zuplo 6.72.7 → 6.72.8

package/docs/policies/data-loss-prevention-outbound/schema.json

@@ -140,8 +140,21 @@
                 ]
               }
             },
+            "action": {
+              "type": "string",
+              "enum": ["mask", "block", "log"],
+              "default": "mask",
+              "description": "What to do when sensitive data is detected. `mask` redacts matches before returning the response, `block` replaces the response with a 422 listing only the detected entity names, and `log` records a warning and returns the response unchanged."
+            },
+            "mask": {
+              "type": "string",
+              "default": "[REDACTED]",
+              "examples": ["[REDACTED]"],
+              "description": "The string that replaces detected values when `action` is `mask`."
+            },
             "customPatterns": {
               "type": "array",
+              "x-advanced": true,
               "description": "Additional customer-defined regex recognizers. Invalid patterns are logged and skipped rather than failing the response.",
               "items": {
                 "type": "object",
@@ -174,28 +187,18 @@
                 }
               }
             },
-            "action": {
-              "type": "string",
-              "enum": ["mask", "block", "log"],
-              "default": "mask",
-              "description": "What to do when sensitive data is detected. `mask` redacts matches before returning the response, `block` replaces the response with a 422 listing only the detected entity names, and `log` records a warning and returns the response unchanged."
-            },
-            "mask": {
-              "type": "string",
-              "default": "[REDACTED]",
-              "examples": ["[REDACTED]"],
-              "description": "The string that replaces detected values when `action` is `mask`."
-            },
             "minConfidence": {
               "type": "number",
               "minimum": 0,
               "maximum": 1,
               "default": 0.5,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "Minimum confidence (0-1) a match must reach to count as a finding. Context-dependent recognizers (for example `finance-us-bank-account` or `finance-us-aba-routing`) sit below the default threshold of 0.5 until a context word near the match boosts them above it. Lower the threshold to surface them everywhere; raise it to keep only prefix- or checksum-validated matches."
             },
             "contentTypes": {
               "type": "array",
+              "x-advanced": true,
               "description": "Override the set of scannable content-type prefixes. When omitted, the built-in text content-type allow-list (JSON, XML, form-encoded, text/\\*) is used.",
               "items": {
                 "type": "string"

package/docs/policies/firebase-jwt-inbound/schema.json

@@ -35,19 +35,21 @@
           "additionalProperties": false,
           "required": ["projectId"],
           "properties": {
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
-            },
             "projectId": {
               "type": "string",
               "examples": ["my-project-id"],
               "description": "Your Firebase Project ID."
             },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
+            },
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           }

package/docs/policies/formdata-to-json-inbound/schema.json

@@ -42,6 +42,7 @@
             },
             "optionalHoneypotName": {
               "type": "string",
+              "x-advanced": true,
               "description": "The name of the honeypot field. Used to provide basic spam filtering."
             }
           }

package/docs/policies/galileo-tracing-inbound/schema.json

@@ -46,6 +46,7 @@
               "type": "string"
             },
             "baseUrl": {
+              "x-advanced": true,
               "description": "The base URL for the Galileo API (optional, defaults to https://api.galileo.ai).",
               "type": "string"
             }

package/docs/policies/geo-filter-inbound/schema.json

@@ -80,6 +80,7 @@
             "ignoreUnknown": {
               "type": "boolean",
               "default": true,
+              "x-advanced": true,
               "description": "Specifies whether unknown geo-location parameters should be ignored (allowed through)."
             }
           }

package/docs/policies/graphql-analytics-outbound/schema.json

@@ -70,6 +70,7 @@
               "maximum": 5242880,
               "default": 131072,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "How many bytes of the response body the policy reads to look for GraphQL errors. The body is read and scanned for the `errors` token up to this limit; a body larger than the limit — by `Content-Length`, or measured while reading when the header is absent — is treated as error-free, so any errors it carries go unreported. The default of 128 KiB suits the common case, where servers emit `errors` near the front of the body. Raise it (up to the 5 MiB maximum) to detect errors in larger responses, at the cost of reading more of every response. When the token is found and the body fits within the limit, the body is parsed and its errors are reported."
             }
           }

package/docs/policies/mcp-auth0-oauth-inbound/schema.json

@@ -61,6 +61,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -84,6 +85,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {
@@ -163,6 +165,7 @@
             },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/mcp-clerk-oauth-inbound/schema.json

@@ -60,6 +60,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -83,6 +84,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {
@@ -162,6 +164,7 @@
             },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/mcp-cognito-oauth-inbound/schema.json

@@ -76,6 +76,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -99,6 +100,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {
@@ -178,6 +180,7 @@
             },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/mcp-entra-oauth-inbound/schema.json

@@ -57,6 +57,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -80,6 +81,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {
@@ -159,6 +161,7 @@
             },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/mcp-google-oauth-inbound/schema.json

@@ -52,6 +52,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -75,6 +76,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {
@@ -154,6 +156,7 @@
             },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/mcp-keycloak-oauth-inbound/schema.json

@@ -65,6 +65,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -88,6 +89,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {
@@ -167,6 +169,7 @@
             },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/mcp-logto-oauth-inbound/schema.json

@@ -57,6 +57,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -80,6 +81,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {
@@ -159,6 +161,7 @@
             },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/mcp-oauth-inbound/schema.json

@@ -126,6 +126,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -149,6 +150,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {

package/docs/policies/mcp-okta-oauth-inbound/schema.json

@@ -62,6 +62,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -85,6 +86,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {
@@ -164,6 +166,7 @@
             },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/mcp-onelogin-oauth-inbound/schema.json

@@ -57,6 +57,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -80,6 +81,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {
@@ -159,6 +161,7 @@
             },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/mcp-ping-oauth-inbound/schema.json

@@ -75,6 +75,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -98,6 +99,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {
@@ -177,6 +179,7 @@
             },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/mcp-token-exchange-inbound/schema.json

@@ -82,11 +82,6 @@
               "examples": ["Native Linear remote MCP server."],
               "description": "Optional human-readable summary of the upstream, shown on the consent page."
             },
-            "protectedResourceMetadataUrl": {
-              "type": "string",
-              "format": "uri",
-              "description": "Optional override for the upstream's OAuth protected-resource metadata URL. Defaults from the route handler's rewritePattern."
-            },
             "authMode": {
               "type": "string",
               "enum": ["user-oauth", "shared-oauth", "id-jag"],
@@ -99,11 +94,19 @@
                 "type": "string"
               }
             },
+            "protectedResourceMetadataUrl": {
+              "type": "string",
+              "format": "uri",
+              "x-advanced": true,
+              "description": "Optional override for the upstream's OAuth protected-resource metadata URL. Defaults from the route handler's rewritePattern."
+            },
             "scopeDelimiter": {
               "type": "string",
+              "x-advanced": true,
               "description": "Delimiter used to join scopes in the OAuth authorization request. Defaults to a single space."
             },
             "prompt": {
+              "x-advanced": true,
               "description": "Overrides the OIDC `prompt` parameter on upstream authorization requests. The MCP SDK adds `prompt=consent` whenever the requested scope includes `offline_access`, which forces a consent screen on every authorization on providers like Microsoft Entra ID even after a tenant admin has granted org-wide admin consent. Leave unset to keep the SDK's behavior; set to `false` to strip the `prompt` parameter; set an explicit value to replace it. Warning: stripping `prompt=consent` while requesting `offline_access` can silently prevent refresh-token issuance on providers that require a fresh consent grant for offline access (e.g. Google) — only use this when the provider grants offline access via pre-authorized/admin consent (e.g. Entra tenant admin consent).",
               "oneOf": [
                 {
@@ -117,6 +120,7 @@
               ]
             },
             "clientRegistration": {
+              "x-advanced": true,
               "description": "OAuth client registration mode. Defaults to `auto`, which uses Client ID Metadata Documents when the upstream advertises support and falls back to Dynamic Client Registration otherwise.",
               "oneOf": [
                 {
@@ -163,6 +167,7 @@
               "type": "object",
               "additionalProperties": false,
               "required": ["idp", "resourceAs"],
+              "x-advanced": true,
               "description": "ID-JAG (Cross-App Access / XAA) token-exchange configuration. Required when `authMode` is `id-jag`; not used by the OAuth modes.",
               "properties": {
                 "scopes": {

package/docs/policies/mcp-workos-oauth-inbound/schema.json

@@ -52,6 +52,7 @@
             },
             "gateway": {
               "type": "object",
+              "x-advanced": true,
               "description": "Gateway-side OAuth token settings. The gateway issuer and advertised URLs are derived from the incoming request origin.",
               "additionalProperties": false,
               "properties": {
@@ -75,6 +76,7 @@
               }
             },
             "idJag": {
+              "x-advanced": true,
               "description": "Optional Identity Assertion JWT Authorization Grant (ID-JAG / XAA) support for the gateway token endpoint.",
               "oneOf": [
                 {
@@ -154,6 +156,7 @@
             },
             "browserLoginOverrides": {
               "type": "object",
+              "x-advanced": true,
               "description": "Optional overrides for the derived browser-login settings.",
               "additionalProperties": false,
               "properties": {

package/docs/policies/monetization-inbound/schema.json

@@ -35,37 +35,47 @@
           "additionalProperties": false,
           "required": [],
           "properties": {
+            "meters": {
+              "type": "object",
+              "examples": [
+                {
+                  "api_requests": 1
+                }
+              ],
+              "additionalProperties": {
+                "type": "number"
+              },
+              "description": "The meters to be used by the policy against the subscription quota."
+            },
+            "requiredEntitlements": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
+              "description": "A list of entitlement keys that the subscription must have access to (hasAccess=true) for the request to be allowed. If any required entitlement is missing or does not have access, the request will be rejected with a 403 Forbidden.",
+              "examples": [["custom_domains"]]
+            },
             "authHeader": {
               "type": "string",
               "default": "Authorization",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The name of the header with the key."
             },
             "authScheme": {
               "type": "string",
               "default": "Bearer",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The scheme used on the header."
             },
             "cacheTtlSeconds": {
               "type": "number",
               "default": 60,
+              "x-advanced": true,
               "description": "The time to cache authentication results for a particular key. Higher values will decrease latency. Cached results will be valid until the cache expires even in the event the key is deleted, etc."
             },
-            "meters": {
-              "type": "object",
-              "examples": [
-                {
-                  "api_requests": 1
-                }
-              ],
-              "patternProperties": {
-                "^.*$": {
-                  "type": "number"
-                }
-              },
-              "description": "The meters to be used by the policy against the subscription quota."
-            },
             "meterOnStatusCodes": {
               "oneOf": [
                 {
@@ -79,18 +89,10 @@
                 }
               ],
               "x-show-example": false,
+              "x-advanced": true,
               "description": "A list of successful status codes and ranges \"200-299, 304\" that should trigger a metering call.",
               "default": "200-299",
               "examples": ["200-399"]
-            },
-            "requiredEntitlements": {
-              "type": "array",
-              "items": {
-                "type": "string",
-                "minLength": 1
-              },
-              "description": "A list of entitlement keys that the subscription must have access to (hasAccess=true) for the request to be allowed. If any required entitlement is missing or does not have access, the request will be rejected with a 403 Forbidden.",
-              "examples": [["custom_domains"]]
             }
           }
         }

package/docs/policies/mtls-auth-inbound/schema.json

@@ -35,15 +35,16 @@
           "additionalProperties": false,
           "required": [],
           "properties": {
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Allows requests to continue even when mTLS verification fails, no client certificate is presented, or the certificate metadata cannot be parsed. Defaults to false."
-            },
             "certIssuerDN": {
               "type": "string",
               "description": "Fully qualified issuer distinguished name to require on the client certificate. The policy rejects certificates whose parsed issuer DN does not match this string exactly. Required unless `allowUnauthenticatedRequests` is `true`. The expected format matches the parsed metadata issuer, e.g. \"CN=example-ca, O=Example, C=US\".",
               "examples": ["CN=example-ca, O=Example, C=US"]
+            },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Allows requests to continue even when mTLS verification fails, no client certificate is presented, or the certificate metadata cannot be parsed. Defaults to false."
             }
           },
           "anyOf": [

package/docs/policies/okta-fga-authz-inbound/schema.json

@@ -56,12 +56,6 @@
               "description": "The ID of the authorization model.",
               "examples": ["$env(FGA_MODEL_ID)"]
             },
-            "allowUnauthorizedRequests": {
-              "type": "boolean",
-              "default": false,
-              "x-show-example": false,
-              "description": "Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response."
-            },
             "credentials": {
               "type": "object",
               "required": ["clientId", "clientSecret"],
@@ -81,6 +75,13 @@
                   "clientSecret": "$env(FGA_CLIENT_SECRET)"
                 }
               ]
+            },
+            "allowUnauthorizedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response."
             }
           }
         }

package/docs/policies/okta-jwt-auth-inbound/schema.json

@@ -35,11 +35,6 @@
           "additionalProperties": false,
           "required": ["issuerUrl"],
           "properties": {
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
-            },
             "issuerUrl": {
               "type": "string",
               "examples": ["https://dev-12345.okta.com/oauth2/abc"],
@@ -50,9 +45,16 @@
               "examples": ["api://my-api"],
               "description": "The Okta audience of your API, for example `api://my-api`."
             },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
+            },
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           }