zuplo 6.72.7 → 6.72.8

package/docs/policies/open-id-jwt-auth-inbound/schema.json

@@ -35,12 +35,6 @@
           "additionalProperties": false,
           "required": [],
           "properties": {
-            "authHeader": {
-              "type": "string",
-              "default": "Authorization",
-              "x-show-example": false,
-              "description": "The name of the header with the key."
-            },
             "issuer": {
               "type": "string",
               "examples": ["$env(AUTH_ISSUER)"],
@@ -63,18 +57,28 @@
               "examples": ["$env(AUTH_JWT_SIGNING_KEY)"],
               "description": "The key used to verify the signature of the JWT token (either this or `jwkUrl` must be set)."
             },
+            "authHeader": {
+              "type": "string",
+              "default": "Authorization",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The name of the header with the key."
+            },
             "allowUnauthenticatedRequests": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "indicates whether the request should continue if authentication fails. Defaults is `false` which means unauthenticated users will automatically receive a 401 response."
             },
             "subPropertyName": {
               "type": "string",
               "examples": ["sub"],
+              "x-advanced": true,
               "description": "The name of the property in the JWT token that contains the user's unique identifier."
             },
             "headers": {
               "type": "object",
+              "x-advanced": true,
               "description": "Additional headers to send with the JWK request.",
               "additionalProperties": {
                 "type": "string"
@@ -83,6 +87,7 @@
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           },

package/docs/policies/openfga-authz-inbound/schema.json

@@ -55,12 +55,6 @@
               "description": "The ID of the authorization model.",
               "examples": ["$env(FGA_MODEL_ID)"]
             },
-            "allowUnauthorizedRequests": {
-              "type": "boolean",
-              "default": false,
-              "x-show-example": false,
-              "description": "Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response."
-            },
             "credentials": {
               "oneOf": [
                 {
@@ -165,6 +159,13 @@
                   "oauthTokenEndpointUrl": "https://fga.us.auth0.com/oauth/token"
                 }
               ]
+            },
+            "allowUnauthorizedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "Indicates whether the request should continue if authorization fails. Default is `false` which means unauthorized users will automatically receive a 403 response."
             }
           }
         }

package/docs/policies/openmeter-inbound/schema.json

@@ -33,17 +33,6 @@
           "description": "Send usage metrics to OpenMeter.",
           "type": "object",
           "properties": {
-            "apiUrl": {
-              "type": "string",
-              "x-show-example": false,
-              "description": "The URL of the OpenMeter API endpoint.",
-              "examples": [
-                "https://openmeter.cloud",
-                "http://localhost:8888",
-                "http://openmeter.example.com"
-              ],
-              "default": "https://openmeter.cloud"
-            },
             "apiKey": {
               "type": "string",
               "description": "The API key to use when sending metering calls to OpenMeter.",
@@ -119,6 +108,26 @@
                 }
               ]
             },
+            "requiredEntitlements": {
+              "type": "array",
+              "description": "A list of entitlements (feature keys) required in order for the call to be allowed.",
+              "items": {
+                "type": "string"
+              },
+              "examples": [["api-request"], ["llm_tokens", "api-request"]]
+            },
+            "apiUrl": {
+              "type": "string",
+              "x-show-example": false,
+              "x-advanced": true,
+              "description": "The URL of the OpenMeter API endpoint.",
+              "examples": [
+                "https://openmeter.cloud",
+                "http://localhost:8888",
+                "http://openmeter.example.com"
+              ],
+              "default": "https://openmeter.cloud"
+            },
             "meterOnStatusCodes": {
               "oneOf": [
                 {
@@ -132,6 +141,7 @@
                 }
               ],
               "x-show-example": false,
+              "x-advanced": true,
               "description": "A list of successful status codes and ranges \"200-299, 304\" that should trigger a metering event.",
               "default": "200-299",
               "examples": ["200-399"]
@@ -139,21 +149,15 @@
             "eventSource": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The event's source (e.g. the service name).",
               "examples": ["api-gateway", "payment-service"],
               "default": "api-gateway"
             },
-            "requiredEntitlements": {
-              "type": "array",
-              "description": "A list of entitlements (feature keys) required in order for the call to be allowed.",
-              "items": {
-                "type": "string"
-              },
-              "examples": [["api-request"], ["llm_tokens", "api-request"]]
-            },
             "subjectPath": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The path to the property on `request.user` that contains the subject used for meters and entitlements. For example `.data.accountId` would read the `request.user.data.accountId` property.",
               "examples": [".sub", ".data.customerId"],
               "default": ".sub"

package/docs/policies/prompt-injection-outbound/schema.json

@@ -45,15 +45,16 @@
               "description": "Model to use for classification.",
               "default": "gpt-3.5-turbo"
             },
-            "baseUrl": {
-              "type": "string",
-              "description": "Base URL for the OpenAI compatible API.",
-              "default": "https://api.openai.com/v1"
-            },
             "strict": {
               "type": "boolean",
               "description": "Whether to block traffic if the classifier fails. When disabled, allows traffic flow if the classifier or inference API is unavailable.",
               "default": false
+            },
+            "baseUrl": {
+              "type": "string",
+              "x-advanced": true,
+              "description": "Base URL for the OpenAI compatible API.",
+              "default": "https://api.openai.com/v1"
             }
           }
         }

package/docs/policies/propel-auth-jwt-inbound/schema.json

@@ -35,11 +35,6 @@
           "additionalProperties": false,
           "required": ["authUrl", "verifierKey"],
           "properties": {
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
-            },
             "authUrl": {
               "type": "string",
               "examples": ["https://12345678.propelauthtest.com"],
@@ -50,9 +45,16 @@
               "examples": ["$env(PROPEL_VERIFIER_KEY)"],
               "description": "Your public (verifier) key that is used to verify access tokens. This key has a value that begins with '\\-\\-\\---BEGIN PUBLIC KEY\\-\\-\\---'. Make sure to remove all line breaks from the key before saving the variable."
             },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Allow unauthenticated requests to proceed. This is use useful if you want to use multiple authentication policies or if you want to allow both authenticated and non-authenticated traffic."
+            },
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           }

package/docs/policies/query-param-to-header-inbound/schema.json

@@ -53,6 +53,7 @@
             "removeFromUrl": {
               "type": "boolean",
               "default": true,
+              "x-advanced": true,
               "description": "Whether to remove the query parameter from the URL after extracting it."
             }
           }

package/docs/policies/quota-inbound/schema.json

@@ -46,12 +46,6 @@
               "enum": ["user", "function"],
               "default": "user"
             },
-            "quotaAnchorMode": {
-              "type": "string",
-              "description": "How the policy determines the anchor date for ongoing quota cycles - defaults to `first-api-call` which uses the first API call for this key.",
-              "enum": ["first-api-call", "function"],
-              "default": "first-api-call"
-            },
             "allowances": {
               "type": "object",
               "description": "The allowances for the quota.",
@@ -59,6 +53,13 @@
                 "type": "number"
               }
             },
+            "quotaAnchorMode": {
+              "type": "string",
+              "x-advanced": true,
+              "description": "How the policy determines the anchor date for ongoing quota cycles - defaults to `first-api-call` which uses the first API call for this key.",
+              "enum": ["first-api-call", "function"],
+              "default": "first-api-call"
+            },
             "quotaOnStatusCodes": {
               "oneOf": [
                 {
@@ -72,6 +73,7 @@
                 }
               ],
               "x-show-example": false,
+              "x-advanced": true,
               "description": "A list of successful status codes and ranges \"200-299, 304\" that should trigger a quota increment.",
               "default": "200-299",
               "examples": ["200-399"]
@@ -79,6 +81,7 @@
             "identifier": {
               "type": "object",
               "additionalProperties": false,
+              "x-advanced": true,
               "description": "The module and functions to dynamically set the anchor date and/or the key/allowances for this request.",
               "required": ["module"],
               "properties": {

package/docs/policies/rate-limit-inbound/schema.json

@@ -55,6 +55,7 @@
             "identifier": {
               "type": "object",
               "additionalProperties": false,
+              "x-advanced": true,
               "description": "The function that returns dynamic configuration data. Used only with `rateLimitBy=function`.",
               "required": ["export", "module"],
               "properties": {
@@ -77,11 +78,13 @@
               "default": "retry-after",
               "title": "RateLimitHeaderMode",
               "enum": ["none", "retry-after"],
+              "x-advanced": true,
               "description": "Adds the retry-after header."
             },
             "throwOnFailure": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "If true, the policy will throw an error in the event there is a problem connecting to the rate limit service."
             },
             "mode": {
@@ -89,6 +92,7 @@
               "default": "strict",
               "title": "RateLimitMode",
               "enum": ["strict", "async"],
+              "x-advanced": true,
               "description": "The mode of the policy. If set to `async`, the policy will check if the request is over the rate limit without blocking. This can result in some requests allowed over the rate limit."
             }
           },

package/docs/policies/readme-metrics-inbound/schema.json

@@ -40,29 +40,33 @@
               "examples": ["$env(README_API_KEY)"],
               "description": "The API key to use when sending metrics calls to Readme."
             },
+            "userEmailPropertyPath": {
+              "type": "string",
+              "default": "",
+              "description": "This is the path to the property on `request.user` that contains the e-mail of the user. For example `.data.email` would read the `request.user.data.email` property."
+            },
             "userLabelPropertyPath": {
               "type": "string",
               "x-show-example": false,
               "default": ".sub",
+              "x-advanced": true,
               "description": "This is the path to the property on `request.user` that contains the label you want to use. For example `.data.accountNumber` would read the `request.user.data.accountNumber` property."
             },
-            "userEmailPropertyPath": {
-              "type": "string",
-              "default": "",
-              "description": "This is the path to the property on `request.user` that contains the e-mail of the user. For example `.data.email` would read the `request.user.data.email` property."
-            },
             "development": {
               "type": "boolean",
+              "x-advanced": true,
               "description": "Whether the data should be ingested as 'development' mode or not. Defaults to true for working-copy and false for all other environments."
             },
             "useFullRequestPath": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "When true, Zuplo sends the full request path (which might contain sensitive information). By default, we only send the route path which should not contain sensitive information."
             },
             "url": {
               "type": "string",
               "default": "https://metrics.readme.io/request",
+              "x-advanced": true,
               "description": "The URL to send metering events. This is useful for testing purposes."
             }
           }

package/docs/policies/request-size-limit-inbound/schema.json

@@ -42,6 +42,7 @@
             },
             "trustContentLengthHeader": {
               "type": "boolean",
+              "x-advanced": true,
               "description": "If true, the policy will reject any request with a `content-length` header in excess of `maxSizeInBytes` bytes value, but will not verify the actual size of the request. This is more efficient and offers slightly better memory usage but should only be used if you trust/control the clients calling the gateway to send an accurate content-length. If false, the gateway will actually verify the request size and reject any request with a size in excess of the stated maximum."
             }
           }

package/docs/policies/request-validation-inbound/schema.json

@@ -35,12 +35,6 @@
           "additionalProperties": false,
           "required": [],
           "properties": {
-            "logLevel": {
-              "type": "string",
-              "default": "info",
-              "description": "The log level to use when logging validation errors.",
-              "enum": ["error", "warn", "info", "debug"]
-            },
             "validateBody": {
               "examples": ["reject-and-log"],
               "type": "string",
@@ -72,9 +66,17 @@
               "description": "The action to perform when validation fails.",
               "enum": ["none", "log-only", "reject-and-log", "reject-only"]
             },
+            "logLevel": {
+              "type": "string",
+              "default": "info",
+              "x-advanced": true,
+              "description": "The log level to use when logging validation errors.",
+              "enum": ["error", "warn", "info", "debug"]
+            },
             "includeRequestInLogs": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Whether to include the request in the logs."
             }
           }

package/docs/policies/require-origin-inbound/schema.json

@@ -46,6 +46,7 @@
               "examples": [
                 "Your origin is not authorized to make this request."
               ],
+              "x-advanced": true,
               "description": "The `detail` of the HTTP Problem response, if the origin is missing or disallowed."
             }
           }

package/docs/policies/semantic-cache-inbound/schema.json

@@ -58,9 +58,15 @@
               "enum": ["function", "propertyPath"],
               "description": "Determines how the cache key is generated. Use 'function' for custom logic or 'propertyPath' to extract from JSON body."
             },
+            "cacheByPropertyPath": {
+              "type": "string",
+              "description": "The path to the property in the request body (JSON) to use as cache key. For example '.userId' would read the 'userId' property from the request body. Only works with cacheBy=propertyPath.",
+              "examples": [".userId", ".data.customerId"]
+            },
             "cacheByFunction": {
               "type": "object",
               "additionalProperties": false,
+              "x-advanced": true,
               "description": "The function that returns dynamic cache key data. Used only with `cacheBy=function`.",
               "required": ["export", "module"],
               "properties": {
@@ -76,11 +82,6 @@
                 }
               }
             },
-            "cacheByPropertyPath": {
-              "type": "string",
-              "description": "The path to the property in the request body (JSON) to use as cache key. For example '.userId' would read the 'userId' property from the request body. Only works with cacheBy=propertyPath.",
-              "examples": [".userId", ".data.customerId"]
-            },
             "statusCodes": {
               "type": "array",
               "items": {
@@ -88,16 +89,19 @@
               },
               "examples": [[200, 201]],
               "default": [200, 206, 301, 302, 303, 410],
+              "x-advanced": true,
               "description": "Response status codes to be cached."
             },
             "returnCacheStatusHeader": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "If true, the policy will return a custom header with the cache status. The default header name is `zp-semantic-cache`."
             },
             "cacheStatusHeaderName": {
               "type": "string",
               "default": "zp-semantic-cache",
+              "x-advanced": true,
               "description": "The name of the header to return the cache status. Only used if `returnCacheStatusHeader` is true."
             }
           },

package/docs/policies/set-status-outbound/schema.json

@@ -43,6 +43,7 @@
             "statusText": {
               "type": "string",
               "examples": ["OK", "Not Found"],
+              "x-advanced": true,
               "description": "The statusText to be used in the response."
             }
           }

package/docs/policies/set-upstream-api-key-inbound/schema.json

@@ -35,21 +35,23 @@
           "additionalProperties": false,
           "required": ["value"],
           "properties": {
+            "value": {
+              "type": "string",
+              "examples": ["Bearer $env(UPSTREAM_API_KEY)"],
+              "description": "The value of the header. Most commonly an environment variable reference such as `Bearer $env(UPSTREAM_API_KEY)` so the secret is sourced from your environment."
+            },
             "header": {
               "type": "string",
               "default": "Authorization",
               "examples": ["Authorization"],
+              "x-advanced": true,
               "description": "The name of the header to set on the request. Defaults to `Authorization`."
             },
-            "value": {
-              "type": "string",
-              "examples": ["Bearer $env(UPSTREAM_API_KEY)"],
-              "description": "The value of the header. Most commonly an environment variable reference such as `Bearer $env(UPSTREAM_API_KEY)` so the secret is sourced from your environment."
-            },
             "overwrite": {
               "type": "boolean",
               "x-show-example": false,
               "default": true,
+              "x-advanced": true,
               "description": "Overwrite the value if the header is already present in the request."
             }
           }

package/docs/policies/stripe-webhook-verification-inbound/schema.json

@@ -42,7 +42,8 @@
             "tolerance": {
               "type": "number",
               "default": 300,
-              "description": "The allowed clock skew in seconds between the time the webhook signature was crated and the current time."
+              "x-advanced": true,
+              "description": "The allowed clock skew in seconds between the time the webhook signature was created and the current time."
             }
           }
         }

package/docs/policies/supabase-jwt-auth-inbound/schema.json

@@ -40,11 +40,6 @@
               "examples": ["$env(SUPABASE_JWT_SECRET)"],
               "description": "The key used to verify the signature of the JWT token."
             },
-            "allowUnauthenticatedRequests": {
-              "type": "boolean",
-              "default": false,
-              "description": "Indicates whether the request should continue if authentication fails. Default is `false` which means unauthenticated users will automatically receive a 401 response."
-            },
             "requiredClaims": {
               "type": "object",
               "examples": [
@@ -60,9 +55,16 @@
               },
               "description": "Any claims that must be present for authentication to succeed - multiple valid values can be specified for each claim."
             },
+            "allowUnauthenticatedRequests": {
+              "type": "boolean",
+              "default": false,
+              "x-advanced": true,
+              "description": "Indicates whether the request should continue if authentication fails. Default is `false` which means unauthenticated users will automatically receive a 401 response."
+            },
             "oAuthResourceMetadataEnabled": {
               "type": "boolean",
               "default": false,
+              "x-advanced": true,
               "description": "Flag that determines whether OAuth protected resource metadata is enabled."
             }
           }

package/docs/policies/traffic-splitting-inbound/schema.json

@@ -67,6 +67,7 @@
               "type": "boolean",
               "default": false,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "When `true`, logs which base path was selected for each request. Defaults to `false`."
             }
           },

package/docs/policies/upstream-aws-federated-auth-inbound/schema.json

@@ -49,35 +49,41 @@
               "type": "string",
               "default": "sts.amazonaws.com",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The audience ('aud' claim) of the Zuplo-issued OIDC token. Must match a client ID configured on the IAM OIDC identity provider."
             },
             "roleSessionName": {
               "type": "string",
               "default": "zuplo-gateway",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The STS role session name recorded in AWS CloudTrail. Must match the pattern \\[\\\\w+=,.@-\\]{2,64}."
             },
             "durationSeconds": {
               "type": "number",
               "default": 3600,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The lifetime in seconds of the temporary credentials requested from STS (900-43200). The assumed role's maximum session duration may further limit this value."
             },
             "stsEndpoint": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "Overrides the STS endpoint URL. Only needed for non-standard partitions such as AWS GovCloud or AWS China."
             },
             "tokenRetries": {
               "type": "number",
               "default": 3,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The number of times to retry fetching temporary credentials in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "default": 300,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The number of seconds before credential expiration at which cached credentials are discarded and refreshed."
             }
           }

package/docs/policies/upstream-aws-service-auth-inbound/schema.json

@@ -53,45 +53,53 @@
             "sessionToken": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The AWS session token, required only when the configured access key pair is itself a temporary credential."
             },
             "roleArn": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "An IAM role to assume using STS AssumeRole with the configured access keys. When set, the resolved credentials are the role's temporary credentials instead of the static keys."
             },
             "externalId": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The external ID to pass to STS AssumeRole when the role's trust policy requires one."
             },
             "roleSessionName": {
               "type": "string",
               "default": "zuplo-gateway",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The STS role session name recorded in AWS CloudTrail. Must match the pattern \\[\\\\w+=,.@-\\]{2,64}."
             },
             "durationSeconds": {
               "type": "number",
               "default": 3600,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The lifetime in seconds of the temporary credentials requested from STS (900-43200). The assumed role's maximum session duration may further limit this value."
             },
             "stsEndpoint": {
               "type": "string",
               "x-show-example": false,
+              "x-advanced": true,
               "description": "Overrides the STS endpoint URL. Only needed for non-standard partitions such as AWS GovCloud or AWS China."
             },
             "tokenRetries": {
               "type": "number",
               "default": 3,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The number of times to retry fetching temporary credentials in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "default": 300,
               "x-show-example": false,
+              "x-advanced": true,
               "description": "The number of seconds before credential expiration at which cached credentials are discarded and refreshed."
             }
           }

package/docs/policies/upstream-azure-ad-service-auth-inbound/schema.json

@@ -57,11 +57,13 @@
             "tokenRetries": {
               "type": "number",
               "default": 3,
-              "description": "The number of times to retry fetching the token in the event of a failure.."
+              "x-advanced": true,
+              "description": "The number of times to retry fetching the token in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "default": 300,
+              "x-advanced": true,
               "description": "The number of seconds less than the token expiration to cache the token."
             }
           }

package/docs/policies/upstream-firebase-admin-auth-inbound/schema.json

@@ -43,11 +43,13 @@
             "tokenRetries": {
               "type": "number",
               "default": 3,
+              "x-advanced": true,
               "description": "The number of times to retry fetching the token in the event of a failure."
             },
             "expirationOffsetSeconds": {
               "type": "number",
               "default": 300,
+              "x-advanced": true,
               "description": "The number of seconds less than the token expiration to cache the token."
             }
           }