endpoint URL. The literal `{configurationId}` is replaced with the configured ID. Defaults to `https://aisec.akamai.com/fai/v1/fai-configurations/{configurationId}/detect`. Useful for regional Akamai endpoints or for pointing tests at a mock server."
             }
           }

package/docs/policies/amberflo-metering-inbound/schema.json

@@ -65,6 +65,7 @@
               "additionalProperties": {
                 "type": "string"
               },
+              "x-advanced": true,
               "description": "A dictionary of dimensions to be sent to Amberflo (extensible in code)."
             },
             "statusCodes": {
@@ -79,12 +80,14 @@
                   }
                 }
               ],
+              "x-advanced": true,
               "description": "A list of successful status codes and ranges \"200-299, 304\" that should trigger a metering call to Amberflo.",
               "default": "200-299"
             },
             "url": {
               "type": "string",
-              "default": " https://app.amberflo.io/ingest",
+              "default": "https://app.amberflo.io/ingest",
+              "x-advanced": true,
               "description": "The URL to send metering events. This is useful for testing purposes."
             }
           }
@@ -100,7 +103,7 @@
             "meterApiName": "$env(AMBERFLO_METER_API_NAME)",
             "meterValue": "$env(AMBERFLO_METER_VALUE)",
             "statusCodes": "200-299",
-            "url": " https://app.amberflo.io/ingest"
+            "url": "https://app.amberflo.io/ingest"
           }
         }
       ]

package/docs/policies/api-key-inbound/schema.json

@@ -35,41 +35,47 @@
           "additionalProperties": false,
           "required": [],
           "properties": {
+            "cacheTtlSeconds": {
+              "type": "number",
+              "default": 60,
+              "description": "The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc."
+            },
             "authHeader": {
               "type": "string",
               "default": "Authorization",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The name of the header with the key."
             },
             "authScheme": {
               "type": "string",
               "default": "Bearer",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The scheme used on the header."
             },
             "bucketId": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The ID of the API Key service bucket. Preferred over bucketName. Defaults to the autogenerated bucket ID for your project."
             },
             "bucketName": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The name of the API Key service bucket. Defaults to the autogenerated bucket name for your project."
             },
             "allowUnauthenticatedRequests": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "If requests should proceed even if the policy does not successfully authenticate the request. Defaults to false and rejects any request without a valid API key (returning a `401 - Unauthorized` response). Set to `true` to support multiple authentication methods or support both authenticated and anonymous requests."
             },
-            "cacheTtlSeconds": {
-              "type": "number",
-              "default": 60,
-              "description": "The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc."
-            },
             "disableAutomaticallyAddingKeyHeaderToOpenApi": {
               "type": "boolean",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "Zuplo will automatically document your API key header within your OpenAPI specification & Developer Portal. Set this to `true` to disable this behavior."
             }
           }

package/docs/policies/audit-log-inbound/schema.json

@@ -46,6 +46,7 @@
             },
             "samplingRate": {
               "type": "number",
+              "x-advanced": true,
               "description": "Fraction of requests to capture, between 0 (none) and 1 (all). Defaults to 1.",
               "default": 1,
               "minimum": 0,
@@ -53,6 +54,7 @@
             },
             "include": {
               "type": "object",
+              "x-advanced": true,
               "description": "Controls which potentially-sensitive parts of each request are captured in the auto-emitted audit event. Disable fields to satisfy your own data-handling and PII policies. All are enabled by default.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/auth0-jwt-auth-inbound/schema.json

@@ -35,11 +35,6 @@
           "additionalProperties": false,
           "required": ["auth0Domain"],
           "properties": {
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
-            },
             "auth0Domain": {
               "type": "string",
               "examples": ["my-company.auth0.com"],
@@ -50,9 +45,16 @@
               "examples": ["https://api.example.com/"],
               "description": "The Auth0 audience of your API, for example `https://api.example.com/`."
             },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
+            },
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           }

package/docs/policies/authzen-inbound/schema.json

@@ -40,11 +40,6 @@
               "description": "The hostname of the AuthZen PDP service.",
               "examples": ["authzen.example.com"]
             },
-            "authorizerAuthorizationHeader": {
-              "type": "string",
-              "description": "The authorization header to use when communicating with the AuthZen PDP service.",
-              "examples": ["Bearer $env(AUTHZEN_PDP_TOKEN)"]
-            },
             "subject": {
               "type": "object",
               "description": "The subject of the request.",
@@ -91,8 +86,15 @@
                 }
               }
             },
+            "authorizerAuthorizationHeader": {
+              "type": "string",
+              "x-advanced": true,
+              "description": "The authorization header to use when communicating with the AuthZen PDP service.",
+              "examples": ["Bearer $env(AUTHZEN_PDP_TOKEN)"]
+            },
             "throwOnError": {
               "type": "boolean",
+              "x-advanced": true,
               "description": "If explicitly set to false, the policy will not throw an error if there is any problem communicating with the AuthZen PDP service and allow calls through. By default throwOnError is assumed to be on/true.",
               "default": true,
               "examples": [true]

package/docs/policies/axiomatics-authz-inbound/schema.json

@@ -35,12 +35,6 @@
           "additionalProperties": false,
           "required": ["pdpUrl", "pdpUsername", "pdpPassword"],
           "properties": {
-            "allowUnauthorizedRequests": {
-              "type": "boolean",
-              "default": false,
-              "x-show-example": false,
-              "description": "Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response."
-            },
             "pdpUrl": {
               "type": "string",
               "examples": ["https://pdp.example.com"],
@@ -56,32 +50,44 @@
               "examples": ["$env(PDP_PASSWORD)"],
               "description": "The password to use when authenticating with the PDP."
             },
+            "allowUnauthorizedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response."
+            },
             "includeDefaultActionAttributes": {
               "type": "boolean",
               "default": true,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "Indicates whether the plugin should include default action attributes in the authorization request."
             },
             "includeDefaultResourceAttributes": {
               "type": "boolean",
               "default": true,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "Indicates whether the plugin should include default resource attributes in the authorization request."
             },
             "includeDefaultSubjectAttributes": {
               "type": "boolean",
               "default": true,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "Indicates whether the plugin should include default subject attributes in the authorization request."
             },
             "tokenHeaderName": {
               "type": "string",
               "default": "Authorization",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The name of the header that carries the JWT."
             },
             "accessSubjectAttributes": {
               "x-show-example": false,
+              "x-advanced": true,
               "type": "array",
               "description": "A list of attributes that will be included in the authorization request.",
               "items": {
@@ -103,6 +109,7 @@
             },
             "resourceAttributes": {
               "x-show-example": false,
+              "x-advanced": true,
               "type": "array",
               "description": "A list of attributes that will be included in the authorization request.",
               "items": {
@@ -124,6 +131,7 @@
             },
             "actionAttributes": {
               "x-show-example": false,
+              "x-advanced": true,
               "type": "array",
               "description": "A list of attributes that will be included in the authorization request.",
               "items": {

package/docs/policies/basic-auth-inbound/schema.json

@@ -71,7 +71,8 @@
             "allowUnauthenticatedRequests": {
               "type": "boolean",
               "default": false,
-              "description": "If 'true' allows the request to continue even if authenticated. When 'false' (the default) any unauthenticated request is automatically rejected with a 401."
+              "x-advanced": true,
+              "description": "If 'true' allows the request to continue even if unauthenticated. When 'false' (the default) any unauthenticated request is automatically rejected with a 401."
             }
           }
         }

package/docs/policies/caching-inbound/schema.json

@@ -35,17 +35,10 @@
           "additionalProperties": false,
           "required": [],
           "properties": {
-            "cacheId": {
-              "type": "string",
-              "examples": ["my-key"],
-              "x-show-example": false,
-              "description": "Specifies an id or 'key' for this policy to store cache. This is useful for cache-busting. For example, set this property to an env var and if you change that env var value, you invalidate the cache."
-            },
-            "dangerouslyIgnoreAuthorizationHeader": {
-              "type": "boolean",
-              "x-show-example": false,
-              "default": false,
-              "description": "By default, the Authorization header is always considered in the caching policy. You can disable by setting this to `true`."
+            "expirationSecondsTtl": {
+              "type": "number",
+              "default": 60,
+              "description": "The timeout of the cache in seconds."
             },
             "headers": {
               "type": "array",
@@ -63,13 +56,9 @@
                 "enum": ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]
               },
               "default": ["GET"],
+              "x-advanced": true,
               "description": "HTTP Methods to be cached. Valid methods are: GET, POST, PUT, PATCH, DELETE, HEAD."
             },
-            "expirationSecondsTtl": {
-              "type": "number",
-              "default": 60,
-              "description": "The timeout of the cache in seconds."
-            },
             "statusCodes": {
               "type": "array",
               "items": {
@@ -77,7 +66,22 @@
               },
               "examples": [[200, 201, 404]],
               "default": [[200, 206, 301, 302, 303, 404, 410]],
+              "x-advanced": true,
               "description": "Response status codes to be cached."
+            },
+            "cacheId": {
+              "type": "string",
+              "examples": ["my-key"],
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "Specifies an id or 'key' for this policy to store cache. This is useful for cache-busting. For example, set this property to an env var and if you change that env var value, you invalidate the cache."
+            },
+            "dangerouslyIgnoreAuthorizationHeader": {
+              "type": "boolean",
+              "x-show-example": false,
+              "default": false,
+              "x-advanced": true,
+              "description": "By default, the Authorization header is always considered in the caching policy. You can disable by setting this to `true`."
             }
           }
         }

package/docs/policies/clerk-jwt-auth-inbound/schema.json

@@ -35,19 +35,21 @@
           "additionalProperties": false,
           "required": ["frontendApiUrl"],
           "properties": {
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
-            },
             "frontendApiUrl": {
               "type": "string",
               "examples": ["https://verb-noun-00.clerk.accounts.dev"],
               "description": "Your Clerk Frontend API URL, i.e. `https://verb-noun-00.clerk.accounts.dev`. Can be found in the Clerk portal: https://dashboard.clerk.com/last-active?path=api-keys."
             },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
+            },
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           }

package/docs/policies/cognito-jwt-auth-inbound/schema.json

@@ -35,11 +35,6 @@
           "additionalProperties": false,
           "required": ["region", "userPoolId"],
           "properties": {
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
-            },
             "region": {
               "type": "string",
               "examples": ["us-east-1"],
@@ -50,9 +45,16 @@
               "examples": ["$env(AWS_COGNITO_USER_POOL_ID)"],
               "description": "The user pool identifier."
             },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
+            },
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           }

package/docs/policies/comet-opik-tracing-inbound/schema.json

@@ -46,6 +46,7 @@
               "type": "string"
             },
             "baseUrl": {
+              "x-advanced": true,
               "description": "The base URL for the Comet Opik API (optional, defaults to https://www.comet.com/opik/api).",
               "type": "string"
             }

package/docs/policies/complex-rate-limit-inbound/schema.json

@@ -57,6 +57,7 @@
             "identifier": {
               "type": "object",
               "additionalProperties": false,
+              "x-advanced": true,
               "description": "The function that returns dynamic configuration data. Used only with `rateLimitBy=function`.",
               "required": ["export", "module"],
               "properties": {
@@ -79,11 +80,13 @@
               "default": "retry-after",
               "title": "RateLimitHeaderMode",
               "enum": ["none", "retry-after"],
+              "x-advanced": true,
               "description": "Adds the retry-after header."
             },
             "throwOnFailure": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "If true, the policy will throw an error in the event there is a problem connecting to the rate limit service."
             },
             "mode": {
@@ -91,6 +94,7 @@
               "default": "strict",
               "title": "RateLimitMode",
               "enum": ["strict", "async"],
+              "x-advanced": true,
               "description": "The mode of the policy. If set to `async`, the policy will check if the request is over the rate limit without blocking. This can result in some requests allowed over the rate limit."
             }
           },

package/docs/policies/curity-phantom-token-inbound/schema.json

@@ -49,6 +49,7 @@
             },
             "cacheDurationSeconds": {
               "type": "number",
+              "x-advanced": true,
               "description": "The duration in seconds to cache the introspected response.",
               "default": 600
             }

package/docs/policies/data-loss-prevention-inbound/schema.json

@@ -140,8 +140,21 @@
                 ]
               }
             },
+            "action": {
+              "type": "string",
+              "enum": ["mask", "block", "log"],
+              "default": "mask",
+              "description": "What to do when sensitive data is detected. `mask` redacts matches before forwarding the request, `block` rejects with a 422 listing only the detected entity names, and `log` records a warning and forwards the request unchanged."
+            },
+            "mask": {
+              "type": "string",
+              "default": "[REDACTED]",
+              "examples": ["[REDACTED]"],
+              "description": "The string that replaces detected values when `action` is `mask`."
+            },
             "customPatterns": {
               "type": "array",
+              "x-advanced": true,
               "description": "Additional customer-defined regex recognizers. Invalid patterns are logged and skipped rather than failing the request.",
               "items": {
                 "type": "object",
@@ -174,28 +187,18 @@
                 }
               }
             },
-            "action": {
-              "type": "string",
-              "enum": ["mask", "block", "log"],
-              "default": "mask",
-              "description": "What to do when sensitive data is detected. `mask` redacts matches before forwarding the request, `block` rejects with a 422 listing only the detected entity names, and `log` records a warning and forwards the request unchanged."
-            },
-            "mask": {
-              "type": "string",
-              "default": "[REDACTED]",
-              "examples": ["[REDACTED]"],
-              "description": "The string that replaces detected values when `action` is `mask`."
-            },
             "minConfidence": {
               "type": "number",
               "minimum": 0,
               "maximum": 1,
               "default": 0.5,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "Minimum confidence (0-1) a match must reach to count as a finding. Context-dependent recognizers (for example `finance-us-bank-account` or `finance-us-aba-routing`) sit below the default threshold of 0.5 until a context word near the match boosts them above it. Lower the threshold to surface them everywhere; raise it to keep only prefix- or checksum-validated matches."
             },
             "contentTypes": {
               "type": "array",
+              "x-advanced": true,
               "description": "Override the set of scannable content-type prefixes. When omitted, the built-in text content-type allow-list (JSON, XML, form-encoded, text/\\*) is used.",
               "items": {
                 "type": "string"